API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Nov 21st, 2018
196
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 48.13 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #A script to enumerate local information from a Linux host
  3. version="version 0.93"
  4. #@rebootuser
  5.  
  6. #help function
  7. usage ()
  8. {
  9. echo -e "\n\e[00;31m#########################################################\e[00m"
  10. echo -e "\e[00;31m#\e[00m" "\e[00;33mLocal Linux Enumeration & Privilege Escalation Script\e[00m" "\e[00;31m#\e[00m"
  11. echo -e "\e[00;31m#########################################################\e[00m"
  12. echo -e "\e[00;33m# www.rebootuser.com | @rebootuser \e[00m"
  13. echo -e "\e[00;33m# $version\e[00m\n"
  14. echo -e "\e[00;33m# Example: ./LinEnum.sh -k keyword -r report -e /tmp/ -t \e[00m\n"
  15.  
  16.         echo "OPTIONS:"
  17.         echo "-k    Enter keyword"
  18.         echo "-e    Enter export location"
  19.         echo "-s    Supply user password for sudo checks (INSECURE)"
  20.         echo "-t    Include thorough (lengthy) tests"
  21.         echo "-r    Enter report name"
  22.         echo "-h    Displays this help text"
  23.         echo -e "\n"
  24.         echo "Running with no options = limited scans/no output file"
  25.        
  26. echo -e "\e[00;31m#########################################################\e[00m"     
  27. }
  28. header()
  29. {
  30. echo -e "\n\e[00;31m#########################################################\e[00m"
  31. echo -e "\e[00;31m#\e[00m" "\e[00;33mLocal Linux Enumeration & Privilege Escalation Script\e[00m" "\e[00;31m#\e[00m"
  32. echo -e "\e[00;31m#########################################################\e[00m"
  33. echo -e "\e[00;33m# www.rebootuser.com\e[00m"
  34. echo -e "\e[00;33m# $version\e[00m\n"
  35.  
  36. }
  37.  
  38. debug_info()
  39. {
  40. echo "[-] Debug Info"
  41.  
  42. if [ "$keyword" ]; then
  43.     echo "[+] Searching for the keyword $keyword in conf, php, ini and log files"
  44. else
  45.     :
  46. fi
  47.  
  48. if [ "$report" ]; then
  49.     echo "[+] Report name = $report"
  50. else
  51.     :
  52. fi
  53.  
  54. if [ "$export" ]; then
  55.     echo "[+] Export location = $export"
  56. else
  57.     :
  58. fi
  59.  
  60. if [ "$thorough" ]; then
  61.     echo "[+] Thorough tests = Enabled"
  62. else
  63.     echo -e "\e[00;33m[+] Thorough tests = Disabled (SUID/GUID checks will not be perfomed!)\e[00m"
  64. fi
  65.  
  66. sleep 2
  67.  
  68. if [ "$export" ]; then
  69.   mkdir $export 2>/dev/null
  70.   format=$export/LinEnum-export-`date +"%d-%m-%y"`
  71.   mkdir $format 2>/dev/null
  72. else
  73.   :
  74. fi
  75.  
  76. if [ "$sudopass" ]; then
  77.   echo -e "\e[00;35m[+] Please enter password - INSECURE - really only for CTF use!\e[00m"
  78.   read -s userpassword
  79.   echo
  80. else
  81.   :
  82. fi
  83.  
  84. who=`whoami` 2>/dev/null
  85. echo -e "\n"
  86.  
  87. echo -e "\e[00;33mScan started at:"; date
  88. echo -e "\e[00m\n"
  89. }
  90.  
  91. # useful binaries (thanks to https://gtfobins.github.io/)
  92. binarylist='nmap\|perl\|awk\|find\|bash\|sh\|man\|more\|less\|vi\|emacs\|vim\|nc\|netcat\|python\|ruby\|lua\|irb\|tar\|zip\|gdb\|pico\|scp\|git\|rvim\|script\|ash\|csh\|curl\|dash\|ed\|env\|expect\|ftp\|sftp\|node\|php\|rpm\|rpmquery\|socat\|strace\|taskset\|tclsh\|telnet\|tftp\|wget\|wish\|zsh\|ssh'
  93.  
  94. system_info()
  95. {
  96. echo -e "\e[00;33m### SYSTEM ##############################################\e[00m"
  97.  
  98. #basic kernel info
  99. unameinfo=`uname -a 2>/dev/null`
  100. if [ "$unameinfo" ]; then
  101.   echo -e "\e[00;31m[-] Kernel information:\e[00m\n$unameinfo"
  102.   echo -e "\n"
  103. else
  104.   :
  105. fi
  106.  
  107. procver=`cat /proc/version 2>/dev/null`
  108. if [ "$procver" ]; then
  109.   echo -e "\e[00;31m[-] Kernel information (continued):\e[00m\n$procver"
  110.   echo -e "\n"
  111. else
  112.   :
  113. fi
  114.  
  115. #search all *-release files for version info
  116. release=`cat /etc/*-release 2>/dev/null`
  117. if [ "$release" ]; then
  118.   echo -e "\e[00;31m[-] Specific release information:\e[00m\n$release"
  119.   echo -e "\n"
  120. else
  121.   :
  122. fi
  123.  
  124. #target hostname info
  125. hostnamed=`hostname 2>/dev/null`
  126. if [ "$hostnamed" ]; then
  127.   echo -e "\e[00;31m[-] Hostname:\e[00m\n$hostnamed"
  128.   echo -e "\n"
  129. else
  130.   :
  131. fi
  132. }
  133.  
  134. user_info()
  135. {
  136. echo -e "\e[00;33m### USER/GROUP ##########################################\e[00m"
  137.  
  138. #current user details
  139. currusr=`id 2>/dev/null`
  140. if [ "$currusr" ]; then
  141.   echo -e "\e[00;31m[-] Current user/group info:\e[00m\n$currusr"
  142.   echo -e "\n"
  143. else
  144.   :
  145. fi
  146.  
  147. #last logged on user information
  148. lastlogedonusrs=`lastlog 2>/dev/null |grep -v "Never" 2>/dev/null`
  149. if [ "$lastlogedonusrs" ]; then
  150.   echo -e "\e[00;31m[-] Users that have previously logged onto the system:\e[00m\n$lastlogedonusrs"
  151.   echo -e "\n"
  152. else
  153.   :
  154. fi
  155.  
  156.  
  157. #who else is logged on
  158. loggedonusrs=`w 2>/dev/null`
  159. if [ "$loggedonusrs" ]; then
  160.   echo -e "\e[00;31m[-] Who else is logged on:\e[00m\n$loggedonusrs"
  161.   echo -e "\n"
  162. else
  163.   :
  164. fi
  165.  
  166. #lists all id's and respective group(s)
  167. grpinfo=`for i in $(cut -d":" -f1 /etc/passwd 2>/dev/null);do id $i;done 2>/dev/null`
  168. if [ "$grpinfo" ]; then
  169.   echo -e "\e[00;31m[-] Group memberships:\e[00m\n$grpinfo"
  170.   echo -e "\n"
  171. else
  172.   :
  173. fi
  174.  
  175. #added by phackt - look for adm group (thanks patrick)
  176. adm_users=$(echo -e "$grpinfo" | grep "(adm)")
  177. if [[ ! -z $adm_users ]];
  178.   then
  179.     echo -e "\e[00;31m[-] It looks like we have some admin users:\e[00m\n$adm_users"
  180.     echo -e "\n"
  181. else
  182.   :
  183. fi
  184.  
  185. #checks to see if any hashes are stored in /etc/passwd (depreciated  *nix storage method)
  186. hashesinpasswd=`grep -v '^[^:]*:[x]' /etc/passwd 2>/dev/null`
  187. if [ "$hashesinpasswd" ]; then
  188.   echo -e "\e[00;33m[+] It looks like we have password hashes in /etc/passwd!\e[00m\n$hashesinpasswd"
  189.   echo -e "\n"
  190. else
  191.   :
  192. fi
  193.  
  194. #contents of /etc/passwd
  195. readpasswd=`cat /etc/passwd 2>/dev/null`
  196. if [ "$readpasswd" ]; then
  197.   echo -e "\e[00;31m[-] Contents of /etc/passwd:\e[00m\n$readpasswd"
  198.   echo -e "\n"
  199. else
  200.   :
  201. fi
  202.  
  203. if [ "$export" ] && [ "$readpasswd" ]; then
  204.   mkdir $format/etc-export/ 2>/dev/null
  205.   cp /etc/passwd $format/etc-export/passwd 2>/dev/null
  206. else
  207.   :
  208. fi
  209.  
  210. #checks to see if the shadow file can be read
  211. readshadow=`cat /etc/shadow 2>/dev/null`
  212. if [ "$readshadow" ]; then
  213.   echo -e "\e[00;33m[+] We can read the shadow file!\e[00m\n$readshadow"
  214.   echo -e "\n"
  215. else
  216.   :
  217. fi
  218.  
  219. if [ "$export" ] && [ "$readshadow" ]; then
  220.   mkdir $format/etc-export/ 2>/dev/null
  221.   cp /etc/shadow $format/etc-export/shadow 2>/dev/null
  222. else
  223.   :
  224. fi
  225.  
