API tools faq
paste
Advertisement
Guest User

root.sh

a guest
Jan 21st, 2019
94
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 67.68 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2.  
  3. VERSION=v0.9
  4. cat << "EOF"
  5.  
  6. ██▓ ▄████▄ ██░ ██ ▓█████ ▒██ ██▒ ██▓███ ██▓ ▒█████ ██▓▄▄▄█████▓▓█████ ██▀███
  7. ▓██▒▒██▀ ▀█ ▓██░ ██▒ ▓█ ▀ ▒▒ █ █ ▒░▓██░ ██▒▓██▒ ▒██▒ ██▒▓██▒▓ ██▒ ▓▒▓█ ▀ ▓██ ▒ ██▒
  8. ▒██▒▒▓█ ▄ ▒██▀▀██░ ▒███ ░░ █ ░▓██░ ██▓▒▒██░ ▒██░ ██▒▒██▒▒ ▓██░ ▒░▒███ ▓██ ░▄█ ▒
  9. ░██░▒▓▓▄ ▄██▒░▓█ ░██ ▒▓█ ▄ ░ █ █ ▒ ▒██▄█▓▒ ▒▒██░ ▒██ ██░░██░░ ▓██▓ ░ ▒▓█ ▄ ▒██▀▀█▄
  10. ░██░▒ ▓███▀ ░░▓█▒░██▓ ░▒████▒▒██▒ ▒██▒▒██▒ ░ ░░██████▒░ ████▓▒░░██░ ▒██▒ ░ ░▒████▒░██▓ ▒██▒
  11. ░▓ ░ ░▒ ▒ ░ ▒ ░░▒░▒ ░░ ▒░ ░▒▒ ░ ░▓ ░▒▓▒░ ░ ░░ ▒░▓ ░░ ▒░▒░▒░ ░▓ ▒ ░░ ░░ ▒░ ░░ ▒▓ ░▒▓░
  12. ▒ ░ ░ ▒ ▒ ░▒░ ░ ░ ░ ░░░ ░▒ ░░▒ ░ ░ ░ ▒ ░ ░ ▒ ▒░ ▒ ░ ░ ░ ░ ░ ░▒ ░ ▒░
  13. ▒ ░░ ░ ░░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ▒ ▒ ░ ░ ░ ░░ ░
  14. ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░
  15. ░
  16. EOF
  17. # bash colors
  18. #txtred="\e[0;31m"
  19. txtred="\e[91;1m"
  20. txtgrn="\e[1;32m"
  21. txtgray="\e[1;30m"
  22. txtblu="\e[0;36m"
  23. txtrst="\e[0m"
  24. bldwht='\e[1;37m'
  25. bldblu='\e[1;34m'
  26. yellow='\e[1;93m'
  27. lightyellow='\e[0;93m'
  28.  
  29. # input data
  30. UNAME_A=""
  31.  
  32. # parsed data for current OS
  33. KERNEL=""
  34. OS=""
  35. DISTRO=""
  36. ARCH=""
  37. PKG_LIST=""
  38.  
  39. # kernel config
  40. KCONFIG=""
  41.  
  42. CVELIST_FILE=""
  43.  
  44. opt_fetch_bins=false
  45. opt_fetch_srcs=false
  46. opt_kernel_version=false
  47. opt_uname_string=false
  48. opt_pkglist_file=false
  49. opt_cvelist_file=false
  50. opt_checksec_mode=false
  51. opt_full=false
  52. opt_summary=false
  53. opt_kernel_only=false
  54. opt_userspace_only=false
  55. opt_show_dos=false
  56. opt_skip_more_checks=false
  57. opt_skip_pkg_versions=false
  58.  
  59. ARGS=
  60. SHORTOPTS="hVfbsu:k:dp:g"
  61. LONGOPTS="help,version,full,fetch-binaries,fetch-sources,uname:,kernel:,show-dos,pkglist-file:,short,kernelspace-only,userspace-only,skip-more-checks,skip-pkg-versions,cvelist-file:,checksec"
  62.  
  63. ## exploits database
  64. declare -a EXPLOITS
  65. declare -a EXPLOITS_USERSPACE
  66.  
  67. ############ LINUX KERNELSPACE EXPLOITS ####################
  68. n=0
  69.  
  70. EXPLOITS[((n++))]=$(cat <<EOF
  71. Name: ${txtgrn}[CVE-2004-1235]${txtrst} elflbl
  72. Reqs: pkg=linux-kernel,ver=2.4.29
  73. Tags:
  74. analysis-url: http://isec.pl/vulnerabilities/isec-0021-uselib.txt
  75. bin-url: https://web.archive.org/web/20111103042904/http://tarantula.by.ru/localroot/2.6.x/elflbl
  76. exploit-db: 744
  77. EOF
  78. )
  79.  
  80. EXPLOITS[((n++))]=$(cat <<EOF
  81. Name: ${txtgrn}[CVE-2004-1235]${txtrst} uselib()
  82. Reqs: pkg=linux-kernel,ver=2.4.29
  83. Tags:
  84. analysis-url: http://isec.pl/vulnerabilities/isec-0021-uselib.txt
  85. exploit-db: 778
  86. Comments: Known to work only for 2.4 series (even though 2.6 is also vulnerable)
  87. EOF
  88. )
  89.  
  90. EXPLOITS[((n++))]=$(cat <<EOF
  91. Name: ${txtgrn}[CVE-2004-1235]${txtrst} krad3
  92. Reqs: pkg=linux-kernel,ver>=2.6.5,ver<=2.6.11
  93. Tags:
  94. exploit-db: 1397
  95. EOF
  96. )
  97.  
  98. EXPLOITS[((n++))]=$(cat <<EOF
  99. Name: ${txtgrn}[CVE-2004-0077]${txtrst} mremap_pte
  100. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.2
  101. Tags:
  102. exploit-db: 160
  103. EOF
  104. )
  105.  
  106. EXPLOITS[((n++))]=$(cat <<EOF
  107. Name: ${txtgrn}[CVE-2006-2451]${txtrst} raptor_prctl
  108. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  109. Tags:
  110. exploit-db: 2031
  111. EOF
  112. )
  113.  
  114. EXPLOITS[((n++))]=$(cat <<EOF
  115. Name: ${txtgrn}[CVE-2006-2451]${txtrst} prctl
  116. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  117. Tags:
  118. exploit-db: 2004
  119. EOF
  120. )
  121.  
  122. EXPLOITS[((n++))]=$(cat <<EOF
  123. Name: ${txtgrn}[CVE-2006-2451]${txtrst} prctl2
  124. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  125. Tags:
  126. exploit-db: 2005
  127. EOF
  128. )
  129.  
  130. EXPLOITS[((n++))]=$(cat <<EOF
  131. Name: ${txtgrn}[CVE-2006-2451]${txtrst} prctl3
  132. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  133. Tags:
  134. exploit-db: 2006
  135. EOF
  136. )
  137.  
  138. EXPLOITS[((n++))]=$(cat <<EOF
  139. Name: ${txtgrn}[CVE-2006-2451]${txtrst} prctl4
  140. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  141. Tags:
  142. exploit-db: 2011
  143. EOF
  144. )
  145.  
  146. EXPLOITS[((n++))]=$(cat <<EOF
  147. Name: ${txtgrn}[CVE-2006-3626]${txtrst} h00lyshit
  148. Reqs: pkg=linux-kernel,ver>=2.6.8,ver<=2.6.16
  149. Tags:
  150. bin-url: https://web.archive.org/web/20111103042904/http://tarantula.by.ru/localroot/2.6.x/h00lyshit
  151. exploit-db: 2013
  152. EOF
  153. )
  154.  
  155. EXPLOITS[((n++))]=$(cat <<EOF
  156. Name: ${txtgrn}[CVE-2008-0600]${txtrst} vmsplice1
  157. Reqs: pkg=linux-kernel,ver>=2.6.17,ver<=2.6.24
  158. Tags:
  159. exploit-db: 5092
  160. EOF
  161. )
  162.  
  163. EXPLOITS[((n++))]=$(cat <<EOF
  164. Name: ${txtgrn}[CVE-2008-0600]${txtrst} vmsplice2
  165. Reqs: pkg=linux-kernel,ver>=2.6.23,ver<=2.6.24
  166. Tags:
  167. exploit-db: 5093
  168. EOF
  169. )
  170.  
  171. EXPLOITS[((n++))]=$(cat <<EOF
  172. Name: ${txtgrn}[CVE-2008-4210]${txtrst} ftrex
  173. Reqs: pkg=linux-kernel,ver>=2.6.11,ver<=2.6.22
  174. Tags:
  175. exploit-db: 6851
  176. Comments: world-writable sgid directory and shell that does not drop sgid privs upon exec (ash/sash) are required
  177. EOF
  178. )
  179.  
  180. EXPLOITS[((n++))]=$(cat <<EOF
  181. Name: ${txtgrn}[CVE-2008-4210]${txtrst} exit_notify
  182. Reqs: pkg=linux-kernel,ver>=2.6.25,ver<=2.6.29
  183. Tags:
  184. exploit-db: 8369
  185. EOF
  186. )
  187.  
  188. EXPLOITS[((n++))]=$(cat <<EOF
  189. Name: ${txtgrn}[CVE-2009-2692]${txtrst} sock_sendpage (simple version)
  190. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  191. Tags: ubuntu=7.10,RHEL=4,fedora=4|5|6|7|8|9|10|11
  192. exploit-db: 9479
  193. Comments: Works for systems with /proc/sys/vm/mmap_min_addr equal to 0
  194. EOF
  195. )
  196.  
  197. EXPLOITS[((n++))]=$(cat <<EOF
  198. Name: ${txtgrn}[CVE-2009-2692,CVE-2009-1895]${txtrst} sock_sendpage
  199. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  200. Tags: ubuntu=9.04
  201. analysis-url: https://xorl.wordpress.com/2009/07/16/cve-2009-1895-linux-kernel-per_clear_on_setid-personality-bypass/
  202. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/9435.tgz
  203. exploit-db: 9435
  204. Comments: /proc/sys/vm/mmap_min_addr needs to equal 0 OR pulseaudio needs to be installed
  205. EOF
  206. )
  207.  
  208. EXPLOITS[((n++))]=$(cat <<EOF
  209. Name: ${txtgrn}[CVE-2009-2692,CVE-2009-1895]${txtrst} sock_sendpage2
  210. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  211. Tags:
  212. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/9436.tgz
  213. exploit-db: 9436
  214. Comments: Works for systems with /proc/sys/vm/mmap_min_addr equal to 0
  215. EOF
  216. )
  217.  
  218. EXPLOITS[((n++))]=$(cat <<EOF
  219. Name: ${txtgrn}[CVE-2009-2692,CVE-2009-1895]${txtrst} sock_sendpage3
  220. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  221. Tags:
  222. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/9641.tar.gz
  223. exploit-db: 9641
  224. Comments: /proc/sys/vm/mmap_min_addr needs to equal 0 OR pulseaudio needs to be installed
  225. EOF
  226. )
  227.  
  228. EXPLOITS[((n++))]=$(cat <<EOF
  229. Name: ${txtgrn}[CVE-2009-2692,CVE-2009-1895]${txtrst} sock_sendpage (ppc)
  230. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  231. Tags: ubuntu=8.10,RHEL=4|5
  232. exploit-db: 9545
  233. Comments: /proc/sys/vm/mmap_min_addr needs to equal 0
  234. EOF
  235. )
  236.  
  237. EXPLOITS[((n++))]=$(cat <<EOF
  238. Name: ${txtgrn}[CVE-2009-2698]${txtrst} udp_sendmsg (by spender)
  239. Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19
  240. Tags:
  241. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/9574.tgz
  242. exploit-db: 9574
  243. EOF
  244. )
  245.  
  246. EXPLOITS[((n++))]=$(cat <<EOF
  247. Name: ${txtgrn}[CVE-2009-2698]${txtrst} udp_sendmsg
  248. Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19
  249. Tags: debian=4
  250. exploit-db: 9575
  251. EOF
  252. )
  253.  
