#
# Readme for initd_'s Automated Exploitation Tool v0.0.3
#

Heyas ;)
	This is the beta release of initd_.sh by myself, initd_. First a 
couple of answers to some simple and obvious questions:

1. Why initd_.sh?
	Actually I couldn't think of anything else until yesterday when I
   thought about callin it 'sushi'. By then everyone knew it as initd_.sh
   so the name stuck ;)
	Note that all code/shellcode was written and invented by myself.
	No code segments were taken from any other projects or programs.

2. Did you think of the script kiddies?
	Yes, I did think about script kiddies. I honestly don't believe
   that this program will be ran by many s.k. cuz it doesnt promise 
   the immediate gratification of a root shell on a remote machine. This
   program was written with system administration in mind, not cracking.
   The equivalent of running this program with a suid-seek wrapper to
   obtain root on a box u dont own is lame (LAME). Imagine all the time
   it will take to brute force each switch on each binary in each directory
   on each mounted FS on each HDD. :-/ One of two things will happen: The
   skrizzipt kid will get extremely bored and kill the prog _or_ the sys
   admin will see the process and kill the script and the shell himself.

3. Why write it at all?
	Why did Larry Wall write Perl? Heh, mainly because I love over-
   confidence in my box's security. Also, I am lazy when it comes to 
   checking each binary one by one. I do not want to eradicate suid bins
   that I don't use simply because I dont understand them. I'd rather
   write a tool that does all the checking for me while I kick back and
   watch the outcome. I do _not_ and will _not_ advertise this as an end
   all be all security tool. Duh! There are _tons_ of things initd_.sh
   does _not_ yet check for such as temp races, format vulnerabilities,
   impersonation and even certain types of switching methods fail in this
   version. However, initd_.sh will successfully attempt to handle 85%
   of these issues in future versions. Also, I dropped Solaris/BSDi/
   FreeBSD support so I can tweak the shellcode the way I did with Linux.
   However, also noted in the 'Known Bugs' section, fully qualified paths
   for the root shell dropper configuration tool (executed by the shellcode)
   are max'd at 15 characters due to current shellcode restrictions. This
   will also be handled in future versions. So, in conclusion, this program
   was written as a test to see if I had the skill and creativity to 
   successfully implement this technique. After 5 days of here and there 
   coding this is the result ;) I hope you are as pleased with this beta
   quickie version as I am.

4. Why release it if all the bugs arent fixed?
	Heh!@# The script handles enough parameters in order to consider it
   releasable. Also, so many people are excited about this program I wanted
   to get out a working linux version at the least. Also, I am looking for
   a _job_ in computer security and/or system administration. I decided to
   release this program so that I can give myself a little marketing edge
   while seeking job opportunities! If you are an employer email me and I
   will be more than happy to submit my resume to you: initd_@digital.net

5. How to use initd_.sh
	initd_.sh will attempt to exploit a local binary's buffers to
   obtain a shell. To target a binary simply define the fully qualified
   path of the binary with he '-t' switch. A quick explanation of the 
   directory placement switches is in order as you probably do now know
   what my abbreviations mean. ET (--et_dir) is short for Exploit Tool. 
   The exploit tool is a dynamically configurable program to test standard
   buffer overflows in a given target. The program itself is named .0x7f 
   and will be written/compiled/placed in a directory you specify with the
   corresponding switch, --et_dir, or, in a folder initd_.sh determines to
   be writable. ET, when successfully exploiting a target will execute
   the RSDCT via shellcode. The RSDCT is short for Root Shell Dropper 
   Configuration Tool. This program does not drop you in to a shell, but,
   configures the RSD (Root Shell Dropper) to be setuid/setgid and chown'd
   to the User and Group IDs of the target binary. For example, if I have
   target defined as '/bin/umount'. The userid who owns umount is root and
   the groupid of umount is also root. If successfully exploited, RSDCT
   will configure the Root Shell Dropper to be owned by id root and group
   root, then setuid/setgid root. RSDCT's program name is '.7' and is 
   written/compiled/placed in a directory determined by the script or defined
   by the user running initd_.sh with the --rsdct_dir switch. Finally, 
   the Root Shell Dropper (RSD) is simply a small program that sets the
   real and effective user id/ group id it is owned by before dropping into
   a shell, creating an effective root shell if owned by root. The program
   is named '.bash_log1n' and is written/compiled/placed in a directory
   determined by the script or defined by the user running initd_.sh wih
   the switch '--rsd_dir'. Please place this in a directory safe from other
   users so to not give access to unwanted individuals. 
	initd_.sh targets a binary by determining command line switches for
   it to overflow, however, sometimes these switches are not accessible for
   display via --help or -h. In that case define the switches you would like
   to test via command line with the '-s' option. Switches you want to test
   should be a white space seperated string encased in quotations. For
   example, if I want to test the target '/bin/testme' with the switches
   -t and -x I would pass initd_.sh the string: initd_.sh -t /bin/test -s 
   "-t -x"; To tell initd_.sh _not_ to query the program for command line
   switches send it the switch '-n'. If switches are defined with the -s 
   switch and the -n switch is invoked initd_,sh will not query the program
   but will still test the switches defined via command line. 
	To force a userid/groupid shell to be dropped into by the RSD pass
   it the --uid and --gid options. The RSD will be created with these 
   options instead. 
	Minimum, maximum and jump values for the buffer sizes and offsets
   should be self explanatory.
	To increase program verbocity send the program -v up to 3 times.
	To run initd_.sh without any messages but error messages send it
   the -q switch.