  226. #checks to see if /etc/master.passwd can be read - BSD 'shadow' variant
  227. readmasterpasswd=`cat /etc/master.passwd 2>/dev/null`
  228. if [ "$readmasterpasswd" ]; then
  229.   echo -e "\e[00;33m[+] We can read the master.passwd file!\e[00m\n$readmasterpasswd"
  230.   echo -e "\n"
  231. else
  232.   :
  233. fi
  234.  
  235. if [ "$export" ] && [ "$readmasterpasswd" ]; then
  236.   mkdir $format/etc-export/ 2>/dev/null
  237.   cp /etc/master.passwd $format/etc-export/master.passwd 2>/dev/null
  238. else
  239.   :
  240. fi
  241.  
  242. #all root accounts (uid 0)
  243. superman=`grep -v -E "^#" /etc/passwd 2>/dev/null| awk -F: '$3 == 0 { print $1}' 2>/dev/null`
  244. if [ "$superman" ]; then
  245.   echo -e "\e[00;31m[-] Super user account(s):\e[00m\n$superman"
  246.   echo -e "\n"
  247. else
  248.   :
  249. fi
  250.  
  251. #pull out vital sudoers info
  252. sudoers=`grep -v -e '^$' /etc/sudoers 2>/dev/null |grep -v "#" 2>/dev/null`
  253. if [ "$sudoers" ]; then
  254.   echo -e "\e[00;31m[-] Sudoers configuration (condensed):\e[00m$sudoers"
  255.   echo -e "\n"
  256. else
  257.   :
  258. fi
  259.  
  260. if [ "$export" ] && [ "$sudoers" ]; then
  261.   mkdir $format/etc-export/ 2>/dev/null
  262.   cp /etc/sudoers $format/etc-export/sudoers 2>/dev/null
  263. else
  264.   :
  265. fi
  266.  
  267. #can we sudo without supplying a password
  268. sudoperms=`echo '' | sudo -S -l -k 2>/dev/null`
  269. if [ "$sudoperms" ]; then
  270.   echo -e "\e[00;33m[+] We can sudo without supplying a password!\e[00m\n$sudoperms"
  271.   echo -e "\n"
  272. else
  273.   :
  274. fi
  275.  
  276. #check sudo perms - authenticated
  277. if [ "$sudopass" ]; then
  278.     if [ "$sudoperms" ]; then
  279.       :
  280.     else
  281.       sudoauth=`echo $userpassword | sudo -S -l -k 2>/dev/null`
  282.       if [ "$sudoauth" ]; then
  283.         echo -e "\e[00;33m[+] We can sudo when supplying a password!\e[00m\n$sudoauth"
  284.         echo -e "\n"
  285.       else
  286.         :
  287.       fi
  288.     fi
  289. else
  290.   :
  291. fi
  292.  
  293. ##known 'good' breakout binaries (cleaned to parse /etc/sudoers for comma separated values) - authenticated
  294. if [ "$sudopass" ]; then
  295.     if [ "$sudoperms" ]; then
  296.       :
  297.     else
  298.       sudopermscheck=`echo $userpassword | sudo -S -l -k 2>/dev/null | xargs -n 1 2>/dev/null|sed 's/,*$//g' 2>/dev/null | grep -w $binarylist 2>/dev/null`
  299.       if [ "$sudopermscheck" ]; then
  300.         echo -e "\e[00;33m[-] Possible sudo pwnage!\e[00m\n$sudopermscheck"
  301.         echo -e "\n"
  302.      else
  303.         :
  304.       fi
  305.     fi
  306. else
  307.   :
  308. fi
  309.  
  310. #known 'good' breakout binaries (cleaned to parse /etc/sudoers for comma separated values)
  311. sudopwnage=`echo '' | sudo -S -l -k 2>/dev/null | xargs -n 1 2>/dev/null | sed 's/,*$//g' 2>/dev/null | grep -w $binarylist 2>/dev/null`
  312. if [ "$sudopwnage" ]; then
  313.   echo -e "\e[00;33m[+] Possible sudo pwnage!\e[00m\n$sudopwnage"
  314.   echo -e "\n"
  315. else
  316.   :
  317. fi
  318.  
  319. #who has sudoed in the past
  320. whohasbeensudo=`find /home -name .sudo_as_admin_successful 2>/dev/null`
  321. if [ "$whohasbeensudo" ]; then
  322.   echo -e "\e[00;31m[-] Accounts that have recently used sudo:\e[00m\n$whohasbeensudo"
  323.   echo -e "\n"
  324. else
  325.   :
  326. fi
  327.  
  328. #checks to see if roots home directory is accessible
  329. rthmdir=`ls -ahl /root/ 2>/dev/null`
  330. if [ "$rthmdir" ]; then
  331.   echo -e "\e[00;33m[+] We can read root's home directory!\e[00m\n$rthmdir"
  332.   echo -e "\n"
  333. else
  334.   :
  335. fi
  336.  
  337. #displays /home directory permissions - check if any are lax
  338. homedirperms=`ls -ahl /home/ 2>/dev/null`
  339. if [ "$homedirperms" ]; then
  340.   echo -e "\e[00;31m[-] Are permissions on /home directories lax:\e[00m\n$homedirperms"
  341.   echo -e "\n"
  342. else
  343.   :
  344. fi
  345.  
  346. #looks for files we can write to that don't belong to us
  347. if [ "$thorough" = "1" ]; then
  348.   grfilesall=`find / -writable ! -user \`whoami\` -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null`
  349.   if [ "$grfilesall" ]; then
  350.     echo -e "\e[00;31m[-] Files not owned by user but writable by group:\e[00m\n$grfilesall"
  351.     echo -e "\n"
  352.   else
  353.     :
  354.   fi
  355. fi
  356.  
  357. #looks for files that belong to us
  358. if [ "$thorough" = "1" ]; then
  359.   ourfilesall=`find / -user \`whoami\` -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null`
  360.   if [ "$ourfilesall" ]; then
  361.     echo -e "\e[00;31m[-] Files owned by our user:\e[00m\n$ourfilesall"
  362.     echo -e "\n"
  363.   else
  364.     :
  365.   fi
  366. fi
  367.  
  368. #looks for hidden files
  369. if [ "$thorough" = "1" ]; then
  370.   hiddenfiles=`find / -name ".*" -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null`
  371.   if [ "$hiddenfiles" ]; then
  372.     echo -e "\e[00;31m[-] Hidden files:\e[00m\n$hiddenfiles"
  373.     echo -e "\n"
  374.   else
  375.     :
  376.   fi
  377. fi
  378.  
  379. #looks for world-reabable files within /home - depending on number of /home dirs & files, this can take some time so is only 'activated' with thorough scanning switch
  380. if [ "$thorough" = "1" ]; then
  381. wrfileshm=`find /home/ -perm -4 -type f -exec ls -al {} \; 2>/dev/null`
  382.     if [ "$wrfileshm" ]; then
  383.         echo -e "\e[00;31m[-] World-readable files within /home:\e[00m\n$wrfileshm"
  384.         echo -e "\n"
  385.     else
  386.         :
  387.     fi
  388.   else
  389.     :
  390. fi
  391.  
  392. if [ "$thorough" = "1" ]; then
  393.     if [ "$export" ] && [ "$wrfileshm" ]; then
  394.         mkdir $format/wr-files/ 2>/dev/null
  395.         for i in $wrfileshm; do cp --parents $i $format/wr-files/ ; done 2>/dev/null
  396.     else
  397.         :
  398.     fi
  399.   else
  400.     :
  401. fi
  402.  
  403. #lists current user's home directory contents
  404. if [ "$thorough" = "1" ]; then
  405. homedircontents=`ls -ahl ~ 2>/dev/null`
  406.     if [ "$homedircontents" ] ; then
  407.         echo -e "\e[00;31m[-] Home directory contents:\e[00m\n$homedircontents"
  408.         echo -e "\n"
  409.     else
  410.         :
  411.     fi
  412.   else
  413.     :
  414. fi
  415.  
  416. #checks for if various ssh files are accessible - this can take some time so is only 'activated' with thorough scanning switch
  417. if [ "$thorough" = "1" ]; then
  418. sshfiles=`find / \( -name "id_dsa*" -o -name "id_rsa*" -o -name "known_hosts" -o -name "authorized_hosts" -o -name "authorized_keys" \) -exec ls -la {} 2>/dev/null \;`
  419.     if [ "$sshfiles" ]; then
  420.         echo -e "\e[00;31m[-] SSH keys/host information found in the following locations:\e[00m\n$sshfiles"
  421.         echo -e "\n"
  422.     else
  423.         :
  424.     fi
  425.   else
  426.   :
  427. fi
  428.  
  429. if [ "$thorough" = "1" ]; then
  430.     if [ "$export" ] && [ "$sshfiles" ]; then
  431.         mkdir $format/ssh-files/ 2>/dev/null
  432.         for i in $sshfiles; do cp --parents $i $format/ssh-files/; done 2>/dev/null
  433.     else
  434.         :
  435.     fi
  436.   else
  437.     :
  438. fi
  439.  
  440. #is root permitted to login via ssh
  441. sshrootlogin=`grep "PermitRootLogin " /etc/ssh/sshd_config 2>/dev/null | grep -v "#" | awk '{print  $2}'`
  442. if [ "$sshrootlogin" = "yes" ]; then
  443.   echo -e "\e[00;31m[-] Root is allowed to login via SSH:\e[00m" ; grep "PermitRootLogin " /etc/ssh/sshd_config 2>/dev/null | grep -v "#"
  444.   echo -e "\n"
  445. else
  446.   :
  447. fi
  448. }
  449.  
