f

build_lists/sensitive_files.yaml

@@ -307,6 +307,31 @@ search:
                 type: d
                 search_in:
                   - ${ROOT_FOLDER}etc
+
+          - name: "system-local.d"
+            value:
+                type: d
+                search_in:
+                  - ${ROOT_FOLDER}etc
+
+          - name: "session.d"
+            value:
+                type: d
+                search_in:
+                  - ${ROOT_FOLDER}etc
+                  - ${ROOT_FOLDER}usr/share/dbus-1
+
+          - name: "system-services"
+            value:
+                type: d
+                search_in:
+                  - ${ROOT_FOLDER}usr/share/dbus-1
+
+          - name: "services"
+            value:
+                type: d
+                search_in:
+                  - ${ROOT_FOLDER}usr/share/dbus-1
     
   - name: MySQL
     value:
@@ -342,13 +367,20 @@ search:
           
           - name: "mysqld.cnf"
             value: 
-                bad_regex: "user.*|password.*|admin_address.*|debug.*|sql_warnings.*|secure_file_priv.*"
+                bad_regex: "user.*|password.*|admin_address.*|debug.*|sql_warnings.*|secure_file_priv.*|local_infile.*"
                 remove_regex: '^#'
                 remove_empty_lines: True
                 type: f
                 search_in: 
                   - common
 
+          - name: ".mylogin.cnf"
+            value:
+                just_list_file: True
+                type: f
+                search_in:
+                  - common
+
   - name: MariaDB
     value:
         config:
@@ -357,7 +389,7 @@ search:
         files:
           - name: "mariadb.cnf"
             value: 
-                bad_regex: "user.*|password.*|admin_address.*|debug.*|sql_warnings.*|secure_file_priv.*"
+                bad_regex: "user.*|password.*|admin_address.*|debug.*|sql_warnings.*|secure_file_priv.*|local_infile.*"
                 type: f
                 remove_regex: '^#'
                 remove_empty_lines: True
@@ -390,7 +422,7 @@ search:
       
           - name: "pg_hba.conf"
             value: 
-                bad_regex: "auth|password|md5|user=|pass=|trust"
+                bad_regex: "auth|password|md5|user=|pass=|trust|peer"
                 type: f
                 remove_empty_lines: True
                 remove_regex: '\W+\#|^#'
@@ -408,12 +440,21 @@ search:
       
           - name: "pgsql.conf"
             value: 
-                bad_regex: "auth|password|md5|user=|pass=|trust"
+                bad_regex: "auth|password|md5|user=|pass=|trust|peer"
                 type: f
                 remove_empty_lines: True
                 remove_regex: '\W+\#|^#'
                 search_in: 
                   - common
+
+          - name: ".pgpass"
+            value:
+                bad_regex: ".*"
+                remove_regex: '^#'
+                remove_empty_lines: True
+                type: f
+                search_in:
+                  - common
           
           - name: "pgadmin4.db"
             value: 
@@ -440,7 +481,7 @@ search:
                 files:
                     - name: "*"
                       value:
-                        bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias|command on"
+                        bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias|DocumentRoot|AllowOverride|ProxyPass|ProxyPassReverse|RemoteIPHeader|SetEnvIf.*X-Forwarded|ErrorDocument|server-status|command on"
                         remove_empty_lines: True
                         remove_regex: '#'
                 search_in: 
@@ -448,7 +489,7 @@ search:
       
             - name: "000-default.conf"
               value: 
-                bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias"
+                bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias|DocumentRoot|AllowOverride|ProxyPass|ProxyPassReverse|RemoteIPHeader|SetEnvIf.*X-Forwarded|ErrorDocument|server-status"
                 remove_regex: '#'
                 type: f
                 search_in: 
@@ -465,7 +506,7 @@ search:
             