  254. EXPLOITS[((n++))]=$(cat <<EOF
  255. Name: ${txtgrn}[CVE-2009-2698]${txtrst} ip_append_data
  256. Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19,x86
  257. Tags: fedora=4|5|6,RHEL=4
  258. exploit-db: 9542
  259. EOF
  260. )
  261.  
  262. EXPLOITS[((n++))]=$(cat <<EOF
  263. Name: ${txtgrn}[CVE-2009-3547]${txtrst} pipe.c 1
  264. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.31
  265. Tags:
  266. exploit-db: 33321
  267. EOF
  268. )
  269.  
  270. EXPLOITS[((n++))]=$(cat <<EOF
  271. Name: ${txtgrn}[CVE-2009-3547]${txtrst} pipe.c 2
  272. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.31
  273. Tags:
  274. exploit-db: 33322
  275. EOF
  276. )
  277.  
  278. EXPLOITS[((n++))]=$(cat <<EOF
  279. Name: ${txtgrn}[CVE-2009-3547]${txtrst} pipe.c 3
  280. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.31
  281. Tags:
  282. exploit-db: 10018
  283. EOF
  284. )
  285.  
  286. EXPLOITS[((n++))]=$(cat <<EOF
  287. Name: ${txtgrn}[CVE-2010-3301]${txtrst} ptrace_kmod2
  288. Reqs: pkg=linux-kernel,ver>=2.6.26,ver<=2.6.34
  289. Tags: debian=6,ubuntu=10.04|10.10
  290. bin-url: https://web.archive.org/web/20111103042904/http://tarantula.by.ru/localroot/2.6.x/kmod2
  291. bin-url: https://web.archive.org/web/20111103042904/http://tarantula.by.ru/localroot/2.6.x/ptrace-kmod
  292. bin-url: https://web.archive.org/web/20160602192641/https://www.kernel-exploits.com/media/ptrace_kmod2-64
  293. exploit-db: 15023
  294. EOF
  295. )
  296.  
  297. EXPLOITS[((n++))]=$(cat <<EOF
  298. Name: ${txtgrn}[CVE-2010-1146]${txtrst} reiserfs
  299. Reqs: pkg=linux-kernel,ver>=2.6.18,ver<=2.6.34
  300. Tags: ubuntu=9.10
  301. exploit-db: 12130
  302. EOF
  303. )
  304.  
  305. EXPLOITS[((n++))]=$(cat <<EOF
  306. Name: ${txtgrn}[CVE-2010-2959]${txtrst} can_bcm
  307. Reqs: pkg=linux-kernel,ver>=2.6.18,ver<=2.6.36
  308. Tags: ubuntu=10.04
  309. bin-url: https://web.archive.org/web/20160602192641/https://www.kernel-exploits.com/media/can_bcm
  310. exploit-db: 14814
  311. EOF
  312. )
  313.  
  314. EXPLOITS[((n++))]=$(cat <<EOF
  315. Name: ${txtgrn}[CVE-2010-3904]${txtrst} rds
  316. Reqs: pkg=linux-kernel,ver>=2.6.30,ver<2.6.37
  317. Tags: debian=6,ubuntu=10.10|9.10,fedora=13{kernel:2.6.33.3-85.fc13.i686.PAE},ubuntu=10.04{kernel:2.6.32-21-generic}
  318. analysis-url: http://www.securityfocus.com/archive/1/514379
  319. src-url: http://web.archive.org/web/20101020044048/http://www.vsecurity.com/download/tools/linux-rds-exploit.c
  320. bin-url: https://web.archive.org/web/20160602192641/https://www.kernel-exploits.com/media/rds
  321. bin-url: https://web.archive.org/web/20160602192641/https://www.kernel-exploits.com/media/rds64
  322. exploit-db: 15285
  323. EOF
  324. )
  325.  
  326. EXPLOITS[((n++))]=$(cat <<EOF
  327. Name: ${txtgrn}[CVE-2010-3848,CVE-2010-3850,CVE-2010-4073]${txtrst} half_nelson
  328. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.36
  329. Tags: ubuntu=10.04|9.10
  330. bin-url: http://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/half-nelson3
  331. exploit-db: 17787
  332. EOF
  333. )
  334.  
  335. EXPLOITS[((n++))]=$(cat <<EOF
  336. Name: ${txtgrn}[N/A]${txtrst} caps_to_root
  337. Reqs: pkg=linux-kernel,ver>=2.6.34,ver<=2.6.36,x86
  338. Tags: ubuntu=10.10
  339. exploit-db: 15916
  340. EOF
  341. )
  342.  
  343. EXPLOITS[((n++))]=$(cat <<EOF
  344. Name: ${txtgrn}[N/A]${txtrst} caps_to_root 2
  345. Reqs: pkg=linux-kernel,ver>=2.6.34,ver<=2.6.36
  346. Tags: ubuntu=10.10
  347. exploit-db: 15944
  348. EOF
  349. )
  350.  
  351. EXPLOITS[((n++))]=$(cat <<EOF
  352. Name: ${txtgrn}[CVE-2010-4347]${txtrst} american-sign-language
  353. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.36
  354. Tags:
  355. exploit-db: 15774
  356. EOF
  357. )
  358.  
  359. EXPLOITS[((n++))]=$(cat <<EOF
  360. Name: ${txtgrn}[CVE-2010-3437]${txtrst} pktcdvd
  361. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.36
  362. Tags: ubuntu=10.04
  363. exploit-db: 15150
  364. EOF
  365. )
  366.  
  367. EXPLOITS[((n++))]=$(cat <<EOF
  368. Name: ${txtgrn}[CVE-2010-3081]${txtrst} video4linux
  369. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.33
  370. Tags: RHEL=5
  371. exploit-db: 15024
  372. EOF
  373. )
  374.  
  375. EXPLOITS[((n++))]=$(cat <<EOF
  376. Name: ${txtgrn}[CVE-2012-0056]${txtrst} memodipper
  377. Reqs: pkg=linux-kernel,ver>=3.0.0,ver<=3.1.0
  378. Tags: ubuntu=10.04|11.10
  379. analysis-url: https://git.zx2c4.com/CVE-2012-0056/about/
  380. src-url: https://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c
  381. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/memodipper
  382. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/memodipper64
  383. exploit-db: 18411
  384. EOF
  385. )
  386.  
  387. EXPLOITS[((n++))]=$(cat <<EOF
  388. Name: ${txtgrn}[CVE-2012-0056,CVE-2010-3849,CVE-2010-3850]${txtrst} full-nelson
  389. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.36
  390. Tags: ubuntu=9.10|10.04|10.10,ubuntu=10.04.1
  391. src-url: http://vulnfactory.org/exploits/full-nelson.c
  392. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/full-nelson
  393. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/full-nelson64
  394. exploit-db: 15704
  395. EOF
  396. )
  397.  
  398. EXPLOITS[((n++))]=$(cat <<EOF
  399. Name: ${txtgrn}[CVE-2013-1858]${txtrst} CLONE_NEWUSER|CLONE_FS
  400. Reqs: pkg=linux-kernel,ver=3.8,CONFIG_USER_NS=y
  401. Tags:
  402. src-url: http://stealth.openwall.net/xSports/clown-newuser.c
  403. analysis-url: https://lwn.net/Articles/543273/
  404. exploit-db: 38390
  405. author: Sebastian Krahmer
  406. Comments: CONFIG_USER_NS needs to be enabled
  407. EOF
  408. )
  409.  
  410. EXPLOITS[((n++))]=$(cat <<EOF
  411. Name: ${txtgrn}[CVE-2013-2094]${txtrst} perf_swevent
  412. Reqs: pkg=linux-kernel,ver>=2.6.32,ver<3.8.9
  413. Tags: RHEL=6,ubuntu=12.04
  414. analysis-url: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
  415. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/perf_swevent
  416. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/perf_swevent64
  417. exploit-db: 26131
  418. EOF
  419. )
  420.  
  421. EXPLOITS[((n++))]=$(cat <<EOF
  422. Name: ${txtgrn}[CVE-2013-2094]${txtrst} perf_swevent 2
  423. Reqs: pkg=linux-kernel,ver>=2.6.32,ver<3.8.9,x86_64
  424. Tags: ubuntu=12.04
  425. analysis-url: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
  426. src-url: https://cyseclabs.com/exploits/vnik_v1.c
  427. exploit-db: 33589
  428. EOF
  429. )
  430.  
  431. EXPLOITS[((n++))]=$(cat <<EOF
  432. Name: ${txtgrn}[CVE-2013-0268]${txtrst} msr
  433. Reqs: pkg=linux-kernel,ver>=2.6.18,ver<3.7.6
  434. Tags:
  435. exploit-db: 27297
  436. EOF
  437. )
  438.  
  439. EXPLOITS[((n++))]=$(cat <<EOF
  440. Name: ${txtgrn}[CVE-2013-1959]${txtrst} userns_root_sploit
  441. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<3.8.9
  442. Tags:
  443. analysis-url: http://www.openwall.com/lists/oss-security/2013/04/29/1
  444. exploit-db: 25450
  445. EOF
  446. )
  447.  
  448. EXPLOITS[((n++))]=$(cat <<EOF
  449. Name: ${txtgrn}[CVE-2013-2094]${txtrst} semtex
  450. Reqs: pkg=linux-kernel,ver>=2.6.32,ver<3.8.9
  451. Tags: RHEL=6
  452. analysis-url: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
  453. exploit-db: 25444
  454. EOF
  455. )
  456.  
  457. EXPLOITS[((n++))]=$(cat <<EOF
  458. Name: ${txtgrn}[CVE-2014-0038]${txtrst} timeoutpwn
  459. Reqs: pkg=linux-kernel,ver>=3.4.0,ver<=3.13.1,CONFIG_X86_X32=y
  460. Tags: ubuntu=13.10
  461. analysis-url: http://blog.includesecurity.com/2014/03/exploit-CVE-2014-0038-x32-recvmmsg-kernel-vulnerablity.html
  462. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/timeoutpwn64
  463. exploit-db: 31346
  464. Comments: CONFIG_X86_X32 needs to be enabled
  465. EOF
  466. )
  467.  
  468. EXPLOITS[((n++))]=$(cat <<EOF
  469. Name: ${txtgrn}[CVE-2014-0038]${txtrst} timeoutpwn 2
  470. Reqs: pkg=linux-kernel,ver>=3.4.0,ver<=3.13.1,CONFIG_X86_X32=y
  471. Tags: ubuntu=13.10|13.04
  472. analysis-url: http://blog.includesecurity.com/2014/03/exploit-CVE-2014-0038-x32-recvmmsg-kernel-vulnerablity.html
  473. exploit-db: 31347
  474. Comments: CONFIG_X86_X32 needs to be enabled
  475. EOF
  476. )
  477.  
  478. EXPLOITS[((n++))]=$(cat <<EOF
  479. Name: ${txtgrn}[CVE-2014-0196]${txtrst} rawmodePTY
  480. Reqs: pkg=linux-kernel,ver>=2.6.31,ver<=3.14.3
  481. Tags:
  482. analysis-url: http://blog.includesecurity.com/2014/06/exploit-walkthrough-cve-2014-0196-pty-kernel-race-condition.html
  483. exploit-db: 33516
  484. EOF
  485. )
  486.  
  487. EXPLOITS[((n++))]=$(cat <<EOF
  488. Name: ${txtgrn}[CVE-2014-2851]${txtrst} use-after-free in ping_init_sock() ${bldblu}(DoS)${txtrst}
  489. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<=3.14
  490. Tags:
  491. analysis-url: https://cyseclabs.com/page?n=02012016
  492. exploit-db: 32926
  493. EOF
  494. )
  495.  
  496. EXPLOITS[((n++))]=$(cat <<EOF
  497. Name: ${txtgrn}[CVE-2014-4014]${txtrst} inode_capable
  498. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<=3.13
  499. Tags: ubuntu=12.04
  500. analysis-url: http://www.openwall.com/lists/oss-security/2014/06/10/4
  501. exploit-db: 33824
  502. EOF
  503. )
  504.  