  450. environmental_info()
  451. {
  452. echo -e "\e[00;33m### ENVIRONMENTAL #######################################\e[00m"
  453.  
  454. #env information
  455. envinfo=`env 2>/dev/null | grep -v 'LS_COLORS' 2>/dev/null`
  456. if [ "$envinfo" ]; then
  457.   echo -e "\e[00;31m[-] Environment information:\e[00m\n$envinfo"
  458.   echo -e "\n"
  459. else
  460.   :
  461. fi
  462.  
  463. #check if selinux is enabled
  464. sestatus=`sestatus 2>/dev/null`
  465. if [ "$sestatus" ]; then
  466.   echo -e "\e[00;31m[-] SELinux seems to be present:\e[00m\n$sestatus"
  467.   echo -e "\n"
  468. fi
  469.  
  470. #phackt
  471.  
  472. #current path configuration
  473. pathinfo=`echo $PATH 2>/dev/null`
  474. if [ "$pathinfo" ]; then
  475.   echo -e "\e[00;31m[-] Path information:\e[00m\n$pathinfo"
  476.   echo -e "\n"
  477. else
  478.   :
  479. fi
  480.  
  481. #lists available shells
  482. shellinfo=`cat /etc/shells 2>/dev/null`
  483. if [ "$shellinfo" ]; then
  484.   echo -e "\e[00;31m[-] Available shells:\e[00m\n$shellinfo"
  485.   echo -e "\n"
  486. else
  487.   :
  488. fi
  489.  
  490. #current umask value with both octal and symbolic output
  491. umaskvalue=`umask -S 2>/dev/null & umask 2>/dev/null`
  492. if [ "$umaskvalue" ]; then
  493.   echo -e "\e[00;31m[-] Current umask value:\e[00m\n$umaskvalue"
  494.   echo -e "\n"
  495. else
  496.   :
  497. fi
  498.  
  499. #umask value as in /etc/login.defs
  500. umaskdef=`grep -i "^UMASK" /etc/login.defs 2>/dev/null`
  501. if [ "$umaskdef" ]; then
  502.   echo -e "\e[00;31m[-] umask value as specified in /etc/login.defs:\e[00m\n$umaskdef"
  503.   echo -e "\n"
  504. else
  505.   :
  506. fi
  507.  
  508. #password policy information as stored in /etc/login.defs
  509. logindefs=`grep "^PASS_MAX_DAYS\|^PASS_MIN_DAYS\|^PASS_WARN_AGE\|^ENCRYPT_METHOD" /etc/login.defs 2>/dev/null`
  510. if [ "$logindefs" ]; then
  511.   echo -e "\e[00;31m[-] Password and storage information:\e[00m\n$logindefs"
  512.   echo -e "\n"
  513. else
  514.   :
  515. fi
  516.  
  517. if [ "$export" ] && [ "$logindefs" ]; then
  518.   mkdir $format/etc-export/ 2>/dev/null
  519.   cp /etc/login.defs $format/etc-export/login.defs 2>/dev/null
  520. else
  521.   :
  522. fi
  523. }
  524.  
  525. job_info()
  526. {
  527. echo -e "\e[00;33m### JOBS/TASKS ##########################################\e[00m"
  528.  
  529. #are there any cron jobs configured
  530. cronjobs=`ls -la /etc/cron* 2>/dev/null`
  531. if [ "$cronjobs" ]; then
  532.   echo -e "\e[00;31m[-] Cron jobs:\e[00m\n$cronjobs"
  533.   echo -e "\n"
  534. else
  535.   :
  536. fi
  537.  
  538. #can we manipulate these jobs in any way
  539. cronjobwwperms=`find /etc/cron* -perm -0002 -type f -exec ls -la {} \; -exec cat {} 2>/dev/null \;`
  540. if [ "$cronjobwwperms" ]; then
  541.   echo -e "\e[00;33m[+] World-writable cron jobs and file contents:\e[00m\n$cronjobwwperms"
  542.   echo -e "\n"
  543. else
  544.   :
  545. fi
  546.  
  547. #contab contents
  548. crontabvalue=`cat /etc/crontab 2>/dev/null`
  549. if [ "$crontabvalue" ]; then
  550.   echo -e "\e[00;31m[-] Crontab contents:\e[00m\n$crontabvalue"
  551.   echo -e "\n"
  552. else
  553.   :
  554. fi
  555.  
  556. crontabvar=`ls -la /var/spool/cron/crontabs 2>/dev/null`
  557. if [ "$crontabvar" ]; then
  558.   echo -e "\e[00;31m[-] Anything interesting in /var/spool/cron/crontabs:\e[00m\n$crontabvar"
  559.   echo -e "\n"
  560. else
  561.   :
  562. fi
  563.  
  564. anacronjobs=`ls -la /etc/anacrontab 2>/dev/null; cat /etc/anacrontab 2>/dev/null`
  565. if [ "$anacronjobs" ]; then
  566.   echo -e "\e[00;31m[-] Anacron jobs and associated file permissions:\e[00m\n$anacronjobs"
  567.   echo -e "\n"
  568. else
  569.   :
  570. fi
  571.  
  572. anacrontab=`ls -la /var/spool/anacron 2>/dev/null`
  573. if [ "$anacrontab" ]; then
  574.   echo -e "\e[00;31m[-] When were jobs last executed (/var/spool/anacron contents):\e[00m\n$anacrontab"
  575.   echo -e "\n"
  576. else
  577.   :
  578. fi
  579.  
  580. #pull out account names from /etc/passwd and see if any users have associated cronjobs (priv command)
  581. cronother=`cut -d ":" -f 1 /etc/passwd | xargs -n1 crontab -l -u 2>/dev/null`
  582. if [ "$cronother" ]; then
  583.   echo -e "\e[00;31m[-] Jobs held by all users:\e[00m\n$cronother"
  584.   echo -e "\n"
  585. else
  586.   :
  587. fi
  588.  
  589. # list systemd timers
  590. if [ "$thorough" = "1" ]; then
  591.   # include inactive timers in thorough mode
  592.   systemdtimers="$(systemctl list-timers --all 2>/dev/null)"
  593.   info=""
  594. else
  595.   systemdtimers="$(systemctl list-timers 2>/dev/null |head -n -1 2>/dev/null)"
  596.   # replace the info in the output with a hint towards thorough mode
  597.   info="\e[2mEnable thorough tests to see inactive timers\e[00m"
  598. fi
  599. if [ "$systemdtimers" ]; then
  600.   echo -e "\e[00;31m[-] Systemd timers:\e[00m\n$systemdtimers\n$info"
  601.   echo -e "\n"
  602. else
  603.   :
  604. fi
  605.  
  606.  
  607. }
  608. networking_info()
  609. {
  610. echo -e "\e[00;33m### NETWORKING  ##########################################\e[00m"
  611.  
  612. #nic information
  613. nicinfo=`/sbin/ifconfig -a 2>/dev/null`
  614. if [ "$nicinfo" ]; then
  615.   echo -e "\e[00;31m[-] Network and IP info:\e[00m\n$nicinfo"
  616.   echo -e "\n"
  617. else
  618.   :
  619. fi
  620.  
  621. #nic information (using ip)
  622. nicinfoip=`/sbin/ip a 2>/dev/null`
  623. if [ ! "$nicinfo" ] && [ "$nicinfoip" ]; then
  624.   echo -e "\e[00;31m[-] Network and IP info:\e[00m\n$nicinfoip"
  625.   echo -e "\n"
  626. else
  627.   :
  628. fi
  629.  
  630. arpinfo=`arp -a 2>/dev/null`
  631. if [ "$arpinfo" ]; then
  632.   echo -e "\e[00;31m[-] ARP history:\e[00m\n$arpinfo"
  633.   echo -e "\n"
  634. else
  635.   :
  636. fi
  637.  
  638. arpinfoip=`ip n 2>/dev/null`
  639. if [ ! "$arpinfo" ] && [ "$arpinfoip" ]; then
  640.   echo -e "\e[00;31m[-] ARP history:\e[00m\n$arpinfoip"
  641.   echo -e "\n"
  642. else
  643.   :
  644. fi
  645.  
  646. #dns settings
  647. nsinfo=`grep "nameserver" /etc/resolv.conf 2>/dev/null`
  648. if [ "$nsinfo" ]; then
  649.   echo -e "\e[00;31m[-] Nameserver(s):\e[00m\n$nsinfo"
  650.   echo -e "\n"
  651. else
  652.   :
  653. fi
  654.  
  655. nsinfosysd=`systemd-resolve --status 2>/dev/null`
  656. if [ "$nsinfosysd" ]; then
  657.   echo -e "\e[00;31m[-] Nameserver(s):\e[00m\n$nsinfosysd"
  658.   echo -e "\n"
  659. else
  660.   :
  661. fi
  662.  
  663. #default route configuration
  664. defroute=`route 2>/dev/null | grep default`
  665. if [ "$defroute" ]; then
  666.   echo -e "\e[00;31m[-] Default route:\e[00m\n$defroute"
  667.   echo -e "\n"
  668. else
  669.   :
  670. fi
  671.  
  672. #default route configuration
  673. defrouteip=`ip r 2>/dev/null | grep default`
  674. if [ ! "$defroute" ] && [ "$defrouteip" ]; then
  675.   echo -e "\e[00;31m[-] Default route:\e[00m\n$defrouteip"
  676.   echo -e "\n"
  677. else
  678.   :
  679. fi
  680.  