6. Known Bugs
	initd_.sh can not yet handle odd switches such as -X=this -X:this
   and the like. This will be updated in version four. 
	Paths for the RSDCT defined by the user via switches _must_ be
   12 characters maximum. The reason for this is I didnt write the shellcode
   to be able to handle random pathlengths larger than a 15 chars. After
   15 chars the jmp/call offsets change and I just didnt code it with 
   that in mind this time around. This will also be updated in version four.
	This isnt really a bug but multiple operating systems are not 
   currently handled. I want to rewrite the shellcode for Solaris/FBSD/BSDi
   before I release a version with more OS support. Luckily I run Solaris
   and FreeBSD at home so this shouldnt take but a week. 

7. How you can help!
	If you would like to donate a shell for me to increase program
   portability I would highly appreciate it. I am looking for shells on
   the following systems to develop shellcode and portability issue 
   management:
	Any system _but_: Solaris/BSDi/Linux/FreeBSD Intel Systems
	I do _not_ need root access to test the shellcode.
	Send info/queries to: initd_@digital.net

8. Is there anything left?
	See the example below

Enjoy my program and look forward to upcoming versions!
initd_
initd_@digital.net
0x7f Security Research Team

Usage Example:

phoenix.initd_ % id
uid=1000(initd_) gid=100(users) groups=100(users)
phoenix.initd_ % ./initd_.sh -t ../../INITD_2000.08.24/ex --min_buffer 1024 -v -v -v
 #
 # initd_.sh
 # Automated Exploitation Tool v0.0.3
 #
 # 0x7f Security Research: Something Wicked This Way Comes...
 #
 [+] Target Confirmed
 [+] Binary is not stripped
 [+] Strip has been located. Exploit stealth has increased
 [+] Confirmed temp directory
 [+] RSD Directory confirmed
 [+] Configuring for a Linux system on a i586 chip
 [ ] Owner of target is root
 [ ] Group name of target is root
 [+] User id # determined to be 0
 [+] Group id number determined to be 0
 [ ] Creating the Root Shell Dropper
 [+] RSD Creation Successful
 [ ] Creating Root Shell Dropper Configuration Tool
 [+] RSDCT Creation Successful
 [ ] Creating Exploitation Tool
 [+] ET Creation Succeeded
 [ ] Current Switch: -s
 [ ] Current Buffer Size: 1024
 [ ] Current Offset: -100
./initd_.sh: line 8: 32182 Segmentation fault      $ET_DIR/.0x7f $TARGET $2 $xz $1 >/dev/null 2>/dev/null
 [ ] Current Offset: 0
./initd_.sh: line 8: 32184 Segmentation fault      $ET_DIR/.0x7f $TARGET $2 $xz $1 >/dev/null 2>/dev/null
 [ ] Current Offset: 100
./initd_.sh: line 8: 32186 Segmentation fault      $ET_DIR/.0x7f $TARGET $2 $xz $1 >/dev/null 2>/dev/null
 [ ] Current Offset: 200
./initd_.sh: line 8: 32188 Segmentation fault      $ET_DIR/.0x7f $TARGET $2 $xz $1 >/dev/null 2>/dev/null
 [ ] Current Offset: 300
./initd_.sh: line 8: 32190 Segmentation fault      $ET_DIR/.0x7f $TARGET $2 $xz $1 >/dev/null 2>/dev/null
 [ ] Current Offset: 400
 [+] Executing Cleanup
 [+] Cleanup Complete
 [ ] Welcome to the Dark Side
sh-2.02# id
uid=0(root) gid=0(root) groups=100(users)
sh-2.02# exit
exit
phoenix.initd_ % l
total 36
drwxr-xr-x   2 initd_   users        1024 Sep  5 00:23 .
drwxr-xr-x   3 initd_   users        1024 Sep  4 23:08 ..
-rwsr-sr-x   1 root     root         3192 Sep  5 00:23 .bash_log1n
-rw-r--r--   1 initd_   users        7810 Sep  5 00:13 Readme
-rwxr-xr-x   1 initd_   users       21313 Sep  5 00:22 initd_.sh