  505. EXPLOITS[((n++))]=$(cat <<EOF
  506. Name: ${txtgrn}[CVE-2014-4699]${txtrst} ptrace/sysret
  507. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<=3.8
  508. Tags: ubuntu=12.04
  509. analysis-url: http://www.openwall.com/lists/oss-security/2014/07/08/16
  510. exploit-db: 34134
  511. EOF
  512. )
  513.  
  514. EXPLOITS[((n++))]=$(cat <<EOF
  515. Name: ${txtgrn}[CVE-2014-4943]${txtrst} PPPoL2TP ${bldblu}(DoS)${txtrst}
  516. Reqs: pkg=linux-kernel,ver>=3.2,ver<=3.15.6
  517. Tags:
  518. analysis-url: https://cyseclabs.com/page?n=01102015
  519. exploit-db: 36267
  520. EOF
  521. )
  522.  
  523. EXPLOITS[((n++))]=$(cat <<EOF
  524. Name: ${txtgrn}[CVE-2014-5207]${txtrst} fuse_suid
  525. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<=3.16.1
  526. Tags:
  527. exploit-db: 34923
  528. EOF
  529. )
  530.  
  531. EXPLOITS[((n++))]=$(cat <<EOF
  532. Name: ${txtgrn}[CVE-2015-9322]${txtrst} BadIRET
  533. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<3.17.5,x86_64
  534. Tags: RHEL<=7,fedora=20
  535. analysis-url: http://labs.bromium.com/2015/02/02/exploiting-badiret-vulnerability-cve-2014-9322-linux-kernel-privilege-escalation/
  536. src-url: http://site.pi3.com.pl/exp/p_cve-2014-9322.tar.gz
  537. exploit-db:
  538. author: Rafal 'n3rgal' Wojtczuk & Adam 'pi3' Zabrocki
  539. EOF
  540. )
  541.  
  542. EXPLOITS[((n++))]=$(cat <<EOF
  543. Name: ${txtgrn}[CVE-2015-3290]${txtrst} espfix64_NMI
  544. Reqs: pkg=linux-kernel,ver>=3.13,ver<4.1.6,x86_64
  545. Tags:
  546. analysis-url: http://www.openwall.com/lists/oss-security/2015/08/04/8
  547. exploit-db: 37722
  548. EOF
  549. )
  550.  
  551. EXPLOITS[((n++))]=$(cat <<EOF
  552. Name: ${txtgrn}[N/A]${txtrst} bluetooth
  553. Reqs: pkg=linux-kernel,ver<=2.6.11
  554. Tags:
  555. exploit-db: 4756
  556. EOF
  557. )
  558.  
  559. EXPLOITS[((n++))]=$(cat <<EOF
  560. Name: ${txtgrn}[CVE-2015-1328]${txtrst} overlayfs
  561. Reqs: pkg=linux-kernel,ver>=3.13.0,ver<=3.19.0
  562. Tags: ubuntu=12.04|14.04|14.10|15.04
  563. analysis-url: http://seclists.org/oss-sec/2015/q2/717
  564. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/ofs_32
  565. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/ofs_64
  566. exploit-db: 37292
  567. EOF
  568. )
  569.  
  570. EXPLOITS[((n++))]=$(cat <<EOF
  571. Name: ${txtgrn}[CVE-2015-8660]${txtrst} overlayfs (ovl_setattr)
  572. Reqs: pkg=linux-kernel,ver>=3.0.0,ver<=4.3.3
  573. Tags:
  574. analysis-url: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/
  575. exploit-db: 39230
  576. EOF
  577. )
  578.  
  579. EXPLOITS[((n++))]=$(cat <<EOF
  580. Name: ${txtgrn}[CVE-2015-8660]${txtrst} overlayfs (ovl_setattr)
  581. Reqs: pkg=linux-kernel,ver>=3.0.0,ver<=4.3.3
  582. Tags: ubuntu=14.04|15.10
  583. analysis-url: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/
  584. exploit-db: 39166
  585. EOF
  586. )
  587.  
  588. EXPLOITS[((n++))]=$(cat <<EOF
  589. Name: ${txtgrn}[CVE-2016-0728]${txtrst} keyring
  590. Reqs: pkg=linux-kernel,ver>=3.10,ver<4.4.1
  591. Tags:
  592. analysis-url: http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
  593. exploit-db: 40003
  594. Comments: Exploit takes about ~30 minutes to run. Exploit is not reliable, see: https://cyseclabs.com/blog/cve-2016-0728-poc-not-working
  595. EOF
  596. )
  597.  
  598. EXPLOITS[((n++))]=$(cat <<EOF
  599. Name: ${txtgrn}[CVE-2016-2384]${txtrst} usb-midi
  600. Reqs: pkg=linux-kernel,ver>=3.0.0,ver<=4.4.8
  601. Tags: ubuntu=14.04,fedora=22
  602. analysis-url: https://xairy.github.io/blog/2016/cve-2016-2384
  603. src-url: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-2384/poc.c
  604. exploit-db: 41999
  605. Comments: Requires ability to plug in a malicious USB device and to execute a malicious binary as a non-privileged user
  606. author: Andrey 'xairy' Konovalov
  607. EOF
  608. )
  609.  
  610. EXPLOITS[((n++))]=$(cat <<EOF
  611. Name: ${txtgrn}[N/A]${txtrst} target_offset
  612. Reqs: pkg=linux-kernel,ver>=4.4.0,ver<=4.4.0,cmd:grep -qi ip_tables /proc/modules
  613. Tags: ubuntu=16.04{kernel:4.4.0-21}
  614. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/40053.zip
  615. Comments: ip_tables.ko needs to be loaded
  616. exploit-db: 40049
  617. author: Vitaly Nikolenko (vnik)
  618. EOF
  619. )
  620.  
  621. EXPLOITS[((n++))]=$(cat <<EOF
  622. Name: ${txtgrn}[CVE-2016-4557]${txtrst} double-fdput()
  623. Reqs: pkg=linux-kernel,ver>=4.4,ver<4.5.5,CONFIG_BPF_SYSCALL=y,sysctl:kernel.unprivileged_bpf_disabled!=1
  624. Tags: ubuntu=16.04{kernel:4.4.0-21-generic}
  625. analysis-url: https://bugs.chromium.org/p/project-zero/issues/detail?id=808
  626. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/39772.zip
  627. Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1
  628. exploit-db: 40759
  629. author: Jann Horn
  630. EOF
  631. )
  632.  
  633. EXPLOITS[((n++))]=$(cat <<EOF
  634. Name: ${txtgrn}[CVE-2016-5195]${txtrst} dirtycow
  635. Reqs: pkg=linux-kernel,ver>=2.6.22,ver<=4.8.3
  636. Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},ubuntu=16.04|14.04|12.04
  637. analysis-url: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
  638. Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh
  639. exploit-db: 40611
  640. author: Phil Oester
  641. EOF
  642. )
  643.  
  644. EXPLOITS[((n++))]=$(cat <<EOF
  645. Name: ${txtgrn}[CVE-2016-5195]${txtrst} dirtycow 2
  646. Reqs: pkg=linux-kernel,ver>=2.6.22,ver<=4.8.3
  647. Tags: debian=7|8,RHEL=5|6|7,ubuntu=14.04|12.04,ubuntu=10.04{kernel:2.6.32-21-generic},ubuntu=16.04{kernel:4.4.0-21-generic}
  648. analysis-url: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
  649. ext-url: https://www.exploit-db.com/download/40847.cpp
  650. Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh
  651. exploit-db: 40839
  652. author: FireFart (author of exploit at EDB 40839); Gabriele Bonacini (author of exploit at 'ext-url')
  653. EOF
  654. )
  655.  
  656. EXPLOITS[((n++))]=$(cat <<EOF
  657. Name: ${txtgrn}[CVE-2016-8655]${txtrst} chocobo_root
  658. Reqs: pkg=linux-kernel,ver>=4.4.0,ver<4.9,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1
  659. Tags: ubuntu=(14.04|16.04){kernel:4.4.0-(21|22|24|28|31|34|36|38|42|43|45|47|51)-generic}
  660. analysis-url: http://www.openwall.com/lists/oss-security/2016/12/06/1
  661. Comments: CAP_NET_RAW capability is needed OR CONFIG_USER_NS=y needs to be enabled
  662. exploit-db: 40871
  663. author: rebel
  664. EOF
  665. )
  666.  
  667. EXPLOITS[((n++))]=$(cat <<EOF
  668. Name: ${txtgrn}[CVE-2016-9793]${txtrst} SO_{SND|RCV}BUFFORCE
  669. Reqs: pkg=linux-kernel,ver>=3.11,ver<4.8.14,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1
  670. Tags:
  671. analysis-url: https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793
  672. src-url: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-9793/poc.c
  673. Comments: CAP_NET_ADMIN caps OR CONFIG_USER_NS=y needed. No SMEP/SMAP/KASLR bypass included. Tested in QEMU only
  674. exploit-db: 41995
  675. author: Andrey 'xairy' Konovalov
  676. EOF
  677. )
  678.  
  679. EXPLOITS[((n++))]=$(cat <<EOF
  680. Name: ${txtgrn}[CVE-2017-6074]${txtrst} dccp
  681. Reqs: pkg=linux-kernel,ver>=2.6.18,ver<=4.9.11,CONFIG_IP_DCCP=[my]
  682. Tags: ubuntu=(14.04|16.04){kernel:4.4.0-62-generic}
  683. analysis-url: http://www.openwall.com/lists/oss-security/2017/02/22/3
  684. Comments: Requires Kernel be built with CONFIG_IP_DCCP enabled. Includes partial SMEP/SMAP bypass
  685. exploit-db: 41458
  686. author: Andrey 'xairy' Konovalov
  687. EOF
  688. )
  689.  
  690. EXPLOITS[((n++))]=$(cat <<EOF
  691. Name: ${txtgrn}[CVE-2017-7308]${txtrst} af_packet
  692. Reqs: pkg=linux-kernel,ver>=3.2,ver<=4.10.6,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1
  693. Tags: ubuntu=16.04{kernel:4.8.0-(34|36|39|41|42|44|45)-generic}
  694. analysis-url: https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html
  695. src-url: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-7308/poc.c
  696. ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/cve-2017-7308/CVE-2017-7308/poc.c
  697. Comments: CAP_NET_RAW cap or CONFIG_USER_NS=y needed. Modified version at 'ext-url' adds support for additional kernels
  698. exploit-db: 41994
  699. author: Andrey 'xairy' Konovalov (orginal exploit author); Brendan Coles (author of exploit update at 'ext-url')
  700. EOF
  701. )
  702.  
  703. EXPLOITS[((n++))]=$(cat <<EOF
  704. Name: ${txtgrn}[CVE-2017-16995]${txtrst} eBPF_verifier
  705. Reqs: pkg=linux-kernel,ver>=4.4,ver<=4.14.8,CONFIG_BPF_SYSCALL=y,sysctl:kernel.unprivileged_bpf_disabled!=1
  706. Tags: ubuntu=16.04.4{kernel:4.4.0-116}
  707. analysis-url: https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor
  708. Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1
  709. exploit-db: 44298
  710. author: Bruce Leidl
  711. EOF
  712. )
  713.  
  714. EXPLOITS[((n++))]=$(cat <<EOF
  715. Name: ${txtgrn}[CVE-2017-1000112]${txtrst} NETIF_F_UFO
  716. Reqs: pkg=linux-kernel,ver>=4.4,ver<=4.13,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1
  717. Tags: ubuntu=14.04{kernel:4.4.0-*},ubuntu=16.04{kernel:4.8.0-*}
  718. analysis-url: http://www.openwall.com/lists/oss-security/2017/08/13/1
  719. src-url: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-1000112/poc.c
  720. ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/cve-2017-1000112/CVE-2017-1000112/poc.c
  721. Comments: CAP_NET_ADMIN cap or CONFIG_USER_NS=y needed. SMEP/KASLR bypass included. Modified version at 'ext-url' adds support for additional distros/kernels
  722. exploit-db:
  723. author: Andrey 'xairy' Konovalov (orginal exploit author); Brendan Coles (author of exploit update at 'ext-url')
  724. EOF
  725. )
  726.  