  681. #listening TCP
  682. tcpservs=`netstat -antp 2>/dev/null`
  683. if [ "$tcpservs" ]; then
  684.   echo -e "\e[00;31m[-] Listening TCP:\e[00m\n$tcpservs"
  685.   echo -e "\n"
  686. else
  687.   :
  688. fi
  689.  
  690. tcpservsip=`ss -t 2>/dev/null`
  691. if [ ! "$tcpservs" ] && [ "$tcpservsip" ]; then
  692.   echo -e "\e[00;31m[-] Listening TCP:\e[00m\n$tcpservsip"
  693.   echo -e "\n"
  694. else
  695.   :
  696. fi
  697. #listening UDP
  698. udpservs=`netstat -anup 2>/dev/null`
  699. if [ "$udpservs" ]; then
  700.   echo -e "\e[00;31m[-] Listening UDP:\e[00m\n$udpservs"
  701.   echo -e "\n"
  702. else
  703.   :
  704. fi
  705.  
  706. udpservsip=`ip -u 2>/dev/null`
  707. if [ ! "$udpservs" ] && [ "$udpservsip" ]; then
  708.   echo -e "\e[00;31m[-] Listening UDP:\e[00m\n$udpservsip"
  709.   echo -e "\n"
  710. else
  711.   :
  712. fi
  713. }
  714.  
  715. services_info()
  716. {
  717. echo -e "\e[00;33m### SERVICES #############################################\e[00m"
  718.  
  719. #running processes
  720. psaux=`ps aux 2>/dev/null`
  721. if [ "$psaux" ]; then
  722.   echo -e "\e[00;31m[-] Running processes:\e[00m\n$psaux"
  723.   echo -e "\n"
  724. else
  725.   :
  726. fi
  727.  
  728. #lookup process binary path and permissisons
  729. procperm=`ps aux 2>/dev/null | awk '{print $11}'|xargs -r ls -la 2>/dev/null |awk '!x[$0]++' 2>/dev/null`
  730. if [ "$procperm" ]; then
  731.   echo -e "\e[00;31m[-] Process binaries and associated permissions (from above list):\e[00m\n$procperm"
  732.   echo -e "\n"
  733. else
  734.   :
  735. fi
  736.  
  737. if [ "$export" ] && [ "$procperm" ]; then
  738. procpermbase=`ps aux 2>/dev/null | awk '{print $11}' | xargs -r ls 2>/dev/null | awk '!x[$0]++' 2>/dev/null`
  739.   mkdir $format/ps-export/ 2>/dev/null
  740.   for i in $procpermbase; do cp --parents $i $format/ps-export/; done 2>/dev/null
  741. else
  742.   :
  743. fi
  744.  
  745. #anything 'useful' in inetd.conf
  746. inetdread=`cat /etc/inetd.conf 2>/dev/null`
  747. if [ "$inetdread" ]; then
  748.   echo -e "\e[00;31m[-] Contents of /etc/inetd.conf:\e[00m\n$inetdread"
  749.   echo -e "\n"
  750. else
  751.   :
  752. fi
  753.  
  754. if [ "$export" ] && [ "$inetdread" ]; then
  755.   mkdir $format/etc-export/ 2>/dev/null
  756.   cp /etc/inetd.conf $format/etc-export/inetd.conf 2>/dev/null
  757. else
  758.   :
  759. fi
  760.  
  761. #very 'rough' command to extract associated binaries from inetd.conf & show permisisons of each
  762. inetdbinperms=`awk '{print $7}' /etc/inetd.conf 2>/dev/null |xargs -r ls -la 2>/dev/null`
  763. if [ "$inetdbinperms" ]; then
  764.   echo -e "\e[00;31m[-] The related inetd binary permissions:\e[00m\n$inetdbinperms"
  765.   echo -e "\n"
  766. else
  767.   :
  768. fi
  769.  
  770. xinetdread=`cat /etc/xinetd.conf 2>/dev/null`
  771. if [ "$xinetdread" ]; then
  772.   echo -e "\e[00;31m[-] Contents of /etc/xinetd.conf:\e[00m\n$xinetdread"
  773.   echo -e "\n"
  774. else
  775.   :
  776. fi
  777.  
  778. if [ "$export" ] && [ "$xinetdread" ]; then
  779.   mkdir $format/etc-export/ 2>/dev/null
  780.   cp /etc/xinetd.conf $format/etc-export/xinetd.conf 2>/dev/null
  781. else
  782.   :
  783. fi
  784.  
  785. xinetdincd=`grep "/etc/xinetd.d" /etc/xinetd.conf 2>/dev/null`
  786. if [ "$xinetdincd" ]; then
  787.   echo -e "\e[00;31m[-] /etc/xinetd.d is included in /etc/xinetd.conf - associated binary permissions are listed below:\e[00m"; ls -la /etc/xinetd.d 2>/dev/null
  788.   echo -e "\n"
  789. else
  790.   :
  791. fi
  792.  
  793. #very 'rough' command to extract associated binaries from xinetd.conf & show permisisons of each
  794. xinetdbinperms=`awk '{print $7}' /etc/xinetd.conf 2>/dev/null |xargs -r ls -la 2>/dev/null`
  795. if [ "$xinetdbinperms" ]; then
  796.   echo -e "\e[00;31m[-] The related xinetd binary permissions:\e[00m\n$xinetdbinperms"
  797.   echo -e "\n"
  798. else
  799.   :
  800. fi
  801.  
  802. initdread=`ls -la /etc/init.d 2>/dev/null`
  803. if [ "$initdread" ]; then
  804.   echo -e "\e[00;31m[-] /etc/init.d/ binary permissions:\e[00m\n$initdread"
  805.   echo -e "\n"
  806. else
  807.   :
  808. fi  
  809.  
  810. #init.d files NOT belonging to root!
  811. initdperms=`find /etc/init.d/ \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
  812. if [ "$initdperms" ]; then
  813.   echo -e "\e[00;31m[-] /etc/init.d/ files not belonging to root:\e[00m\n$initdperms"
  814.   echo -e "\n"
  815. else
  816.   :
  817. fi
  818.  
  819. rcdread=`ls -la /etc/rc.d/init.d 2>/dev/null`
  820. if [ "$rcdread" ]; then
  821.   echo -e "\e[00;31m[-] /etc/rc.d/init.d binary permissions:\e[00m\n$rcdread"
  822.   echo -e "\n"
  823. else
  824.   :
  825. fi
  826.  
  827. #init.d files NOT belonging to root!
  828. rcdperms=`find /etc/rc.d/init.d \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
  829. if [ "$rcdperms" ]; then
  830.   echo -e "\e[00;31m[-] /etc/rc.d/init.d files not belonging to root:\e[00m\n$rcdperms"
  831.   echo -e "\n"
  832. else
  833.   :
  834. fi
  835.  
  836. usrrcdread=`ls -la /usr/local/etc/rc.d 2>/dev/null`
  837. if [ "$usrrcdread" ]; then
  838.   echo -e "\e[00;31m[-] /usr/local/etc/rc.d binary permissions:\e[00m\n$usrrcdread"
  839.   echo -e "\n"
  840. else
  841.   :
  842. fi
  843.  
  844. #rc.d files NOT belonging to root!
  845. usrrcdperms=`find /usr/local/etc/rc.d \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
  846. if [ "$usrrcdperms" ]; then
  847.   echo -e "\e[00;31m[-] /usr/local/etc/rc.d files not belonging to root:\e[00m\n$usrrcdperms"
  848.   echo -e "\n"
  849. else
  850.   :
  851. fi
  852.  
  853. initread=`ls -la /etc/init/ 2>/dev/null`
  854. if [ "$initread" ]; then
  855.   echo -e "\e[00;31m[-] /etc/init/ config file permissions:\e[00m\n$initread"
  856.   echo -e "\n"
  857. else
  858.   :
  859. fi
  860.  
  861. # upstart scripts not belonging to root
  862. initperms=`find /etc/init \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
  863. if [ "$initperms" ]; then
  864.    echo -e "\e[00;31m[-] /etc/init/ config files not belonging to root:\e[00m\n$initperms"
  865.    echo -e "\n"
  866. else
  867.   :
  868. fi
  869.  
  870. systemdread=`ls -lthR /lib/systemd/ 2>/dev/null`
  871. if [ "$systemdread" ]; then
  872.   echo -e "\e[00;31m[-] /lib/systemd/* config file permissions:\e[00m\n$systemdread"
  873.   echo -e "\n"
  874. else
  875.   :
  876. fi
  877.  
  878. # systemd files not belonging to root
  879. systemdperms=`find /lib/systemd/ \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
  880. if [ "$systemdperms" ]; then
  881.    echo -e "\e[00;31m[-] /lib/systemd/* config files not belonging to root:\e[00m\n$systemdperms"
  882.    echo -e "\n"
  883. else
  884.   :
  885. fi
  886. }
  887.  
  888. software_configs()
  889. {
  890. echo -e "\e[00;33m### SOFTWARE #############################################\e[00m"
  891.  
  892. #sudo version - check to see if there are any known vulnerabilities with this
  893. sudover=`sudo -V 2>/dev/null| grep "Sudo version" 2>/dev/null`
  894. if [ "$sudover" ]; then
  895.   echo -e "\e[00;31m[-] Sudo version:\e[00m\n$sudover"
  896.   echo -e "\n"
  897. else
  898.   :
  899. fi
  900.  
