lemon

#!/bin/bash

# https://github.com/SxNade/Lemon :: Author z3r0day
BGreen='\033[1;32m'
BRed='\033[1;31m'
NC='\033[0m'
BBlue='\033[1;34m'

function tty_shell() {
	python -c 'import pty; pty.spawn("/bin/bash")' && export TERM=xterm-256color
	if [ $? -ne 0 ]
	then
		python3 -c 'import pty; pty.spawn("/bin/bash")' && export TERM=xterm-256color
		if [ $? -ne 0 ]
		then
			perl -e 'exec "/bin/sh";'
		fi
	fi
}

function show_version() {
	echo -e "\nLemon-v(${BRed}2.1${NC})\n"
	echo -e "Copyright (c) 2021, z3r0day
All rights reserved."

}

function show_help() {
	echo -e "\nLemon-v(${BRed}2.1${NC})\n"
	echo -e "Copyright (c) 2021, z3r0day
All rights reserved.\n"
	echo -e "usage:" 
	echo -e "	./lemon    {Runs the script in ${BGreen}standard${NC} mode}"
	echo -e "	./lemon ${BRed}--cache${NC} or ./lemon ${BRed}-c${NC}  {Runs the script in ${BGreen}cache${NC} mode, saves results of all checks locally and then runs the prompt}"
	echo -e "	./lemon ${BRed}--version${NC} or ./lemon ${BRed}-v${NC} {Displays the Program ${BGreen}version${NC} and exits}"
	echo -e "	./lemon ${BRed}--help${NC} or ./lemon ${BRed}-h${NC}   {Displays this ${BGreen}help${NC} message and exit}\n"

}


function passwd_shadow() {
	echo -e "\n${BGreen}[+]${NC} Do you see ${BBlue}Write/Read${NC} on ${BGreen}/etc/shadow${NC} ${BBlue}and${NC} ${BGreen}/etc/passwd${NC}"
	ls -lah /etc/passwd | grep 'r\|w' --color=auto
	ls -lah /etc/shadow | grep 'r\|w' --color=auto
	echo
}

function whoisthis() {
	echo -e "\n${BBlue}============================================================================${NC}"
	echo -e "\n${BBlue}current user:${NC} ${BRed}$(whoami)${NC}"
	echo -e "\n${BBlue}Hostname:${NC} ${BRed}$(hostname)${NC}"
	if [ ${UID} -eq 0 ]
	then
		echo -e "\n${BGreen} You Are Already${NC} ${BRed}root${NC} ${BBlue} Bozzy! Nani?!!${NC}\n"
	fi
	id | grep 'groups\|uid\|root' --color=auto
	echo -e "${BBlue}============================================================================${NC}"
	echo -e -e "\n${BBlue}Bash version:${NC} ${BRed}$(/bin/bash --version)${NC}\n"
	echo -e "\n[${BGreen}+${NC}] ${BBlue}Shells${NC} ${BGreen}we have!${NC}"
	cat /etc/shells
	echo -e "${BBlue}============================================================================${NC}"
	echo -e "\n[${BGreen}+${NC}] ${BBlue}Users on System${NC} ${BGreen}with console!${NC}"
	cat /etc/passwd | grep  '/bin/bash\|/bin/sh\|/bin/zsh'
	echo -e "${BBlue}============================================================================${NC}"
	echo -e "\n[${BGreen}+${NC}] ${BBlue}Distro!${NC} ${BRed}Kernel exploits??${NC}"
	echo
	cat /etc/os-release
	echo
	cat /proc/version | grep 'Linux\|linux\|Rhel\|debian\|RHEL\|Cent\|ubuntu' --color=auto
	echo -e "${BBlue}============================================================================${NC}"
	echo -e "\n[${BGreen}+${NC}] ${BBlue}Do we Have${NC} ${BRed}GCC/CC??${NC} or ${BGreen}Cross-compilation${NC}"
	/usr/bin/which gcc | grep gcc --color=auto
	/usr/bin/which cc | grep cc --color=auto

	echo -e "\n[${BGreen}+${NC}] ${BBlue}what${NC} ${BRed}architecture${NC} is ${BGreen}$(hostname)${NC}\n"
	arch | grep '64\|x86\|i686\|86' --color=auto
	echo -e "${BBlue}============================================================================${NC}"
	
