diff --git a/build_lists/sensitive_files.yaml b/build_lists/sensitive_files.yaml index fab2fff..e9a07a4 100644 --- a/build_lists/sensitive_files.yaml +++ b/build_lists/sensitive_files.yaml @@ -307,6 +307,31 @@ search: type: d search_in: - ${ROOT_FOLDER}etc + + - name: "system-local.d" + value: + type: d + search_in: + - ${ROOT_FOLDER}etc + + - name: "session.d" + value: + type: d + search_in: + - ${ROOT_FOLDER}etc + - ${ROOT_FOLDER}usr/share/dbus-1 + + - name: "system-services" + value: + type: d + search_in: + - ${ROOT_FOLDER}usr/share/dbus-1 + + - name: "services" + value: + type: d + search_in: + - ${ROOT_FOLDER}usr/share/dbus-1 - name: MySQL value: @@ -342,13 +367,20 @@ search: - name: "mysqld.cnf" value: - bad_regex: "user.*|password.*|admin_address.*|debug.*|sql_warnings.*|secure_file_priv.*" + bad_regex: "user.*|password.*|admin_address.*|debug.*|sql_warnings.*|secure_file_priv.*|local_infile.*" remove_regex: '^#' remove_empty_lines: True type: f search_in: - common + - name: ".mylogin.cnf" + value: + just_list_file: True + type: f + search_in: + - common + - name: MariaDB value: config: @@ -357,7 +389,7 @@ search: files: - name: "mariadb.cnf" value: - bad_regex: "user.*|password.*|admin_address.*|debug.*|sql_warnings.*|secure_file_priv.*" + bad_regex: "user.*|password.*|admin_address.*|debug.*|sql_warnings.*|secure_file_priv.*|local_infile.*" type: f remove_regex: '^#' remove_empty_lines: True @@ -390,7 +422,7 @@ search: - name: "pg_hba.conf" value: - bad_regex: "auth|password|md5|user=|pass=|trust" + bad_regex: "auth|password|md5|user=|pass=|trust|peer" type: f remove_empty_lines: True remove_regex: '\W+\#|^#' @@ -408,12 +440,21 @@ search: - name: "pgsql.conf" value: - bad_regex: "auth|password|md5|user=|pass=|trust" + bad_regex: "auth|password|md5|user=|pass=|trust|peer" type: f remove_empty_lines: True remove_regex: '\W+\#|^#' search_in: - common + + - name: ".pgpass" + value: + bad_regex: ".*" + remove_regex: '^#' + remove_empty_lines: True + type: f + search_in: + - common - name: "pgadmin4.db" value: @@ -440,7 +481,7 @@ search: files: - name: "*" value: - bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias|command on" + bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias|DocumentRoot|AllowOverride|ProxyPass|ProxyPassReverse|RemoteIPHeader|SetEnvIf.*X-Forwarded|ErrorDocument|server-status|command on" remove_empty_lines: True remove_regex: '#' search_in: @@ -448,7 +489,7 @@ search: - name: "000-default.conf" value: - bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias" + bad_regex: "AuthType|AuthName|AuthUserFile|ServerName|ServerAlias|DocumentRoot|AllowOverride|ProxyPass|ProxyPassReverse|RemoteIPHeader|SetEnvIf.*X-Forwarded|ErrorDocument|server-status" remove_regex: '#' type: f search_in: @@ -465,7 +506,7 @@ search: - name: "nginx.conf" value: - bad_regex: "location.*.php$|$uri|$document_uri|proxy_intercept_errors.*on|proxy_hide_header.*|merge_slashes.*on|resolver.*|proxy_pass|internal|location.+[a-zA-Z0-9][^/]\\s+\\{|map|proxy_set_header.*Upgrade.*http_upgrade|proxy_set_header.*Connection.*http_connection" + bad_regex: "location.*.php$|$uri|$document_uri|proxy_intercept_errors.*on|proxy_hide_header.*|merge_slashes.*on|resolver.*|proxy_pass|fastcgi_pass|alias|try_files|internal|location.+[a-zA-Z0-9][^/]\\s+\\{|map|proxy_set_header.*Upgrade.*http_upgrade|proxy_set_header.*Connection.*http_connection" remove_regex: "#" type: f remove_empty_lines: True @@ -478,7 +519,7 @@ search: files: - name: "*.conf" value: - bad_regex: "location.*.php$|$uri|$document_uri|proxy_intercept_errors.*on|proxy_hide_header.*|merge_slashes.*on|resolver.*|proxy_pass|internal|location.+[a-zA-Z0-9][^/]\\s+\\{|map|proxy_set_header.*Upgrade.*http_upgrade|proxy_set_header.*Connection.*http_connection" + bad_regex: "location.*.php$|$uri|$document_uri|proxy_intercept_errors.*on|proxy_hide_header.*|merge_slashes.*on|resolver.*|proxy_pass|fastcgi_pass|alias|try_files|internal|location.+[a-zA-Z0-9][^/]\\s+\\{|map|proxy_set_header.