  901. #mysql details - if installed
  902. mysqlver=`mysql --version 2>/dev/null`
  903. if [ "$mysqlver" ]; then
  904.   echo -e "\e[00;31m[-] MYSQL version:\e[00m\n$mysqlver"
  905.   echo -e "\n"
  906. else
  907.   :
  908. fi
  909.  
  910. #checks to see if root/root will get us a connection
  911. mysqlconnect=`mysqladmin -uroot -proot version 2>/dev/null`
  912. if [ "$mysqlconnect" ]; then
  913.   echo -e "\e[00;33m[+] We can connect to the local MYSQL service with default root/root credentials!\e[00m\n$mysqlconnect"
  914.   echo -e "\n"
  915. else
  916.   :
  917. fi
  918.  
  919. #mysql version details
  920. mysqlconnectnopass=`mysqladmin -uroot version 2>/dev/null`
  921. if [ "$mysqlconnectnopass" ]; then
  922.   echo -e "\e[00;33m[+] We can connect to the local MYSQL service as 'root' and without a password!\e[00m\n$mysqlconnectnopass"
  923.   echo -e "\n"
  924. else
  925.   :
  926. fi
  927.  
  928. #postgres details - if installed
  929. postgver=`psql -V 2>/dev/null`
  930. if [ "$postgver" ]; then
  931.   echo -e "\e[00;31m[-] Postgres version:\e[00m\n$postgver"
  932.   echo -e "\n"
  933. else
  934.   :
  935. fi
  936.  
  937. #checks to see if any postgres password exists and connects to DB 'template0' - following commands are a variant on this
  938. postcon1=`psql -U postgres template0 -c 'select version()' 2>/dev/null | grep version`
  939. if [ "$postcon1" ]; then
  940.   echo -e "\e[00;33m[+] We can connect to Postgres DB 'template0' as user 'postgres' with no password!:\e[00m\n$postcon1"
  941.   echo -e "\n"
  942. else
  943.   :
  944. fi
  945.  
  946. postcon11=`psql -U postgres template1 -c 'select version()' 2>/dev/null | grep version`
  947. if [ "$postcon11" ]; then
  948.   echo -e "\e[00;33m[+] We can connect to Postgres DB 'template1' as user 'postgres' with no password!:\e[00m\n$postcon11"
  949.   echo -e "\n"
  950. else
  951.   :
  952. fi
  953.  
  954. postcon2=`psql -U pgsql template0 -c 'select version()' 2>/dev/null | grep version`
  955. if [ "$postcon2" ]; then
  956.   echo -e "\e[00;33m[+] We can connect to Postgres DB 'template0' as user 'psql' with no password!:\e[00m\n$postcon2"
  957.   echo -e "\n"
  958. else
  959.   :
  960. fi
  961.  
  962. postcon22=`psql -U pgsql template1 -c 'select version()' 2>/dev/null | grep version`
  963. if [ "$postcon22" ]; then
  964.   echo -e "\e[00;33m[+] We can connect to Postgres DB 'template1' as user 'psql' with no password!:\e[00m\n$postcon22"
  965.   echo -e "\n"
  966. else
  967.   :
  968. fi
  969.  
  970. #apache details - if installed
  971. apachever=`apache2 -v 2>/dev/null; httpd -v 2>/dev/null`
  972. if [ "$apachever" ]; then
  973.   echo -e "\e[00;31m[-] Apache version:\e[00m\n$apachever"
  974.   echo -e "\n"
  975. else
  976.   :
  977. fi
  978.  
  979. #what account is apache running under
  980. apacheusr=`grep -i 'user\|group' /etc/apache2/envvars 2>/dev/null |awk '{sub(/.*\export /,"")}1' 2>/dev/null`
  981. if [ "$apacheusr" ]; then
  982.   echo -e "\e[00;31m[-] Apache user configuration:\e[00m\n$apacheusr"
  983.   echo -e "\n"
  984. else
  985.   :
  986. fi
  987.  
  988. if [ "$export" ] && [ "$apacheusr" ]; then
  989.   mkdir --parents $format/etc-export/apache2/ 2>/dev/null
  990.   cp /etc/apache2/envvars $format/etc-export/apache2/envvars 2>/dev/null
  991. else
  992.   :
  993. fi
  994.  
  995. #installed apache modules
  996. apachemodules=`apache2ctl -M 2>/dev/null; httpd -M 2>/dev/null`
  997. if [ "$apachemodules" ]; then
  998.   echo -e "\e[00;31m[-] Installed Apache modules:\e[00m\n$apachemodules"
  999.   echo -e "\n"
  1000. else
  1001.   :
  1002. fi
  1003.  
  1004. #htpasswd check
  1005. htpasswd=`find / -name .htpasswd -print -exec cat {} \; 2>/dev/null`
  1006. if [ "$htpasswd" ]; then
  1007.     echo -e "\e[00;33m[-] htpasswd found - could contain passwords:\e[00m\n$htpasswd"
  1008.     echo -e "\n"
  1009. else
  1010.     :
  1011. fi
  1012.  
  1013. #anything in the default http home dirs (changed to thorough as can be large)
  1014. if [ "$thorough" = "1" ]; then
  1015.   apachehomedirs=`ls -alhR /var/www/ 2>/dev/null; ls -alhR /srv/www/htdocs/ 2>/dev/null; ls -alhR /usr/local/www/apache2/data/ 2>/dev/null; ls -alhR /opt/lampp/htdocs/ 2>/dev/null`
  1016.   if [ "$apachehomedirs" ]; then
  1017.     echo -e "\e[00;31m[-] www home dir contents:\e[00m\n$apachehomedirs"
  1018.     echo -e "\n"
  1019. else
  1020.     :
  1021.   fi
  1022. fi
  1023.  
  1024. }
  1025.  
  1026. interesting_files()
  1027. {
  1028. echo -e "\e[00;33m### INTERESTING FILES ####################################\e[00m"
  1029.  
  1030. #checks to see if various files are installed
  1031. echo -e "\e[00;31m[-] Useful file locations:\e[00m" ; which nc 2>/dev/null ; which netcat 2>/dev/null ; which wget 2>/dev/null ; which nmap 2>/dev/null ; which gcc 2>/dev/null; which curl 2>/dev/null
  1032. echo -e "\n"
  1033.  
  1034. #limited search for installed compilers
  1035. compiler=`dpkg --list 2>/dev/null| grep compiler |grep -v decompiler 2>/dev/null && yum list installed 'gcc*' 2>/dev/null| grep gcc 2>/dev/null`
  1036. if [ "$compiler" ]; then
  1037.   echo -e "\e[00;31m[-] Installed compilers:\e[00m\n$compiler"
  1038.   echo -e "\n"
  1039.  else
  1040.   :
  1041. fi
  1042.  
  1043. #manual check - lists out sensitive files, can we read/modify etc.
  1044. echo -e "\e[00;31m[-] Can we read/write sensitive files:\e[00m" ; ls -la /etc/passwd 2>/dev/null ; ls -la /etc/group 2>/dev/null ; ls -la /etc/profile 2>/dev/null; ls -la /etc/shadow 2>/dev/null ; ls -la /etc/master.passwd 2>/dev/null
  1045. echo -e "\n"
  1046.  
  1047. #search for suid files - this can take some time so is only 'activated' with thorough scanning switch (as are all suid scans below)
  1048. if [ "$thorough" = "1" ]; then
  1049. findsuid=`find / -perm -4000 -type f -exec ls -la {} 2>/dev/null \;`
  1050.     if [ "$findsuid" ]; then
  1051.         echo -e "\e[00;31m[-] SUID files:\e[00m\n$findsuid"
  1052.         echo -e "\n"
  1053.     else
  1054.         :
  1055.     fi
  1056.   else
  1057.     :
  1058. fi
  1059.  
  1060. if [ "$thorough" = "1" ]; then
  1061.     if [ "$export" ] && [ "$findsuid" ]; then
  1062.         mkdir $format/suid-files/ 2>/dev/null
  1063.         for i in $findsuid; do cp $i $format/suid-files/; done 2>/dev/null
  1064.     else
  1065.         :
  1066.     fi
  1067.   else
  1068.     :
  1069. fi
  1070.  
  1071. #list of 'interesting' suid files - feel free to make additions
  1072. if [ "$thorough" = "1" ]; then
  1073. intsuid=`find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null | grep -w $binarylist 2>/dev/null`
  1074.     if [ "$intsuid" ]; then
  1075.         echo -e "\e[00;33m[+] Possibly interesting SUID files:\e[00m\n$intsuid"
  1076.         echo -e "\n"
  1077.     else
  1078.         :
  1079.     fi
  1080.   else
  1081.     :
  1082. fi
  1083.  
  1084. #lists word-writable suid files
  1085. if [ "$thorough" = "1" ]; then
  1086. wwsuid=`find / -perm -4007 -type f -exec ls -la {} 2>/dev/null \;`
  1087.     if [ "$wwsuid" ]; then
  1088.         echo -e "\e[00;33m[+] World-writable SUID files:\e[00m\n$wwsuid"
  1089.         echo -e "\n"
  1090.     else
  1091.         :
  1092.     fi
  1093.   else
  1094.     :
  1095. fi
  1096.  