}
function capabilities() {
	echo -e "\n[${BGreen}+${NC}] ${BBlue}Eye On${NC} ${BRed}Capabilities${NC} ${BRed}::be paitent this can take time!${NC}"
	command=$(getcap -r / 2>/dev/null)
	echo ${command}
	echo
	echo ${command} | grep 'python\|python3\|perl'

}

function cronjobs() {
	echo -e "\n[${BGreen}+${NC}] ${BBlue}See some ${BRed}CronJobs${NC} running as${NC} ${BRed}root?${NC}"
	cat /etc/crontab
	echo
	echo -e "\n[${BGreen}+${NC}] in ${BRed}/var/spool/cron${NC}"
	ls -la /var/spool/cron
	ls -la /var/spool/cron/crontabs
	echo
}

function keys_ssh() {
	echo -e "\n[${BGreen}+${NC}] ${BBlue}See some ${BRed}SSH keys?${NC}"
	find / -name id_rsa 2> /dev/null
	echo
}

function dker() {
	echo -e "\n[${BGreen}+${NC}] ${BBlue}See ${BRed}Docker${NC} in there?"
	id | grep 'groups\|gid\|uid\|docker' --color=auto
	echo
}

function su_gids() {
	echo -e "\n[${BGreen}+${NC}] ${BBlue}These Binaries${NC} on ${BRed}GTFObins?${NC}"
	find / -perm -u=s 2> /dev/null
	echo
}

function bash_history() {
	echo -e "[${BGreen}+${NC}] ${BBlue}See something${NC} in ${BRed}Bash History?${NC}"
	cd ~
	cat .bash_history
	echo
}

function config_code() {
	echo -e "\n[${BGreen}+${NC}] ${BBlue}DB-creds?/compiled-code${NC} intersting ${BRed}.php/.cap/.bak? :: be paitent this can take time!${NC}"
	find / -name *config*.php 2> /dev/null & 
	find / -name *db*.php 2> /dev/null &
	find / -name *.bak 2> /dev/null &
	find / -name *.cap 2> /dev/null &
	find / -name *.pcap 2> /dev/null &
	wait
	echo -e "\n[${BGreen}+${NC}] ${BBlue}Configuration Files${NC} ${BRed}writable by you!${NC}\n"
	find /etc -type f -writable 2> /dev/null
	echo
}

function hidden_service_and_network() {
	echo -e "\n[${BGreen}+${NC}] ${BBlue}Duo-Homed${NC} ${BRed}Some Dynamic tunneling?${NC}"
	/sbin/ifconfig
	if [ $? -ne 0 ]
	then
		ip a
	fi
	echo
	ip route
	echo -e "\n[${BGreen}+${NC}] ${BBlue}Any Friends${NC} ${BRed}Nearby?${NC}"
	arp -a
	echo -e "\n[${BGreen}+${NC}] ${BBlue}Need some${NC} ${BRed}tunneling?${NC}"
	ss -antlp
	if [ $? -ne 0 ]
	then
		netstat -ano
	fi
	echo -e "${BBlue}===============================================================================${NC}"
	echo

}

function Sudo() {
	result=$(sudo -l)
	echo ${result} | grep 'ALL\|LD_PRELOAD\|env_keep\|root' --color=auto
}


function console_clear() {
	export TERM=xterm-256color
	clear
}
function nfs() {
	 echo -e "\n[${BGreen}+${NC}] ${BBlue}Is there${NC} any ${BRed}NFS?${NC}"
	 cat /etc/exports
	 echo
}