*Upgrade.*http_upgrade|proxy_set_header.*Connection.*http_connection" remove_empty_lines: True remove_regex: '#' remove_path: "nginx.conf" @@ -798,6 +839,18 @@ search: type: d search_in: - ${ROOT_FOLDER}etc + + - name: "wpa_supplicant" + value: + type: d + files: + - name: "*.conf" + value: + bad_regex: "psk.*|password.*|ssid.*" + only_bad_lines: True + type: f + search_in: + - ${ROOT_FOLDER}etc - name: PAM Auth value: @@ -1842,7 +1895,7 @@ search: files: - name: "redis.conf" value: - bad_regex: "masterauth.*|requirepass.*" + bad_regex: "masterauth.*|requirepass.*|rename-command.*|protected-mode.*no" type: f remove_empty_lines: True remove_regex: '\W+\#|^#' @@ -2915,6 +2968,15 @@ search: auto_check: True files: + - name: "aliases" + value: + bad_regex: "\\|" + only_bad_lines: True + remove_empty_lines: True + type: f + search_in: + - common + - name: "postfix" value: files: diff --git a/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/14_DBus_analysis.sh b/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/14_DBus_analysis.sh index 16031de..631dd9c 100644 --- a/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/14_DBus_analysis.sh +++ b/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/14_DBus_analysis.sh @@ -216,14 +216,34 @@ if ! [ "$SEARCH_IN_FOLDER" ]; then echo "" print_2title "D-Bus Configuration Files" "T1559.001" echo "$PSTORAGE_DBUS" | while read -r dir; do - for dbus_file in "$dir"/*; do - if [ -f "$dbus_file" ]; then - echo "Analyzing $dbus_file:" - if analyze_policy_file "$dbus_file"; then - echo " └─(${RED}Multiple weak policies found${NC})" - fi + [ -n "$dir" ] || continue + + if [ -f "$dir" ]; then + echo "Analyzing $dir:" + if analyze_policy_file "$dir"; then + echo " └─(${RED}Multiple weak policies found${NC})" fi - done + continue + fi + + [ -d "$dir" ] || continue + + case "$dir" in + */system-services|*/services) + echo "Activation definitions in $dir:" + grep -RInE '^(Name|Exec|User)=' "$dir" 2>/dev/null | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g" | sed "s,Exec=,${SED_RED}Exec=${NC},g" | sed "s,User=,${SED_RED}User=${NC},g" + ;; + *) + for dbus_file in "$dir"/*; do + if [ -f "$dbus_file" ]; then + echo "Analyzing $dbus_file:" + if analyze_policy_file "$dbus_file"; then + echo " └─(${RED}Multiple weak policies found${NC})" + fi + fi + done + ;; + esac done fi @@ -251,4 +271,4 @@ if ! [ "$SEARCH_IN_FOLDER" ]; then fi fi fi -echo "" \ No newline at end of file +echo "" diff --git a/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/17_Deleted_open_files.sh b/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/17_Deleted_open_files.sh index 3307f22..7ad7aea 100644 --- a/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/17_Deleted_open_files.sh +++ b/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/17_Deleted_open_files.sh @@ -18,9 +18,19 @@ if [ "$(command -v lsof 2>/dev/null || echo -n '')" ] || [ "$DEBUG" ]; then print_info "Open deleted files can hide tools and still consume disk space" lsof +L1 2>/dev/null | sed -${E} "s,\\(deleted\\),${SED_RED},g" echo "" + + print_2title "Deleted executables still running" "T1083" + print_info "A deleted /proc//exe may indicate tampering, cleanup, or a useful runtime-only binary" + ls -l /proc/[0-9]*/exe 2>/dev/null | grep "(deleted)" | sed -${E} "s,\\(deleted\\),${SED_RED},g" | head -n 200 + echo "" elif [ "$EXTRA_CHECKS" ] || [ "$DEBUG" ]; then print_2title "Deleted files still open" "T1083" print_info "lsof not found, scanning /proc for deleted file descriptors" ls -l /proc/[0-9]*/fd 2>/dev/null | grep "(deleted)" | sed -${E} "s,\\(deleted\\),${SED_RED},g" | head -n 200 echo "" + + print_2title "Deleted executables still running" "T1083" + print_info "Scanning /proc//exe for deleted runtime binaries" + ls -l /proc/[0-9]*/exe 2>/dev/null | grep "(deleted)" | sed -${E} "s,\\(deleted\\),${SED_RED},g" | head -n 200 + echo "" fi diff --git a/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/7_Cron_jobs.sh