  1097. #lists world-writable suid files owned by root
  1098. if [ "$thorough" = "1" ]; then
  1099. wwsuidrt=`find / -uid 0 -perm -4007 -type f -exec ls -la {} 2>/dev/null \;`
  1100.     if [ "$wwsuidrt" ]; then
  1101.         echo -e "\e[00;33m[+] World-writable SUID files owned by root:\e[00m\n$wwsuidrt"
  1102.         echo -e "\n"
  1103.     else
  1104.         :
  1105.     fi
  1106.   else
  1107.     :
  1108. fi
  1109.  
  1110. #search for guid files - this can take some time so is only 'activated' with thorough scanning switch (as are all guid scans below)
  1111. if [ "$thorough" = "1" ]; then
  1112. findguid=`find / -perm -2000 -type f -exec ls -la {} 2>/dev/null \;`
  1113.     if [ "$findguid" ]; then
  1114.         echo -e "\e[00;31m[-] GUID files:\e[00m\n$findguid"
  1115.         echo -e "\n"
  1116.     else
  1117.         :
  1118.     fi
  1119.   else
  1120.     :
  1121. fi
  1122.  
  1123. if [ "$thorough" = "1" ]; then
  1124.     if [ "$export" ] && [ "$findguid" ]; then
  1125.         mkdir $format/guid-files/ 2>/dev/null
  1126.         for i in $findguid; do cp $i $format/guid-files/; done 2>/dev/null
  1127.     else
  1128.         :
  1129.     fi
  1130.   else
  1131.     :
  1132. fi
  1133.  
  1134. #list of 'interesting' guid files - feel free to make additions
  1135. if [ "$thorough" = "1" ]; then
  1136. intguid=`find / -perm -2000 -type f  -exec ls -la {} \; 2>/dev/null | grep -w $binarylist 2>/dev/null`
  1137.     if [ "$intguid" ]; then
  1138.         echo -e "\e[00;33m[+] Possibly interesting GUID files:\e[00m\n$intguid"
  1139.         echo -e "\n"
  1140.     else
  1141.         :
  1142.     fi
  1143.   else
  1144.     :
  1145. fi
  1146.  
  1147. #lists world-writable guid files
  1148. if [ "$thorough" = "1" ]; then
  1149. wwguid=`find / -perm -2007 -type f -exec ls -la {} 2>/dev/null \;`
  1150.     if [ "$wwguid" ]; then
  1151.         echo -e "\e[00;33m[+] World-writable GUID files:\e[00m\n$wwguid"
  1152.         echo -e "\n"
  1153.     else
  1154.         :
  1155.     fi
  1156.   else
  1157.     :
  1158. fi
  1159.  
  1160. #lists world-writable guid files owned by root
  1161. if [ "$thorough" = "1" ]; then
  1162. wwguidrt=`find / -uid 0 -perm -2007 -type f -exec ls -la {} 2>/dev/null \;`
  1163.     if [ "$wwguidrt" ]; then
  1164.         echo -e "\e[00;33m[+] World-writable GUID files owned by root:\e[00m\n$wwguidrt"
  1165.         echo -e "\n"
  1166.     else
  1167.         :
  1168.     fi
  1169.   else
  1170.     :
  1171. fi
  1172.  
  1173. #list all files with POSIX capabilities set along with there capabilities
  1174. if [ "$thorough" = "1" ]; then
  1175. fileswithcaps=`getcap -r / 2>/dev/null || /sbin/getcap -r / 2>/dev/null`
  1176.     if [ "$fileswithcaps" ]; then
  1177.         echo -e "\e[00;31m[+] Files with POSIX capabilities set:\e[00m\n$fileswithcaps"
  1178.         echo -e "\n"
  1179.     else
  1180.         :
  1181.     fi
  1182.   else
  1183.       :
  1184. fi
  1185.  
  1186. if [ "$thorough" = "1" ]; then
  1187.     if [ "$export" ] && [ "$fileswithcaps" ]; then
  1188.         mkdir $format/files_with_capabilities/ 2>/dev/null
  1189.         for i in $fileswithcaps; do cp $i $format/files_with_capabilities/; done 2>/dev/null
  1190.     else
  1191.         :
  1192.     fi
  1193.   else
  1194.       :
  1195. fi
  1196.  
  1197. #searches /etc/security/capability.conf for users associated capapilies
  1198. if [ "$thorough" = "1" ]; then
  1199. userswithcaps=`grep -v '^#\|none\|^$' /etc/security/capability.conf 2>/dev/null`
  1200.     if [ "$userswithcaps" ]; then
  1201.         echo -e "\e[00;33m[+] Users with specific POSIX capabilities:\e[00m\n$userswithcaps"
  1202.         echo -e "\n"
  1203.     else
  1204.         :
  1205.     fi
  1206.   else
  1207.       :
  1208. fi
  1209.  
  1210. if [ "$thorough" = "1" ] && [ "$userswithcaps" ] ; then
  1211. #matches the capabilities found associated with users with the current user
  1212. matchedcaps=`echo -e "$userswithcaps" | grep \`whoami\` | awk '{print $1}' 2>/dev/null`
  1213.     if [ "$matchedcaps" ]; then
  1214.         echo -e "\e[00;33m[+] Capabilities associated with the current user:\e[00m\n$matchedcaps"
  1215.         echo -e "\n"
  1216.         #matches the files with capapbilities with capabilities associated with the current user
  1217.         matchedfiles=`echo -e "$matchedcaps" | while read -r cap ; do echo -e "$fileswithcaps" | grep "$cap" ; done 2>/dev/null`
  1218.         if [ "$matchedfiles" ]; then
  1219.             echo -e "\e[00;33m[+] Files with the same capabilities associated with the current user (You may want to try abusing those capabilties):\e[00m\n$matchedfiles"
  1220.             echo -e "\n"
  1221.             #lists the permissions of the files having the same capabilies associated with the current user
  1222.             matchedfilesperms=`echo -e "$matchedfiles" | awk '{print $1}' | while read -r f; do ls -la $f ;done 2>/dev/null`
  1223.             echo -e "\e[00;33m[+] Permissions of files with the same capabilities associated with the current user:\e[00m\n$matchedfilesperms"
  1224.             echo -e "\n"
  1225.             if [ "$matchedfilesperms" ]; then
  1226.                 #checks if any of the files with same capabilities associated with the current user is writable
  1227.                 writablematchedfiles=`echo -e "$matchedfiles" | awk '{print $1}' | while read -r f; do find $f -writable -exec ls -la {} + ;done 2>/dev/null`
  1228.                 if [ "$writablematchedfiles" ]; then
  1229.                     echo -e "\e[00;33m[+] User/Group writable files with the same capabilities associated with the current user:\e[00m\n$writablematchedfiles"
  1230.                     echo -e "\n"
  1231.                 else
  1232.                     :
  1233.                 fi
  1234.             else
  1235.                 :
  1236.             fi
  1237.         else
  1238.             :
  1239.         fi
  1240.     else
  1241.         :
  1242.     fi
  1243.   else
  1244.       :
  1245. fi
  1246.  
  1247. #list all world-writable files excluding /proc and /sys
  1248. if [ "$thorough" = "1" ]; then
  1249. wwfiles=`find / ! -path "*/proc/*" ! -path "/sys/*" -perm -2 -type f -exec ls -la {} 2>/dev/null \;`
  1250.     if [ "$wwfiles" ]; then
  1251.         echo -e "\e[00;31m[-] World-writable files (excluding /proc and /sys):\e[00m\n$wwfiles"
  1252.         echo -e "\n"
  1253.     else
  1254.         :
  1255.     fi
  1256.   else
  1257.     :
  1258. fi
  1259.  
  1260. if [ "$thorough" = "1" ]; then
  1261.     if [ "$export" ] && [ "$wwfiles" ]; then
  1262.         mkdir $format/ww-files/ 2>/dev/null
  1263.         for i in $wwfiles; do cp --parents $i $format/ww-files/; done 2>/dev/null
  1264.     else
  1265.         :
  1266.     fi
  1267.   else
  1268.     :
  1269. fi
  1270.  
  1271. #are any .plan files accessible in /home (could contain useful information)
  1272. usrplan=`find /home -iname *.plan -exec ls -la {} \; -exec cat {} 2>/dev/null \;`
  1273. if [ "$usrplan" ]; then
  1274.   echo -e "\e[00;31m[-] Plan file permissions and contents:\e[00m\n$usrplan"
  1275.   echo -e "\n"
  1276. else
  1277.   :
  1278. fi
  1279.  
  1280. if [ "$export" ] && [ "$usrplan" ]; then
  1281.   mkdir $format/plan_files/ 2>/dev/null
  1282.   for i in $usrplan; do cp --parents $i $format/plan_files/; done 2>/dev/null
  1283. else
  1284.   :
  1285. fi
  1286.  
  1287. bsdusrplan=`find /usr/home -iname *.plan -exec ls -la {} \; -exec cat {} 2>/dev/null \;`
  1288. if [ "$bsdusrplan" ]; then
  1289.   echo -e "\e[00;31m[-] Plan file permissions and contents:\e[00m\n$bsdusrplan"
  1290.   echo -e "\n"
  1291. else
  1292.   :
  1293. fi
  1294.  
  1295. if [ "$export" ] && [ "$bsdusrplan" ]; then
  1296.   mkdir $format/plan_files/ 2>/dev/null
  1297.   for i in $bsdusrplan; do cp --parents $i $format/plan_files/; done 2>/dev/null
  1298. else
  1299.   :
  1300. fi
  1301.  
