zmarch / orc

Orc is a post-exploitation framework for Linux written in Bash

Orc is a simple post-exploitation written in bash.

Authors: Darren Martyn, March, Ulrich Berntien

The Project

IRC Channel: #orc on irc.hackint.eu

I initially wrote this because I myself needed a more featureful post-exploitation toolkit for Linux. It's part of a larger bundle of scripts and tools, but I'll add those as I write and re-write them.

Script Start

It takes the form of an ENV script, so load orc into a shell by running ENV=o.rc sh -i (it does need an interactive shell, I'm afraid) You can also source it.

It creates a directory (.q) typical in /dev/shm, and all output of commands etc tend to go in there. It will also auto-delete this directory on exit. If /dev/shm does not exist or is mounted with noexec option, then the script can choose another directory. The used directory is stored in the HOME variable. The user account home directory is stored in the NHOME variable.

HISTFILE is unset, and we use ulimit -c 0 to try and prevent any corefiles showing up. If ulimit isn't present, we'll try and use the limit coredumpsize command.

Functions

It also contains a relatively decent selection of useful functions: some are currently not super featureful, and there's likely to be a large number of bugs, but you can find the vast majority of them by running the command 'gethelp'. HOWEVER. An overview:

• dropsuid basically drops a tiny SUID shell written in ASM wherever. You'll need to chmod a+sx it. (Wiki)

• fpssh is just a wrapper around ssh-keyscan. (Wiki)

• getdbus lists all dbus services for delicious priv-esc. (Wiki)

• getdocker checks if the docker socket in /var/run/docker.sock exists, if we have write access, and then if we do, runs docker ps. (Wiki)

• getenum takes the versions from the kernel, glibc, and dbus. For privilege escalation exploits, they're usually the ones you want. It also prints the init system, because it's good to know that. (Wiki)

• getescape attempts to find a way to escape a chroot by traversing a poorly configured /proc/. (Wiki)

• getexploit pulls down the linux exploit suggester (Wiki)

• getgtfobins pulls down the list of current gtfobins and checks to see which are installed in your $PATH (Wiki)

• getsctp checks if SCTP support is enabled. (Wiki)

• getidle gives you an accurate idle time for ptys, letting you see how recently other users have been active. (Wiki)

• getinfo pulls basically everything useful and generic i could think of and sticks it in a tar.xz file for you. (Wiki)

• getip uses HTTP and DNS to get your external IP. It aims to use curl and dig, but will fall back to wget and host if it needs to. It grabs these from Akami and Google respectively to try and avoid using smaller sites that might flag in a SOC's logs or alerts. (Wiki)

• getjail does a check to see if we're in a chroot, and then does some very basic checks for hypervisors/virtualisation. If there are any better checks, let me know. (Wiki)

• getluks uses lsblk to look for partitions of type crypt, indicating disk crypto. (Wiki)

• getnet does some basic network enumeration with arp and known_hosts. (Wiki)

• getpty pops a pty using script. This pty should have Orc already loaded. (Wiki)

• getrel prints the OS name from the release file. (Wiki)

• getsec checks for the presence of SELinux, AppArmor, and GrSec. I thought about adding stuff for rkhunter/chkrootkit, but in my experience they're not much of a threat unless you're using rootkits from 2003. (Wiki)

• getsfiles lists setuid flagged files and setcap files. (Wiki)

• getspec prints some basic hardware information. (Wiki)

• getsuspect pulls down my suspect script and runs it, looking for malware or signs of compromise. (Wiki)

• gettmp lists typical directories for tmp files. (Wiki)

• getusers gets all users with a shell. (Wiki)

• getuservices gets all processes running by users who don't have a shell. Useful. (Wiki)

• memexec uses some janky perl (see https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html who I stole much of the basis of it for) to execute a binary in-memory. No arguments or anything yet, and only x64 supported. (Wiki)

• portscan should be fairly self-evident. It checks for the following open ports on one host: 21, 22, 23, 80, 443, 8080, 8443, 129, 445, 3389, 3306. (Wiki)

• prochide grabs the longest process name from ps (because we can't hide arguments, but we can choose something that makes them relatively invisible in the noise) and uses that as the $0 of whatever you execute. (Wiki)

• qssh uses an ASKPASS script to launch ssh without requiring a tty. Apply arguments as usual. (Wiki)