b/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/7_Cron_jobs.sh index e62e00e..c8e2cbf 100644 --- a/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/7_Cron_jobs.sh +++ b/linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/7_Cron_jobs.sh @@ -25,11 +25,20 @@ if ! [ "$SEARCH_IN_FOLDER" ]; then ls -alR /etc/cron* /var/spool/cron/crontabs /var/spool/anacron 2>/dev/null | sed -${E} "s,$cronjobsG,${SED_GREEN},g" | sed "s,$cronjobsB,${SED_RED},g" cat /etc/cron* /etc/at* /etc/anacrontab /var/spool/cron/crontabs/* /etc/incron.d/* /var/spool/incron/* 2>/dev/null | tr -d "\r" | grep -v "^#" | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g" | sed -${E} "s,$sh_usrs,${SED_LIGHT_CYAN}," | sed "s,$USER,${SED_LIGHT_MAGENTA}," | sed -${E} "s,$nosh_usrs,${SED_BLUE}," | sed "s,root,${SED_RED}," grep -Hn '^PATH=' /etc/crontab /etc/cron.d/* 2>/dev/null | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g" + grep -RInE 'pg_basebackup|run-parts|crontab-ui' /etc/crontab /etc/cron.d /etc/anacrontab /var/spool/cron/crontabs /etc/incron.d /var/spool/incron 2>/dev/null | sed -${E} "s,$cronjobsB,${SED_RED},g" | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g" crontab -l -u "$USER" 2>/dev/null | tr -d "\r" ls -lR /usr/lib/cron/tabs/ /private/var/at/jobs /var/at/tabs/ /etc/periodic/ 2>/dev/null | sed -${E} "s,$cronjobsG,${SED_GREEN},g" | sed "s,$cronjobsB,${SED_RED},g" #MacOS paths atq 2>/dev/null echo "" + print_3title "Cron files with hidden carriage returns" "T1053.003" + grep -IRl $'\r' /etc/crontab /etc/cron.d /var/spool/cron/crontabs 2>/dev/null | while read -r file; do + [ -n "$file" ] || continue + echo "$file" | sed -${E} "s,.*,${SED_RED},g" + sed -n 'l' "$file" 2>/dev/null | head -n 20 + done + echo "" + print_3title "Checking for specific cron jobs vulnerabilities" "T1053.003" # Function to check if a binary is writable and executable check_binary_perms() { @@ -213,6 +222,16 @@ if ! [ "$SEARCH_IN_FOLDER" ]; then fi done + if command -v run-parts >/dev/null 2>&1; then + print_3title "run-parts executable entries" "T1053.003" + for cron_dir in /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly; do + [ -d "$cron_dir" ] || continue + echo "[$cron_dir]" + run-parts --test "$cron_dir" 2>/dev/null | sed -${E} "s,$Wfolders,${SED_RED_YELLOW},g" + done + echo "" + fi + # Check for at jobs #if command -v atq >/dev/null 2>&1; then # echo "Checking at jobs..." diff --git a/linPEAS/builder/linpeas_parts/7_software_information/Mysql.sh b/linPEAS/builder/linpeas_parts/7_software_information/Mysql.sh index 29a92e5..12a9889 100644 --- a/linPEAS/builder/linpeas_parts/7_software_information/Mysql.sh +++ b/linPEAS/builder/linpeas_parts/7_software_information/Mysql.sh @@ -100,6 +100,8 @@ if [ "$(command -v mysql || echo -n '')" ] || [ "$(command -v mysqladmin || echo if [ "$mysqlconnectnopass" ]; then echo "Yes" | sed -${E} "s,.*,${SED_RED}," mysql -u root -e "SELECT User,Host,authentication_string FROM mysql.user;" 2>/dev/null | sed -${E} "s,.*,${SED_RED}," + mysql -u root -e "SELECT User,Host,plugin FROM mysql.user;" 2>/dev/null | sed -${E} "s,auth_socket|unix_socket|plugin,${SED_RED},g" + mysql -u root -e "SHOW VARIABLES LIKE 'secure_file_priv'; SHOW VARIABLES LIKE 'local_infile';" 2>/dev/null | sed -${E} "s,secure_file_priv|local_infile,${SED_RED},g" else echo_no fi echo "" @@ -141,4 +143,4 @@ else ### ------------------------------------------------------------------------------------------------------------------------------------------------ ### fi -fi \ No newline at end of file +fi diff --git a/linPEAS/builder/linpeas_parts/variables/cronjobsB.sh b/linPEAS/builder/linpeas_parts/variables/cronjobsB.sh index 920e63d..b45c414 100644 --- a/linPEAS/builder/linpeas_parts/variables/cronjobsB.sh +++ b/linPEAS/builder/linpeas_parts/variables/cronjobsB.sh @@ -13,4 +13,4 @@ # Small linpeas: 1 -cronjobsB="centreon" \ No newline at end of file +cronjobsB="centreon|pg_basebackup|run-parts|crontab-ui"