GREY HACK · COMMUNITY TOOLS REFERENCE PORTAL
ONLINE
GREY HACK
// GREY HACK · COMMUNITY TOOLS //
HACKTOOL DOCS
SELECT A TOOL TO BROWSE ITS DOCUMENTATION
DOOM
● LIVE
Full-featured Grey Hack hacking suite. Exploit engine, session manager, proxy chaining, macro system, and network recon — all in one tool.
121 COMMANDS 8 CATEGORIES 7 GUIDES MULTIPLAYER
OPEN DOCUMENTATION
5HELL
● LIVE
Pipe-driven shell exploitation framework. Flat command architecture with a built-in macro engine, GLASSPOOL session mirroring, and .5pk package system.
100 COMMANDS 8 CATEGORIES 6 GUIDES LOCAL SOURCE
OPEN DOCUMENTATION
HEX
● LIVE
State-persistent exploit toolkit. Session stack navigation, typed Exploit objects, Result wrappers, and three structured dispatch maps for systematic attacks.
20 COMMANDS SESSION STACK 6 GUIDES LOCAL SOURCE
OPEN DOCUMENTATION
VIPER
⚠ LEGACY
Deprecated ExtensionMediator structured hacktool. Architecture A DI pattern reference — typed command system, session manager, theme layer, and config system.
ARCHITECTURE A DEPRECATED 4 GUIDES
OPEN REFERENCE
GREYSCRIPT
● LIVE
GreyScript language reference and Grey Hack API guide. Data types, OOP patterns, built-in intrinsics, and the complete game object API documentation.
9 SECTIONS FULL GH API PATTERNS INTRINSICS
OPEN REFERENCE
ONLINE
GREY HACK
v4+
DOOM
GREY HACK HACKTOOL — COMMAND REFERENCE
A comprehensive reference for all Doom commands and features. Use the sidebar to browse commands by category or search for specific commands. Navigate guides for in-depth tutorials.
90+
COMMANDS
8
CATEGORIES
7
GUIDE SECTIONS
MP
MULTIPLAYER ONLY
QUICK ACCESS
▶ GETTING STARTED
Install Doom, set up repositories, configuration overview.
▶ HACKING GUIDE
hack, hacklib, bounce exploits, escalation and sessions.
▶ MACROS
Create and run macro files, special commands, #jump, #if.
▶ PIPED COMMANDS
Use | to chain commands, $p variable, clip and grep patterns.
▶ PROXY SETUP
Stay anonymous — proxy chains, dpath, and dcall management.
▶ EXPLOIT SYSTEM
Library scanning, shells/computers/files, zero-day payloads.
EXPLOIT CHAIN
proxy -c
map [ip]
hack -shell -any [ip] [port]
escalate
pass -r
clean
COMMANDS
GETTING STARTED
Doom is only available for Grey Hack multiplayer. It can be requested and used by anyone — new player or veteran, guild member or solo.
1. JOIN THE DISCORD
To obtain the tool, first join the official Doom Discord server:
https://discord.gg/nF58jBwVSJ
Open a Ticket in the server and request a personal in-game repository IP. This IP is personal — keep it safe and never leave it noted anywhere in-game.
2. ADD THE REPOSITORY
Escalate to root first, then add the repository IP you received:
sudo -s apt-get addrepo [YOUR_REPO_IP] apt-get update apt-get install doom /root
CRITICAL
After downloading, immediately remove the repository IP from your apt source to keep it safe.
apt-get delrepo [YOUR_REPO_IP] apt-get update
3. ADD YOUR HACKSHOP
Before doing anything else, add your hackshop IP (received during tutorial/email creation). Doom uses it to download and update required libraries.
apt-get addrepo [HACKSHOP_IP] apt-get update
4. RUN DOOM
From a root terminal, simply run:
doom
On first run, Doom will prompt you to set an encryption key — this is your password used to encrypt sensitive files including the dcall payload. Choose something memorable but secure.
Doom will also check for metaxploit.so and crypto.so libraries and offer to download them. A dfiles/ folder and eventually a doomDB/ folder will be created in the same directory as the Doom binary.
5. FILES STRUCTURE
/root/ doom ← the binary dfiles/ calls/ ← custom call scripts macros/ ← macro files logs/ ← dtop logs wifi/ ← captured wifi .cap files monitor/ ← doomspy downloaded logs unseclibs/ ← dlib weak libraries seclibs/ ← slib secure libraries doomDB/ ← library data & password dicts
6. CONFIGURATION
Open the configuration menu with:
config
Key settings to understand:
SETTINGDESCRIPTION
RESUME RESULTSWhen enabled, shows only one result of the same type (e.g., one guest shell instead of three). Reduces clutter.
DATABASE LINKKeep enabled. Doom will use and populate the database for library info and passwords.
REMOTE DATABASEConfigure if you want multiple Doom installs to share the same database via SSH.
METAXPLOIT / CRYPTO PATHRecommended to move these libs to your dfiles folder rather than /lib to prevent them from being exploited.
DCALL INJECTIf a target crashes when uploading dcall, enable this to create it on-target instead.
DCALL NAMESet a custom name for your dcall file to avoid conflicts with other Doom users.
CUSTOM LOG PATHPath to a template file used when corrupting target logs.
INTERNAL DICTDoom builds a brute-force dictionary at startup. Disable after running sys -ph -internal once to speed up startup.
PROMPTS & NAVIGATION
MAIN PROMPT
The main prompt is your home PC. It shows:
—[DOOM]—[P2]—[SHELL]—{PUBLIC_IP}—{LOCAL_IP}—[/current/path] |—[root]:~$
PROMPT FIELDS
[P2] — number of proxy sessions in chain
PUBLIC_IP — your network's public IP
LOCAL_IP — your device's LAN IP
/current/path — active path used for relative commands
[user] — current user
TARGET PROMPTS
When connected to a target, sessions stack in a chain. The prompt shows the current target session:
—[DOOM]—[P2][2]—[SHELL]—{PUBLIC_IP}—{LOCAL_IP}—[/current/path] |—[root]:~$
SESSION TYPES
SHELL — full access, can run scripts, hack, connect, upload binaries
COMPUTER — most commands available, no script execution or hacks
FILE — limited, can read/copy/delete/list files
PCOMPUTER — partial computer object (from bounce exploits)
[MC] — metaxploit and/or crypto cached for this session
NAVIGATION COMMANDS
COMMANDACTION
mainClose all sessions, return to main prompt
back / close / 0Close current session, go back to previous one
backcClose all regular target sessions, keep proxy sessions open
CONTEXT COMMANDS
Run commands on a different target context without switching prompt:
// Run Terminal.exe on home system while on a target prompt >main Terminal.exe // Run on a named alias session >s1 open /var/system.log
To set an alias on the current cached session:
rcache -a s1
GAME EXPLOIT SYSTEM
The exploit system revolves around vulnerabilities in library files. Each library version has a unique set of memory/value pairs that can be exploited to get shells, computer objects, files, or trigger special effects.
LIBRARY SCANNING
Scanning discovers the memory/value pairs of a library version. Doom saves all data to doomDB — subsequent interactions skip the scan entirely. Doom scans automatically when it first interacts with an unknown library version.
TIP
Use libdata [libname] to view saved scan data. Use scan -u to force an update of saved data.
SESSION TYPES
TYPECAPABILITIES
SHELLFull access — scripts, hacking, uploading binaries, connecting to other targets, escalating privileges. Highest utility.
COMPUTERRead/write files, interact with system, change permissions. Cannot run scripts or perform new hacks.
FILERead, copy, delete, list file system. Most limited but still useful for data extraction.
BOUNCE EXPLOIT
A bounce exploit occurs when a router library vulnerability returns a COMPUTER object. By passing a [lanIP] as an extra parameter to hack/hacklib, the returned computer object belongs to that LAN device instead of the router itself — allowing you to target machines with no open ports.
// Attack router and bounce to target at 192.168.1.2 hack 170.110.50.20 0 192.168.1.2 // or using hacklib from inside the network hacklib kernel_router.so 192.168.1.2
DVAR TIP
dvar -a bounce hacklib -computer -any
// Then use: bounce 192.168.0.2
Finding a Bounce Library
1. Connect to a proxy via proxy -q
2. Run map to find a LAN IP (e.g. 192.168.1.2)
3. Run hacklib 192.168.1.2 and try each library
4. Any COMPUTER result with that LAN IP = bounce exploit
5. Download the lib with dlib -a /lib/[libname]
ZERO-DAY EXPLOITS (PAYLOAD)
Zero-day exploits use debug mode credentials to access a library's internals and extract data through payload vulnerabilities. Use debuglib to scan for zero-days and payload to exploit them. Credentials are managed with zcred.
WARNING
Using debuglib remotely on a PC can leave logs. Use it from a proxy to avoid traces.
HACKING GUIDE
HACK COMMAND
Hack performs remote attacks using an IP and port. When using public IP, the router forwards the connection to the service. From inside a network you can use LAN IPs directly.
// Full attack on all vulnerabilities (recommended first time) hack 170.110.50.20 0 // Attack a specific service port hack 170.110.50.20 22 // Use domain URL hack www.site.com 0 // Bounce to internal target hack 170.110.50.20 0 192.168.1.2 // Auto-connect to first root shell found hack -shell -root 170.110.50.20 0 // Auto-connect to any shell hack -shell -any 170.110.50.20 0 // Scan and list entry points hack -l 170.110.50.20
DVAR TIP
dvar -a shell hack -shell -any
// Then use: shell 115.124.207.47 22
HACKLIB COMMAND
Hacklib attacks library files directly — it can only be used from an existing shell session on the target.
// Attack all vulnerabilities (selection menu) hacklib // Attack specific library hacklib libssh.so // Direct attack on specific vulnerability hacklib -l // Auto-connect to root computer via bounce hacklib -computer -root init.so 192.168.1.2
ESCALATE PRIVILEGES
From a guest shell, escalate uploads dcall and attempts a dictionary brute-force attack on the root password. Works reliably against NPCs; less effective against players with strong passwords.