• qsu uses an ASKPASS script to launch sudo without requiring a tty. Apply arguments as usual to sudo. (Wiki)

• sourceurl sources a file via http or https download. (Wiki)

• srm is just a wrapper around shred, basically. (Wiki)

• stomp is just an alias for "touch -r". (Wiki)

• tools checks for common tools. (Wiki)

• wiper uses utmpdump to dump wtmp into plain text and then greps out the string given as an argument. It then repacks the modified file into /var/log/wtmp, and ensures that the file is nicely time stomped. (Wiki)

Build Status

Tests of the Orc script file are executed automatically with the Travis CI service.

ShellCheck is used to ensure wide compatibility of the Orc script. The Bourne shell dialects: bash, dash, sh and ksh are checked.

Scripts in the tests sub-directory automatically tests Orc functions. Current the tests are in construction. The tests will be widened over the time.

For details see the Travis CI job log.

orc's Issues

Fix bug in hangup

I accidentally introduced a bug in the hangup function. If you run it without arguments, it kills everyone elses session on the box.

This is great and all, but not exactly what I intended to do.

I should probably rewrite this function to work better.

Credential dumping from memory

This honestly might be better as something we fork and pull in remotely at runtime, but I'd be interested in thoughts on implementing something like Mimipenguin for dumping creds out of memory.

Link: https://github.com/Miscellaneous0/mimipenguin/

Shellcode Execution

We can ~probably implement this trickery so we can execute arbitrary shellcodes. Maybe as a helper function?

https://twitter.com/David3141593/status/1386663070991360001

The example pops /bin/sh

cd /proc/$$;read a<syscall;exec 3>mem;base64 -d<<<McBIu9GdlpHQjJf/SPfbU1RfmVJXVF6wOw8F|dd bs=1 seek=$[`echo $a|cut -d" " -f9`]>&3

We could use this as another way to do the memexec using memfd's by implementing the memfd loader as shellcode (something I actually did before, I'll just have to find the code).

find setuid/setcap bins?

Wondering if there is any value in adding some functionality to find setuid files? Basically just a function that calls find / -perm 4000 2>/dev/null (for setuid) and getcap -r / 2>/dev/null (for setcap) and maybe does some output parsing or further processing? I'm unsure what "further processing" would actually be useful, but checking these binaries for RPATH issues or against the gtfobins list and such is sometimes fruitful.

Choosing a license

I would suggest to add a license to the repository. Choosing and attaching a license file is just a few steps. Add license file
In my opinion, the MIT license or the Apache license could be used. (Overview)

Use "ip a" instead of "ifconfig"

net-tools package (where ifconfig, netstat, route...commands belong) is deprecated and not installed by default in increasingly more distributions.
Thanks

More sysinfo on launch

Knowing things like processor speed/cores, available storage and RAM would be interesting.

Perhaps something akin to this or similar scripts could be added. Need to think about this though.

getnet rework discussion

In the getnet_rework branch I created a new implementation of the getnet function, the getnet2 function. (The original getnet functions is unchanged in the script file.)

The getnet2 function should work like the getnet function and could replace the getnet function in the master branch after testing. (See issue #51)

Corrections, extensions, error messages, comments are welcome.

checks from THC "whatserver" script.

The folks at THC have a rather nice host-info-gathering script, some of which could possibly be folded into Orc.

https://raw.githubusercontent.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet/master/tools/whatserver.sh

proxy or additional gateway support

In the context of linux machines that do not have access to the internet (think of hackthebox challenge boxes - where you, the user, vpn into a lab environment, and YOU have internet access, but the boxes dont - all the stuff where a tool like this tries to contact the internet would fall over) some parts of this tool (the exploit suggester for example) don't work.

It would be super neat to be able to specify a proxy (like the machine you're vpnining into a lab from!) so that orc can reach the internet somehow

LUKS/disk crypto

Need to add a detection mechanism - probably just going to grab /dev/mapper for LUKS; not sure what signatures are needed for veracrypt etc.
might see if we can drop something to try and pull the encryption key for memory (or maybe just a function to do a full memory dump for analysis with volatility)

Compatability

Mostly a note to myself, but upon initializing Orc, it should probably detect what tools are available (ifconfig, curl, a functioning awk, relevant ps flags being available), and construct the various commands in the functions then and there instead of messing around in each function.

an issue here is that if we try and support EVERYTHING, though, orc is going to get pretty unwieldy pretty quickly, so perhaps targeting the most common "weird distro-specific behaviour" is best

LDAP tricks

If we can find a domain-joined Linux, i've seen some tricks that might let us extract hashes and secrets etc. I've not had too much of a deep look, noting it for myself, mostly.