             - name: "nginx.conf"
               value: 
-                bad_regex: "location.*.php$|$uri|$document_uri|proxy_intercept_errors.*on|proxy_hide_header.*|merge_slashes.*on|resolver.*|proxy_pass|internal|location.+[a-zA-Z0-9][^/]\\s+\\{|map|proxy_set_header.*Upgrade.*http_upgrade|proxy_set_header.*Connection.*http_connection"
+                bad_regex: "location.*.php$|$uri|$document_uri|proxy_intercept_errors.*on|proxy_hide_header.*|merge_slashes.*on|resolver.*|proxy_pass|fastcgi_pass|alias|try_files|internal|location.+[a-zA-Z0-9][^/]\\s+\\{|map|proxy_set_header.*Upgrade.*http_upgrade|proxy_set_header.*Connection.*http_connection"
                 remove_regex: "#"
                 type: f
                 remove_empty_lines: True
@@ -478,7 +519,7 @@ search:
                 files:
                     - name: "*.conf"
                       value:
-                        bad_regex: "location.*.php$|$uri|$document_uri|proxy_intercept_errors.*on|proxy_hide_header.*|merge_slashes.*on|resolver.*|proxy_pass|internal|location.+[a-zA-Z0-9][^/]\\s+\\{|map|proxy_set_header.*Upgrade.*http_upgrade|proxy_set_header.*Connection.*http_connection"
+                        bad_regex: "location.*.php$|$uri|$document_uri|proxy_intercept_errors.*on|proxy_hide_header.*|merge_slashes.*on|resolver.*|proxy_pass|fastcgi_pass|alias|try_files|internal|location.+[a-zA-Z0-9][^/]\\s+\\{|map|proxy_set_header.*Upgrade.*http_upgrade|proxy_set_header.*Connection.*http_connection"
                         remove_empty_lines: True
                         remove_regex: '#'
                         remove_path: "nginx.conf"
@@ -798,6 +839,18 @@ search:
               type: d
               search_in: 
                 - ${ROOT_FOLDER}etc
+
+          - name: "wpa_supplicant"
+            value:
+              type: d
+              files:
+                - name: "*.conf"
+                  value:
+                      bad_regex: "psk.*|password.*|ssid.*"
+                      only_bad_lines: True
+                      type: f
+              search_in:
+                - ${ROOT_FOLDER}etc
   
   - name: PAM Auth
     value:
@@ -1842,7 +1895,7 @@ search:
         files:
           - name: "redis.conf"
             value: 
-                bad_regex: "masterauth.*|requirepass.*"
+                bad_regex: "masterauth.*|requirepass.*|rename-command.*|protected-mode.*no"
                 type: f
                 remove_empty_lines: True
                 remove_regex: '\W+\#|^#'
@@ -2915,6 +2968,15 @@ search:
           auto_check: True
 
         files:
+          - name: "aliases"
+            value:
+                bad_regex: "\\|"
+                only_bad_lines: True
+                remove_empty_lines: True
+                type: f
+                search_in:
+                  - common
+
           - name: "postfix"
             value: 
               files:

linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/14_DBus_analysis.sh

@@ -216,14 +216,34 @@ if ! [ "$SEARCH_IN_FOLDER" ]; then
         echo ""
         print_2title "D-Bus Configuration Files" "T1559.001"
         echo "$PSTORAGE_DBUS" | while read -r dir; do
-            for dbus_file in "$dir"/*; do
-                if [ -f "$dbus_file" ]; then
-                    echo "Analyzing $dbus_file:"
-                    if analyze_policy_file "$dbus_file"; then
-                        echo "  └─(${RED}Multiple weak policies found${NC})"
-                    fi
+            [ -n "$dir" ] || continue
+
+            if [ -f "$dir" ]; then
+                echo "Analyzing $dir:"
+                if analyze_policy_file "$dir"; then
+                    echo "  └─(${RED}Multiple weak policies found${NC})"
                 fi
-            done
+                continue
+            fi
+
+            [ -d "$dir" ] || continue
+
+            case "$dir" in
+                */system-services|*/services)
+                    echo "Activation definitions in $dir:"
+                    grep -RInE '^(Name|Exec|User)=' "$dir" 2>/dev/null | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g" | sed "s,Exec=,${SED_RED}Exec=${NC},g" | sed "s,User=,${SED_RED}User=${NC},g"
+                    ;;
+                *)
+                    for dbus_file in "$dir"/*; do
+                        if [ -f "$dbus_file" ]; then
+                            echo "Analyzing $dbus_file:"
+                            if analyze_policy_file "$dbus_file"; then
+                                echo "  └─(${RED}Multiple weak policies found${NC})"
+                            fi
+                        fi
+                    done
+                    ;;
+            esac
         done
     fi
 
@@ -251,4 +271,4 @@ if ! [ "$SEARCH_IN_FOLDER" ]; then
         fi
     fi
 fi
-echo ""
+echo ""

linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/17_Deleted_open_files.sh

@@ -18,9 +18,19 @@ if [ "$(command -v lsof 2>/dev/null || echo -n '')" ] || [ "$DEBUG" ]; then
     print_info "Open deleted files can hide tools and still consume disk space"
     lsof +L1 2>/dev/null | sed -${E} "s,\\(deleted\\),${SED_RED},g"
     echo ""
+
+    print_2title "Deleted executables still running" "T1083"
+    print_info "A deleted /proc/<PID>/exe may indicate tampering, cleanup, or a useful runtime-only binary"
+    ls -l /proc/[0-9]*/exe 2>/dev/null | grep "(deleted)" | sed -${E} "s,\\(deleted\\),${SED_RED},g" | head -n 200
+    echo ""
 elif [ "$EXTRA_CHECKS" ] || [ "$DEBUG" ]; then
     print_2title "Deleted files still open" "T1083"
     print_info "lsof not found, scanning /proc for deleted file descriptors"
     ls -l /proc/[0-9]*/fd 2>/dev/null | grep "(deleted)" | sed -${E} "s,\\(deleted\\),${SED_RED},g" | head -n 200
     echo ""
+
+    print_2title "Deleted executables still running" "T1083"
+    print_info "Scanning /proc/<PID>/exe for deleted runtime binaries"
+    ls -l /proc/[0-9]*/exe 2>/dev/null | grep "(deleted)" | sed -${E} "s,\\(deleted\\),${SED_RED},g" | head -n 200
+    echo ""
 fi

linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/7_Cron_jobs.sh

@@ -25,11 +25,20 @@ if ! [ "$SEARCH_IN_FOLDER" ]; then
   ls -alR /etc/cron* /var/spool/cron/crontabs /var/spool/anacron 2>/dev/null | sed -${E} "s,$cronjobsG,${SED_GREEN},g" | sed "s,$cronjobsB,${SED_RED},g"
   cat /etc/cron* /etc/at* /etc/anacrontab /var/spool/cron/crontabs/* /etc/incron.d/* /var/spool/incron/* 2>/dev/null | tr -d "\r" | grep -v "^#" | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g" | sed -${E} "s,$sh_usrs,${SED_LIGHT_CYAN}," | sed "s,$USER,${SED_LIGHT_MAGENTA}," | sed -${E} "s,$nosh_usrs,${SED_BLUE},"  | sed "s,root,${SED_RED},"
   grep -Hn '^PATH=' /etc/crontab /etc/cron.d/* 2>/dev/null | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g"
+  grep -RInE 'pg_basebackup|run-parts|crontab-ui' /etc/crontab /etc/cron.d /etc/anacrontab /var/spool/cron/crontabs /etc/incron.d /var/spool/incron 2>/dev/null | sed -${E} "s,$cronjobsB,${SED_RED},g" | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g"
   crontab -l -u "$USER" 2>/dev/null | tr -d "\r"
   ls -lR /usr/lib/cron/tabs/ /private/var/at/jobs /var/at/tabs/ /etc/periodic/ 2>/dev/null | sed -${E} "s,$cronjobsG,${SED_GREEN},g" | sed "s,$cronjobsB,${SED_RED},g" #MacOS paths
   atq 2>/dev/null
   echo ""
 
+  print_3title "Cron files with hidden carriage returns" "T1053.003"
+  grep -IRl $'\r' /etc/crontab /etc/cron.d /var/spool/cron/crontabs 2>/dev/null | while read -r file; do
+    [ -n "$file" ] || continue
+    echo "$file" | sed -${E} "s,.*,${SED_RED},g"
+    sed -n 'l' "$file" 2>/dev/null | head -n 20
+  done
+  echo ""
+
   print_3title "Checking for specific cron jobs vulnerabilities" "T1053.003"
   # Function to check if a binary is writable and executable
   check_binary_perms() {
@@ -213,6 +222,16 @@ if ! [ "$SEARCH_IN_FOLDER" ]; then
     fi
   done
 
+  if command -v run-parts >/dev/null 2>&1; then
+    print_3title "run-parts executable entries" "T1053.003"
+    for cron_dir in /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly; do
+      [ -d "$cron_dir" ] || continue
+      echo "[$cron_dir]"
+      run-parts --test "$cron_dir" 2>/dev/null | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g"
+    done
+    echo ""
+  fi
+
   # Check for at jobs
   #if command -v atq >/dev/null 2>&1; then
   #  echo "Checking at jobs..."

linPEAS/builder/linpeas_parts/7_software_information/Mysql.sh

@@ -100,6 +100,8 @@ if [ "$(command -v mysql || echo -n '')" ] || [ "$(command -v mysqladmin || echo
   if [ "$mysqlconnectnopass" ]; then
     echo "Yes" | sed -${E} "s,.*,${SED_RED},"
     mysql -u root -e "SELECT User,Host,authentication_string FROM mysql.user;" 2>/dev/null | sed -${E} "s,.*,${SED_RED},"
+    mysql -u root -e "SELECT User,Host,plugin FROM mysql.user;" 2>/dev/null | sed -${E} "s,auth_socket|unix_socket|plugin,${SED_RED},g"
+    mysql -u root -e "SHOW VARIABLES LIKE 'secure_file_priv'; SHOW VARIABLES LIKE 'local_infile';" 2>/dev/null | sed -${E} "s,secure_file_priv|local_infile,${SED_RED},g"
   else echo_no
   fi
   echo ""
@@ -141,4 +143,4 @@ else
     ### ------------------------------------------------------------------------------------------------------------------------------------------------ ###
   
   fi
-fi
+fi

linPEAS/builder/linpeas_parts/variables/cronjobsB.sh

@@ -13,4 +13,4 @@
 # Small linpeas: 1
 
 
-cronjobsB="centreon"
+cronjobsB="centreon|pg_basebackup|run-parts|crontab-ui"