gitea-mirror/PEASS-ng
1
0
Fork 0
mirror of https://github.com/peass-ng/PEASS-ng.git synced 2026-07-28 14:47:18 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge master into PR 649

Browse Source
This commit is contained in:
Carlos Polop
2026-06-28 19:56:23 +02:00
parent e0faca1926 a7a09a338e
commit 615a285482
4 changed files with 53 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
linPEAS/builder/linpeas_parts/2_container/4_Docker_container_details.sh
+3 -1
View File
@@ -6,7 +6,7 @@
# License: GNU GPL
# Version: 1.0
# Mitre: T1613
# Functions Used: checkDockerRootless, checkDockerVersionExploits, containerCheck, enumerateDockerSockets, inDockerGroup, print_2title, print_list
# Functions Used: checkDockerRootless, checkDockerVersionExploits, containerCheck, enumerateDockerDesktopAPI, enumerateDockerSockets, inDockerGroup, print_2title, print_list
# Global Variables: $containerType, $DOCKER_GROUP, $DOCKER_ROOTLESS, $dockerVersion, $inContainer, $VULN_CVE_2019_5736, $VULN_CVE_2019_13139, $VULN_CVE_2021_41091
# Initial Functions: containerCheck
# Generated Global Variables:
@@ -29,6 +29,8 @@ if echo "$containerType" | grep -qi "docker"; then
if [ "$inContainer" ]; then
checkDockerRootless
print_list "Rootless Docker? ............... $DOCKER_ROOTLESS\n"$NC | sed -${E} "s,No,${SED_RED}," | sed -${E} "s,Yes,${SED_GREEN},"
print_list "Checking Docker Desktop internal Engine API (CVE-2025-9074):\n"$NC
enumerateDockerDesktopAPI
echo ""
fi
if df -h | grep docker; then
linPEAS/builder/linpeas_parts/functions/enumerateDockerDesktopAPI.sh
+36
View File
@@ -0,0 +1,36 @@
# Title: Container - enumerateDockerDesktopAPI
# ID: enumerateDockerDesktopAPI
# Author: Carlos Polop
# Last Update: 24-06-2026
# Description: Check from inside a container if the Docker Desktop internal Engine API (CVE-2025-9074) is reachable over TCP on 192.168.65.7:2375 even when the docker socket is NOT mounted, which allows a full container escape.
# License: GNU GPL
# Version: 1.0
# Functions Used:
# Global Variables: $GREP_DOCKER_SOCK_INFOS, $GREP_DOCKER_SOCK_INFOS_IGNORE
# Initial Functions:
# Generated Global Variables: $SEARCHED_DOCKER_DESKTOP_API, $ddEndpoint, $ddInfoResponse
# Fat linpeas: 0
# Small linpeas: 1
enumerateDockerDesktopAPI() {
if ! [ "$SEARCHED_DOCKER_DESKTOP_API" ]; then
SEARCHED_DOCKER_DESKTOP_API="1"
# Docker Desktop exposes its internal Engine API on the VM services host 192.168.65.7.
# CVE-2025-9074 (fixed in Docker Desktop 4.44.3) let a container reach this UNAUTHENTICATED
# Engine API on 192.168.65.7:2375 even when /var/run/docker.sock was NOT mounted, enabling a
# full container escape (e.g. creating a container that bind-mounts the host filesystem).
# Ref: https://nvd.nist.gov/vuln/detail/CVE-2025-9074
ddEndpoint="http://192.168.65.7:2375/info"
ddInfoResponse=""
if [ "$(command -v curl 2>/dev/null || echo -n '')" ]; then
ddInfoResponse="$(curl -s --max-time 3 "$ddEndpoint" 2>/dev/null)"
elif [ "$(command -v wget 2>/dev/null || echo -n '')" ]; then
ddInfoResponse="$(wget -q -T 3 -O - "$ddEndpoint" 2>/dev/null)"
fi
if echo "$ddInfoResponse" | grep -q "ServerVersion"; then
echo "Docker Desktop internal Engine API (CVE-2025-9074) reachable at 192.168.65.7:2375 - container escape possible!" | sed -${E} "s,reachable at 192.168.65.7:2375,${SED_RED_YELLOW},g"
echo "$ddInfoResponse" | tr ',' '\n' | grep -E "$GREP_DOCKER_SOCK_INFOS" | grep -v "$GREP_DOCKER_SOCK_INFOS_IGNORE" | tr -d '"'
fi
fi
}
linPEAS/builder/linpeas_parts/functions/kernel_cve_registry_checks.sh
+1 -1
View File
@@ -1,7 +1,7 @@
# Title: Function - kernel_cve_registry_checks
# ID: kernel_cve_registry_checks
# Author: Carlos Polop
# Last Update: 25-02-2026
# Last Update: 28-06-2026
# Description: Evaluate declared kernel CVE rules using kernel version, arch, kernel config, sysctl and command prerequisites.
