Coder Social home page Coder Social logo

merces / bashacks Goto Github PK

View Code? Open in Web Editor NEW
197.0 14.0 43.0 338 KB

A set of functions to increase productivity while hacking with Bash

License: GNU General Public License v3.0

Makefile 4.08% Shell 95.92%
bash-hacks malware-analysis command-line oneliners

bashacks's Introduction

bashacks

What?

bashacks started as a collection of bash functions most likely useful for programmers, security analysts, and general users that need some low level type of operations.

In fact, there is nothing really new in bashacks as all functions are written using exiting software in UNIX-like systems. However, it allows you to use shorter commands to run tasks that commonly would require many a few more lines of code.

Requirements

  • bash >= 4
  • bc
  • binutils
  • coreutils
  • curl
  • file
  • grep
  • hexdump
  • html2text
  • perl
  • sed
  • wget
  • xxd
  • zip

Installation

Use the make command to generate a single file containing all functions and add it to your /etc/bash.bashrc file:

make
make install

That's all. You can now check the available functions from command line by typing bh_ and pressing TAB.

Documentation

Click here.

Usage

What time is now in Epoch?

$ bh_epoch
1522324129

Alphabetically add 4 to 'f'

$ bh_charcalc f + 4
j

Check external IP address

$ bh_myip
177.212.113.13

Create a basic C program skeleton

$ bh_skel_c > hello.c
$ cat hello.c
#include <stdio.h>

int main(int argc, char *argv[]) {


    return 0;
}

Calculate common checksums for files

$ bh_hashes /bin/ip*
387478f58a0669173fb6557d392a58e9 /bin/ip
1dd0f3b100bd6efc4664da0cdefff801d7d2efd8 /bin/ip
1d418ae3a767280c7fc6026a25e5bb9774c0e8afc7b3387b547765b62cbe578f /bin/ip
78868acd29e4a33194fb786f6589d3d1 /bin/ipcmk
8c22a129ff4b5748cc62222a93ba8471d7fdce19 /bin/ipcmk
34a068d7f85e85746b3fc98502fa96a734cc51f3a9d49cad92911e8f239bd9c9 /bin/ipcmk
69c2bedc20e77c039912c9d5e7af33db /bin/ipcrm
7992a936b28359d7f087a448d2b8a2418ef4f112 /bin/ipcrm
cded383eb3b74467409c1731c2804350fe3d1123bdac7304c1c6f3af9e7976f7 /bin/ipcrm
499f17765c0aa55ac99739c9bcac1d0c /bin/ipcs
c476949e77ef8710398fd8ec4f78c8cf1d76a420 /bin/ipcs
33c77a5b625f4de919f55dc24207645d219a2fde2e0b92be27c5cda8c662cd72 /bin/ipcs
6a738c5c2506f7e87c9458e0c3df378f /bin/iptables-xml
ba97af2e429aca6beb5a2b8861e370bbf874dee9 /bin/iptables-xml
cb8c10461da5247e8d6d63a123ba563df95ae1e78f29e1717eb8bb02c2ca045b /bin/iptables-xml

Find files by MIME type (ignores file extension):

$ bh_findmime -elf /bin | head
/bin/[
/bin/addpart
/bin/appres
/bin/apt
/bin/apt-cache
/bin/apt-cdrom
/bin/apt-config
/bin/apt-extracttemplates
/bin/apt-ftparchive
/bin/apt-get

You could pipe the results to xargs in order to calculate checksums quickly:

$ bh_findmime -pe ~/Downloads/ | xargs shasum
d9e49c4209087170e36cbef689d96240d736cf3b  /Users/menteb/Downloads/CSCWCNG.dll
50dfeea02e89f41caf52df152c7cb923c667bffc  /Users/menteb/Downloads/Receitanet-1.10.exe
86a5f89d43ab11456fb817aeceb14b83cc6c2608  /Users/menteb/Downloads/Xojo2017r3Setup.exe.opdownload

Convert string to hex in different output formats

$ bh_str2hex mentebinaria
6d 65 6e 74 65 62 69 6e 61 72 69 61

$ bh_str2hex -x mentebinaria
\x6d\x65\x6e\x74\x65\x62\x69\x6e\x61\x72\x69\x61

$ bh_str2hex -c mentebinaria
{ 0x6d, 0x65, 0x6e, 0x74, 0x65, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x69, 0x61 }

There is very basic error handling in bashacks. If a function does not receive the arguments it needs, it justs returns 1.