  1302. #are there any .rhosts files accessible - these may allow us to login as another user etc.
  1303. rhostsusr=`find /home -iname *.rhosts -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;`
  1304. if [ "$rhostsusr" ]; then
  1305.   echo -e "\e[00;33m[+] rhost config file(s) and file contents:\e[00m\n$rhostsusr"
  1306.   echo -e "\n"
  1307. else
  1308.   :
  1309. fi
  1310.  
  1311. if [ "$export" ] && [ "$rhostsusr" ]; then
  1312.   mkdir $format/rhosts/ 2>/dev/null
  1313.   for i in $rhostsusr; do cp --parents $i $format/rhosts/; done 2>/dev/null
  1314. else
  1315.   :
  1316. fi
  1317.  
  1318. bsdrhostsusr=`find /usr/home -iname *.rhosts -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;`
  1319. if [ "$bsdrhostsusr" ]; then
  1320.   echo -e "\e[00;33m[+] rhost config file(s) and file contents:\e[00m\n$bsdrhostsusr"
  1321.   echo -e "\n"
  1322. else
  1323.   :
  1324. fi
  1325.  
  1326. if [ "$export" ] && [ "$bsdrhostsusr" ]; then
  1327.   mkdir $format/rhosts 2>/dev/null
  1328.   for i in $bsdrhostsusr; do cp --parents $i $format/rhosts/; done 2>/dev/null
  1329. else
  1330.   :
  1331. fi
  1332.  
  1333. rhostssys=`find /etc -iname hosts.equiv -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;`
  1334. if [ "$rhostssys" ]; then
  1335.   echo -e "\e[00;33m[+] Hosts.equiv file and contents: \e[00m\n$rhostssys"
  1336.   echo -e "\n"
  1337.   else
  1338.   :
  1339. fi
  1340.  
  1341. if [ "$export" ] && [ "$rhostssys" ]; then
  1342.   mkdir $format/rhosts/ 2>/dev/null
  1343.   for i in $rhostssys; do cp --parents $i $format/rhosts/; done 2>/dev/null
  1344. else
  1345.   :
  1346. fi
  1347.  
  1348. #list nfs shares/permisisons etc.
  1349. nfsexports=`ls -la /etc/exports 2>/dev/null; cat /etc/exports 2>/dev/null`
  1350. if [ "$nfsexports" ]; then
  1351.   echo -e "\e[00;31m[-] NFS config details: \e[00m\n$nfsexports"
  1352.   echo -e "\n"
  1353.   else
  1354.   :
  1355. fi
  1356.  
  1357. if [ "$export" ] && [ "$nfsexports" ]; then
  1358.   mkdir $format/etc-export/ 2>/dev/null
  1359.   cp /etc/exports $format/etc-export/exports 2>/dev/null
  1360. else
  1361.   :
  1362. fi
  1363.  
  1364. if [ "$thorough" = "1" ]; then
  1365.   #phackt
  1366.   #displaying /etc/fstab
  1367.   fstab=`cat /etc/fstab 2>/dev/null`
  1368.   if [ "$fstab" ]; then
  1369.     echo -e "\e[00;31m[-] NFS displaying partitions and filesystems - you need to check if exotic filesystems\e[00m"
  1370.     echo -e "$fstab"
  1371.     echo -e "\n"
  1372.   fi
  1373. fi
  1374.  
  1375. #looking for credentials in /etc/fstab
  1376. fstab=`grep username /etc/fstab 2>/dev/null |awk '{sub(/.*\username=/,"");sub(/\,.*/,"")}1' 2>/dev/null| xargs -r echo username: 2>/dev/null; grep password /etc/fstab 2>/dev/null |awk '{sub(/.*\password=/,"");sub(/\,.*/,"")}1' 2>/dev/null| xargs -r echo password: 2>/dev/null; grep domain /etc/fstab 2>/dev/null |awk '{sub(/.*\domain=/,"");sub(/\,.*/,"")}1' 2>/dev/null| xargs -r echo domain: 2>/dev/null`
  1377. if [ "$fstab" ]; then
  1378.   echo -e "\e[00;33m[+] Looks like there are credentials in /etc/fstab!\e[00m\n$fstab"
  1379.   echo -e "\n"
  1380.   else
  1381.   :
  1382. fi
  1383.  
  1384. if [ "$export" ] && [ "$fstab" ]; then
  1385.   mkdir $format/etc-exports/ 2>/dev/null
  1386.   cp /etc/fstab $format/etc-exports/fstab done 2>/dev/null
  1387. else
  1388.   :
  1389. fi
  1390.  
  1391. fstabcred=`grep cred /etc/fstab 2>/dev/null |awk '{sub(/.*\credentials=/,"");sub(/\,.*/,"")}1' 2>/dev/null | xargs -I{} sh -c 'ls -la {}; cat {}' 2>/dev/null`
  1392. if [ "$fstabcred" ]; then
  1393.     echo -e "\e[00;33m[+] /etc/fstab contains a credentials file!\e[00m\n$fstabcred"
  1394.     echo -e "\n"
  1395.     else
  1396.     :
  1397. fi
  1398.  
  1399. if [ "$export" ] && [ "$fstabcred" ]; then
  1400.   mkdir $format/etc-exports/ 2>/dev/null
  1401.   cp /etc/fstab $format/etc-exports/fstab done 2>/dev/null
  1402. else
  1403.   :
  1404. fi
  1405.  
  1406. #use supplied keyword and cat *.conf files for potential matches - output will show line number within relevant file path where a match has been located
  1407. if [ "$keyword" = "" ]; then
  1408.   echo -e "[-] Can't search *.conf files as no keyword was entered\n"
  1409.   else
  1410.     confkey=`find / -maxdepth 4 -name *.conf -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
  1411.     if [ "$confkey" ]; then
  1412.       echo -e "\e[00;31m[-] Find keyword ($keyword) in .conf files (recursive 4 levels - output format filepath:identified line number where keyword appears):\e[00m\n$confkey"
  1413.       echo -e "\n"
  1414.      else
  1415.     echo -e "\e[00;31m[-] Find keyword ($keyword) in .conf files (recursive 4 levels):\e[00m"
  1416.     echo -e "'$keyword' not found in any .conf files"
  1417.     echo -e "\n"
  1418.     fi
  1419. fi
  1420.  
  1421. if [ "$keyword" = "" ]; then
  1422.   :
  1423.   else
  1424.     if [ "$export" ] && [ "$confkey" ]; then
  1425.       confkeyfile=`find / -maxdepth 4 -name *.conf -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
  1426.       mkdir --parents $format/keyword_file_matches/config_files/ 2>/dev/null
  1427.       for i in $confkeyfile; do cp --parents $i $format/keyword_file_matches/config_files/ ; done 2>/dev/null
  1428.     else
  1429.       :
  1430.   fi
  1431. fi
  1432.  
  1433. #use supplied keyword and cat *.php files for potential matches - output will show line number within relevant file path where a match has been located
  1434. if [ "$keyword" = "" ]; then
  1435.   echo -e "[-] Can't search *.php files as no keyword was entered\n"
  1436.   else
  1437.     phpkey=`find / -maxdepth 10 -name *.php -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
  1438.     if [ "$phpkey" ]; then
  1439.       echo -e "\e[00;31m[-] Find keyword ($keyword) in .php files (recursive 10 levels - output format filepath:identified line number where keyword appears):\e[00m\n$phpkey"
  1440.       echo -e "\n"
  1441.      else
  1442.   echo -e "\e[00;31m[-] Find keyword ($keyword) in .php files (recursive 10 levels):\e[00m"
  1443.   echo -e "'$keyword' not found in any .php files"
  1444.   echo -e "\n"
  1445.     fi
  1446. fi
  1447.  
  1448. if [ "$keyword" = "" ]; then
  1449.   :
  1450.   else
  1451.     if [ "$export" ] && [ "$phpkey" ]; then
  1452.     phpkeyfile=`find / -maxdepth 10 -name *.php -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
  1453.       mkdir --parents $format/keyword_file_matches/php_files/ 2>/dev/null
  1454.       for i in $phpkeyfile; do cp --parents $i $format/keyword_file_matches/php_files/ ; done 2>/dev/null
  1455.     else
  1456.       :
  1457.   fi
  1458. fi
  1459.  
  1460. #use supplied keyword and cat *.log files for potential matches - output will show line number within relevant file path where a match has been located
  1461. if [ "$keyword" = "" ];then
  1462.   echo -e "[-] Can't search *.log files as no keyword was entered\n"
  1463.   else
  1464.     logkey=`find / -maxdepth 4 -name *.log -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
  1465.     if [ "$logkey" ]; then
  1466.       echo -e "\e[00;31m[-] Find keyword ($keyword) in .log files (recursive 4 levels - output format filepath:identified line number where keyword appears):\e[00m\n$logkey"
  1467.       echo -e "\n"
  1468.      else
  1469.     echo -e "\e[00;31m[-] Find keyword ($keyword) in .log files (recursive 4 levels):\e[00m"
  1470.     echo -e "'$keyword' not found in any .log files"
  1471.     echo -e "\n"
  1472.     fi
  1473. fi
  1474.  