  727. EXPLOITS[((n++))]=$(cat <<EOF
  728. Name: ${txtgrn}[CVE-2017-1000253]${txtrst} PIE_stack_corruption
  729. Reqs: pkg=linux-kernel,ver>=3.2,ver<=4.13,x86_64
  730. Tags: RHEL=6,RHEL=7{kernel:3.10.0-514.21.2|3.10.0-514.26.1}
  731. analysis-url: https://www.qualys.com/2017/09/26/linux-pie-cve-2017-1000253/cve-2017-1000253.txt
  732. src-url: https://www.qualys.com/2017/09/26/linux-pie-cve-2017-1000253/cve-2017-1000253.c
  733. exploit-db: 42887
  734. author: Qualys
  735. Comments:
  736. EOF
  737. )
  738.  
  739. ############ USERSPACE EXPLOITS ###########################
  740. n=0
  741.  
  742. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  743. Name: ${txtgrn}[CVE-2004-0186]${txtrst} samba
  744. Reqs: pkg=samba,ver<=2.2.8
  745. Tags:
  746. exploit-db: 23674
  747. EOF
  748. )
  749.  
  750. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  751. Name: ${txtgrn}[CVE-2009-1185]${txtrst} udev
  752. Reqs: pkg=udev,cmd:[[ -f /etc/udev/rules.d/95-udev-late.rules || -f /lib/udev/rules.d/95-udev-late.rules ]]
  753. Tags: ubuntu=8.10|9.04
  754. exploit-db: 8572
  755. Comments: Version<1.4.1 vulnerable but distros use own versioning scheme. Manual verification needed
  756. EOF
  757. )
  758.  
  759. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  760. Name: ${txtgrn}[CVE-2009-1185]${txtrst} udev 2
  761. Reqs: pkg=udev
  762. Tags:
  763. exploit-db: 8478
  764. Comments: SSH access to non privileged user is needed. Version<1.4.1 vulnerable but distros use own versioning scheme. Manual verification needed
  765. EOF
  766. )
  767.  
  768. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  769. Name: ${txtgrn}[CVE-2010-0832]${txtrst} PAM MOTD
  770. Reqs: pkg=libpam-modules,ver<=1.1.1
  771. Tags: ubuntu=9.10|10.04
  772. exploit-db: 14339
  773. Comments: SSH access to non privileged user is needed
  774. EOF
  775. )
  776.  
  777. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  778. Name: ${txtgrn}[CVE-2011-1485]${txtrst} pkexec
  779. Reqs: pkg=polkit,ver=0.96
  780. Tags: RHEL=6,ubuntu=10.04|10.10
  781. exploit-db: 17942
  782. EOF
  783. )
  784.  
  785. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  786. Name: ${txtgrn}[CVE-2012-0809]${txtrst} death_star (sudo)
  787. Reqs: pkg=sudo,ver>=1.8.0,ver<=1.8.3
  788. Tags: fedora=16
  789. analysis-url: http://seclists.org/fulldisclosure/2012/Jan/att-590/advisory_sudo.txt
  790. exploit-db: 18436
  791. EOF
  792. )
  793.  
  794. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  795. Name: ${txtgrn}[CVE-2014-0476]${txtrst} chkrootkit
  796. Reqs: pkg=chkrootkit,ver<0.50
  797. Tags:
  798. analysis-url: http://seclists.org/oss-sec/2014/q2/430
  799. exploit-db: 33899
  800. Comments: Rooting depends on the crontab (up to one day of dealy)
  801. EOF
  802. )
  803.  
  804. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  805. Name: ${txtgrn}[CVE-2014-5119]${txtrst} __gconv_translit_find
  806. Reqs: pkg=glibc|libc6,x86
  807. Tags: debian=6
  808. analysis-url: http://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-edition.html
  809. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/34421.tar.gz
  810. exploit-db: 34421
  811. EOF
  812. )
  813.  
  814. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  815. Name: ${txtgrn}[CVE-2015-1862]${txtrst} newpid (abrt)
  816. Reqs: pkg=abrt,cmd:grep -qi abrt /proc/sys/kernel/core_pattern
  817. Tags: fedora=20
  818. analysis-url: http://openwall.com/lists/oss-security/2015/04/14/4
  819. src-url: https://gist.githubusercontent.com/taviso/0f02c255c13c5c113406/raw/eafac78dce51329b03bea7167f1271718bee4dcc/newpid.c
  820. exploit-db: 36746
  821. EOF
  822. )
  823.  
  824. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  825. Name: ${txtgrn}[CVE-2015-3315]${txtrst} raceabrt
  826. Reqs: pkg=abrt,cmd:grep -qi abrt /proc/sys/kernel/core_pattern
  827. Tags: fedora=19|20|21,RHEL=7
  828. analysis-url: http://seclists.org/oss-sec/2015/q2/130
  829. src-url: https://gist.githubusercontent.com/taviso/fe359006836d6cd1091e/raw/32fe8481c434f8cad5bcf8529789231627e5074c/raceabrt.c
  830. exploit-db: 36747
  831. EOF
  832. )
  833.  
  834. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  835. Name: ${txtgrn}[CVE-2015-1318]${txtrst} newpid (apport)
  836. Reqs: pkg=apport,ver>=2.13,ver<=2.17,cmd:grep -qi apport /proc/sys/kernel/core_pattern
  837. Tags: ubuntu=14.04
  838. analysis-url: http://openwall.com/lists/oss-security/2015/04/14/4
  839. src-url: https://gist.githubusercontent.com/taviso/0f02c255c13c5c113406/raw/eafac78dce51329b03bea7167f1271718bee4dcc/newpid.c
  840. exploit-db: 36746
  841. EOF
  842. )
  843.  
  844. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  845. Name: ${txtgrn}[CVE-2015-1318]${txtrst} newpid (apport) 2
  846. Reqs: pkg=apport,ver>=2.13,ver<=2.17,cmd:grep -qi apport /proc/sys/kernel/core_pattern
  847. Tags: ubuntu=14.04.2
  848. analysis-url: http://openwall.com/lists/oss-security/2015/04/14/4
  849. exploit-db: 36782
  850. EOF
  851. )
  852.  
  853. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  854. Name: ${txtgrn}[CVE-2015-3202]${txtrst} fuse (fusermount)
  855. Reqs: pkg=fuse,ver<2.9.3
  856. Tags: debian=7.0|8.0,ubuntu=*
  857. analysis-url: http://seclists.org/oss-sec/2015/q2/520
  858. exploit-db: 37089
  859. Comments: Needs cron or system admin interaction
  860. EOF
  861. )
  862.  
  863. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  864. Name: ${txtgrn}[CVE-2015-1815]${txtrst} setroubleshoot
  865. Reqs: pkg=setroubleshoot,ver<3.2.22
  866. Tags: fedora=21
  867. exploit-db: 36564
  868. EOF
  869. )
  870.  
  871. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  872. Name: ${txtgrn}[CVE-2015-3246]${txtrst} userhelper
  873. Reqs: pkg=libuser,ver<=0.60
  874. Tags: RHEL<=7,centos<=7,fedora<=22
  875. analysis-url: https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt
  876. exploit-db: 37706
  877. EOF
  878. )
  879.  
  880. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  881. Name: ${txtgrn}[CVE-2015-6565]${txtrst} not_an_sshnuke
  882. Reqs: pkg=openssh-server,ver>=6.8,ver<=6.9
  883. Tags:
  884. analysis-url: http://www.openwall.com/lists/oss-security/2017/01/26/2
  885. exploit-db: 41173
  886. author: Federico Bento
  887. Comments: Needs admin interaction (root user needs to login via ssh to trigger exploitation)
  888. EOF
  889. )
  890.  
  891. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  892. Name: ${txtgrn}[CVE-2016-1240]${txtrst} tomcat-rootprivesc-deb.sh
  893. Reqs: pkg=tomcat
  894. Tags: debian=8,ubuntu=16.04
  895. analysis-url: https://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html
  896. src-url: http://legalhackers.com/exploits/tomcat-rootprivesc-deb.sh
  897. exploit-db: 40450
  898. author: Dawid Golunski
  899. Comments: Affects only Debian-based distros
  900. EOF
  901. )
  902.  
  903. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  904. Name: ${txtgrn}[CVE-2016-1247]${txtrst} nginxed-root.sh
  905. Reqs: pkg=nginx|nginx-full
  906. Tags: debian=8,ubuntu=14.04|16.04|16.10
  907. analysis-url: https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html
  908. src-url: https://legalhackers.com/exploits/CVE-2016-1247/nginxed-root.sh
  909. exploit-db: 40768
  910. author: Dawid Golunski
  911. Comments: Rooting depends on cron.daily (up to 24h of dealy). Affected: deb8: <1.6.2; 14.04: <1.4.6; 16.04: 1.10.0
  912. EOF
  913. )
  914.  
  915. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  916. Name: ${txtgrn}[CVE-2016-1531]${txtrst} perl_startup (exim)
  917. Reqs: pkg=exim,ver<4.86.2
  918. Tags:
  919. analysis-url: http://www.exim.org/static/doc/CVE-2016-1531.txt
  920. exploit-db: 39549
  921. EOF
  922. )
  923.  
  924. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  925. Name: ${txtgrn}[CVE-2016-1531]${txtrst} perl_startup (exim) 2
  926. Reqs: pkg=exim,ver<4.86.2
  927. Tags:
  928. analysis-url: http://www.exim.org/static/doc/CVE-2016-1531.txt
  929. exploit-db: 39535
  930. EOF
  931. )
  932.  
  933. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  934. Name: ${txtgrn}[CVE-2016-4989]${txtrst} setroubleshoot 2
  935. Reqs: pkg=setroubleshoot
  936. Tags: RHEL=6|7
  937. analysis-url: https://c-skills.blogspot.com/2016/06/lets-feed-attacker-input-to-sh-c-to-see.html
  938. src-url: https://github.com/stealth/troubleshooter/raw/master/straight-shooter.c
  939. exploit-db:
  940. EOF
  941. )
  942.  
  943. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  944. Name: ${txtgrn}[CVE-2016-5425]${txtrst} tomcat-RH-root.sh
  945. Reqs: pkg=tomcat
  946. Tags: RHEL=7
  947. analysis-url: http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html
  948. src-url: http://legalhackers.com/exploits/tomcat-RH-root.sh
  949. exploit-db: 40488
  950. author: Dawid Golunski
  951. Comments: Affects only RedHat-based distros
  952. EOF
  953. )
  954.  
  955. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  956. Name: ${txtgrn}[CVE-2016-6663,CVE-2016-6664|CVE-2016-6662]${txtrst} mysql-exploit-chain
  957. Reqs: pkg=mysql-server|mariadb-server,ver<5.5.52
  958. Tags: ubuntu=16.04.1
  959. analysis-url: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html
  960. src-url: http://legalhackers.com/exploits/CVE-2016-6663/mysql-privesc-race.c
  961. exploit-db: 40678
  962. author: Dawid Golunski
  963. Comments: Also MariaDB ver<10.1.18 and ver<10.0.28 affected
  964. EOF
  965. )
  966.  
  967. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  968. Name: ${txtgrn}[CVE-2016-9566]${txtrst} nagios-root-privesc
  969. Reqs: pkg=nagios,ver<4.2.4
  970. Tags:
  971. analysis-url: https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.html
  972. src-url: https://legalhackers.com/exploits/CVE-2016-9566/nagios-root-privesc.sh
  973. exploit-db: 40921
  974. author: Dawid Golunski
  975. Comments: Allows priv escalation from nagios user or nagios group
  976. EOF
  977. )
  978.  
  979. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  980. Name: ${txtgrn}[CVE-2017-0358]${txtrst} ntfs-3g-modprobe
  981. Reqs: pkg=ntfs-3g
  982. Tags: ubuntu=16.04|16.10,debian=7|8
  983. analysis-url: https://bugs.chromium.org/p/project-zero/issues/detail?id=1072
  984. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/41356.zip
  985. exploit-db: 41356
  986. author: Jann Horn
  987. Comments: Distros use own versioning scheme. Manual verification needed. Linux headers must be installed. System must have at least two CPU cores.
