mirror of
https://github.com/peass-ng/PEASS-ng.git
synced 2026-07-28 14:47:18 -07:00
fix
This commit is contained in:
Carlos Polop
@@ -26,9 +26,9 @@
|
||||
# License: GNU GPL
|
||||
# Version: 1.0
|
||||
# Mitre: T1082
|
||||
# Functions Used: print_2title, print_info, warn_exec
|
||||
# Functions Used: print_2title, print_info, warn_exec, linpeas_start_host_checker_lookup
|
||||
# Global Variables: $MACPEAS, $kernelDCW_Ubuntu_Precise_1, $kernelB, $kernelDCW_Ubuntu_Precise_2, $kernelDCW_Ubuntu_Precise_3, $kernelDCW_Ubuntu_Precise_4, $kernelDCW_Ubuntu_Precise_5, $kernelDCW_Ubuntu_Precise_6, $kernelDCW_Rhel5_1, $kernelDCW_Rhel5_2, $kernelDCW_Rhel5_3, $kernelDCW_Rhel6_1, $kernelDCW_Rhel6_2, $kernelDCW_Rhel6_3, $kernelDCW_Rhel6_4, $kernelDCW_Rhel7, $kernelDCW_Ubuntu_Trusty_1, $kernelDCW_Ubuntu_Trusty_2, $kernelDCW_Ubuntu_Trusty_3, $kernelDCW_Ubuntu_Trusty_4, $kernelDCW_Ubuntu_Xenial
|
||||
# Initial Functions:
|
||||
# Initial Functions: linpeas_start_host_checker_lookup
|
||||
# Generated Global Variables:
|
||||
# Fat linpeas: 0
|
||||
# Small linpeas: 1
|
||||
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
# Title: System Information - Online package vulnerabilities
|
||||
# ID: SY_Online_package_vulnerabilities
|
||||
# Author: Carlos Polop
|
||||
# Last Update: 29-06-2026
|
||||
# Description: Print package vulnerabilities returned by the optional HackTricks online package lookup.
|
||||
# License: GNU GPL
|
||||
# Version: 1.0
|
||||
# Mitre: T1082
|
||||
# Functions Used: print_2title, print_info, linpeas_print_package_vulnerabilities
|
||||
# Global Variables: $ONLINE_VULN_CHECKS, $NOT_CHECK_EXTERNAL_HOSTNAME
|
||||
# Initial Functions:
|
||||
# Generated Global Variables:
|
||||
# Fat linpeas: 0
|
||||
# Small linpeas: 1
|
||||
|
||||
if [ "$ONLINE_VULN_CHECKS" ] && [ -z "$NOT_CHECK_EXTERNAL_HOSTNAME" ]; then
|
||||
print_2title "Online package vulnerabilities" "T1082"
|
||||
print_info "This uses the optional HackTricks online lookup enabled with -V or -a. Output is capped at 50 vulnerable packages."
