The 0x00sec Package Manager: Agora! Introduction & How to use

[pry0cc (Leader & Offsec Engineer & Forum Daddy)]

Hi all! Recently we have been able to get our own GitLab server, made possible by @anon3236228! Since then we have moved all of 0x00sec’s project there. You can find us at https://gitlab.s-3.tech/groups/0x00sec

In this tutorial I will going over how to use Agora to get packages from NullHub.

Explanation

---

So NullHub is a GitLab repo, inside this repo (as you will see) there are lots of JSON files. We call these files “Jasons”, affectively named by me and @Joe_Schmoe. Inside these files are essentially just a description of the package, and a git url to where we can find them. An example is DTM’s k3kbot

{
    "k3kbot": [{
        "repo-url":"https://github.com/0x00sec/k3kBot",
        "description":"Badass Malware started by DTM",
        "version":1.0,
        "contributors":[
            "@93aef0ce4dd141ece6f5 (dtm)"
        ]
    }]
}

When we run agora for the first time, it clones (Downloads) the repo, and imports the Jasons. When we install a package, it clones the git repo that is supplied in repo-url. It’s really that simple. When we run an update, it iterates through the installed packages and runs git pull. And of course, when we delete, it rm -r's the folder it got cloned into.

How to use Agora

---

First off, you’re going to want to clone the repo, ensuring you have git installed run

git clone https://gitlab.s-3.tech/0x00sec/Agora

This will create a directory called “Agora”, type cd Agora.

On first run, Agora will detect that it is a new installation, and will automagically create the directories needed, and update the package list. To see a list of commands type

./agora -h

Now, you’re going to update your package list, so you can be sure everything is up to date.

./agora -y

This will update the Jason list. (In the image, I was fully up to date so it did nothing apart from check.)

Okay! Now you’re good to go! Lets see whats available…

./agora -l

(If you look next to “JavaSocketPortscan” notice the ‘[installed]’ label? This shows that I have that package installed. )

So, I’m in the mood for some 1337 DoS’ing (@dtm) , so I will try sockstress. Installing packages with Agora is as easy as

./agora -S sockstress

This is will download sockstress and put it in the Packages directory.

I could have found this tool equally by using the search function.

./agora -s dos

This will return all packages with “dos” either in the name or in the description. (another reason why agora is better than null-get)

To uninstall a package, just type

./agora -R sockstress

This will uninstall sockstress.

Submitting packages to NullHub

---

Submitting packages to NullHub is fairly simple once you get the hang of it. I won’t spoonfeed you it so what you need to do is - Fork NullHub, upload your Jason to your repo, make a pull request. You can generate Jasons with the genjason.rb script.

I hope this all helped you out! I look forward to seeing what packages get uploaded to NullHub!

pry0cc