  988. EOF
  989. )
  990.  
  991. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  992. Name: ${txtgrn}[CVE-2017-1000367]${txtrst} Sudoer-to-root
  993. Reqs: pkg=sudo,ver<=1.8.20,cmd:[ -f /usr/sbin/getenforce ]
  994. Tags: RHEL=7{sudo:1.8.6p7}
  995. analysis-url: https://www.sudo.ws/alerts/linux_tty.html
  996. src-url: https://www.qualys.com/2017/05/30/cve-2017-1000367/linux_sudo_cve-2017-1000367.c
  997. exploit-db: 42183
  998. author: Qualys
  999. Comments: Needs to be sudoer. Works only on SELinux enabled systems
  1000. EOF
  1001. )
  1002.  
  1003. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1004. Name: ${txtgrn}[CVE-2017-1000367]${txtrst} sudopwn
  1005. Reqs: pkg=sudo,ver<=1.8.20,cmd:[ -f /usr/sbin/getenforce ]
  1006. Tags:
  1007. analysis-url: https://www.sudo.ws/alerts/linux_tty.html
  1008. src-url: https://raw.githubusercontent.com/c0d3z3r0/sudo-CVE-2017-1000367/master/sudopwn.c
  1009. exploit-db:
  1010. author: c0d3z3r0
  1011. Comments: Needs to be sudoer. Works only on SELinux enabled systems
  1012. EOF
  1013. )
  1014.  
  1015. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1016. Name: ${txtgrn}[CVE-2017-1000366,CVE-2017-1000370]${txtrst} linux_ldso_hwcap
  1017. Reqs: pkg=glibc|libc6,ver<=2.25,x86
  1018. Tags:
  1019. analysis-url: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
  1020. src-url: https://www.qualys.com/2017/06/19/stack-clash/linux_ldso_hwcap.c
  1021. exploit-db: 42274
  1022. author: Qualys
  1023. Comments: Uses "Stack Clash" technique, works against most SUID-root binaries
  1024. EOF
  1025. )
  1026.  
  1027. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1028. Name: ${txtgrn}[CVE-2017-1000366,CVE-2017-1000371]${txtrst} linux_ldso_dynamic
  1029. Reqs: pkg=glibc|libc6,ver<=2.25,x86
  1030. Tags: debian=9|10,ubuntu=14.04.5|16.04.2|17.04,fedora=23|24|25
  1031. analysis-url: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
  1032. src-url: https://www.qualys.com/2017/06/19/stack-clash/linux_ldso_dynamic.c
  1033. exploit-db: 42276
  1034. author: Qualys
  1035. Comments: Uses "Stack Clash" technique, works against most SUID-root PIEs
  1036. EOF
  1037. )
  1038.  
  1039. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1040. Name: ${txtgrn}[CVE-2017-1000366,CVE-2017-1000379]${txtrst} linux_ldso_hwcap_64
  1041. Reqs: pkg=glibc|libc6,ver<=2.25,x86_64
  1042. Tags: debian=7.7|8.5|9.0,ubuntu=14.04.2|16.04.2|17.04,fedora=22|25,centos=7.3.1611
  1043. analysis-url: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
  1044. src-url: https://www.qualys.com/2017/06/19/stack-clash/linux_ldso_hwcap_64.c
  1045. exploit-db: 42275
  1046. author: Qualys
  1047. Comments: Uses "Stack Clash" technique, works against most SUID-root binaries
  1048. EOF
  1049. )
  1050.  
  1051. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1052. Name: ${txtgrn}[CVE-2017-1000370,CVE-2017-1000371]${txtrst} linux_offset2lib
  1053. Reqs: pkg=glibc|libc6,ver<=2.25,x86
  1054. Tags:
  1055. analysis-url: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
  1056. src-url: https://www.qualys.com/2017/06/19/stack-clash/linux_offset2lib.c
  1057. exploit-db: 42273
  1058. author: Qualys
  1059. Comments: Uses "Stack Clash" technique
  1060. EOF
  1061. )
  1062.  
  1063. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1064. Name: ${txtgrn}[CVE-2018-1000001]${txtrst} RationalLove
  1065. Reqs: pkg=glibc|libc6,ver<2.27,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1,x86_64
  1066. Tags: debian=9{glibc:2.24-11+deb9u1},ubuntu=16.04.3{glibc:2.23-0ubuntu9}
  1067. analysis-url: https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
  1068. src-url: https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/RationalLove.c
  1069. Comments: kernel.unprivileged_userns_clone=1 required
  1070. exploit-db: 43775
  1071. author: halfdog
  1072. EOF
  1073. )
  1074.  
  1075. ###########################################################
  1076. ## security related HW/kernel features
  1077. ###########################################################
  1078. n=0
  1079.  
  1080. FEATURES[((n++))]=$(cat <<EOF
  1081. section: Kernel protection mechanisms:
  1082. EOF
  1083. )
  1084.  
  1085. FEATURES[((n++))]=$(cat <<EOF
  1086. feature: GCC stack protector support
  1087. available: CONFIG_CC_STACKPROTECTOR=y
  1088. analysis-url: https://github.com/mzet-/les-res/blob/master/features/stackprotector-regular.md
  1089. EOF
  1090. )
  1091.  
  1092. FEATURES[((n++))]=$(cat <<EOF
  1093. feature: GCC stack protector STRONG support
  1094. available: CONFIG_CC_STACKPROTECTOR_STRONG=y,ver>=3.14
  1095. analysis-url: https://github.com/mzet-/les-res/blob/master/features/stackprotector-strong.md
  1096. EOF
  1097. )
  1098.  
  1099. FEATURES[((n++))]=$(cat <<EOF
  1100. feature: Low address space to protect from user allocation
  1101. available: CONFIG_DEFAULT_MMAP_MIN_ADDR=[0-9]+
  1102. enabled: sysctl:vm.mmap_min_addr!=0
  1103. analysis-url: https://github.com/mzet-/les-res/blob/master/features/mmap_min_addr.md
  1104. EOF
  1105. )
  1106.  
  1107. FEATURES[((n++))]=$(cat <<EOF
  1108. feature: Hiding kernel pointers in /proc/kallsyms
  1109. available: ver>=2.6.28
  1110. enabled: sysctl:kernel.kptr_restrict!=0
  1111. analysis-url: https://github.com/mzet-/les-res/blob/master/features/kptr_restrict.md
  1112. EOF
  1113. )
  1114.  
  1115. FEATURES[((n++))]=$(cat <<EOF
  1116. feature: Restrict unprivileged access to kernel syslog
  1117. available: ver>=2.6.37
  1118. enabled: sysctl:kernel.dmesg_restrict!=0
  1119. analysis-url: https://github.com/mzet-/les-res/blob/master/features/dmesg_restrict.md
  1120. EOF
  1121. )
  1122.  
  1123. FEATURES[((n++))]=$(cat <<EOF
  1124. feature: Supervisor Mode Execution Protection (SMEP) support
  1125. available: ver>=3.0,cmd:grep -qi smep /proc/cpuinfo
  1126. enabled: cmd:grep -qi smep /proc/cpuinfo
  1127. analysis-url: https://github.com/mzet-/les-res/blob/master/features/smep.md
  1128. EOF
  1129. )
  1130.  
  1131. FEATURES[((n++))]=$(cat <<EOF
  1132. feature: Supervisor Mode Access Prevention (SMAP) support
  1133. available: ver>=3.7,cmd:grep -qi smap /proc/cpuinfo
  1134. enabled: cmd:grep -qi smap /proc/cpuinfo
  1135. analysis-url: https://github.com/mzet-/les-res/blob/master/features/smap.md
  1136. EOF
  1137. )
  1138.  
  1139. FEATURES[((n++))]=$(cat <<EOF
  1140. feature: Randomize the address of the kernel image (KASLR)
  1141. available: CONFIG_RANDOMIZE_BASE=y
  1142. analysis-url: https://github.com/mzet-/les-res/blob/master/features/kaslr.md
  1143. EOF
  1144. )
  1145.  
  1146. FEATURES[((n++))]=$(cat <<EOF
  1147. feature: Hardened user copy support
  1148. available: CONFIG_HARDENED_USERCOPY=y
  1149. analysis-url: https://github.com/mzet-/les-res/blob/master/features/hardened_usercopy.md
  1150. EOF
  1151. )
  1152.  
  1153. FEATURES[((n++))]=$(cat <<EOF
  1154. feature: Make kernel text and rodata read-only
  1155. available: CONFIG_STRICT_KERNEL_RWX=y
  1156. analysis-url: https://github.com/mzet-/les-res/blob/master/features/strict_kernel_rwx.md
  1157. EOF
  1158. )
  1159.  
  1160. FEATURES[((n++))]=$(cat <<EOF
  1161. feature: Set loadable kernel module data as NX and text as RO
  1162. available: CONFIG_STRICT_MODULE_RWX=y
  1163. analysis-url: https://github.com/mzet-/les-res/blob/master/features/strict_module_rwx.md
  1164. EOF
  1165. )
  1166.  
  1167. FEATURES[((n++))]=$(cat <<EOF
  1168. feature: Restrict /dev/mem access
  1169. available: CONFIG_STRICT_DEVMEM=y
  1170. analysis-url: https://github.com/mzet-/les-res/blob/master/features/strict_devmem.md
  1171. EOF
  1172. )
  1173.  
  1174. FEATURES[((n++))]=$(cat <<EOF
  1175. feature: Restrict I/O access to /dev/mem
  1176. available: CONFIG_IO_STRICT_DEVMEM=y
  1177. analysis-url: https://github.com/mzet-/les-res/blob/master/features/io_strict_devmem.md
  1178. EOF
  1179. )
  1180.  
  1181. FEATURES[((n++))]=$(cat <<EOF
  1182. section: Attack Surface:
  1183. EOF
  1184. )
  1185.  
  1186. FEATURES[((n++))]=$(cat <<EOF
  1187. feature: Support for /dev/mem access
  1188. available: CONFIG_DEVMEM=y
  1189. analysis-url: https://github.com/mzet-/les-res/blob/master/features/devmem.md
  1190. EOF
  1191. )
  1192.  
  1193. FEATURES[((n++))]=$(cat <<EOF
  1194. feature: Support for /dev/kmem access
  1195. available: CONFIG_DEVKMEM=y
  1196. analysis-url: https://github.com/mzet-/les-res/blob/master/features/devkmem.md
  1197. EOF
  1198. )
  1199.  
  1200. FEATURES[((n++))]=$(cat <<EOF
  1201. feature: User namespaces for unprivileged accounts
  1202. available: CONFIG_USER_NS=y
  1203. enabled: sysctl:kernel.unprivileged_userns_clone==1
  1204. analysis-url: https://github.com/mzet-/les-res/blob/master/features/user_ns.md
  1205. EOF
  1206. )
  1207.  
  1208. FEATURES[((n++))]=$(cat <<EOF
  1209. feature: Unprivileged access to bpf() system call
  1210. available: CONFIG_BPF_SYSCALL=y
  1211. enabled: sysctl:kernel.unprivileged_bpf_disabled!=1
  1212. analysis-url: https://github.com/mzet-/les-res/blob/master/features/bpf_syscall.md
  1213. EOF
  1214. )
  1215.  
  1216. version() {
  1217. echo "ICH ROOT EXPLOITER "$VERSION", h4m45t3r, indiancyberheros.com, august 2018"
  1218. }
  1219.  