// From guest shell escalate
If you only have COMPUTER or FILE access, try extracting data first:
pass -u // user passwords pass -m // email credentials pass -b // bank credentials
REVERSE SHELL SOCIAL ENGINEERING
For targets with no open ports, use the rshell + funny game email approach:
1. Get target's email via bounce exploit + pass -m
2. Install rshell server on a router: rshell -i then rshell -s
3. Login to an employee email: mail -m [email] [passwd]
4. Send a funny game email to target with your rshell server IP + port 1222
5. When target runs the game, check: rshell -l
6. Connect to the new rshell session
DLIB — LIBRARY MANAGEMENT
Store and quickly upload weak libraries to targets for exploitation:
dlib -a /lib/init.so // add library to dlib store dlib -l // list stored libs dlib -u // upload menu (select lib to upload to target) dlib -u init.so // upload specific lib
MACROS
Macros are text files stored in ../dfiles/macros/ where each line is a Doom command. Run them with @macroname.
CREATING MACROS
// Create a new macro file macro -n mymacro // Or open an existing one macro -o mymacro // List all macros macro -l
MACRO PARAMS
Pass parameters when running a macro. Inside the file, use $1, $2, etc:
// Macro file: attack.macro hack -shell -any $1 0 escalate dfile /var/$2 /root echo File $2 downloaded from $1 // Run it @attack 170.150.55.20 system.log
MACRO BREAKS
TYPEDESCRIPTION
Auto BreakTriggered if a session command (hack, hacklib, escalate, rshell, rcache) fails. Prevents commands running on wrong target.
Manual BreakTriggered by the break command. Useful in conditional logic.
SPECIAL MACRO COMMANDS
COMMANDDESCRIPTION
#jumpCreates a jump point. On auto break, macro jumps here instead of stopping. Auto break also calls backc first.
#onbreakMarks the jump point for manual break command (without auto backc).
#commandPrefix any command with # — it only executes IF the command directly before it caused an auto break. Ignored otherwise.
#holdPauses macro and prompts user to continue or stop. Useful when you need to take a manual action mid-macro.
#if ... #endifBlock-style conditional. Commands inside only execute if condition is true.
#loop N ... #endloopBlock-style loop. Use $n for index. Cleaner than the inline loop command for complex iterations.
#macro name ... #endmacroDefine an inline macro callable within the same file. Use 1$, 2$ for params.
// commentLines starting with // are ignored (comments).
FULL EXAMPLE
// Try root shell first, fall back to any shell hack -shell -root 170.110.50.20 0 #hack -shell -any 170.110.50.20 0 escalate dfile /home/user/file.txt /root rm /home/user/file.txt clean #jump proxy -clean
PIPED COMMANDS
Chain commands with | to pass the response of one command to the next. The piped response is always a string accessible via $p.
// Basic pipe cat /etc/passwd | echo $p // Save response to clip variable map 170.120.55.10 | clip m $p // Use saved variable later echo $m
NOTES
• If a piped command fails, there is no response and the next command using $p will not execute
• When piped, some commands behave differently (suppress their normal output)
• Piped response is always a string
CLIP COMMAND
Store values in single-letter variables (a-z, excluding $p and $n which are reserved):
clip a MY TEXT HERE // store text clip a -a MORE TEXT // append to existing clip a -s MORE TEXT // append with space clip a -l MORE TEXT // append on new line clip -clear // clear all variables clip -null a b c // set a, b, c to null echo $a // use the variable
GREP FOR DATA EXTRACTION
// Find first line containing pattern grep -n1 root /etc/passwd // Return first line matching pattern, pipe it map | grep -n1 *192.168.0.2 -v $p | echo ip: $p // Return line by number grep -i 1 /etc/passwd // first line grep -i -1 /etc/passwd // last line // Count lines grep -c /etc/passwd
IF COMMAND
if $a : echo not null if $a == true : echo is true if $a != null : echo a is NOT NULL ? echo a IS NULL if $a == blue : @mymacro ? echo not blue
PROXY CHAIN TIP
Use piped commands and dvars to create powerful one-liners:
// Connect to 2 saved + 2 quick proxies dvar -a pcon proxy -c 2 && proxy -q && proxy -q // Run: pcon
PROXY & DCALL
IMPORTANT
Before doing any hacking, ALWAYS use proxies to protect yourself and stay hidden. Skip this and risk getting hacked back by players.
PROXY SETUP
Doom uses random NPC routers as proxies — they're easy to hack and their admins don't trigger traces from router logs.
// Add 4 proxies to your saved list (max 10) proxy -a 4 // Connect to all saved proxies proxy -c // Connect to 2 saved proxies proxy -c 2 // Connect to a quick random proxy (not saved) proxy -q // Restore last proxy sessions from cache proxy -p // Clean logs and doom files from proxy chain proxy -clean
RECOMMENDED ROUTINE
proxy -c 2 (2 saved proxies)
proxy -q (random quick proxy)
proxy -q (another random quick proxy)

This gives you a 4-hop chain. The end proxies are random and won't be reused, making monitoring extremely difficult.
DCALL
dcall is Doom's payload file — unique to your installation. Many shell commands require it to be uploaded to the target first. By default, Doom uploads it to /home/guest automatically.
When /home/guest doesn't have write permission or doesn't exist (common with PvP targets), you need to configure a custom upload path using dpath:
// Add a custom path for dcall upload dpath -a /tmp // List and activate a saved path dpath -l // Or activate directly dpath -l /tmp
Alternatively, use inject -dcall to create dcall on-target instead of uploading it, or enable the DCALL INJECT option in config.
RCACHE — SESSION CACHE
Every shell/computer/file session you obtain is cached. Use rcache to reconnect or set aliases:
rcache // list all cached sessions rcache -a s1 // alias current session as 's1' rcache s1 // reconnect to 's1' rcache -clear // clear all cached sessions rcache -s // list currently connected sessions

DOOM Tool Created By: @GSQ

ONLINE
GREY HACK
v4.3.6
5HELL
GREY HACK HACKTOOL — COMMAND REFERENCE
5hell v4.3.6 "falling_skies" by Plu70. A pipe-driven exploitation framework with flat command dispatch, GLASSPOOL session mirroring, persistent macro engine, and full .5pk package system.
75+
COMMANDS
8
CATEGORIES
6
GUIDE SECTIONS
L
LOCAL SOURCE
QUICK ACCESS
▶ GETTING STARTED
Install, rkit setup, do.rc config, file structure.
▶ SHELL & PIPING
Pipe engine, GLASSPOOL mirroring, EZ_CLIP tokens.
▶ CLIP & BUFFER
Clipboard slots, Memory Alpha BUFFER, malp object handling.
▶ MACROS & SCRIPTS
Persistent macros, do scripts, bat alias, SAFEWORD, do.rc.
▶ EXPLOIT WORKFLOW
probe → meta → zap/db/roil, 5phinx TUI, hashim cracking.
▶ CUSTOM OBJECT / cob
Persistent key-value store, @home config, session exports.
EXPLOIT CHAIN
probe [ip]
meta link [ip] [port]
meta scan
roil
malp
glasspool
silentclean
COMMANDS
GETTING STARTED
5hell is a pipe-driven exploitation framework for Grey Hack multiplayer. It runs as a compiled GreyScript binary using a flat command dispatch map, full pipe engine, persistent macros, and modular .5pk packages.
1. OBTAIN 5HELL
The full 5hell source is available on GitHub. Clone or download the repository to get all .5pk.src files:
GITHUBhttps://github.com/jhook777/5hell-for-Grey-Hack-the-Game
2. REQUIRED LIBRARIES
5hell uses metaxploit.so, crypto.so, and aptclient.so. At startup, super_import automatically scans the filesystem for the highest-version copies and loads them. Ensure they exist:
apt-get addrepo [HACKSHOP_IP] apt-get update apt-get install metaxploit /lib apt-get install crypto /lib
3. COMPILE AND RUN
5hell ships as source files and must be compiled before first use. You have two options:
OPTION A — IN-GAME BUILD COMMAND
Copy all .src files from the repository into /root/src on your in-game machine. You can do this manually by pasting them into the Grey Hack script editor
From a root terminal inside Grey Hack, navigate to your source folder and compile:
cd /root/src build 5hell.src /root/rkit/
OPTION B — GREYBEL VS CODE EXTENSION
Use the Greybel VS Code extension to transpile and bundle the source outside of the game. Open 5hell.src in VS Code, then use the Greybel build command to produce compiled output installer.src files you can paste into the in-game editor.
GREYBEL
The Greybel extension handles import_code() directives at transpile time, bundling all .5pk.src modules into a few output installer files. Greybel also supports direct file import/compile using a bepinex extension. Learn more and install the greybel extension from the VS Code Marketplace: search greybel-vs.
Once compiled, launch 5hell from the output directory:
cd /root/rkit 5hell
4. BUILD THE RKIT
Once running, set up the operational environment using kore -r. This creates the ~/rkit directory with 5hell, its libraries, and your database file:
|> kore -r
RKIT CONTENTS
~/rkit/ — compiled 5hell binary + metaxploit.so + crypto.so + database.csv
~/rkit/tables/ — rainbow tables (t5, tp) for hash cracking
~/Config/do.rc — auto-executed on every 5hell startup
5. FILE STRUCTURE
/root/ src/ 5hell.src ← entry point (user-editable) 5hell.5pk.src ← core: globals, CLIP, BUFFER, ls/cd/rm/ps... 5phinx.5pk.src ← print override, get_file, GLASSPOOL, switch engine kore.5pk.src ← kore command, DaemonManager, startup RC dtools.5pk.src ← macro, grep, tree, cob, code, glosure... contrib.5pk.src ← pwgen, DaemonManager class, dm net.5pk.src ← probe, db, zap, ssh, rsi, air, scpm... help.5pk.src ← help command + summary rkit/ 5hell ← compiled binary database.csv ← lib scan results (grows over time) do.rc ← startup resource config (auto-executed) tables/t5 ← rainbow table tables/tp ← rainbow table (passwords) Config/ do.rc ← startup config (checked first before rkit/do.rc)
6. CONFIGURE do.rc
The do.rc file runs automatically on every 5hell startup. Create it at ~/Config/do.rc (priority) or ~/rkit/do.rc. Each line is a 5hell command:
# do.rc example kore --silent # suppress startup output target 1.2.3.4 22 # set default target macro set autoexp "probe @pipe | sphinx" kore --override colorDefault <#FFFFFFFF> # override terminal color kore --silent # re-enable output
TIP
Wrap your do.rc with kore --silent at the start and end to suppress output during the initialization sequence. Lines beginning with # are comments and are skipped.