|
||||
linpeas_print_package_vulnerabilities
|
||||
echo ""
|
||||
fi
|
||||
@@ -6,9 +6,9 @@
|
||||
# License: GNU GPL
|
||||
# Version: 1.0
|
||||
# Functions Used:
|
||||
# Global Variables: $VERSION, $ONLINE_VULN_CHECKS
|
||||
# Global Variables: $VERSION, $ONLINE_VULN_CHECKS, $NOT_CHECK_EXTERNAL_HOSTNAME, $E, $SED_RED_YELLOW
|
||||
# Initial Functions:
|
||||
# Generated Global Variables: $$INTERNET_SEARCH_TIMEOUT, $HACKTRICKS_HOST_CHECKER_URL, $HACKTRICKS_PACKAGE_LIMIT, $_os_id, $_os_version_id, $_os_version_major, $_ecosystem, $_pkg_name, $_pkg_line, $_pkg_version, $_limit, $_os_name, $_os_codename, $_hostname, $_hacktricks_host_checker_url, $_hacktricks_payload, $source, $binary, $Version
|
||||
# Generated Global Variables: $$INTERNET_SEARCH_TIMEOUT, $TMPDIR, $HACKTRICKS_HOST_CHECKER_URL, $HACKTRICKS_PACKAGE_LIMIT, $LINPEAS_HOST_CHECKER_OUT, $LINPEAS_HOST_CHECKER_ERR, $LINPEAS_HOST_CHECKER_PID, $LINPEAS_HOST_CHECKER_STARTED, $_os_id, $_os_version_id, $_os_version_major, $_ecosystem, $_pkg_name, $_pkg_line, $_pkg_version, $_limit, $_os_name, $_os_codename, $_hostname, $_hacktricks_host_checker_url, $_hacktricks_payload, $source, $binary, $Version
|
||||
# Fat linpeas: 0
|
||||
# Small linpeas: 1
|
||||
|
||||
@@ -137,16 +137,177 @@ linpeas_host_checker_payload(){
|
||||
}
|
||||
|
||||
|
||||
check_external_hostname(){
|
||||
linpeas_start_host_checker_lookup(){
|
||||
[ "$NOT_CHECK_EXTERNAL_HOSTNAME" ] && return
|
||||
[ "$LINPEAS_HOST_CHECKER_STARTED" ] && return
|
||||
|
||||
INTERNET_SEARCH_TIMEOUT=15
|
||||
LINPEAS_HOST_CHECKER_STARTED="1"
|
||||
LINPEAS_HOST_CHECKER_OUT="${TMPDIR:-/tmp}/linpeas_host_checker_$$.json"
|
||||
LINPEAS_HOST_CHECKER_ERR="${TMPDIR:-/tmp}/linpeas_host_checker_$$.err"
|
||||
_hacktricks_host_checker_url="${HACKTRICKS_HOST_CHECKER_URL:-https://tools.hacktricks.wiki/api/host-checker}"
|
||||
_hacktricks_payload="$(linpeas_host_checker_payload)"
|
||||
# wget or curl?
|
||||
|
||||
if command -v curl >/dev/null 2>&1; then
|
||||
curl -s "$_hacktricks_host_checker_url" -H "User-Agent: linpeas" --data-binary "$_hacktricks_payload" -H "Content-Type: application/json" --max-time "$INTERNET_SEARCH_TIMEOUT"
|
||||
(curl -s "$_hacktricks_host_checker_url" -H "User-Agent: linpeas" --data-binary "$_hacktricks_payload" -H "Content-Type: application/json" --max-time "$INTERNET_SEARCH_TIMEOUT" > "$LINPEAS_HOST_CHECKER_OUT" 2>"$LINPEAS_HOST_CHECKER_ERR") &
|
||||
LINPEAS_HOST_CHECKER_PID=$!
|
||||
elif command -v wget >/dev/null 2>&1; then
|
||||
wget -q -O - "$_hacktricks_host_checker_url" --header "User-Agent: linpeas" --header "Content-Type: application/json" --post-data "$_hacktricks_payload" --timeout "$INTERNET_SEARCH_TIMEOUT"
|
||||
(wget -q -O - "$_hacktricks_host_checker_url" --header "User-Agent: linpeas" --header "Content-Type: application/json" --post-data "$_hacktricks_payload" --timeout "$INTERNET_SEARCH_TIMEOUT" > "$LINPEAS_HOST_CHECKER_OUT" 2>"$LINPEAS_HOST_CHECKER_ERR") &
|
||||
LINPEAS_HOST_CHECKER_PID=$!