  1220. usage() {
  1221. echo "Usage: linux-exploit-suggester.sh [OPTIONS]"
  1222. echo
  1223. echo " -V | --version - print version of this script"
  1224. echo " -h | --help - print this help"
  1225. echo " -k | --kernel <version> - provide kernel version"
  1226. echo " -u | --uname <string> - provide 'uname -a' string"
  1227. echo " --skip-more-checks - do not perform additional checks (kernel config, sysctl) to determine if exploit is applicable"
  1228. echo " --skip-pkg-versions - skip checking for exact userspace package version (helps to avoid false negatives)"
  1229. echo " -p | --pkglist-file <file> - provide file with 'dpkg -l' or 'rpm -qa' command output"
  1230. echo " --cvelist-file <file> - provide file with Linux kernel CVEs list"
  1231. echo " --checksec - list security related features for your HW/kernel"
  1232. echo " -s | --fetch-sources - automatically downloads source for matched exploit"
  1233. echo " -b | --fetch-binaries - automatically downloads binary for matched exploit if available"
  1234. echo " -f | --full - show full info about matched exploit"
  1235. echo " -g | --short - show shorten info about matched exploit"
  1236. echo " --kernelspace-only - show only kernel vulnerabilities"
  1237. echo " --userspace-only - show only userspace vulnerabilities"
  1238. echo " -d | --show-dos - show also DoSes in results"
  1239. }
  1240.  
  1241. exitWithErrMsg() {
  1242. echo "$1" 1>&2
  1243. exit 1
  1244. }
  1245.  
  1246. # extracts all information from output of 'uname -a' command
  1247. parseUname() {
  1248. local uname=$1
  1249.  
  1250. KERNEL=$(echo "$uname" | awk '{print $3}' | cut -d '-' -f 1)
  1251. KERNEL_ALL=$(echo "$uname" | awk '{print $3}')
  1252. ARCH=$(echo "$uname" | awk '{print $(NF-1)}')
  1253.  
  1254. OS=""
  1255. echo "$uname" | grep -q -i 'deb' && OS="debian"
  1256. echo "$uname" | grep -q -i 'ubuntu' && OS="ubuntu"
  1257. echo "$uname" | grep -q -i '\.fc' && OS="fedora"
  1258. echo "$uname" | grep -q -i '\.el' && OS="RHEL"
  1259.  
  1260. # 'uname -a' output doesn't contain distribution number (at least not in case of all distros)
  1261. }
  1262.  
  1263. getPkgList() {
  1264. local distro=$1
  1265. local pkglist_file=$2
  1266.  
  1267. # take package listing from provided file & detect if it's 'rpm -qa' listing or 'dpkg -l' listing or not recognized listing
  1268. if [ "$opt_pkglist_file" = "true" -a -e "$pkglist_file" ]; then
  1269.  
  1270. # ubuntu/debian package listing file
  1271. if [ $(cat "$pkglist_file" | head -1 | grep 'Desired=Unknown/Install/Remove/Purge/Hold') ]; then
  1272. PKG_LIST=$(cat "$pkglist_file" | awk '{print $2"-"$3}' | sed 's/:amd64//g')
  1273.  
  1274. OS="debian"
  1275. [ "$(cat "$pkglist_file" | grep "ubuntu")" ] && OS="ubuntu"
  1276. # redhat package listing file
  1277. elif [ $(cat "$pkglist_file" | head -1 | grep -E '\.el[1-9]+\.') ]; then
  1278. PKG_LIST=$(cat "$pkglist_file")
  1279. OS="RHEL"
  1280. # file not recognized - skipping
  1281. else
  1282. PKG_LIST=""
  1283. fi
  1284.  
  1285. elif [ "$distro" = "debian" -o "$distro" = "ubuntu" ]; then
  1286. PKG_LIST=$(dpkg -l | awk '{print $2"-"$3}' | sed 's/:amd64//g')
  1287. elif [ "$distro" = "RHEL" -o "$distro" = "fedora" ]; then
  1288. PKG_LIST=$(rpm -qa)
  1289. else
  1290. # packages listing not available
  1291. PKG_LIST=""
  1292. fi
  1293. }
  1294.  
  1295. # from: https://stackoverflow.com/questions/4023830/how-compare-two-strings-in-dot-separated-version-format-in-bash
  1296. verComparision() {
  1297.  
  1298. if [[ $1 == $2 ]]
  1299. then
  1300. return 0
  1301. fi
  1302.  
  1303. local IFS=.
  1304. local i ver1=($1) ver2=($2)
  1305.  
  1306. # fill empty fields in ver1 with zeros
  1307. for ((i=${#ver1[@]}; i<${#ver2[@]}; i++))
  1308. do
  1309. ver1[i]=0
  1310. done
  1311.  
  1312. for ((i=0; i<${#ver1[@]}; i++))
  1313. do
  1314. if [[ -z ${ver2[i]} ]]
  1315. then
  1316. # fill empty fields in ver2 with zeros
  1317. ver2[i]=0
  1318. fi
  1319. if ((10#${ver1[i]} > 10#${ver2[i]}))
  1320. then
  1321. return 1
  1322. fi
  1323. if ((10#${ver1[i]} < 10#${ver2[i]}))
  1324. then
  1325. return 2
  1326. fi
  1327. done
  1328.  
  1329. return 0
  1330. }
  1331.  
  1332. doVersionComparision() {
  1333. local reqVersion="$1"
  1334. local reqRelation="$2"
  1335. local currentVersion="$3"
  1336.  
  1337. verComparision $currentVersion $reqVersion
  1338. case $? in
  1339. 0) currentRelation='=';;
  1340. 1) currentRelation='>';;
  1341. 2) currentRelation='<';;
  1342. esac
  1343.  
  1344. if [ "$reqRelation" == "=" ]; then
  1345. [ $currentRelation == "=" ] && return 0
  1346. elif [ "$reqRelation" == ">" ]; then
  1347. [ $currentRelation == ">" ] && return 0
  1348. elif [ "$reqRelation" == "<" ]; then
  1349. [ $currentRelation == "<" ] && return 0
  1350. elif [ "$reqRelation" == ">=" ]; then
  1351. [ $currentRelation == "=" ] && return 0
  1352. [ $currentRelation == ">" ] && return 0
  1353. elif [ "$reqRelation" == "<=" ]; then
  1354. [ $currentRelation == "=" ] && return 0
  1355. [ $currentRelation == "<" ] && return 0
  1356. fi
  1357. }
  1358.  
  1359. compareValues() {
  1360. curVal=$1
  1361. val=$2
  1362. sign=$3
  1363.  
  1364. if [ "$sign" == "==" ]; then
  1365. [ "$val" == "$curVal" ] && return 0
  1366. elif [ "$sign" == "!=" ]; then
  1367. [ "$val" != "$curVal" ] && return 0
  1368. fi
  1369.  
  1370. return 1
  1371. }
  1372.  
  1373. checkRequirement() {
  1374. #echo "Checking requirement: $1"
  1375. local IN="$1"
  1376. local pkgName="${2:4}"
  1377.  
  1378. if [[ "$IN" =~ ^pkg=.*$ ]]; then
  1379.  
  1380. # always true for Linux OS
  1381. [ ${pkgName} == "linux-kernel" ] && return 0
  1382.  
  1383. # verify if package is present
  1384. pkg=$(echo "$PKG_LIST" | grep -E -i "^$pkgName-[0-9]+" | head -1)
  1385. if [ -n "$pkg" ]; then
  1386. return 0
  1387. fi
  1388.  
  1389. elif [[ "$IN" =~ ^ver.*$ ]]; then
  1390. version="${IN//[^0-9.]/}"
  1391. rest="${IN#ver}"
  1392. operator=${rest%$version}
  1393.  
  1394. if [ "$pkgName" == "linux-kernel" -o "$opt_checksec_mode" == "true" ]; then
  1395.  
  1396. # for --cvelist-file mode skip kernel version comparision
  1397. [ "$opt_cvelist_file" = "true" ] && return 0
  1398.  
  1399. doVersionComparision $version $operator $KERNEL && return 0
  1400. else
  1401. # extract package version and check if requiremnt is true
  1402. pkg=$(echo "$PKG_LIST" | grep -E -i "^$pkgName-[0-9]+" | head -1)
  1403.  
  1404. # skip (if run with --skip-pkg-versions) version checking if package with given name is installed
  1405. [ "$opt_skip_pkg_versions" = "true" -a -n "$pkg" ] && return 0
  1406.  
  1407. # versioning:
  1408. #echo "pkg: $pkg"
  1409. pkgVersion=$(echo "$pkg" | grep -E -i -o -e '-[\.0-9\+:p]+[-\+]' | cut -d':' -f2 | sed 's/[\+-]//g' | sed 's/p[0-9]//g')
  1410. #echo "version: $pkgVersion"
  1411. #echo "operator: $operator"
  1412. #echo "required version: $version"
  1413. #echo
  1414. doVersionComparision $version $operator $pkgVersion && return 0
  1415. fi
  1416. elif [[ "$IN" =~ ^x86_64$ ]] && [ "$ARCH" == "x86_64" -o "$ARCH" == "" ]; then
  1417. return 0
  1418. elif [[ "$IN" =~ ^x86$ ]] && [ "$ARCH" == "i386" -o "$ARCH" == "i686" -o "$ARCH" == "" ]; then
  1419. return 0
  1420. elif [[ "$IN" =~ ^CONFIG_.*$ ]]; then
  1421.  
  1422. # skip if check is not applicable (-k or --uname or -p set) or if user said so (--skip-more-checks)
  1423. [ "$opt_skip_more_checks" = "true" ] && return 0
  1424.  
  1425. # if kernel config IS available:
  1426. if [ -n "$KCONFIG" ]; then
  1427. if $KCONFIG | grep -E -qi $IN; then
  1428. return 0;
  1429. # required option wasn't found, exploit is not applicable
  1430. else
  1431. return 1;
  1432. fi
  1433. # config is not available
  1434. else
  1435. return 0;
  1436. fi
  1437. elif [[ "$IN" =~ ^sysctl:.*$ ]]; then
  1438.  
  1439. # skip if check is not applicable (-k or --uname or -p modes) or if user said so (--skip-more-checks)
  1440. [ "$opt_skip_more_checks" = "true" ] && return 0
  1441.  
  1442. sysctlCondition="${IN:7}"
  1443.  
  1444. # extract sysctl entry, relation sign and required value
  1445. if echo $sysctlCondition | grep -qi "!="; then
  1446. sign="!="
  1447. elif echo $sysctlCondition | grep -qi "=="; then
  1448. sign="=="
  1449. else
  1450. exitWithErrMsg "Wrong sysctl condition. There is syntax error in your features DB. Aborting."
  1451. fi
  1452. val=$(echo "$sysctlCondition" | awk -F "$sign" '{print $2}')
  1453. entry=$(echo "$sysctlCondition" | awk -F "$sign" '{print $1}')
  1454.  
  1455. # get current setting of sysctl entry
  1456. curVal=$(/sbin/sysctl -a 2> /dev/null | grep "$entry" | awk -F'=' '{print $2}')
  1457.  
  1458. # special case for --checksec mode: return 2 if there is no such switch in sysctl
  1459. [ -z "$curVal" -a "$opt_checksec_mode" = "true" ] && return 2
  1460.  
  1461. # for other modes: skip if there is no such switch in sysctl
  1462. [ -z "$curVal" ] && return 0
  1463.  
  1464. # compare & return result
  1465. compareValues $curVal $val $sign && return 0
  1466.  
  1467. elif [[ "$IN" =~ ^cmd:.*$ ]]; then
  1468.  
  1469. # skip if check is not applicable (-k or --uname or -p modes) or if user said so (--skip-more-checks)
  1470. [ "$opt_skip_more_checks" = "true" ] && return 0
  1471.  
  1472. cmd="${IN:4}"
  1473. if eval "${cmd}"; then
  1474. return 0
  1475. fi
  1476. fi
  1477.  
  1478. return 1
  1479. }
  1480.  
  1481. getKernelConfig() {
  1482. if [ -f /proc/config.gz ] ; then
  1483. KCONFIG="zcat /proc/config.gz"
  1484. elif [ -f /boot/config-`uname -r` ] ; then
  1485. KCONFIG="cat /boot/config-`uname -r`"
  1486. elif [ -f "${KBUILD_OUTPUT:-/usr/src/linux}"/.config ] ; then
  1487. KCONFIG="cat ${KBUILD_OUTPUT:-/usr/src/linux}/.config"
  1488. else
  1489. KCONFIG=""
  1490. fi
  1491. }
  1492.  