7. SECURITY: kore -s
After deployment on any machine, run the security sweep to harden it:
|> kore -s
This performs: chown root on all files, removes /etc/passwd, clears Bank/Mail data, runs silentclean, and locks file permissions. Use kore -sc for the same sweep using silentclean instead of rclean.
WARNING — kore -S
The paranoid mode (kore -S) also removes /home, /bin, and /usr. Use ONLY on rented servers, never on your home machine.
SHELL & PIPING
5hell's core input loop processes commands with full pipe support, EZ_CLIP token substitution, macro expansion, and GLASSPOOL session mirroring. Understanding these mechanics is key to scripting effective workflows.
THE PROMPT
The default prompt is |>. When GLASSPOOL is active, the prompt turns blue — a visual indicator that file operations are targeting a remote machine. Toggle the full decorated prompt with:
|> prompt // toggles full prompt with IP/user/path display on/off
SINGLE PIPE ( | )
The single pipe passes the return value of one command as the last argument of the next. The piped value can be any type — string, object, list.
|> probe 1.2.3.4 | clipa // stores probe output in clipa |> db -r 1.2.3.4 22 | malp // push obtained shell to BUFFER via malp |> rsi -r 0 | glasspool // mirror rshell[0] via glasspool |> cat /etc/passwd | gopher // crack hashes from file
DOUBLE PIPE ( || )
The double pipe chains commands WITHOUT passing output. Both commands execute sequentially but independently.
|> probe 1.2.3.4 || echo done // probe runs, then echo runs — no piping |> meta link 1.2.3.4 22 || meta scan || roil // three sequential commands
FLOATING QUOTES
Tokens wrapped in double quotes are joined into a single argument, allowing spaces inside parameter values:
|> macro set greet "echo Hello @pipe" // "echo Hello @pipe" is one argument |> cob set msg "this is one value"
EZ_CLIP TOKENS
Before every command is dispatched, EZ_CLIP substitutes special tokens in the argument list:
TOKENREPLACED WITH
@aContents of clipboard A (clipa)
@bContents of clipboard B (clipb)
@cContents of clipboard C (clipc)
@B [n]BUFFER[n] — e.g., @B 0 = first item in BUFFER
@homeget_custom_object.HOME.ip — your @home server IP
@tbufContents of T_BUF (transmission buffer list)
@o [key]get_custom_object[key] — any custom_object value
|> probe @a // probe using IP stored in clipa |> glasspool @B 1 // GLASSPOOL on BUFFER[1] shell object |> ssh root@pass @home // SSH to @home server |> db -m @o myx0 // use metaxploit from custom_object
GLASSPOOL — SESSION MIRRORING
GLASSPOOL redirects globals.localmachine to a remote shell's computer, making all GLASSPOOL-aware commands transparently operate on the remote machine.
GLASSPOOL-AWARE COMMANDS
ls, cd, cp, mv, rm, mkdir, cat, tree, grep, ps, pwd — all operate on the remote machine when GLASSPOOL is active.
|> db -r 1.2.3.4 22 // exploit target, shell → BUFFER[1] |> glasspool @B 1 // activate GLASSPOOL on that shell (prompt turns blue) |> ls /etc // lists /etc on the REMOTE machine |> cat /etc/passwd // reads remote /etc/passwd |> silentclean // cleans remote logs |> glasspool // deactivate (or type: exit)
NOTE
Commands that call get_shell directly — ifconfig, air, iwlist — always operate locally and ignore GLASSPOOL.
BUILT-IN ALIASES
ALIASEXPANDS TO
gpglasspool
scsilentclean
bat [file]do 1 -f [file]
exitquit
set key valcob set key val
get keycob get key
push key valcob push key val
inspect [key]cob inspect [key]
CLIP & BUFFER
5hell has two complementary storage systems: the CLIP clipboard (three named slots for quick scalar/object storage) and the BUFFER (an ordered list for any object type, primarily shells and files obtained during exploitation).
THE CLIPBOARD — clipa / clipb / clipc
Three clipboard slots (a, b, c) each store one value of any type. Access slots via EZ_CLIP tokens @a, @b, @c anywhere in a command.
CLIPBOARD |> clipa foobar // store string "foobar" in slot a |> echo @a // prints "foobar" |> clipa // return current value without changing it |> zap | clipa // pipe shell object into clipa |> glasspool @a // use stored object directly |> clipa @B 1 // store BUFFER[1] into clipa |> clipa @tbuf // store T_BUF list in clipa
ARITHMETIC OPERATIONS
When the stored value is an integer (or a string that parses to one), you can perform in-place arithmetic:
|> clipa 0 |> clipa ++ // increment → 1 |> clipa -- // decrement → 0 |> clipa += 10 // add 10 → 10 |> clipa -= 3 // subtract 3 → 7
SPECIAL VALUES
ARGUMENTEFFECT
-nSet slot to null
-zSet slot to integer 0
@ccStore the full command history as a string
@B [n]Store BUFFER[n] in this slot
@tbufStore the T_BUF list in this slot
THE BUFFER — Memory Alpha
BUFFER (globals.BUFFER) is a list that holds any type. It is seeded at startup with the local shell as BUFFER[0]. Every exploit result — shells, computers, files, strings — is pushed here by commands like db, zap, roil, and ssh.
BUFFER ACCESS |> malp // open the BUFFER management menu |> malp @B 1 // open malp on BUFFER[1] specifically |> malp -p someObject // push object to BUFFER without opening menu |> malp --export // return BUFFER contents as a list
MALP OBJECT HANDLERS
When you open an object in malp, it detects the type and presents a context menu:
OBJECT TYPEAVAILABLE ACTIONS
shell / pshell / ftpshellInfiltrate, SCP, silentclean, glasspool, rclean, rshell
computerFile operations, read/write, ps
fileOpen, edit, cat, SCP, delete
stringEcho, store to clip, write to file
listEnumerate, push to BUFFER, store to cob
map / functionDecompile with code, p_exe interactive caller
BUFFER WITH ENUM
|> tree -r /lib // returns list of all files in /lib |> malp --export | enum -a // push each item in BUFFER individually |> db -r 1.2.3.4 * // exploit all ports, shells go to BUFFER |> malp // browse results interactively
WORKFLOW TIP
@B 0 is always the local shell. After exploiting, results start at @B 1. Use malp to browse, or pipe directly: glasspool @B 1 to mirror the first obtained shell.
MACROS & SCRIPTS
5hell macros are named command chains stored persistently in get_custom_object.macros. They survive across sessions and nested launches. Fire a macro simply by typing its name at the prompt.
DEFINING MACROS
INLINE MACRO |> macro set greet "echo Hello @pipe" |> echo World | greet // output: Hello World |> macro set quickhack "probe @pipe | sphinx" |> quickhack 1.2.3.4 // probe 1.2.3.4 then open 5phinx |> macro set chain "meta link @pipe 22 || meta scan || roil"
MULTI-LINE MACRO FROM FILE
Load a .mac file where each line becomes a command in the chain:
MACRO FILE // ~/rkit/exploit.mac probe @pipe meta link @pipe 22 meta scan roil malp // Load it |> macro set exploit -f /root/rkit/exploit.mac |> exploit 1.2.3.4
THE @pipe PLACEHOLDER
Inside a macro body, @pipe is replaced with the argument passed when firing the macro (or the piped input from the previous command):
|> macro set scan "probe @pipe" |> scan 1.2.3.4 // @pipe → "1.2.3.4" |> echo 1.2.3.4 | scan // piped input also works as @pipe
MANAGING MACROS
|> macro list // list all defined macros |> macro -v greet // verbose: print chain before firing |> macro del greet // delete macro "greet" |> macro set greet "echo Hi" // update existing macro
PRIORITY NOTE
Macros take priority over commands of the same name. If a macro and a command share a name, the macro wins. Choose names that don't shadow built-in commands unless you intend to override them.
DO SCRIPTS — BATCH EXECUTION
do runs a command or a batch file N times. Each line in a batch file is executed as a full 5hell command with pipe support.
DO COMMAND |> do 5 "echo hello" // run echo 5 times |> do 1 -f /root/rkit/setup.mac // run batch file once |> bat /root/rkit/setup.mac // alias: same as do 1 -f
BATCH FILE FORMAT
BATCH FILE (setup.mac) # lines starting with # are comments (also | and -) kore --silent probe 1.2.3.4 meta link 1.2.3.4 22 meta scan roil @STOP ← SAFEWORD: breaks the loop immediately if reached silentclean kore --silent
FEATUREDESCRIPTION
@STOPSAFEWORD — placing this on any line immediately breaks the do loop
# / - / |Comment prefixes — these lines are silently skipped
Full pipesEach batch line supports the full pipe engine: probe @pipe | sphinx
N timesdo 10 "zap addr vuln" fires the same exploit 10 times
do.rc — AUTO-EXECUTED ON STARTUP
On every 5hell launch, globals._startup_resource_configuration checks for and executes a do.rc file automatically:
1. Checks ~/Config/do.rc first
2. Falls back to ~/rkit/do.rc
3. Decrypts if the file is binary+encrypted (using HOME.dorc_key)
4. Executes each non-comment line as a 5hell command
do.rc EXAMPLE # startup config kore --silent target 1.2.3.4 22 macro set ex "probe @pipe | sphinx" kore --override colorDefault <#00FF00FF> kore --silent
MACRO VS COMMAND PRIORITY TABLE
ORDERMECHANISMHOW
1stMacro expansionIf prompt[0] is in get_custom_object.macros, expands to macro call
2ndBuilt-in aliasesset/get/push/inspect/exit/sc/gp/bat are replaced before dispatch
3rdcommand map dispatchCalls command[name](arg1, arg2, arg3, arg4)
4thshell.launch fallbackSearches /bin and current path for a matching binary
EXPLOIT WORKFLOW
5hell's exploit system is built around the Grey Hack metaxploit library model. Libraries on remote ports expose memory/value pairs that overflow to yield shells, computers, or files. The workflow follows a consistent pattern regardless of target.