There's much more. Install it and see for yourself. :)

Changelog

bashacks 1.5 - 2023 maybe?

  • New name: bashacks
  • Bugs fixed.
  • New cache engine at $HOME/.bashacks/cache used by internet dependent functions like bh_asminfo and bh_hashcrack.
  • New functions:
    • bh_asminfo - details an Assembly x86 instruction.
    • bh_epoch - converts an Epoch date to its human-readable equivalent.
    • bh_findmime - finds files by their MIME-type.
    • bh_hostcalc - returns the total hosts number for an IPv4 subnet.
    • bh_md5rename - renames files to their MD5 hash.
    • bh_sharefile - upload a file to file.io and returns a download link that only works once.
    • bh_skel_c - outputs a blank C source file skeleton.
    • bh_skel_python - outputs a blank Python script skeleton.
    • bh_skel_yara - outputs a simple Yara rule skeleton.
    • bh_str2hexr - converts a string to its reversed hexadecimal equivalent.
    • bh_unshort - gives the real URL behind shortened links.
    • bh_urlencode - decodes an URL-encoded string.
    • bh_wgetr - site mirroring with random interval between resquests and custom User-Agent.
    • bh_zerostring - fill a string with nullbytes in a binary file.
    • bh_zipmal - zip files with 'infected' password.
    • bh_ipblocked - checks if an IP address is blocked by a few security vendors.
    • bh_skel_latex - outputs a LaTeX template.
  • Removed functions:
    • bh_intel is not needed anymore.
    • bh_asc2hex result is easily achieved with echo a | hd.

hack-functions 1.4 - February, 27 2012

  • new function: bh_charcalc - performs math with characters.
  • new function: bh_intel - set Intel syntax for disassembling.
  • new function: bh_rotall - simultaneous ROT for strings (thanks to @laerciomasalla for suggesting it).
  • created reference guide in Portuguese.
  • bh_hexcalc now supports the four basic math operations and the result is prefixed with 0x.
  • bh_str2hex and hex2str now support the prefixes 0x, \x, with or without spaces, and C-style arrays.

hack-functions 1.2 - February, 24 2012

  • new functions: bh_bin2dec and bh_asc2hex.
  • added Intel syntax by default for gdb and objdump.
  • curl gets replaced by wget in bh_unmd5.
  • code optimization in many functions.

hack-functions 1.0 - February, 24 2012

  • first public release containing 20 functions.

Known Bugs

String escape

In some string functions you have to escape special characters because bash will try to interpret them. See the following example using bh_strxor function:

$ bh_strxor 0x41 fernando
'$3/ /%.

$ bh_strxor 0x41 "'\$3/ /%." # string between double quotes and dollar sign escaped
fernando

ZSH support

As bashacks uses the word splitting feature from bash, they don't work by default in ZSH. However, you can configure ZSH to perform word splitting with the following command:

$ setopt sh_word_split

bashacks's People

Contributors

atcasanova avatar ephiguxta avatar fadamiao avatar hc0d3r avatar j3r3mias avatar leandrofroes avatar mariomoura avatar merces avatar nilsonfsilva avatar traleski avatar wesleyleite avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

bashacks's Issues

coding style

how about we create a configuration file in the repository to standardize the indentation?
[like this]

Split manpage by function

The goal is to better organize this area, because, today is very confusing and difficult maintenance

Build wiki.

Wiki with information of each function I/O examples, the propose of project, code style, standards and more.

Why deliver those codes as functions?

I think using functions and embedding them in .bash_profile puts a lot of pressure on the environment space. Why not to use plain shell scripts? It would be as easy to install and be made globally available as:

$ find ./ -type f -name 'bh_*' -exec cp "{}" /usr/local/bin/ \;

Due to bh_ prefix, this cannot give us any problems with colliding filenames (since 'bh_' can be seen as a namespace). And I would get rid of .sh filename extension as well...

Take a look at a modified version of bh_hashcrack, for instance (of course, there is a minor problem here if wget fails).

