diff --git a/README.md b/README.md index bf7ed7e..b1e7dd0 100644 --- a/README.md +++ b/README.md @@ -49,11 +49,16 @@ govendor add github.com/kr/pty go build -o botbsBinary ``` +Building a cross platform static binary: +``` +gox -output="bin/{{.Dir}}{{.OS}}{{.Arch}}" -osarch="darwin/amd64 linux/386 linux/amd64" +``` + # Usage BOtB can be compiled into a binary for the targeted platform and supports the following usage ``` Usage of ./botb: --aggr string + -aggr string Attempt to exploit RuncPWN (default "nil") -always-succeed Always set BOtB's Exit code to Zero @@ -108,7 +113,7 @@ The following usage examples will return a Exit Code > 0 by default when an anom ### Find UNIX Domain Sockets ``` -#./bob_linux_amd64 -socket=true +#./bob_linux_amd64 -find-sockets=true [+] Break Out The Box [+] Hunting Down UNIX Domain Sockets from: / [!] Valid Socket: /var/meh diff --git a/main.go b/main.go index 3fd6876..7ac7c70 100644 --- a/main.go +++ b/main.go @@ -10,7 +10,7 @@ import ( "gopkg.in/yaml.v2" ) -var verbosePtr, huntSockPtr, huntHttpPtr, huntDockerPtr, toJsonPtr, autopwnPtr, cicdPtr, reconPtr, metaDataPtr, findDockerdPtr, scrapeGcpMeta, alwaysSucceedPtr *bool +var verbosePtr, huntSockPtr, huntHttpPtr, huntDockerPtr, toJsonPtr, autopwnPtr, cicdPtr, reconPtr, metaDataPtr, interfacesPtr, findDockerdPtr, scrapeGcpMeta, alwaysSucceedPtr *bool var validSocks []string @@ -51,6 +51,7 @@ func main() { cicdPtr = flag.Bool("cicd", false, "Attempt to autopwn but don't drop to TTY,return exit code 1 if successful else 0") reconPtr = flag.Bool("recon", false, "Perform Recon of the Container ENV") metaDataPtr = flag.Bool("metadata", false, "Attempt to find metadata services") + interfacesPtr = flag.Bool("interfaces", false, "Attempt to find interfaces") aggressivePtr = flag.String("aggr", "nil", "Attempt to exploit RuncPWN") hijackPtr = flag.String("hijack", "nil", "Attempt to hijack binaries on host") wordlistPtr = flag.String("wordlist", "nil", "Provide a wordlist") @@ -113,6 +114,8 @@ func runCfgArgs(cfg Config) { findDockerD() case "metadata": checkMetadataServices(cfg.EndpointList) + case "interfaces": + checkInterfaces() case "autopwn": autopwn(cfg.Path, cfg.Cicd) case "recon": @@ -190,6 +193,10 @@ func runCMDArgs() { checkMetadataServices(*endpointList) } + if *interfacesPtr { + checkInterfaces() + } + if *autopwnPtr { autopwn(*pathPtr, *cicdPtr) } diff --git a/utils.go b/utils.go index 35ff597..35c1cc1 100644 --- a/utils.go +++ b/utils.go @@ -420,6 +420,24 @@ func checkMetadataServices(endpointList string) { } } +func checkInterfaces() { + ifaces, err := net.Interfaces() + if err != nil { + log.Fatal(err) + } + for _, i := range ifaces { + addrs, err := i.Addrs() + if err != nil { + log.Fatal(err) + } + fmt.Println("[*] Got interface:", i.Name) + for _, addr := range addrs { + fmt.Println(" [*] Got address:", addr) + } + } + exitCode = 1 +} + func runcPwn(hijackCommand string) { if hijackCommand == "nil" {