STEP 1 — PORT RECONNAISSANCE
Use probe to scan a target and populate the port map. Port colors indicate library status:
|> probe 1.2.3.4
PORT COLORS
Green = open port  |  Cyan = known lib in database  |  Gold = unknown lib
Red = closed/firewalled  |  Orange = no database found  |  Grey = no response
Set the target globally so subsequent commands don't need the IP:
|> target 1.2.3.4 22
STEP 2 — LINK THE METALIB
Link the MetaLib on the target port using meta link. This opens a net session, dumps the library, and stores it for exploitation:
|> meta link 1.2.3.4 22 // link a specific port |> meta // show linked MetaLib info
STEP 3 — SCAN FOR VULNERABILITIES
Scan the linked MetaLib to find exploitable addresses. Results are stored in globals.XPLOITS:
|> meta scan // scan → populates globals.XPLOITS // output: list of vulnerable addresses + vuln names
STEP 4 — EXPLOIT
Three options for firing exploits:
COMMANDBEHAVIOR
zap [addr] [vuln]Fire a single specific exploit. Result pushed to BUFFER.
roilFire ALL exploits in XPLOITS at once. All results pushed to BUFFER.
db -r [ip] [port]All-in-one: link + scan + exploit + database. Most efficient.
MANUAL FLOW |> meta link 1.2.3.4 22 |> meta scan |> roil |> malp // browse results in BUFFER AUTOMATED FLOW |> db -r 1.2.3.4 22 // does everything above in one command |> db -r 1.2.3.4 * // scan ALL open ports |> db -r * * // scan ALL ports at targetIP
BOUNCE EXPLOIT
Some router library vulnerabilities return a computer object. By passing a LAN IP as an inject value, that computer belongs to a machine inside the network — allowing you to target devices with no open ports:
|> db -r 1.2.3.4 0 -i 192.168.1.2 // bounce to 192.168.1.2 |> zap 0x00002934 kernel_router.so 192.168.1.2
5PHINX — THE TUI
5phinx is a full-screen TUI that wraps the entire exploit cycle in an interactive menu. It's the fastest way to hack when you don't need to script the flow:
|> sphinx 1.2.3.4 22 // launch 5phinx on specific target |> sphinx // use current targetIP:targetPort
5phinx menu steps: [1] Link MetaLib → [2] Fire all exploits (roil) → [3] View BUFFER results → [4] Interact with obtained objects.
HASH CRACKING — THE HASHIM WORKFLOW
After getting access to a target, gather password hashes and transmit them to your @home hashim server for cracking:
ON TARGET (via GLASSPOOL) |> glasspool @B 1 // mirror shell |> tree / 0 r // recursive tree: buffer hashes to T_BUF |> tdump // write T_BUF to ~/pass TRANSMIT TO @HOME |> transmit // SSH to @home, write hashes to sharedfile ON @HOME (separate session) |> hashim -d // start hashim daemon // hashim monitors sharedfile, cracks hashes with t5/tp tables // writes cracked passwords to dump.txt
DATABASE — db WRITES RESULTS
The db command writes all scan/exploit results to ~/rkit/database.csv. Future runs against the same lib version skip the scan entirely. Load saved results without rescanning:
|> linkdb 1.2.3.4 22 // load XPLOITS from database, no net_use needed |> roil // fire immediately
CUSTOM OBJECT / cob
get_custom_object is a Grey Hack built-in that provides a persistent shared-memory map available across all nested shell.launch calls. 5hell stores macros, @home config, rainbow tables, session exports, and password dictionaries here. The cob command is the full interface to this store.
BASIC OPERATIONS
SET / GET |> cob set myvar hello // store string |> cob get myvar // → "hello" |> set myvar hello // alias: same as cob set |> get myvar // alias: same as cob get |> cob set count 0 // store string "0" |> cob set count @z // store integer 0 (not string) |> cob set nothing @n // store null |> cob set opts {} // create empty map |> cob set targets [] // create empty list
DOT-SYNTAX FOR NESTED ACCESS
Dot notation traverses nested maps and lists. The parent key must already exist as a map/list:
|> cob set config {} |> cob set config.ip 1.2.3.4 |> cob set config.port 22 |> cob get config.ip // → "1.2.3.4" |> cob set hosts [] |> cob push hosts 1.2.3.4 // append to list |> cob push hosts 5.6.7.8 |> cob get hosts.0 // → "1.2.3.4" (list index 0)
INSPECTION & DELETION
|> cob inspect // print all keys + truncated values |> cob inspect config // print just the config map |> cob indexes // return all keys as a list |> cob del myvar // delete a key |> cob purge // ⚠ clear the ENTIRE custom_object |> cob validate // ensure macros/stack_pool/HOME keys exist
INSTALLING FUNCTIONS AS COMMANDS
Store a function in cob, then install it as a live command reachable from the prompt:
// In a .5pk or do.rc: get_custom_object.myTool = function(arg1, arg2, arg3=0, arg4=0) print "myTool called with: " + arg1 end function // In 5hell: |> cob install myTool // now "myTool" works as a command |> myTool hello
@HOME CONFIGURATION
The HOME map in cob stores your @home hashim server config. Use set HOME.key value to update any field:
KEYDEFAULTPURPOSE
HOME.ipSSH/rshell server public IP
HOME.loginport22SSH port
HOME.rshellport1222Reverse shell port
HOME.userrootSSH username
HOME.passSSH password
HOME.sharedfile/root/passHash swap file for hashim
HOME.database/root/rkit/database.csvExploit database path
HOME.dorc_key0Decryption key for do.rc (0 = no encryption)
|> set HOME.ip 1.2.3.4 |> set HOME.pass MyPass123 |> get HOME.ip // → "1.2.3.4" |> echo @home // @home EZ_CLIP token → HOME.ip value
SESSION EXPORTS (myx0 / mys0 / myc0)
On startup and at each nested launch depth, 5hell exports its core objects to cob for access across sessions. The suffix increments with nesting depth (0 = top level, 1 = one launch deep, etc.):
KEYTYPECONTENT
myx0MetaxploitLibLocal metaxploit library
myc0cryptoLibLocal crypto library
mys0shellLocal shell object
myi0string"pubIP : localIP"
myx1MetaxploitLibNested session 1 metaxploit
mys1shellNested session 1 shell
|> db -M // use myx0 automatically (no re-import) |> clipa @o mys1 // get nested session shell into clipa |> glasspool @o mys0 // GLASSPOOL on the cob-stored home shell |> db -m @o myx0 // explicit: use myx0 as metaxploit
WHY THIS MATTERS
When running 5hell inside a compromised target via infil, the session exports let you reference your original home shell and metaxploit from the nested context without re-importing or reconnecting.

5HELL Tool Created By: @PLU70

Hacktool Documentation Portal

ONLINE
GREY HACK
v0.0.836
HEX
GREY HACK HACKTOOL — COMMAND REFERENCE
HEX v0.0.836 by @redit0. Architecture C penetration framework using get_custom_object as persistent state. Three dispatch maps (g.tools / g.util / g.fs), context stack navigation, proxy chains, and full nuke operations.
35
COMMANDS
3
CATEGORIES
6
GUIDE SECTIONS
L
LOCAL SOURCE
QUICK ACCESS
▶ GETTING STARTED
Install, setup, InsecureLibs, proxy config, first run.
▶ ARCHITECTURE
get_custom_object state, dispatch maps, Result & Exploit objects.
▶ SESSION STACK
g.Target prototype, context navigation, swap and jump.
▶ EXPLOIT WORKFLOW
scan → hack → decipher. Exploit object, Result pattern.
▶ PROXY CHAIN
Multi-hop SSH proxies, proxy command, auto-routing.
▶ NUKE OPERATIONS
Hard nuke, soft nuke, mail nuke, network-wide net ops.
EXPLOIT CHAIN
scan [ip] [port]
hack [ip] [port]
swap [index]
decipher
log -a
COMMANDS
Getting Started
Requirements
HEX requires the following before exploitation commands will function:
PATHPURPOSE
/root/InsecureLibs/init.soInsecure lib for poison and LAN bounce exploits
/root/SecureLibs/librshell.soRequired for rshell start
1. OBTAIN HEX
HEX source is available on GitHub. Clone or download the repository to get all GreyScript source files:
GITHUBhttps://github.com/redit0/hex-tool
2. REQUIRED LIBRARIES
HEX uses metaxploit.so and crypto.so. These are loaded automatically at startup if available in the system. Ensure they're installed:
apt-get addrepo [HACKSHOP_IP] apt-get update apt-get install metaxploit /lib apt-get install crypto /lib
3. INSTALL GREYBEL-VS
Recommended compilation method: Open VS Code and install the Greybel VS extension from the marketplace (search greybel-vs). Open the hex-tool folder in VS Code, then open src/hex.src and run Greybel: Build file from context. Compiled output will be saved to the build/ folder.
4. OPTIONAL: SETUP MESSAGE HOOK (FOR AUTO-IMPORT)
To enable automatic file creation and compilation directly in-game, install the Message Hook.dll — a BepInEx plugin that bridges VS Code and Grey Hack. This step is optional — you can use the Installer mode instead if you prefer.
1. Download BepInEx v5.4.23.2 from GitHub and extract it into your Grey Hack game folder (where Grey Hack.exe is located)
2. Download GreyHackMessageHook5.dll and place it in BepInEx/plugins/
3. Launch Grey Hack via Steam — BepInEx initializes automatically on Windows
Alternatively, for newer systems (less stable): Download BepInEx 6.0.0-pre.2 Unity.Mono, extract to your game folder, place GreyHackMessageHook.dll in BepInEx/plugins/, and launch Grey Hack.
5. BUILD OPTIONS
OPTION A — GREYBEL AUTO-IMPORT (RECOMMENDED WITH MESSAGE HOOK)
If you installed BepInEx above, configure VS Code settings to enable automatic file creation in-game:
GREYBEL-VS SETTINGSCreate in-game > Active: true Create in-game > Auto Compile: true (optional) Transpiler > In-game Directory: /root/
When you build in VS Code, files are automatically created and compiled in-game. No manual copy-paste needed.
OPTION B — GREYBEL INSTALLER (NO HOOK REQUIRED)
If you don't have BepInEx installed, use Installer mode:
GREYBEL-VS SETTINGSGreybel > Transpiler > Installer > Active: true Installer > Auto Compile: true (optional)
Build the project — Greybel generates installer `.src` files. Copy-paste each installer file's code into the Grey Hack script editor and compile. Run the installers in order to recreate the entire project in-game.