|
||||
else
|
||||
echo "wget or curl not found"
|
||||
printf '{"error":"wget or curl not found"}\n' > "$LINPEAS_HOST_CHECKER_OUT"
|
||||
fi
|
||||
}
|
||||
|
||||
linpeas_wait_host_checker_lookup(){
|
||||
[ "$NOT_CHECK_EXTERNAL_HOSTNAME" ] && return 1
|
||||
linpeas_start_host_checker_lookup
|
||||
if [ "$LINPEAS_HOST_CHECKER_PID" ]; then
|
||||
wait "$LINPEAS_HOST_CHECKER_PID" 2>/dev/null
|
||||
LINPEAS_HOST_CHECKER_PID=""
|
||||
fi
|
||||
[ -s "$LINPEAS_HOST_CHECKER_OUT" ]
|
||||
}
|
||||
|
||||
linpeas_strip_package_vulns_from_host_response(){
|
||||
if command -v jq >/dev/null 2>&1; then
|
||||
jq 'del(.package_vulnerabilities)' "$LINPEAS_HOST_CHECKER_OUT" 2>/dev/null && return
|
||||
fi
|
||||
|
||||
awk '
|
||||
function brace_delta(s, t, opens, closes) {
|
||||
t=s; opens=gsub(/{/,"{",t)
|
||||
t=s; closes=gsub(/}/,"}",t)
|
||||
return opens - closes
|
||||
}
|
||||
skip {
|
||||
depth += brace_delta($0)
|
||||
if (depth <= 0) skip=0
|
||||
next
|
||||
}
|
||||
/"package_vulnerabilities"[[:space:]]*:/ {
|
||||
sub(/,[[:space:]]*$/, "", prev)
|
||||
skip=1
|
||||
depth=brace_delta($0)
|
||||
if (depth <= 0) skip=0
|
||||
next
|
||||
}
|
||||
{
|
||||
if (have) print prev
|
||||
prev=$0
|
||||
have=1
|
||||
}
|
||||
END {
|
||||
if (have) print prev
|
||||
}
|
||||
' "$LINPEAS_HOST_CHECKER_OUT"
|
||||
}
|
||||
|
||||
check_external_hostname(){
|
||||
if linpeas_wait_host_checker_lookup; then
|
||||
linpeas_strip_package_vulns_from_host_response
|
||||
else
|
||||
echo "HackTricks host checker did not return data"
|
||||
fi
|
||||
}
|
||||
|
||||
linpeas_print_package_vulnerabilities_with_jq(){
|
||||
jq -r '
|
||||
.package_vulnerabilities as $pv
|
||||
| if ($pv == null) then
|
||||
empty
|
||||
elif (($pv.affected // 0) | tonumber) == 0 then
|
||||
"No vulnerable packages found by online lookup (checked \($pv.checked // 0) packages)."
|
||||
else
|
||||
"Online package vulnerabilities found: \($pv.affected) vulnerable package(s), checked \($pv.checked // 0).",
|
||||
(
|
||||
$pv.vulnerable_packages[:50][]?
|
||||
| "- \(.name // "?") \(.version // "?") [\(.ecosystem // "unknown")]: \((.vulns // []) | join(", "))"
|
||||
),
|
||||
(
|
||||
if (($pv.vulnerable_packages | length) > 50) then
|
||||
"... \((($pv.vulnerable_packages | length) - 50)) more vulnerable package(s) not shown."