#!/bin/bash
# vim: set ts=2 sw=2 et:

# NOTICE: I'm using ANSI to colorize some messages.

# We need a single parameter for this script. Ignore the rest, if any.
if [ -z "${1}" ]
then
  echo -e "\e[33;1mUsage\e[0m: bh_hashcrack <hash>\n"
  exit 1
fi

# If it isn't an hexadecimal string...
if [ ! -z "$(sed -n '/[^0-9A-Fa-f]/p' <<< "${1}")" ]
then
  echo -e "\e[31;1mERROR\e[0m: Invalid hash format."
  exit 1
fi

BH_SITE="http://hashtoolkit.com/reverse-hash/?hash=${1}"

# FIXME: Is this the best method?
BH_DATA="$(wget -qO - "${BH_SITE}")"

# if wget didn't fail, this substring is present on the result string!
if grep -qF 'No hashes found' <<< "${BH_DATA}"
then
  echo -e "\e[31;1mERROR\e[0m: No hashes found."
  exit 1
fi

BH_RES=$(echo "${BH_DATA}" \
 | grep -FA1 'res-text' \
 | sed -n 's/^.*<span>\(.*\)<\/span>.*$/\1/p')

if [ "${BH_RES}" != "${1}" ]
then
  echo -e "\e[33;1mFound\e[0m:"
  echo "${BH_RES}" | sort -u
fi

Notice the renaming of 'local' vars, now uppercase and prefixed with BH_. "Local" because they are not exported.

PS: Of course, if multiple hashes could be used as arguments, we can, always, use a loop with $@ var.
PS2: It should be clear that I don't like some bash/shell scripts shortcuts as well... :)

[]s
Fred

doc update

I'll be working on updating all the documentation "next week"...
any comment, send below...

Add support for OS X

Correct if I'm wrong but recent OS X versions have Bash by default. We could easily extend bashacks to support OS X version of Linux commands, as I did on 1f7efcf for bh_md5reanme() function. What do you say @wesleyleite? That may require us to remove some functions, but I suspect some functions like dumpmem() or asm2sc() are rarely used anyway. We must apply KISS methodology here. ;)

new function isspace()

check whether the char is white-space

' ' (0x20) space (SPC)
'\t' (0x09) horizontal tab (TAB)
'\n' (0x0a) newline (LF)
'\v' (0x0b) vertical tab (VT)
'\f' (0x0c) feed (FF)
'\r' (0x0d) carriage return (CR)

Question about bash strict/portable/valid syntax

I saw you write some $() bash expressions without nested double quotes:

matches=$(for i in "$dir"/*; do
filetype=$(file -Nb --mime-type "$i")
[[ "$filetype" =~ application/$opt ]] && echo "${i#./*}"
done)

local pos=$(strings -t d "$fil" | grep -F "$search" | tr -s ' ' ' ' | cut -d' ' -f2)
siz=${#search}
for i in $pos; do
[[ $i -gt 0 ]] || continue
dd conv=notrunc bs=1 count=$siz seek=$i if=/dev/zero of="$fil"
done

cache=$(grep "${hash}:" "${BASHACKS_CACHEDIR}/hash")
if [[ "$cache" ]]; then

It might be not much important in particular code. But there is some discussion exists:

https://stackoverflow.com/questions/68588306/nested-double-quotes-in-bash-scripts
https://unix.stackexchange.com/questions/289574/nested-double-quotes-in-assignment-with-command-substitution

Why not just always put the output into nested double quotes:

myvar="$(... "...")"

Isn't that more safer and faster (command line substitution is skipped)?

I've found that the absence of nested double quotes just gives you random errors dependent on the output and context. So better to just always use the nested double quotes to avoid that.

On another hand, there is a fork with quite opposite fixes:

1d1e93d#r86797412

Create delivery continuous

I would like to make a PKGBUILD and make available in the AUR however the most stable way would be to pull the releases, but it is interesting to create a DC. What do you think?

bh_strxor have a bug

$ bh_strxor 15 'hack'

sed: -e expression #1, char 22: Invalid preceding regular expression

this bug may be related to bh_hex2str script, look this:

$ set -x
$ bh_strxor 15 'hack'

. . .

+ bh_hex2str ' 67 6e 6c 64'
+ [[ 1 -ne 1 ]]
+ local hex
+ local oIFS
+ local i
++ echo ' 67 6e 6c 64'
++ sed -r 's/(0x|\\x| |{\|}|,)//g'
sed: -e expression #1, char 22: Invalid preceding regular expression

new function ispunct()

check whether the char is punctuation,
basically is 'isgraph()' that is not alphanumeric.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.