FILE SIZE LIMIT
If an installer exceeds ~160,000 characters, Greybel splits it automatically. Compile all installers in order.
OPTION C — MANUAL IN-GAME BUILD
Copy source files from the repository into /root/src on your in-game machine. From a root terminal, compile:
cd /root/src build hex.src /root/
6. LAUNCH HEX
Once compiled, move the binary to /bin/ for easy access, then launch:
hex
On first launch, HEX initializes all get_custom_object namespaces, loads the color system, registers built-in type extensions, and attaches local metaxploit and crypto libs if available.
7. CONFIGURE GAME MODE
Edit src/hex/constants.src and uncomment the block matching your game mode. Rebuild after any changes:
constants.src — OPTIONS// Multiplayer (default) g.const.insecureComp = ["/root/InsecureLibs/init.so", "1.0.0", "0x32E65B93", "indopositionx"] // Nightly build servers // g.const.insecureComp = ["/root/InsecureLibs/init.so", "1.0.2", "0x7D6EE022", "stconobjecttransf"] // Singleplayer // g.const.insecureComp = ["/root/InsecureLibs/net.so", "1.0.0", "0x18EBA092", "redit0"]
MULTIPLAYER UPDATES
After any Grey Hack multiplayer update, verify that the g.const.insecureComp values match the current version. Mismatched exploit constants will cause poison and net operations to fail. Update and rebuild as needed.
8. POPULATE INSECURE LIBRARIES
HEX uses vulnerable library files for exploitation. Create the following folders on your home computer and populate them with matching library versions:
DIRECTORY SETUPmkdir -p /root/InsecureLibs mkdir -p /root/SecureLibs
InsecureLibs
Populate /root/InsecureLibs/ with vulnerable .so files matching the versions configured in constants.src. These files are uploaded to target systems via the poison command to enable further exploitation.
SecureLibs
Populate /root/SecureLibs/ with librshell.so. This is required to use the rshell start command.
9. PROXY CONFIGURATION (OPTIONAL)
HEX can pre-load proxies from two sources. Proxies are loaded automatically during proxy initialization:
Environment Variables (Greybel-VS Only)
Configure in Greybel-VS transpiler environment variables:
GREYBEL-VS TRANSPILER ENV#envar proxies = [["1.2.3.4", 22, "user", "pass"], ["5.6.7.8", 22, "user2", "pass2"]]
Map.conf Files
Create Map.conf files anywhere in the filesystem. HEX auto-scans the current file tree and loads proxy entries during proxy initialization. JSON format:
Map.conf[["1.2.3.4", 22, "user", "pass"], ["5.6.7.8", 22, "user2", "pass2"]]
TIP
Map.conf files are easier to manage than environment variables — store them in standard locations like /root/ and HEX will find them automatically.
10. GREYBEL BUILD TYPES
Configure the build output format in VS Code settings under Greybel > Transpiler > Build Type:
MODEDESCRIPTION
DefaultNo transformation; best general-purpose output
UglifyNOT SUPPORTED — HEX will not work if uglified
BeautifyFormats code for readability (slower execution)
BUILD TYPE WARNING
Do not use the Uglify build type. HEX is not compatible with minified output. Always use Default or Beautify.
Architecture Overview
Architecture C: get_custom_object
HEX uses Architecture C — all persistent state lives on get_custom_object (referenced as g). State survives nested shell.launch calls without using globals.*. All namespaces are initialized at startup with hasIndex guards.
STATE INITg = get_custom_object if not g.hasIndex("tools") then g.tools = {} if not g.hasIndex("util") then g.util = {} if not g.hasIndex("fs") then g.fs = {} if not g.hasIndex("func") then g.func = {} if not g.hasIndex("stack") then g.stack = {} if not g.hasIndex("context") then g.context = {}
Dispatch Maps
MAPPURPOSECOMMANDS
g.toolsExploitation & reconscan, nmap, hack, decipher, rshell, poison, net, sniffer
g.utilUtility commandsstack, swap, jump, proxy, log, tree, apt-get, terminal, lockdown
g.fsFilesystem operationscd, rm, ps, kill, reboot
Result Object
HEX uses a Result object for all return values. Check .success before using .data:
RESULT PATTERNr = Result.New(success, data, output) // success: 1 = ok, 0 = fail | data: payload | output: message if not r.success then print r.output return end if // use r.data
Exploit Object
The Exploit class wraps a single metaxploit overflow. Used internally by scan and hack:
EXPLOIT OBJECTe = Exploit.New(metaLib, "0x32E65B93", "indopositionx") r = e.Overflow() // optional extra arg for inject value if r.success then shell = r.data // shell / computer / file object user = e.result.user end if
Color System
Colors are stored in g.colors as hex strings. Each key auto-generates a formatter at g[key](str):
KEYSSHADEUSE
b1 – b5BluePrimary UI, commands
s1 – s4Slate / purpleSecondary elements
r1RedErrors, root user indicator
o1OrangeWarnings
g1 – g2GreenSuccess, exploit hits
l1 – l3Light / tanFilenames, hostnames, labels
y1YellowAlert warnings
COLOR USAGEg.b3("text") // → "<color=#37b3cc><b>text</b></color>" g.error("message") // → g.r1(" [Error] message") g.func.format(str, ["u", "size=90%"]) // wrap with extra tags
Session Stack
Context Stack Overview
HEX maintains a context stack in g.stack — a map keyed by string integers ("0", "1", ...). The active context index is stored at g.context.index. Index "0" is always the home context.
STACK ACCESSg.stack["0"] // home context (always index "0") g.context.index // current active index (string) g.stack[g.context.index] // active context object
g.Target Fields
FIELDTYPEDESCRIPTION
typestring"shell" | "computer" | "file"
sourcestringHow acquired: "home", "overflow", "proxy (N)"
shellshellShell object (populated when type == "shell")
computercomputerComputer object
filefileWorking directory file object
userstringResolved username
currentPathstringActive working path (default "/")
metaxmetaLibAttached metaxploit lib
cryptocryptoLibAttached crypto lib
public / localstringPublic and LAN IP strings
Navigating the Stack
NAVIGATION COMMANDSstack // display all contexts in the stack swap 1 // switch active context to index 1 swap 0 // return to home context stack -c // clear all non-home stack entries
Creating Contexts
New contexts are added automatically by hack when an exploit succeeds. You can also create one manually from any shell/computer/file object using the registered extension:
CREATE CONTEXTctx = someShellObject.createContext("overflow") ctx = someComputerObject.createContext("bounce") newIdx = g.stack.add(ctx, 1) // add; returns new index string
Validation Helpers
VALIDATIONg.func.checkShell(idx) // returns 1 if g.stack[idx].shell is valid g.func.checkMetax(idx) // returns 1 if metax lib is still valid g.func.checkMetax(idx, 1) // silent check (no error print)
BUILT-IN EXTENSIONS
HEX registers helper methods on built-in types at startup. Any shell, computer, or file object gains: .getUser(), .getType(), .getPublic(), .getLocal(), .createContext(source). Calling getType() on a home computer returns "home" (detected via Xorg process).
Exploit Workflow
Standard Flow
scan [ip] [port]
hack [ip] [port]
swap [n]
decipher
log -a
scan
scan opens a net session on the target port, dumps the running lib, scans all memory addresses, and caches exploitable vulnerabilities into g.database. Results are grouped by lib/address and displayed with color-coded access levels.
SCANscan 1.2.3.4 22 // scan specific port scan 1.2.3.4 // scan all open ports scan init.so // scan a local lib by filename
hack
hack fires all cached exploits from g.database against the target. Each successful overflow wraps the result in a g.Target and pushes it onto the stack. Use swap to navigate to the new context.
HACKhack 1.2.3.4 22 // exploit port; add results to stack hack 1.2.3.4 // exploit all ports hack -l init.so // exploit a local lib hack -l 192.168.1.1 // LAN bounce via local IP (requires poison first)
decipher
Decrypts credentials on the current context's computer. Operates on /etc/passwd hashes and optionally on bank/mail credential files:
DECIPHERdecipher // crack /etc/passwd hashes on current context decipher all // crack passwd + bank + mail files decipher bank // crack bank password only decipher mail // crack mail password only decipher hash // interactive: enter hash manually
Vulnerability Database
Scan results are cached in g.database so hack can fire without a repeat scan. Cache persists across sessions via get_custom_object:
DATABASE STRUCTUREg.database[libName][version][address][value] = resultType // resultType: "shell" | "computer" | "file" | "" (untested yet)
LAN BOUNCE
When attacking a router (port 0), use hack -l [lanIP] to exploit via LAN bounce using the insecure lib at g.const.insecureComp. Requires poison to first upload the insecure lib to target's /lib/.
VERSION MISMATCH
The constants at g.const.insecureComp / g.const.insecureShell are version-specific. After any Grey Hack update, re-verify these values before running poison or net.
Proxy Chain
Overview
HEX supports multi-hop proxy chains via SSH. When a proxy is active, scan and hack automatically route all non-LAN operations through it, keeping your home IP out of target logs.
Loading Proxies
SOURCEFORMATLOAD TIME
$proxies env varJSON list: [ip, port, user, pass][]At startup
Map.conf filesScanned from current filesystemDuring proxy initialization (g.func.getMap)
proxy Command
PROXYproxy help // show command usage proxy 1 // activate stack index 1 as the proxy hop proxy -s // connect through all configured $proxies in sequence proxy -c // corrupt logs on all active proxy hops proxy -d // disconnect all proxies and remove from stack
Proxy Chain Flow
home
proxy hop 1
proxy hop 2
target
Manual Proxy Setup
INTERNAL API// Add a hop manually (connects via SSH, optionally activates metaxploit) g.func.add_proxy("1.2.3.4", 22, "user", "pass", 1) // final=1 → activates metaxploit on this hop and sets as g.proxy // Promote an existing stack entry to proxy role g.func.set_proxy("2") // stack index "2" becomes the active proxy
CLEANUP ORDER
Always run proxy -c before proxy -d to corrupt logs on all proxy hops before disconnecting. Or use g.func.clean_proxies(1) to do both in one call.
Nuke Operations
DESTRUCTIVE — IRREVERSIBLE
Nuke operations cannot be undone in-game. A hard nuke renders a target system permanently unbootable. Always verify the active context before running any nuke command.