|
||||
else empty end
|
||||
)
|
||||
end
|
||||
' "$LINPEAS_HOST_CHECKER_OUT" 2>/dev/null
|
||||
}
|
||||
|
||||
linpeas_print_package_vulnerabilities_with_awk(){
|
||||
awk '
|
||||
function json_value(line) {
|
||||
sub(/^[^:]*:[[:space:]]*"/, "", line)
|
||||
sub(/",?[[:space:]]*$/, "", line)
|
||||
return line
|
||||
}
|
||||
function json_number(line) {
|
||||
sub(/^[^:]*:[[:space:]]*/, "", line)
|
||||
sub(/,?[[:space:]]*$/, "", line)
|
||||
return line
|
||||
}
|
||||
function json_string(line) {
|
||||
sub(/^[[:space:]]*"/, "", line)
|
||||
sub(/",?[[:space:]]*$/, "", line)
|
||||
return line
|
||||
}
|
||||
function flush_pkg() {
|
||||
if (name != "" && version != "") {
|
||||
total++
|
||||
if (shown < 50) {
|
||||
print "- " name " " version " [" (ecosystem != "" ? ecosystem : "unknown") "]: " vulns
|
||||
shown++
|
||||
}
|
||||
}
|
||||
name=""; version=""; ecosystem=""; vulns=""; in_vulns=0
|
||||
}
|
||||
/"package_vulnerabilities"[[:space:]]*:/ { in_pv=1; next }
|
||||
in_pv && /"checked"[[:space:]]*:/ { checked=json_number($0); next }
|
||||
in_pv && /"affected"[[:space:]]*:/ { affected=json_number($0); next }
|
||||
in_pv && /"vulnerable_packages"[[:space:]]*:[[:space:]]*\[/ { in_pkgs=1; next }
|
||||
in_pkgs && /"name"[[:space:]]*:/ { name=json_value($0); next }
|
||||
in_pkgs && /"version"[[:space:]]*:/ { version=json_value($0); next }
|
||||
in_pkgs && /"ecosystem"[[:space:]]*:/ { ecosystem=json_value($0); next }
|
||||
in_pkgs && /"vulns"[[:space:]]*:[[:space:]]*\[/ { in_vulns=1; next }
|
||||
in_vulns && /"/ {
|
||||
v=json_string($0)
|
||||
if (v != "") vulns = vulns (vulns != "" ? ", " : "") v
|
||||
next
|
||||
}
|
||||
in_vulns && /\]/ { in_vulns=0; next }
|
||||
in_pkgs && /^[[:space:]]*}[,]?[[:space:]]*$/ { flush_pkg(); next }
|
||||
END {
|
||||
if (affected == "") exit
|
||||
if ((affected + 0) == 0) {
|
||||
print "No vulnerable packages found by online lookup (checked " (checked != "" ? checked : 0) " packages)."
|
||||
} else {
|
||||
print "Online package vulnerabilities found: " affected " vulnerable package(s), checked " (checked != "" ? checked : 0) "."
|
||||
if (total > 50) print "... " (total - 50) " more vulnerable package(s) not shown."
|
||||
}
|
||||
}
|
||||
' "$LINPEAS_HOST_CHECKER_OUT" | awk '
|
||||
/^Online package vulnerabilities found:/ { header=$0; next }
|
||||
/^No vulnerable packages found/ { print; next }
|
||||
/^\.\.\. / { more=$0; next }
|
||||
/^- / { lines[++count]=$0; next }
|
||||
END {
|
||||
if (header) print header
|
||||
for (i=1; i<=count && i<=50; i++) print lines[i]
|
||||
if (more) print more
|
||||
}
|
||||
'
|
||||
}
|
||||
|
||||
linpeas_print_package_vulnerabilities(){
|
||||
[ "$ONLINE_VULN_CHECKS" ] || return
|
||||
|
||||