# Description: Data source chunks KERNEL_CVE_DATA_1..22 are capped to 25 rows each.
# License: GNU GPL
linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh
+13 -12
View File
@@ -1,7 +1,7 @@
# Title: Variables - kernel_cve_registry_data
# ID: kernel_cve_registry_data
# Author: Carlos Polop
# Last Update: 11-06-2026
# Last Update: 28-06-2026
# Description: Embedded kernel exploit matching datasets extracted from linux-exploit-suggester and linux-exploit-suggester-2 examples. Data is split across KERNEL_CVE_DATA_1..X with a maximum of 25 rows per env variable. This file also stores reference-only CVE tokens found in example repos when no explicit suggester matching rule exists.
# License: GNU GPL
# Version: 1.0
@@ -610,6 +610,7 @@ CVE-2017-16994 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token
CVE-2020-27171 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from example repos; appears as related comment in exploit source
CVE-2024-0193 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from example repos; appears as upstream source reference
CVE-2026-43284 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Ubuntu/Red Hat Dirty Frag advisories; no stable matcher added
CVE-2026-43494 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Ubuntu PinTheft advisory; no stable matcher added
CVE-2026-43500 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Ubuntu/Red Hat Dirty Frag advisories; no stable matcher added
CVE-2026-46243 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Red Hat CIFSwitch advisory; no stable matcher added
CVE-2026-46300 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Ubuntu/Red Hat Fragnesia advisories; no stable matcher added
@@ -617,16 +618,16 @@ EOF_DATA_21
)"
KERNEL_CVE_DATA_22="$(cat <<'EOF_DATA_22'
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=3.16.52,ver<3.17,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue backported into 3.16 at 3.16.52
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.4.40,ver<4.5,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue backported into 4.4 at 4.4.40
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.8.16,ver<4.9,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue backported into 4.8 at 4.8.16
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.9.1,ver<4.10,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue backported into 4.9 at 4.9.1
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.10,ver<5.10.256,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue introduced in 4.10; fixed in 5.10.256
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=5.11,ver<5.15.207,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue introduced in 4.10; fixed in 5.15.207
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=5.16,ver<6.1.173,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue introduced in 4.10; fixed in 6.1.173
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.2,ver<6.6.139,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue introduced in 4.10; fixed in 6.6.139
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.7,ver<6.12.89,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue introduced in 4.10; fixed in 6.12.89
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.13,ver<6.18.31,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue introduced in 4.10; fixed in 6.18.31
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.19,ver<7.0.8,sysctl:kernel.yama.ptrace_scope!=2 1 Upstream issue introduced in 4.10; fixed in 7.0.8
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=3.16.52,ver<3.17,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue backported into 3.16 at 3.16.52; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.4.40,ver<4.5,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue backported into 4.4 at 4.4.40; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.8.16,ver<4.9,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue backported into 4.8 at 4.8.16; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.9.1,ver<4.10,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue backported into 4.9 at 4.9.1; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.10,ver<5.10.256,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue introduced in 4.10; fixed in 5.10.256; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=5.11,ver<5.15.207,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue introduced in 4.10; fixed in 5.15.207; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=5.16,ver<6.1.173,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue introduced in 4.10; fixed in 6.1.173; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.2,ver<6.6.139,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue introduced in 4.10; fixed in 6.6.139; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.7,ver<6.12.89,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue introduced in 4.10; fixed in 6.12.89; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.13,ver<6.18.31,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue introduced in 4.10; fixed in 6.18.31; mitigated by kernel.yama.ptrace_scope >= 2
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.19,ver<7.0.8,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue introduced in 4.10; fixed in 7.0.8; mitigated by kernel.yama.ptrace_scope >= 2
EOF_DATA_22
)"