Nuke Levels
LEVELFUNCTIONEFFECT
Hard Nukeg.func.nuke_hard(file)Delete /lib, /sys, /boot — system unbootable
Soft Nukeg.func.nuke_soft(file)Prepend "_" to all files — binaries unexecutable
Mail Nukeg.func.nuke_mail(file)Clear Mail.txt, Bank.txt, passwd files
net Command — Network-Wide Operations
The net command coordinates operations across multiple targets simultaneously:
NETnet -a // map entire network (build computer list) net -b // full sweep: scan + hack all reachable hosts net -l // list all discovered network computers net -m // multi-decipher on all context stack entries net -n // nuke all stack entries (hard nuke) net -nm // nuke + mail wipe on all stack entries net -p // poison all stack entries (upload insecure libs) net -s // sniffer capture then stop net -z // corrupt logs on all stack entries
Log Cleanup
After any operation, corrupt logs to remove your traces. The log command operates on the current context:
LOGlog // corrupt log on current context log -a // corrupt logs on ALL stack entries log -d // delete (not just corrupt) log on current context
LOCKDOWN
lockdown is the defensive counterpart to nuke — it secures the current context by removing world/group write permissions on critical files and deleting guest credentials. Use on your home system or on captured targets you intend to hold.

HEX Tool Created By: @REDIT0

Hacktool Documentation Portal

LEGACY
GREY HACK
⚠ DEPRECATED — ARCHIVE REFERENCE ONLY
Viper 3.0 is no longer actively maintained. This documentation is preserved as an architectural reference for the ExtensionMediator (Architecture A) pattern. Do not use Viper 3.0 as a foundation for new hacktools — consider 5hell (Architecture B) or HEX (Architecture C) instead.
VIPER
GREY HACK HACKTOOL — ARCHITECTURE REFERENCE
Viper 3.0 by @cantemizyurek. Architecture A — ExtensionMediator dependency injection framework with typed sessions, structured commands, parameter validation, UI/theme layer, and macro system.
0
COMMANDS
5
CATEGORIES
4
GUIDE SECTIONS
DEPRECATED
REFERENCE
▶ ALL COMMANDS
Browse all Viper 3.0 commands across filesystem, network, exploit, session, and system categories.
▶ OVERVIEW & ARCHITECTURE
ExtensionMediator DI pattern, project structure, manager wiring.
▶ SESSION SYSTEM
Session types, session manager, navigation, handler interface.
▶ COMMAND SYSTEM
Command registration, parameter types, permission levels.
▶ UI & THEME
ThemeManager, colorText(), macro system, config persistence.
COMMANDS
Overview & Architecture
DEPRECATED
Documented for historical reference. Viper 3.0 is no longer actively maintained.
Architecture A: ExtensionMediator
Viper uses a dependency injection bus called ExtensionMediator. All managers are registered on a single mediator object and communicate exclusively through it — no direct manager-to-manager references.
MEDIATOR WIRINGmediator = ExtensionMediator.New() mediator.addExtension("commandManager", CommandManager.New()) mediator.addExtension("sessionManager", SessionManager.New()) mediator.addExtension("themeManager", ThemeManager.New()) mediator.addExtension("macroManager", MacroManager.New()) mediator.addExtension("configManager", ConfigManager.New()) mediator.addExtension("libManager", LibManager.New()) // Access from any manager: sessionMgr = self.mediator.getExtension("sessionManager")
Project Structure
FILE / FOLDERPURPOSE
main.srcEntry point: imports, init(), main loop
mediator.srcExtensionMediator (DI bus)
commands.srcAll Command registrations
managers/command/CommandManager, Command, Parameter type definitions
managers/session/SessionManager, Session factory, handler types
managers/ui/UI print/display logic (tables, prompt, splash)
managers/theme/ThemeManager — hex color map, colorText() helper
managers/macro/MacroManager — load and execute macros from files
managers/config/ConfigManager — load/save JSON config to disk
managers/lib/LibManager — cache metaxploit/crypto lib handles
libs/error.srcError object — never use raw strings for errors
Error Object Pattern
Never propagate errors as raw strings. Always use the Error object and check with isa Error:
ERROR PATTERNresult = someManager.doThing(params) if result isa Error then print result.message return end if // success — use result
Singleton Pattern
All managers use a singleton guard to prevent duplicate instantiation:
SINGLETONMyManager = {} MyManager.singleton = null MyManager.New = function() if MyManager.singleton != null then return MyManager.singleton result = new MyManager MyManager.singleton = result return result end function
Session System
Session Types
Sessions wrap raw Grey Hack handler objects in a normalized interface so commands don't need to care which underlying type they're operating on:
TYPESOURCECOVERS
ShellSessionget_shell() / SSH connectshell + computer access
ComputerSessionshell.host_computercomputer-level access only
FileSessioncomputer.File(path)file/folder operations only
Session Manager API
SESSION MANAGER// Add a session — type is auto-detected sessionManager.addSession(get_shell()) // ShellSession sessionManager.addSession(someComputer) // ComputerSession // Navigate sessionManager.setCurrentSession(0) sessionManager.goBack() // pop session chain // Access current session handler handler = sessionManager.currentSession.handler handler.type() // "shell" | "computer" | "file" handler.privilege() // "root" | "user" | "guest" handler.user // username string
Handler Interface
Every session handler exposes a consistent interface regardless of the underlying object type:
HANDLER METHODShandler.getFile(path) // → file facade or Error handler.getFiles(path) // → list of file facades or Error handler.createFile(path, name) // → file or Error handler.createFolder(path, name) // → 1 or Error handler.deleteFile(path) // → 1 or Error handler.runBinary(path, params) // → output or Error
PERMISSION SYSTEM
The privilege() method on a handler returns "root", "user", or "guest". Commands declare their required privilege in their permission definition, and the CommandManager enforces this before the callback is called.
Command System
Defining a Command
Commands are registered on the CommandManager using the Command.New() factory. Each command declares its name, description, typed parameters, required permissions, and a callback function.
COMMAND DEFINITIONmyCmd = Command.New({ "name": "ls", "description": "List files in current directory", "parameters": [ Parameter.New({ "name": "path", "required": false, "type": PARAMETER_TYPES.STRING, "default": "." }) ], "permissions": { "object": "file", "privilege": "guest" }, "callback": function(params, mediator) sessionManager = mediator.getExtension("sessionManager") // ... use params.path end function }) commandManager.registerCommand(myCmd)
Parameter Types
CONSTANTBEHAVIOR
PARAMETER_TYPES.STRINGAny string value; passed through as-is
PARAMETER_TYPES.NUMBERConverts via to_int(); errors if non-numeric
PARAMETER_TYPES.BOOLEANAccepts "true" / "false" strings
PARAMETER_TYPES.FLAGPresent = true, absent = false
PARAMETER_TYPES.OPTIONSMust match a key from a declared options map
PARAMETER_TYPES.RESTConsumes all remaining args as a single string
Permission Levels
Object Level (most → least permissive)
LEVELCOVERS
"file"Any session type — file, computer, or shell
"computer"Computer sessions and shell sessions
"shell"Shell sessions only
Privilege Level (most → least permissive)
LEVELCOVERS
"guest"guest, user, and root users
"user"user and root users
"root"root only
UI & Theme
ThemeManager
All output text is colored through the ThemeManager. Never hardcode color strings — always call colorText() with a theme color constant.
THEME COLORSthemeManager = mediator.getExtension("themeManager") colored = themeManager.colorText(THEME_COLORS.INFO, "some text") error = themeManager.colorText(THEME_COLORS.ERROR, "failed!") success = themeManager.colorText(THEME_COLORS.SUCCESS, "done")
Macro System
Macros are plain text files stored in Config/Macros/, one command per line. The MacroManager loads and executes them through the command pipeline, applying the same parameter parsing and permission checks as interactive input.
MACRO FILE (Config/Macros/mymacro.txt)ls /root cd /root ls // Execute from the tool prompt: @mymacro
Config Persistence
The ConfigManager loads and saves settings as JSON at Config/<toolname>-config.json in the user's home directory. Config is loaded once at startup and saved explicitly on write.
CONFIGconfigManager = mediator.getExtension("configManager") value = configManager.get("mySetting") configManager.set("mySetting", "newValue") configManager.save() // serialize and write to disk
Library Manager
The LibManager caches metaxploit and crypto lib handles for the current session, so commands don't need to call include_lib themselves.
LIB MANAGERlibManager = mediator.getExtension("libManager") mx = libManager.getMetaxploit() // → metaxploit lib or null crypto = libManager.getCrypto() // → crypto lib or null
OOP PATTERN
GreyScript has no class keyword. Architecture A uses map-based prototype objects with .New() factories and inherits via new BaseType. The isa operator checks prototype ancestry for type guards.

VIPER 3.0 Created By: @cantemizyurek

Hacktool Documentation Portal

ONLINE
GREY HACK
5HELL
GREY HACK HACKTOOL — COMMAND REFERENCE
A comprehensive reference for all 5SHELL commands and features. Use the sidebar to browse commands by category or search for specific commands. Navigate guides for in-depth tutorials.
100+
COMMANDS
8
CATEGORIES
6
GUIDE SECTIONS
LOCAL
SOURCE AVAILABLE
COMMANDS
ONLINE
GREY HACK
HEX
GREY HACK HACKTOOL — COMMAND REFERENCE
A comprehensive reference for all HEX commands and features. Use the sidebar to browse commands by category or search for specific commands. Navigate guides for in-depth tutorials.
20+
COMMANDS
3
CATEGORIES
6
GUIDE SECTIONS
LOCAL
SOURCE AVAILABLE
COMMANDS
⚠ DEPRECATED TOOL
ONLINE
GREY HACK
VIPER
⚠ DEPRECATED TOOL
GREY HACK HACKTOOL — COMMAND REFERENCE
Architecture reference for the ExtensionMediator pattern. VIPER is deprecated and no longer maintained — provided for reference only.
0
COMMANDS
5
CATEGORIES
4
GUIDE SECTIONS
DEPRECATED
COMMANDS
ONLINE
GREY HACK
MINISCRIPT FORK
GREYSCRIPT
THE GREY HACK SCRIPTING LANGUAGE — FULL REFERENCE
GreyScript is a fork of MiniScript with a full in-game API for shells, computers, networks, files, and services. Scripts run as compiled Grey Hack binaries or as interactive commands in hacktools. File size limit: 160,000 characters.