if ! linpeas_wait_host_checker_lookup; then
|
||||
echo "Online package vulnerability lookup did not return data"
|
||||
return
|
||||
fi
|
||||
|
||||
if command -v jq >/dev/null 2>&1; then
|
||||
linpeas_print_package_vulnerabilities_with_jq | sed -${E} "s,CVE-[0-9]{4}-[0-9]+,${SED_RED_YELLOW},g"
|
||||
else
|
||||
linpeas_print_package_vulnerabilities_with_awk | sed -${E} "s,CVE-[0-9]{4}-[0-9]+,${SED_RED_YELLOW},g"
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
# Functions Used:
|
||||
# Global Variables:
|
||||
# Initial Functions:
|
||||
# Generated Global Variables: $VERSION, $ADVISORY, $IAMROOT, $MAXPATH_FIND_W, $C, $RED, $SED_RED, $GREEN, $SED_GREEN, $YELLOW, $SED_YELLOW, $RED_YELLOW, $SED_RED_YELLOW, $BLUE, $SED_BLUE, $ITALIC_BLUE, $LIGHT_MAGENTA, $SED_LIGHT_MAGENTA, $LIGHT_CYAN, $SED_LIGHT_CYAN, $LG, $SED_LG, $DG, $SED_DG, $NC, $UNDERLINED, $ITALIC, $MACPEAS, $FAST, $SUPERFAST, $DISCOVERY, $PORTS, $QUIET, $CHECKS, $MITRE_FILTER, $SEARCH_IN_FOLDER, $ROOT_FOLDER, $WAIT, $PASSWORD, $NOCOLOR, $DEBUG, $AUTO_NETWORK_SCAN, $EXTRA_CHECKS, $REGEXES, $PORT_FORWARD, $NOT_CHECK_EXTERNAL_HOSTNAME, $ONLINE_VULN_CHECKS, $E, $PING, $FPING, $DISCOVER_BAN_BAD, $DISCOVER_BAN_GOOD, $SCAN_BAN_GOOD, $NMAP_GOOD, $SCRIPTNAME, $FOUND_BASH, $FOUND_NC, $HOMESEARCH, $GREPHOMESEARCH, $SCAN_BAN_BAD, $HOME, $THREADS, $opt, $HELP, $USER, $TOTAL_T1_TIME, $END_T1_TIME, $START_T1_TIME, $title, $title_len, $max_title_len, $rest_len, $CONT_THREADS, $wgroups, $SEDOVERFLOW, $Wfolders, $Wfolder, $grp, $END_T2_TIME, $TOTAL_T2_TIME, $START_T2_TIME, $_mitre_tag, $_mitre_filter, $_mitre_base, $_mitre_tags_left, $_mitre_filters_left
|
||||
# Generated Global Variables: $VERSION, $ADVISORY, $IAMROOT, $MAXPATH_FIND_W, $C, $RED, $SED_RED, $GREEN, $SED_GREEN, $YELLOW, $SED_YELLOW, $RED_YELLOW, $SED_RED_YELLOW, $BLUE, $SED_BLUE, $ITALIC_BLUE, $LIGHT_MAGENTA, $SED_LIGHT_MAGENTA, $LIGHT_CYAN, $SED_LIGHT_CYAN, $LG, $SED_LG, $DG, $SED_DG, $NC, $UNDERLINED, $ITALIC, $MACPEAS, $FAST, $SUPERFAST, $DISCOVERY, $PORTS, $QUIET, $CHECKS, $MITRE_FILTER, $SEARCH_IN_FOLDER, $ROOT_FOLDER, $WAIT, $PASSWORD, $NOCOLOR, $DEBUG, $AUTO_NETWORK_SCAN, $EXTRA_CHECKS, $REGEXES, $PORT_FORWARD, $ONLINE_VULN_CHECKS, $E, $PING, $FPING, $DISCOVER_BAN_BAD, $DISCOVER_BAN_GOOD, $SCAN_BAN_GOOD, $NMAP_GOOD, $SCRIPTNAME, $FOUND_BASH, $FOUND_NC, $HOMESEARCH, $GREPHOMESEARCH, $SCAN_BAN_BAD, $HOME, $THREADS, $opt, $HELP, $USER, $TOTAL_T1_TIME, $END_T1_TIME, $START_T1_TIME, $title, $title_len, $max_title_len, $rest_len, $CONT_THREADS, $wgroups, $SEDOVERFLOW, $Wfolders, $Wfolder, $grp, $END_T2_TIME, $TOTAL_T2_TIME, $START_T2_TIME, $_mitre_tag, $_mitre_filter, $_mitre_base, $_mitre_tags_left, $_mitre_filters_left
|
||||
# Fat linpeas: 0
|
||||
# Small linpeas: 1
|
||||
|
||||
|
||||
Reference in New Issue
Block a user