LPE Suggester

It might be interesting to have a function that dl/exec something like https://github.com/bcoles/linux-exploit-suggester (or parent repo: https://github.com/mzet-/linux-exploit-suggester) with some sane commandline flags (or user-set ones maybe).

First need to work out what flags are sane. I suggest having it not automatically download or run any exploits, as that would be properly unsafe and leave so much forensic evidence behind that it isn't even remotely funny.

Wiki editing and adding docs

Have created a wiki, gotta start documenting stuff... https://github.com/zMarch/Orc/wiki

Removing getnet

Debating it because honestly, it doesn't work, it's terrible, and it's causing half our issues in shellcheck. We could always write something better/not terrible. At the very least, should probably get rid of the ipcalc bits, I think.

More aliases to avoid things snitching.

Going to add more aliases as I find them, because some programs leave logs.

Taking a look through this talk for ideas.

Compatibility: If curl is not available, use wget?

I noticed some hardcoded curl calls in various functions, we should have a fallback to " wget -q -O-" for the event curl is unavailable on the system.

We could also check for the LWP POST/GET commands, lwp-request/etc. After all, never know what kind of weird shit we end up on.

Shellcheck...

I've essentially ignored some directives for now, mostly ones that seemed a bit janky (erroring on ulimit when it was in an if) or were purely informational. We now pass. It's not cheating!

Another Virtualbox detection.

This works, but its not reliable/stable enough to commit yet. I was thinking instead of just flagging one service in there, actually using grep -E with a list of VM services launched inside of guests for more comprehensive detection.

        if ps aux  | grep -v grep | grep -qi "VBoxService"; then
        echo "Virtual machine! (Virtualbox)"
        TTT=1
        fi

Build in suspect for situational awareness.

Would be neat to include your "suspect" utility so once on a host, you can quickly check if you are alone.

Sourcing remote bash scripts

So it might be interesting to have a way to load in remote bash scripts and source them from memory (loading them into Orc) as a means to extend functionality in a modular fashion.

For example, we could fork the Linux Exploit Suggester that was recently implemented as a remote "load and run" and have it as a callable function with arguments somehow. Or load in extra functionality that only works on certain platforms, without cluttering up the main o.rc source file.

Apparently, we can do this with eval, like so: https://access.redhat.com/solutions/34842

I'd like to hear thoughts on this though, see how useful others think it could be?

no-memfd in-memory elf execution (extends #79)

As an extension of #79, I came across this, which actually does the whole goddamn thing I'd been trying to get at, and documents it pretty well:

https://github.com/arget13/DDexec

I'll try add it to Orc at some point in the future as a way to get file-less memexec of ELF files on kernels before memfd support was added.

getidle fails due to awk error

Host is a Debian 8 (Jessie) box.

awk version

$ awk -W version
mawk 1.3.3 Nov 1996, Copyright (C) Michael D. Brennan

compiled limits:
max NF             32767
sprintf buffer      2040

Here is where the bug happens...

$ getidle
awk: line 6: function systime never defined
$ 

getenum output is as follows:

$ getenum
Doing some basic listing of the usual suspects...
Kernel: 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2+deb8u2 (2017-06-26)
glibc: GNU C Library (Debian GLIBC 2.19-18+deb8u10) stable release version 2.19, by Roland McGrath et al.
Compiled by GNU CC version 4.8.4.
dbus: D-Bus Message Bus Daemon 1.8.22
Init system is: systemd

Add x86 memexec using memfd

Going to rename memexec and add the x86 version once I have it tested fully and can confirm it works. Then we will have memfdexec32 and memfdexec64.

We COULD have architecture detection and selection of the method in the perl blob and merge them back into one command, but that is a later problem to solve IMO.

Might want to consider implementing the shm-exec method implemented as a fallback in netelf for boxes with too-old kernels, but that is a separate problem.