REFERENCE SECTIONS
LANGUAGE BASICS
Types, operators, variables, string ops, type checking.
CONTROL FLOW
if/else, while, for, break, continue, functions, scopes.
OOP PATTERNS
Map-based classes, New() factory, inheritance, isa.
BUILT-IN INTRINSICS
Global functions: math, string, list, map, I/O, time.
SHELL & COMPUTER API
shell, computer, file objects — full method reference.
NETWORK & PORTS
router, port, netSession, nslookup, whois.
METAXPLOIT
metaxploit, metaLib, debugLibrary — exploit reference.
BLOCKCHAIN & CRYPTO
blockchain, wallet, coin, subwallet, crypto library.
COMMON PATTERNS
Error handling, SSH connect, file ops, exploitation loop.
KEY LANGUAGE NOTES
IMPORTANT GOTCHAS
All numerics are doubles. Booleans are 1 (true) and 0 (false). No try/catch — check return values explicitly. No class keyword — use map-based prototypes with .New() factories. Functions are always called without parentheses — use @ to get a reference without calling.
QUICK REFERENCEtypeof myVar // "number" | "string" | "list" | "map" | "function" | "null" myVar isa string // 1 or 0 @myFunc // reference without calling get_custom_object // persistent state across shell.launch calls active_user // current username string params // list of CLI args when running as a command
Language Basics
Data Types
TYPENOTESEXAMPLE
numberAll numerics are doubles. Booleans are 1/0.42, 3.14, 1, 0
stringUnicode, double quotes only."hello world"
listOrdered, zero-indexed.["a", "b", "c"]
mapKey-value pairs (dictionary).{"key": "value"}
functionFirst-class values.function(x) ... end function
nullAbsence of a value.null
Operators
Numbers
2 ^ 4 // 16 (power) 7 % 3 // 1 (modulo) a and b // logical AND → 1 or 0 a or b // logical OR → 1 or 0 not a // logical NOT → 1 or 0 a == b // equality a != b // inequality
Strings
"hello" + " world" // concatenation → "hello world" "test" - "est" // removal → "t" "ab" * 3 // repeat → "ababab" "hello"[1:4] // slice → "ell" "hello"[0] // index → "h"
Lists
["a"] + ["b"] // concat → ["a","b"] ["x"] * 2 // repeat → ["x","x"] myList[0] // index myList[1:3] // slice
String Methods
s.len // length s.lower / s.upper // case conversion s.trim // strip whitespace s.code // char code of first character s.val // parse as number → 0 if non-numeric s.to_int // parse as integer → original string if non-numeric s.split(",") // → list; optional 2nd arg: regex option ("i","m","s","n","x") s.replace("pat", "new") // regex replace → string s.replace_regex("pat","new") // explicit regex replace (same as replace on strings) s.indexOf("x") // → number or null (first occurrence) s.indexOf("x", after) // → number or null (start search after this index) s.lastIndexOf("x") // → number — last occurrence position s.is_match("^Hello") // regex match → 1 or 0 s.matches("\\w+") // → map of {startIndex: matchString} for all matches s.insert(3, "!") // → string — insert at character index s.remove("x") // → string — remove first occurrence of substring s.hasIndex(n) // → 1 or 0 — check if character index exists s.indexes // → list of character indices [0, 1, 2, ...] s.values // → list of individual characters
List Methods
myList.push("item") // append → list myList.pop // remove + return last item myList.pull // remove + return first item myList.insert(1, "x") // insert at index → list myList.remove(n) // remove item at index n → null myList.replace(old, new) // replace all matching values → list myList.replace(old, new, max) // replace up to max occurrences → list myList.sort // sort in-place ascending → null myList.sort(key) // sort list-of-maps by field name → null myList.sort(key, asc) // asc: 1 = ascending (default), 0 = descending → null myList.reverse // reverse in-place → null myList.shuffle // randomize in-place → null myList.indexOf("x") // → index or null (first match) myList.indexOf("x", after) // → index or null (start search after this index) myList.hasIndex(n) // → 1 or 0 — check if index exists myList.len // length myList.sum // → sum of all numeric values myList.values // → returns the list itself myList.join(", ") // → string
Map Methods
myMap.hasIndex("key") // → 1 or 0 — check if key exists myMap.indexOf(value) // → key whose value matches, or null myMap.indexOf(value, after) // → key after the given key, or null myMap.indexes // → list of all keys myMap.values // → list of all values myMap.len // → number of entries myMap.remove("key") // delete entry → 1 (found) or 0 (not found) myMap.push("tag") // add key with value 1 (set-like insertion) → map myMap.pop // remove and return the first key myMap.pull // remove and return the first key (alias of pop) myMap.sum // → sum of all numeric values myMap.shuffle // randomize key order in-place → null myMap.replace(old, new) // replace all values matching old with new → map myMap.replace(old, new, max) // replace up to max occurrences → map
TIP
Maps support the + operator for merging: {"a": 1} + {"b": 2}{"a": 1, "b": 2}. Duplicate keys are overwritten by the right operand.
Rich Text Output
GreyScript's terminal supports TextMeshPro rich text tags in any printed string:
"<color=#00FF00FF><b>green bold</b></color>" "<color=red>error!</color>" "<size=75%>smaller text</size>" "<u>underlined</u>" "<mark=yellow>highlighted</mark>" "<noparse>raw text</noparse>"
Control Flow
If / Else
if x > 0 then print "positive" else if x < 0 then print "negative" else print "zero" end if // Single-line form: if x > 0 then print "positive"
While Loop
i = 0 while i < 10 print i i = i + 1 end while
For Loop
for i in range(0, 9) print i end for for item in myList print item end for for key in myMap.indexes print key + ": " + myMap[key] end for
Break & Continue
for i in range(0, 10) if i == 5 then break // exit loop if i == 3 then continue // skip to next iteration print i end for
Functions
myFunc = function(a, b = "default") return a + b end function myFunc("hello") // "hellodefault" myFunc("hello", " world") // "hello world" // @ operator — reference without calling ref = @myFunc ref("test") // calls myFunc("test")
Scopes
// Each function has its own local scope globals.x = 42 // write to global scope from anywhere outer.x = 42 // write to enclosing function's scope locals.x = 42 // explicitly target local scope // Example: closure with outer factory = function locals.count = 0 inc = function outer.count = outer.count + 1 return outer.count end function return @inc end function
exit & print
print "message" // output to terminal print("message") // also valid (with parens) exit "error message" // terminate with message exit // terminate with no message print(output, 1) // 1 = clear screen before printing (live dashboards)
OOP Patterns
Map-Based Class
GreyScript has no class keyword. Define a prototype map and use a New() factory:
MyClass = { "classID": "myClass", "counter": 0 } MyClass.init = function(startVal) self.counter = startVal end function MyClass.inc = function self.counter += 1 return self end function // Instantiate instance = new MyClass instance.init(10) instance.inc.inc // chaining print instance.counter // 12
New() Factory Pattern
MyClass.New = function(startVal) result = new MyClass result.counter = startVal return result end function obj = MyClass.New(5)
Inheritance
MySubClass = new MyClass MySubClass.classID = "mySubClass" MySubClass.describe = function return "Counter: " + super.counter end function sub = new MySubClass print sub isa MyClass // 1 — true print sub isa MySubClass // 1
Extending Built-In Types
Register methods directly on map, string, or list — they become available on every instance of that type, including all Grey Hack game objects:
// Add a method to all strings string.trimEnd = function(text) if self[-1*text.len:] == text then return self[:-1*text.len] return self end function // Add a method to all maps (works on shell, computer, file objects too) map.getPublicIP = function if typeof(self) == "shell" then return self.host_computer.public_ip if typeof(self) == "computer" then return self.public_ip return null end function // Add a method to all lists list.distinct = function seen = {} i = 0 while i < self.len key = str(self[i]) if seen.hasIndex(key) then self.remove(i) else seen[key] = 1 i += 1 end if end while return self end function
REGISTER EARLY
Always register built-in type extensions once at startup before any code uses them. Extensions are available globally for the rest of the session once registered.
Built-in Intrinsics
I/O & Control
FUNCTIONRETURNS
print(value)Output to terminal
print(value, 1)Clear screen then print (live mode)
clear_screenClear terminal
user_input(prompt, isPassword, anyKey, addToHistory)string — read user input
exit(code)Terminate script
wait(seconds)Pause execution
yieldWaits for the next tick.
Type & Conversion
FUNCTIONRETURNS
typeof(value)"number" | "string" | "list" | "map" | "function" | "null" | "etc...", Custom types can be added as well by using the classID property in a map
str(value)Convert to string
char(code)Char from ASCII/Unicode code
code(char)ASCII/Unicode code of first char
hash(value)Numeric hash of any value → number
Math
FUNCTIONRETURNS
abs(n)Absolute value
sign(n)Sign of number → -1, 0, or 1
ceil(n) / floor(n)Round up / down
round(n, decimals)Round to N decimal places (decimals defaults to 0)
sqrt(n)Square root
piπ constant → 3.14159…
rnd(seed)Random number 0–1. Optional seed (any type) makes output deterministic.
sin(n) / cos(n) / tan(n)Trig functions (radians)
asin(n) / acos(n) / atan(n)Inverse trig functions (radians)
log(n, base)Logarithm (base defaults to 10)
bitAnd(a, b)Bitwise AND → number
bitOr(a, b)Bitwise OR → number
bitXor(a, b)Bitwise XOR → number
bitwise(op, a, b)Generic bitwise op → number. ops: & | ^ << >> >>> ~
sum(list)Sum of list elements → number
range(from, to, step)Generate number list (step defaults to 1 or -1)
Environment & Paths
EXPRESSIONRETURNS
active_userCurrent username string
home_dirCurrent user's home directory
current_pathCurrent working directory
program_pathPath to running script
paramsList of CLI args when script runs as a command
get_abs_path(path)Convert relative path to absolute
parent_path(path)Parent directory of path
timeReturns a number of seconds representing the elapsed time since the script started.