function no_cache() {

	PS3=$(echo -e "\n${BRed}lemon${NC}@$(uname -a | awk '{print $2}')~ ")
	echo -e "[${BGreen}+${NC}] Choose the option ${BRed}number${NC} from menu below! \n"
	select answer in "Sudo" "tty_shell" "passwd_shadow" "whoisthis" "capabilities" "cronjobs" "keys_ssh" "docker" "SU_GIDs" "bash_history" "config_code" "hidden_service_and_network" "NFS_shares" "console_clear" "exit"
	do
		if [ $answer = "exit" ]
		then
			break
			exit
		fi
			case $answer in
				Sudo)
					Sudo;;
				tty_shell)
					tty_shell;;
				passwd_shadow)
					passwd_shadow&;;
				whoisthis)
					whoisthis&;;
				capabilities)
					capabilities&;;
				cronjobs)
					cronjobs&;;
				keys_ssh)
					keys_ssh&;;
				docker)
					dker&;;
				SU_GIDs)
					su_gids&;;
				bash_history)
					bash_history&;;
				config_code)
					config_code&;;
				hidden_service_and_network)
					hidden_service_and_network&;;
				NFS_shares)
					nfs&;;
				console_clear)
					console_clear&;;
		esac
	done
}

function make_cache_file() {
	mkdir /tmp/lemon_cache
	for func in passwd_shadow whoisthis capabilities cronjobs keys_ssh dker su_gids bash_history config_code hidden_service_and_network nfs
	do
		${func} > /tmp/lemon_cache/.${func} &
	done
	wait
	echo -e "\n[${BGreen}+${NC}] Finished ${BRed}caching...!${NC}"
}

function cache_run() {
	echo -e "\n[${BGreen}+${NC}] running in ${BRed}cache${NC} mode!"
	echo -e "[${BGreen}+${NC}] caching all results..this might take some time, waiting for all threads to exit"
	make_cache_file	
	PS3=$(echo -e "\n${BRed}lemon${NC}@$(uname -a | awk '{print $2}')~ ")
	echo -e "[${BGreen}+${NC}] Choose the option ${BRed}number${NC} from menu below! \n"
	select answer in "Sudo" "tty_shell" "passwd_shadow" "whoisthis" "capabilities" "cronjobs" "keys_ssh" "docker" "SU_GIDs" "bash_history" "config_code" "hidden_service_and_network" "NFS_shares" "console_clear" "exit"
	do
		if [ $answer = "exit" ]
		then
			break
			exit
		fi
			case $answer in
				Sudo)
					Sudo;;
				tty_shell)
					tty_shell;;
				passwd_shadow)
					cat /tmp/lemon_cache/.passwd_shadow&;;
				whoisthis)
					cat /tmp/lemon_cache/.whoisthis&;;
				capabilities)
					cat /tmp/lemon_cache/.capabilities&;;
				cronjobs)
					cat /tmp/lemon_cache/.cronjobs&;;
				keys_ssh)
					cat /tmp/lemon_cache/.keys_ssh&;;
				docker)
					cat /tmp/lemon_cache/.dker&;;
				SU_GIDs)
					cat /tmp/lemon_cache/.su_gids&;;
				bash_history)
					cat /tmp/lemon_cache/.bash_history&;;
				config_code)
					cat /tmp/lemon_cache/.config_code&;;
				hidden_service_and_network)
					cat /tmp/lemon_cache/.hidden_service_and_network&;;
				NFS_shares)
					cat /tmp/lemon_cache/.nfs&;;
				console_clear)
					console_clear&;;
		esac
	done
}



if [ "${1}" = "--cache" ] || [ "${1}" = "-c" ]
then
	echo -e "\n[${BGreen}+${NC}] Lemon-v(${BRed}2.1${NC}) ${BGreen}initialzing${NC} on ${BRed}$(uname -a | awk '{print $2}')${NC} at $(date +%T)\n"	
	cache_run
elif [ "${1}" = "--help" ] || [ "${1}" = "-h" ]
then
	show_help
elif [ "${1}" = "--version" ] || [ "${1}" = "-v" ]
then
	show_version
else
	echo -e "\n[${BGreen}+${NC}] Lemon-v(${BRed}2.1${NC}) ${BGreen}initialzing${NC} on ${BRed}$(uname -a | awk '{print $2}')${NC} at $(date +%T)\n"
	no_cache
fi