  1493. checksecMode() {
  1494.  
  1495. # start analysis
  1496. for FEATURE in "${FEATURES[@]}"; do
  1497.  
  1498. # create array from current exploit here doc and fetch needed lines
  1499. i=0
  1500. # ('-r' is used to not interpret backslash used for bash colors)
  1501. while read -r line
  1502. do
  1503. arr[i]="$line"
  1504. i=$((i + 1))
  1505. done <<< "$FEATURE"
  1506.  
  1507. NAME="${arr[0]}"
  1508. PRE_NAME="${NAME:0:8}"
  1509. NAME="${NAME:9}"
  1510. if [ "${PRE_NAME}" = "section:" ]; then
  1511. echo
  1512. echo -e "${bldwht}${NAME}${txtrst}"
  1513. echo
  1514. continue
  1515. fi
  1516.  
  1517. AVAILABLE="${arr[1]}" && AVAILABLE="${AVAILABLE:11}"
  1518. ENABLE=$(echo "$FEATURE" | grep "enabled: " | awk -F'ed: ' '{print $2}')
  1519. analysis_url=$(echo "$FEATURE" | grep "analysis-url: " | awk '{print $2}')
  1520.  
  1521. # split line with availability requirements & loop thru all availability reqs one by one & check whether it is met
  1522. IFS=',' read -r -a array <<< "$AVAILABLE"
  1523. AVAILABLE_REQS_NUM=${#array[@]}
  1524. AVAILABLE_PASSED_REQ=0
  1525. for REQ in "${array[@]}"; do
  1526. if (checkRequirement "$REQ"); then
  1527. AVAILABLE_PASSED_REQ=$(($AVAILABLE_PASSED_REQ + 1))
  1528. else
  1529. break
  1530. fi
  1531. done
  1532.  
  1533. # split line with enablement requirements & loop thru all enablement reqs one by one & check whether it is met
  1534. ENABLE_PASSED_REQ=0
  1535. ENABLE_REQS_NUM=-1
  1536. noSysctl=0
  1537. if [ -n "$ENABLE" ]; then
  1538. IFS=',' read -r -a array <<< "$ENABLE"
  1539. ENABLE_REQS_NUM=${#array[@]}
  1540. for REQ in "${array[@]}"; do
  1541. checkRequirement "$REQ"
  1542. retVal=$?
  1543. if [ $retVal -eq 0 ]; then
  1544. ENABLE_PASSED_REQ=$(($ENABLE_PASSED_REQ + 1))
  1545. elif [ $retVal -eq 2 ]; then
  1546. # special case: sysctl entry is not present on given system: signal it as: N/A
  1547. noSysctl=1
  1548. break
  1549. else
  1550. break
  1551. fi
  1552. done
  1553. fi
  1554.  
  1555. feature=$(echo "$FEATURE" | grep "feature: " | cut -d' ' -f 2-)
  1556.  
  1557. available="${txtred}Available${txtrst}"
  1558. enabled=" ${txtgray}N/A${txtrst} "
  1559.  
  1560. if [ $AVAILABLE_PASSED_REQ -eq $AVAILABLE_REQS_NUM ]; then
  1561. available="${txtgrn}Available${txtrst}"
  1562. fi
  1563.  
  1564. if [ $ENABLE_PASSED_REQ -eq $ENABLE_REQS_NUM -a $noSysctl -eq 0 -a -n "$ENABLE" ]; then
  1565. enabled="${txtgrn}Enabled${txtrst}"
  1566. elif [ -n "$ENABLE" -a $noSysctl -eq 0 ]; then
  1567. enabled="${txtred}Disabled${txtrst}"
  1568. fi
  1569.  
  1570. # short (--short) output
  1571. if [ "$opt_summary" = "true" ]; then
  1572. echo -e "[ $available ][ $enabled ] $feature"
  1573. continue
  1574. fi
  1575.  
  1576. echo -e "[+] $feature"
  1577. echo -e "\n [ $available ]: $AVAILABLE"
  1578. [ -n "$ENABLE" ] && echo -e " [ $enabled ]: $ENABLE"
  1579. [ -n "$analysis_url" ] && echo -e " Feature analysis: $analysis_url"
  1580. echo
  1581.  
  1582. done
  1583.  
  1584. }
  1585.  
  1586. # parse command line parameters
  1587. ARGS=$(getopt --options $SHORTOPTS --longoptions $LONGOPTS -- "$@")
  1588. [ $? != 0 ] && exitWithErrMsg "Aborting."
  1589.  
  1590. eval set -- "$ARGS"
  1591.  
  1592. while true; do
  1593. case "$1" in
  1594. -u|--uname)
  1595. shift
  1596. UNAME_A="$1"
  1597. opt_uname_string=true
  1598. ;;
  1599. -V|--version)
  1600. version
  1601. exit 0
  1602. ;;
  1603. -h|--help)
  1604. usage
  1605. exit 0
  1606. ;;
  1607. -f|--full)
  1608. opt_full=true
  1609. ;;
  1610. -g|--short)
  1611. opt_summary=true
  1612. ;;
  1613. -b|--fetch-binaries)
  1614. opt_fetch_bins=true
  1615. ;;
  1616. -s|--fetch-sources)
  1617. opt_fetch_srcs=true
  1618. ;;
  1619. -k|--kernel)
  1620. shift
  1621. KERNEL="$1"
  1622. opt_kernel_version=true
  1623. ;;
  1624. -d|--show-dos)
  1625. opt_show_dos=true
  1626. ;;
  1627. -p|--pkglist-file)
  1628. shift
  1629. PKGLIST_FILE="$1"
  1630. opt_pkglist_file=true
  1631. ;;
  1632. --cvelist-file)
  1633. shift
  1634. CVELIST_FILE="$1"
  1635. opt_cvelist_file=true
  1636. ;;
  1637. --checksec)
  1638. opt_checksec_mode=true
  1639. ;;
  1640. --kernelspace-only)
  1641. opt_kernel_only=true
  1642. ;;
  1643. --userspace-only)
  1644. opt_userspace_only=true
  1645. ;;
  1646. --skip-more-checks)
  1647. opt_skip_more_checks=true
  1648. ;;
  1649. --skip-pkg-versions)
  1650. opt_skip_pkg_versions=true
  1651. ;;
  1652. *)
  1653. shift
  1654. if [ "$#" != "0" ]; then
  1655. exitWithErrMsg "Unknown option '$1'. Aborting."
  1656. fi
  1657. break
  1658. ;;
  1659. esac
  1660. shift
  1661. done
  1662.  
  1663. # check Bash version (associative arrays need Bash in version 4.0+)
  1664. if ((BASH_VERSINFO[0] < 4)); then
  1665. exitWithErrMsg "Script needs Bash in version 4.0 or newer. Aborting."
  1666. fi
  1667.  
  1668. # exit if both --kernel and --uname are set
  1669. [ "$opt_kernel_version" = "true" ] && [ $opt_uname_string = "true" ] && exitWithErrMsg "Switches -u|--uname and -k|--kernel are mutually exclusive. Aborting."
  1670.  
  1671. # exit if both --full and --short are set
  1672. [ "$opt_full" = "true" ] && [ $opt_summary = "true" ] && exitWithErrMsg "Switches -f|--full and -g|--short are mutually exclusive. Aborting."
  1673.  
  1674. # --cvelist-file mode is standalone mode and is not applicable when one of -k | -u | -p | --checksec switches are set
  1675. if [ "$opt_cvelist_file" = "true" ]; then
  1676. [ ! -e "$CVELIST_FILE" ] && exitWithErrMsg "Provided CVE list file does not exists. Aborting."
  1677. [ "$opt_kernel_version" = "true" ] && exitWithErrMsg "Switches -k|--kernel and --cvelist-file are mutually exclusive. Aborting."
  1678. [ "$opt_uname_string" = "true" ] && exitWithErrMsg "Switches -u|--uname and --cvelist-file are mutually exclusive. Aborting."
  1679. [ "$opt_pkglist_file" = "true" ] && exitWithErrMsg "Switches -p|--pkglist-file and --cvelist-file are mutually exclusive. Aborting."
  1680. fi
  1681.  
  1682. # --checksec mode is standalone mode and is not applicable when one of -k | -u | -p | --cvelist-file switches are set
  1683. if [ "$opt_checksec_mode" = "true" ]; then
  1684. [ "$opt_kernel_version" = "true" ] && exitWithErrMsg "Switches -k|--kernel and --checksec are mutually exclusive. Aborting."
  1685. [ "$opt_uname_string" = "true" ] && exitWithErrMsg "Switches -u|--uname and --checksec are mutually exclusive. Aborting."
  1686. [ "$opt_pkglist_file" = "true" ] && exitWithErrMsg "Switches -p|--pkglist-file and --checksec are mutually exclusive. Aborting."
  1687. fi
  1688.  
  1689. # extract kernel version and other OS info like distro name, distro version, etc. 3 possibilities here:
  1690. # case 1: --kernel set
  1691. if [ "$opt_kernel_version" == "true" ]; then
  1692. # TODO: add kernel version number validation
  1693. [ -z "$KERNEL" ] && exitWithErrMsg "Unrecognized kernel version given. Aborting."
  1694. ARCH=""
  1695. OS=""
  1696.  
  1697. # do not perform additional checks on current machine
  1698. opt_skip_more_checks=true
  1699.  
  1700. # do not consider current OS
  1701. getPkgList "" "$PKGLIST_FILE"
  1702.  
  1703. # case 2: --uname set
  1704. elif [ "$opt_uname_string" == "true" ]; then
  1705. [ -z "$UNAME_A" ] && exitWithErrMsg "uname string empty. Aborting."
  1706. parseUname "$UNAME_A"
  1707.  
  1708. # do not perform additional checks on current machine
  1709. opt_skip_more_checks=true
  1710.  
  1711. # do not consider current OS
  1712. getPkgList "" "$PKGLIST_FILE"
  1713.  
  1714. # case 3: --cvelist-file mode
  1715. elif [ "$opt_cvelist_file" = "true" ]; then
  1716.  
  1717. # get kernel configuration in this mode
  1718. [ "$opt_skip_more_checks" = "false" ] && getKernelConfig
  1719.  
  1720. # case 4: --checksec mode
  1721. elif [ "$opt_checksec_mode" = "true" ]; then
  1722.  
  1723. # this switch is not applicable in this mode
  1724. opt_skip_more_checks=false
  1725.  
  1726. # get kernel configuration in this mode
  1727. getKernelConfig
  1728. [ -z "$KCONFIG" ] && exitWithErrMsg "Kernel configuration file not available. Aborting."
  1729.  
  1730. # launch checksec mode
  1731. checksecMode
  1732.  
  1733. exit 0
  1734.  
  1735. # case 5: no --uname | --kernel | --cvelist-file | --checksec set
  1736. else
  1737.  
  1738. # --pkglist-file NOT provided: take all info from current machine
  1739. # case for vanilla execution: ./linux-exploit-suggester.sh
  1740. if [ "$opt_pkglist_file" == "false" ]; then
  1741. UNAME_A=$(uname -a)
  1742. [ -z "$UNAME_A" ] && exitWithErrMsg "uname string empty. Aborting."
  1743. parseUname "$UNAME_A"
  1744.  
  1745. # get kernel configuration in this mode
  1746. [ "$opt_skip_more_checks" = "false" ] && getKernelConfig
  1747.  
  1748. # extract distribution version from /etc/issue
  1749. [ -n "$OS" -a "$opt_skip_more_checks" = "false" ] && DISTRO=$(cat /etc/issue | grep -E -o '[0-9\.]+' | head -1)
  1750.  
  1751. # extract package listing from current OS
  1752. getPkgList "$OS" ""
  1753.  