current_dateFormatted date string
Network Utilities
FUNCTIONRETURNS
nslookup(domain)Resolve domain → IP string
whois(ip)Whois lookup → string
is_valid_ip(ip)1 or 0
is_lan_ip(ip)1 or 0
get_router(ip)Router object
get_switch(ip)Switch object
Persistence
FUNCTIONRETURNS
get_custom_objectPersistent map — survives nested shell.launch calls
include_lib(path)Load a .so shared library → object or null
get_shell(user, pass)Get local (or authenticated) shell object
md5(str)MD5 hash → string
format_columns(list)Format list as aligned columns → string
Shell & Computer API
shell Object
Obtained via get_shell or shell.connect_service:
s = get_shell s.host_computer // → computer s.ping(ip) // → 1 or 0 s.build(srcPath, binPath, allowImport) // compile .src → binary s.connect_service(ip, port, user, pass) // → shell / ftpShell / string / null s.launch(program, params) // run binary → number / string s.scp(file, folder, remoteShell, isUpload) // file transfer → 1 or error s.start_terminal // Launches an active terminal*
*-Script execution will be stopped upon starting a new terminal, unless this is called from another script that was executed via shell.launch. In that case, you will enter the shell after closing your root-level script within that terminal window
computer Object
Obtained via shell.host_computer:
c = get_shell.host_computer c.get_ports // → list<port> c.get_name // → string (hostname) c.local_ip // → string c.public_ip // → string c.File(path) // → file or null c.create_folder(path, name) // → 1 or error string c.touch(path, fileName) // create file → 1 or error string c.show_procs // → string (process list) c.change_password(user, pass) // → 1 or error string c.create_user(user, pass) // → 1 or error string c.delete_user(user, removeHome) // → 1 or error string c.close_program(pid) // → 1, 0, or error string c.reboot(safeMode) // → 1 or error string
file Object
Obtained via computer.File(path) or directory methods:
f = c.File("/home/user/file.txt") f.name // → string f.path // → string f.parent // → file (directory) or null f.is_folder // → 1 or 0 f.is_binary // → 1 or 0 f.size // → string f.owner / f.group // → string f.permissions // → "drwxr-xr-x" style string f.has_permission(perms) // → 1 or 0 f.get_content // → string or null (local only) f.set_content(text) // → 1 or error (local only) f.get_files // → list<file> or null (folder only) f.get_folders // → list<file> or null (folder only) f.chmod(perms, recursive) // → string or error f.copy(path, name) // → 1 or error f.move(path, fileName) // → 1 or error f.rename(name) // → string or 0 f.delete // → string (error) or void f.set_owner(owner, recursive) // → string or null
Network & Ports
router Object
r = get_router("1.2.3.4") r.public_ip // → string r.local_ip // → string r.bssid_name // → string r.kernel_version // → string r.used_ports // → list<port> r.devices_lan_ip // → list<string> r.firewall_rules // → list<string> r.device_ports(ip) // → list<port> or string or null r.ping_port(portNum) // → port or null r.port_info(port) // → string or null
port Object
p = router.used_ports[0] p.port_number // → number p.get_lan_ip // → string (LAN IP this port points to) p.is_closed // → 1 if closed, 0 if open
Default Port Numbers
PORTSERVICE
21FTP
22SSH
25SMTP
80 / 8080HTTP
141 / 3306-3308SQL
1222RShell
1542Repository / Hackshop
6667Chat
37777CCTV
SSH Connection
remoteShell = get_shell.connect_service("1.2.3.4", 22, "user", "pass") if typeof(remoteShell) != "shell" then exit "Failed: " + remoteShell remoteComputer = remoteShell.host_computer print "Connected: " + remoteComputer.get_name
netSession Object
Obtained via metaxploit.net_use(ip, port). Port 0 returns a kernel router session.
session = mx.net_use("1.2.3.4", 22) session.dump_lib // → metaLib (running lib on that port) session.get_num_users // → number of user accounts session.is_any_active_user // → 1 or 0 session.is_root_active_user // → 1 or 0 session.flood_connection // initiate DDoS (requires 4x calls from different IPs)
Metaxploit
metaxploit Object
mx = include_lib("/lib/metaxploit.so") mx.net_use(ip, port) // → netSession or null mx.load(path) // → metaLib or null mx.scan(metaLib) // → list<string> memory addresses or null mx.scan_address(metaLib, address) // → vulnerability details string or null mx.sniffer(saveEncSource) // → captured packet string or null mx.rshell_client(ip, port, name) // → 1 or error mx.rshell_server // → list<shell> or error
metaLib Object
lib = mx.net_use("1.2.3.4", 22).dump_lib lib.lib_name // → "init.so" lib.version // → "1.0.0" lib.is_patched(getDate) // → 1 or date-patched-string or error-string or null lib.overflow(address, value) // → shell / computer / file / string / null lib.debug_tools(user, pass) // → debugLibrary or null
Exploit Loop
The standard pattern: get net session → dump lib → scan addresses → fire overflows on vulnerabilities with no requirements (*):
EXPLOIT LOOPmx = include_lib("/lib/metaxploit.so") ses = mx.net_use(targetIP, portNumber) if ses == null then exit "no session" lib = ses.dump_lib addrs = mx.scan(lib) if addrs == null then exit "nothing found" for addr in addrs details = mx.scan_address(lib, addr) for seg in details.split("Unsafe check: ") hasReq = seg.indexOf("*") != null if not hasReq then exploit = seg[seg.indexOf("<b>") + 3 : seg.indexOf("</b>")] result = lib.overflow(addr, exploit) if typeof(result) != "string" and result != null then print "Got: " + typeof(result) end if end if end for end for
debugLibrary Object
dbg = lib.debug_tools("user", "pass") dbg.scan // → vulnerability report string dbg.unit_testing(errorLines) // → string or null (errorLines: list<number>) dbg.apply_patch(path) // → string or null dbg.payload(memZone, pathFile) // → list<map> or string or null
SCAN_ADDRESS FORMAT
scan_address returns a string with segments split by "Unsafe check: ". Each segment contains the vulnerability name in <b>tags</b>. A * in the segment means a requirement must be injected as the optional 3rd arg to overflow.
Blockchain & Crypto
crypto Library
crypto = include_lib("/lib/crypto.so") // Password cracking crypto.decipher(encPass) // crack MD5 → plaintext or null // File encryption crypto.encrypt(filePath, password) // → 1 or error crypto.decrypt(filePath, password) // → 1 or error crypto.is_encrypted(filePath) // → 1, 0, or error // WiFi cracking crypto.airmon("start", "wlan0") // enable monitor mode crypto.aireplay(bssid, essid, maxAcks) // capture handshake → null or error-string crypto.aircrack(capFilePath) // crack cap file → password or null // SMTP recon crypto.smtp_user_list(ip, port) // → list<string> of usernames or null
blockchain / wallet / coin / subwallet
blockchain = include_lib("/lib/blockchain.so") // Login or create wallet wallet = blockchain.login_wallet("user", "pass") if typeof(wallet) == "string" then wallet = blockchain.create_wallet("user", "pass") end if // Get a coin coin = blockchain.get_coin("MyCoin", "coinUser", "coinPass") // Get or create subwallet sw = coin.get_subwallet("myWallet") if typeof(sw) == "string" then pin = wallet.get_pin coin.create_subwallet("user", pin, "myWallet", "pass") sw = coin.get_subwallet("myWallet") end if // Mine sw.mining // mine one reward cycle → 1 or error sw.get_balance // → number sw.last_transaction // → [dest, amount, direction, date] // Trade wallet.buy_coin("MyCoin", 10, unitPrice, subwalletUser) coin.transaction(origSW, destSW, amount)
WiFi Crack Pattern
crypto = include_lib("/lib/crypto.so") networks = get_shell.host_computer.wifi_networks("wlan0") parts = networks[0].split(" ") bssid = parts[0] pwr = parts[1][:-1].to_int essid = parts[2] crypto.aireplay(bssid, essid, 300000 / (pwr+15)) password = crypto.aircrack(home_dir + "/file.cap") print password
Common Patterns
Error Handling
GreyScript has no try/catch. Check return values explicitly:
result = someGHApiCall(args) if typeof(result) == "string" then print "Error: " + result return end if if result == null then print "Returned null" return end if // success — use result
SSH Connect
remoteShell = get_shell.connect_service("1.2.3.4", 22, "user", "pass") if typeof(remoteShell) != "shell" then exit "Failed: " + remoteShell c = remoteShell.host_computer
Root Check
if active_user != "root" then exit "<color=red>Run As Root!</color>"
Read & Write a File
c = get_shell.host_computer f = c.File("/home/user/notes.txt") if f != null then content = f.get_content f.set_content(content + char(10) + "New line") end if
Create a File
c = get_shell.host_computer result = c.touch("/home/user", "newfile.txt") if result == 1 then c.File("/home/user/newfile.txt").set_content("Hello!") end if
Recursive File Search
findFile = function(folder, name) for f in folder.get_files if f.name == name then return f end for for d in folder.get_folders result = findFile(d, name) if result then return result end for return null end function root = get_shell.host_computer.File("/") found = findFile(root, "metaxploit.so")
Iterate a Directory
folder = get_shell.host_computer.File("/home/user") if folder != null and folder.is_folder then for f in folder.get_files print f.name + " " + f.size end for end if
params-Based CLI Command
if params.len < 1 or params[0] == "-h" then exit command_info("usage_string") end if target = params[0] path = get_abs_path(target)
Live-Updating Display
while true output = buildDisplay() print(output, 1) // 1 = clear_screen before print wait(0.5) end while
Detect Home Computer
// Home computers run Xorg — detect via show_procs procs = shell.host_computer.show_procs.split(char(10)) isHome = 0 for proc in procs if proc.split(" ").len > 4 and proc.split(" ")[4] == "Xorg" then isHome = 1 break end if end for
get_custom_object Persistence
g = get_custom_object // Guard against missing keys if not g.hasIndex("myData") then g.myData = {} // Write g.myData.key = "value" // Read val = g.myData.key // Survives across nested shell.launch calls
DEVELOPMENT TOOLS
greybel-vs — VSCode extension with syntax highlighting, autocomplete, build, and debug.
greybel-js — CLI transpiler, bundler, minifier, and interpreter.
editor.greyscript.org — Browser-based online editor and interpreter.

Hacktool Documentation Portal

GREY HACK
All Tools/references/mechanics/functionalities described in this documentation are for the video game Grey Hack.
This is not real hacking.
For more information about the game, visit the link below...