  1754. # --pkglist-file provided: only consider userspace exploits against provided package listing
  1755. else
  1756. KERNEL=""
  1757. #TODO: extract machine arch from package listing
  1758. ARCH=""
  1759. unset EXPLOITS
  1760. declare -A EXPLOITS
  1761. getPkgList "" "$PKGLIST_FILE"
  1762.  
  1763. # additional checks are not applicable for this mode
  1764. opt_skip_more_checks=true
  1765. fi
  1766. fi
  1767.  
  1768. echo
  1769. echo -e "${bldwht}Available information:${txtrst}"
  1770. echo
  1771. [ -n "$KERNEL" ] && echo -e "Kernel version: ${txtgrn}$KERNEL${txtrst}" || echo -e "Kernel version: ${txtred}N/A${txtrst}"
  1772. echo "Architecture: $([ -n "$ARCH" ] && echo -e "${txtgrn}$ARCH${txtrst}" || echo -e "${txtred}N/A${txtrst}")"
  1773. echo "Distribution: $([ -n "$OS" ] && echo -e "${txtgrn}$OS${txtrst}" || echo -e "${txtred}N/A${txtrst}")"
  1774. echo -e "Distribution version: $([ -n "$DISTRO" ] && echo -e "${txtgrn}$DISTRO${txtrst}" || echo -e "${txtred}N/A${txtrst}")"
  1775.  
  1776. echo "Additional checks (CONFIG_*, sysctl entries, custom Bash commands): $([ "$opt_skip_more_checks" == "false" ] && echo -e "${txtgrn}performed${txtrst}" || echo -e "${txtred}N/A${txtrst}")"
  1777.  
  1778. if [ -n "$PKGLIST_FILE" -a -n "$PKG_LIST" ]; then
  1779. pkgListFile="${txtgrn}$PKGLIST_FILE${txtrst}"
  1780. elif [ -n "$PKGLIST_FILE" ]; then
  1781. pkgListFile="${txtred}unrecognized file provided${txtrst}"
  1782. elif [ -n "$PKG_LIST" ]; then
  1783. pkgListFile="${txtgrn}from current OS${txtrst}"
  1784. fi
  1785.  
  1786. echo -e "Package listing: $([ -n "$pkgListFile" ] && echo -e "$pkgListFile" || echo -e "${txtred}N/A${txtrst}")"
  1787.  
  1788. # handle --kernelspacy-only & --userspace-only filter options
  1789. if [ "$opt_kernel_only" = "true" -o -z "$PKG_LIST" ]; then
  1790. unset EXPLOITS_USERSPACE
  1791. declare -A EXPLOITS_USERSPACE
  1792. fi
  1793.  
  1794. if [ "$opt_userspace_only" = "true" ]; then
  1795. unset EXPLOITS
  1796. declare -A EXPLOITS
  1797. fi
  1798.  
  1799. echo
  1800. echo -e "${bldwht}Searching among:${txtrst}"
  1801. echo
  1802. echo "${#EXPLOITS[@]} kernel space exploits"
  1803. echo "${#EXPLOITS_USERSPACE[@]} user space exploits"
  1804. echo
  1805.  
  1806. echo -e "${bldwht}Possible Exploits:${txtrst}"
  1807. echo
  1808.  
  1809. # start analysis
  1810. for EXP in "${EXPLOITS[@]}" "${EXPLOITS_USERSPACE[@]}"; do
  1811.  
  1812. # create array from current exploit here doc and fetch needed lines
  1813. i=0
  1814. # ('-r' is used to not interpret backslash used for bash colors)
  1815. while read -r line
  1816. do
  1817. arr[i]="$line"
  1818. i=$((i + 1))
  1819. done <<< "$EXP"
  1820.  
  1821. REQS="${arr[1]}" && REQS="${REQS:6}"
  1822. NAME="${arr[0]}" && NAME="${NAME:6}"
  1823. TAGS="${arr[2]}" && TAGS="${TAGS:6}"
  1824.  
  1825. # split line with requirements & loop thru all reqs one by one & check whether it is met
  1826. IFS=',' read -r -a array <<< "$REQS"
  1827. REQS_NUM=${#array[@]}
  1828. PASSED_REQ=0
  1829. for REQ in "${array[@]}"; do
  1830. if (checkRequirement "$REQ" "${array[0]}"); then
  1831. PASSED_REQ=$(($PASSED_REQ + 1))
  1832. else
  1833. break
  1834. fi
  1835. done
  1836.  
  1837. # execute for exploits with all requirements met
  1838. if [ $PASSED_REQ -eq $REQS_NUM ]; then
  1839.  
  1840. # additional requirement for --cvelist-file mode: check if CVE associated with the exploit is on the CVELIST_FILE
  1841. if [ "$opt_cvelist_file" = "true" ]; then
  1842.  
  1843. # extract CVE(s) associated with given exploit (also translates ',' to '|' for easy handling multiple CVEs case - via extended regex)
  1844. cve=$(echo "$NAME" | grep '.*\[.*\].*' | cut -d 'm' -f2 | cut -d ']' -f1 | tr -d '[' | tr "," "|")
  1845. #echo "CVE: $cve"
  1846.  
  1847. # check if it's on CVELIST_FILE list, if no move to next exploit
  1848. [ ! $(cat "$CVELIST_FILE" | grep -E "$cve") ] && continue
  1849. fi
  1850.  
  1851. # process tags and highlight those that match current OS (only for deb|ubuntu|RHEL and if we know distro version - direct mode)
  1852. tags=""
  1853. if [ -n "$TAGS" -a -n "$OS" -a -n "$DISTRO" ]; then
  1854. IFS=',' read -r -a tags_array <<< "$TAGS"
  1855. TAGS_NUM=${#tags_array[@]}
  1856. for TAG in "${tags_array[@]}"; do
  1857. tag_distro=$(echo "$TAG" | cut -d'=' -f1)
  1858. tag_distro_num_all=$(echo "$TAG" | cut -d'=' -f2)
  1859. # in case of tag of form: 'ubuntu=16.04{kernel:4.4.0-21} remove kernel versioning part for comparision
  1860. tag_distro_num="${tag_distro_num_all%{*}"
  1861.  
  1862. # if distro matches:
  1863. if [ "$OS" == "$tag_distro" -a "$(echo "$DISTRO" | grep -E "$tag_distro_num")" ]; then
  1864.  
  1865. # get name (kernel or package name) and version of kernel/pkg if provided:
  1866. tag_pkg=$(echo "$tag_distro_num_all" | cut -d'{' -f 2 | tr -d '}' | cut -d':' -f 1)
  1867. tag_pkg_num=""
  1868. [ $(echo "$tag_distro_num_all" | grep '{') ] && tag_pkg_num=$(echo "$tag_distro_num_all" | cut -d'{' -f 2 | tr -d '}' | cut -d':' -f 2)
  1869.  
  1870. #[ -n "$tag_pkg_num" ] && echo "tag_pkg_num: $tag_pkg_num; kernel: $KERNEL_ALL"
  1871.  
  1872. # if pkg/kernel version is not provided:
  1873. if [ -z "$tag_pkg_num" ]; then
  1874. TAG="${lightyellow}[ ${TAG} ]${txtrst}"
  1875.  
  1876. # kernel version provided, check for match:
  1877. elif [ -n "$tag_pkg_num" -a "$tag_pkg" = "kernel" ]; then
  1878. [ $(echo "$KERNEL_ALL" | grep -E "${tag_pkg_num}") ] && TAG="${yellow}[ ${TAG} ]${txtrst}" || TAG="${lightyellow}[ $tag_distro=$tag_distro_num ]${txtrst}{kernel:$tag_pkg_num}"
  1879.  
  1880. # pkg version provided, check for match (TBD):
  1881. elif [ -n "$tag_pkg_num" -a -n "$tag_pkg" ]; then
  1882. TAG="${lightyellow}[ $tag_distro=$tag_distro_num ]${txtrst}{$tag_pkg:$tag_pkg_num}"
  1883. fi
  1884.  
  1885. fi
  1886.  
  1887. # append current tag to tags list
  1888. tags="${tags}${TAG},"
  1889. done
  1890. # trim ',' added by above loop
  1891. [ -n "$tags" ] && tags="${tags%?}"
  1892. else
  1893. tags="$TAGS"
  1894. fi
  1895.  
  1896. EXPLOIT_DB=$(echo "$EXP" | grep "exploit-db: " | awk '{print $2}')
  1897. analysis_url=$(echo "$EXP" | grep "analysis-url: " | awk '{print $2}')
  1898. ext_url=$(echo "$EXP" | grep "ext-url: " | awk '{print $2}')
  1899. comments=$(echo "$EXP" | grep "Comments: " | cut -d' ' -f 2-)
  1900. reqs=$(echo "$EXP" | grep "Reqs: " | cut -d' ' -f 2)
  1901.  
  1902. # exploit name without CVE number and without commonly used special chars
  1903. name=$(echo "$NAME" | cut -d' ' -f 2- | tr -d ' ()/')
  1904.  
  1905. src_url=$(echo "$EXP" | grep "src-url: " | awk '{print $2}')
  1906. [ -z "$src_url" ] && [ -n "$EXPLOIT_DB" ] && src_url="https://www.exploit-db.com/download/$EXPLOIT_DB"
  1907. [ -z "$src_url" ] && exitWithErrMsg "Both 'src-url' and 'exploit-db' entries are empty for '$NAME' exploit - fix that. Aborting."
  1908.  
  1909. if [ -n "$analysis_url" ]; then
  1910. details="$analysis_url"
  1911. elif $(echo "$src_url" | grep -q 'www.exploit-db.com'); then
  1912. details="https://www.exploit-db.com/exploits/$EXPLOIT_DB/"
  1913. elif [[ "$src_url" =~ ^.*tgz|tar.gz|zip$ && -n "$EXPLOIT_DB" ]]; then
  1914. details="https://www.exploit-db.com/exploits/$EXPLOIT_DB/"
  1915. else
  1916. details="$src_url"
  1917. fi
  1918.  
  1919. # skip DoS by default
  1920. dos=$(echo "$EXP" | grep -o -i "(dos")
  1921. [ "$opt_show_dos" == "false" ] && [ -n "$dos" ] && continue
  1922.  
  1923. # handles --fetch-binaries option
  1924. if [ $opt_fetch_bins = "true" ]; then
  1925. for i in $(echo "$EXP" | grep "bin-url: " | awk '{print $2}'); do
  1926. [ -f "${name}_$(basename $i)" ] && rm -f "${name}_$(basename $i)"
  1927. wget -q -k "$i" -O "${name}_$(basename $i)"
  1928. done
  1929. fi
  1930.  
  1931. # handles --fetch-sources option
  1932. if [ $opt_fetch_srcs = "true" ]; then
  1933. [ -f "${name}_$(basename $src_url)" ] && rm -f "${name}_$(basename $src_url)"
  1934. wget -q -k "$src_url" -O "${name}_$(basename $src_url)" &
  1935. fi
  1936.  
  1937. # display result (short)
  1938. if [ "$opt_summary" = "true" ]; then
  1939. [ -z "$tags" ] && tags="-"
  1940. echo -e "$NAME || $tags || $src_url"
  1941. continue
  1942. fi
  1943.  
  1944. # display result (standard)
  1945. echo -e "[+] $NAME"
  1946. echo -e "\n Details: $details"
  1947. [ -n "$tags" ] && echo -e " Tags: $tags"
  1948. echo -e " Download URL: $src_url"
  1949. [ -n "$ext_url" ] && echo -e " ext-url: $ext_url"
  1950. [ -n "$comments" ] && echo -e " Comments: $comments"
  1951.  
  1952. # handles --full filter option
  1953. if [ "$opt_full" = "true" ]; then
  1954. [ -n "$reqs" ] && echo -e " Requirements: $reqs"
  1955.  
  1956. [ -n "$EXPLOIT_DB" ] && echo -e " exploit-db: $EXPLOIT_DB"
  1957.  
  1958. author=$(echo "$EXP" | grep "author: " | cut -d' ' -f 2-)
  1959. [ -n "$author" ] && echo -e " author: $author"
  1960. fi
  1961.  
  1962. echo
  1963. fi
  1964. done
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!