  1475. if [ "$keyword" = "" ];then
  1476.   :
  1477.   else
  1478.     if [ "$export" ] && [ "$logkey" ]; then
  1479.       logkeyfile=`find / -maxdepth 4 -name *.log -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
  1480.       mkdir --parents $format/keyword_file_matches/log_files/ 2>/dev/null
  1481.       for i in $logkeyfile; do cp --parents $i $format/keyword_file_matches/log_files/ ; done 2>/dev/null
  1482.     else
  1483.       :
  1484.   fi
  1485. fi
  1486.  
  1487. #use supplied keyword and cat *.ini files for potential matches - output will show line number within relevant file path where a match has been located
  1488. if [ "$keyword" = "" ];then
  1489.   echo -e "[-] Can't search *.ini files as no keyword was entered\n"
  1490.   else
  1491.     inikey=`find / -maxdepth 4 -name *.ini -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
  1492.     if [ "$inikey" ]; then
  1493.       echo -e "\e[00;31m[-] Find keyword ($keyword) in .ini files (recursive 4 levels - output format filepath:identified line number where keyword appears):\e[00m\n$inikey"
  1494.       echo -e "\n"
  1495.      else
  1496.     echo -e "\e[00;31m[-] Find keyword ($keyword) in .ini files (recursive 4 levels):\e[00m"
  1497.     echo -e "'$keyword' not found in any .ini files"
  1498.     echo -e "\n"
  1499.     fi
  1500. fi
  1501.  
  1502. if [ "$keyword" = "" ];then
  1503.   :
  1504.   else
  1505.     if [ "$export" ] && [ "$inikey" ]; then
  1506.       inikey=`find / -maxdepth 4 -name *.ini -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
  1507.       mkdir --parents $format/keyword_file_matches/ini_files/ 2>/dev/null
  1508.       for i in $inikey; do cp --parents $i $format/keyword_file_matches/ini_files/ ; done 2>/dev/null
  1509.     else
  1510.       :
  1511.   fi
  1512. fi
  1513.  
  1514. #quick extract of .conf files from /etc - only 1 level
  1515. allconf=`find /etc/ -maxdepth 1 -name *.conf -type f -exec ls -la {} \; 2>/dev/null`
  1516. if [ "$allconf" ]; then
  1517.   echo -e "\e[00;31m[-] All *.conf files in /etc (recursive 1 level):\e[00m\n$allconf"
  1518.   echo -e "\n"
  1519. else
  1520.   :
  1521. fi
  1522.  
  1523. if [ "$export" ] && [ "$allconf" ]; then
  1524.   mkdir $format/conf-files/ 2>/dev/null
  1525.   for i in $allconf; do cp --parents $i $format/conf-files/; done 2>/dev/null
  1526. else
  1527.   :
  1528. fi
  1529.  
  1530. #extract any user history files that are accessible
  1531. usrhist=`ls -la ~/.*_history 2>/dev/null`
  1532. if [ "$usrhist" ]; then
  1533.   echo -e "\e[00;31m[-] Current user's history files:\e[00m\n$usrhist"
  1534.   echo -e "\n"
  1535. else
  1536.   :
  1537. fi
  1538.  
  1539. if [ "$export" ] && [ "$usrhist" ]; then
  1540.   mkdir $format/history_files/ 2>/dev/null
  1541.   for i in $usrhist; do cp --parents $i $format/history_files/; done 2>/dev/null
  1542.  else
  1543.   :
  1544. fi
  1545.  
  1546. #can we read roots *_history files - could be passwords stored etc.
  1547. roothist=`ls -la /root/.*_history 2>/dev/null`
  1548. if [ "$roothist" ]; then
  1549.   echo -e "\e[00;33m[+] Root's history files are accessible!\e[00m\n$roothist"
  1550.   echo -e "\n"
  1551. else
  1552.   :
  1553. fi
  1554.  
  1555. if [ "$export" ] && [ "$roothist" ]; then
  1556.   mkdir $format/history_files/ 2>/dev/null
  1557.   cp $roothist $format/history_files/ 2>/dev/null
  1558. else
  1559.   :
  1560. fi
  1561.  
  1562. #all accessible .bash_history files in /home
  1563. checkbashhist=`find /home -name .bash_history -print -exec cat {} 2>/dev/null \;`
  1564. if [ "$checkbashhist" ]; then
  1565.   echo -e "\e[00;31m[-] Location and contents (if accessible) of .bash_history file(s):\e[00m\n$checkbashhist"
  1566.   echo -e "\n"
  1567. else
  1568.   :
  1569. fi
  1570.  
  1571. #is there any mail accessible
  1572. readmail=`ls -la /var/mail 2>/dev/null`
  1573. if [ "$readmail" ]; then
  1574.   echo -e "\e[00;31m[-] Any interesting mail in /var/mail:\e[00m\n$readmail"
  1575.   echo -e "\n"
  1576. else
  1577.   :
  1578. fi
  1579.  
  1580. #can we read roots mail
  1581. readmailroot=`head /var/mail/root 2>/dev/null`
  1582. if [ "$readmailroot" ]; then
  1583.   echo -e "\e[00;33m[+] We can read /var/mail/root! (snippet below)\e[00m\n$readmailroot"
  1584.   echo -e "\n"
  1585. else
  1586.   :
  1587. fi
  1588.  
  1589. if [ "$export" ] && [ "$readmailroot" ]; then
  1590.   mkdir $format/mail-from-root/ 2>/dev/null
  1591.   cp $readmailroot $format/mail-from-root/ 2>/dev/null
  1592. else
  1593.   :
  1594. fi
  1595. }
  1596.  
  1597. docker_checks()
  1598. {
  1599. #specific checks - check to see if we're in a docker container
  1600. dockercontainer=` grep -i docker /proc/self/cgroup  2>/dev/null; find / -name "*dockerenv*" -exec ls -la {} \; 2>/dev/null`
  1601. if [ "$dockercontainer" ]; then
  1602.   echo -e "\e[00;33m[+] Looks like we're in a Docker container:\e[00m\n$dockercontainer"
  1603.   echo -e "\n"
  1604. else
  1605.   :
  1606. fi
  1607.  
  1608. #specific checks - check to see if we're a docker host
  1609. dockerhost=`docker --version 2>/dev/null; docker ps -a 2>/dev/null`
  1610. if [ "$dockerhost" ]; then
  1611.   echo -e "\e[00;33m[+] Looks like we're hosting Docker:\e[00m\n$dockerhost"
  1612.   echo -e "\n"
  1613. else
  1614.   :
  1615. fi
  1616.  
  1617. #specific checks - are we a member of the docker group
  1618. dockergrp=`id | grep -i docker 2>/dev/null`
  1619. if [ "$dockergrp" ]; then
  1620.   echo -e "\e[00;33m[+] We're a member of the (docker) group - could possibly misuse these rights!\e[00m\n$dockergrp"
  1621.   echo -e "\n"
  1622. else
  1623.   :
  1624. fi
  1625.  
  1626. #specific checks - are there any docker files present
  1627. dockerfiles=`find / -name Dockerfile -exec ls -l {} 2>/dev/null \;`
  1628. if [ "$dockerfiles" ]; then
  1629.   echo -e "\e[00;31m[-] Anything juicy in the Dockerfile:\e[00m\n$dockerfiles"
  1630.   echo -e "\n"
  1631. else
  1632.   :
  1633. fi
  1634.  
  1635. #specific checks - are there any docker files present
  1636. dockeryml=`find / -name docker-compose.yml -exec ls -l {} 2>/dev/null \;`
  1637. if [ "$dockeryml" ]; then
  1638.   echo -e "\e[00;31m[-] Anything juicy in docker-compose.yml:\e[00m\n$dockeryml"
  1639.   echo -e "\n"
  1640. else
  1641.   :
  1642. fi
  1643. }
  1644.  
  1645. lxc_container_checks()
  1646. {
  1647. #specific checks - are we in an lxd/lxc container
  1648. lxccontainer=`grep -qa container=lxc /proc/1/environ 2>/dev/null`
  1649. if [ "$lxccontainer" ]; then
  1650.   echo -e "\e[00;33m[+] Looks like we're in a lxc container:\e[00m\n$lxccontainer"
  1651.   echo -e "\n"
  1652. fi
  1653.  
  1654. #specific checks - are we a member of the lxd group
  1655. lxdgroup=`id | grep -i lxd 2>/dev/null`
  1656. if [ "$lxdgroup" ]; then
  1657.   echo -e "\e[00;33m[+] We're a member of the (lxd) group - could possibly misuse these rights!\e[00m\n$lxdgroup"
  1658.   echo -e "\n"
  1659. fi
  1660. }
  1661.  
  1662. footer()
  1663. {
  1664. echo -e "\e[00;33m### SCAN COMPLETE ####################################\e[00m"
  1665. }
  1666.  
  1667. call_each()
  1668. {
  1669.   header
  1670.   debug_info
  1671.   system_info
  1672.   user_info
  1673.   environmental_info
  1674.   job_info
  1675.   networking_info
  1676.   services_info
  1677.   software_configs
  1678.   interesting_files
  1679.   docker_checks
  1680.   lxc_container_checks
  1681.   footer
  1682. }
  1683.  
  1684. while getopts "h:k:r:e:st" option; do
  1685.  case "${option}" in
  1686.     k) keyword=${OPTARG};;
  1687.     r) report=${OPTARG}"-"`date +"%d-%m-%y"`;;
  1688.     e) export=${OPTARG};;
  1689.     s) sudopass=1;;
  1690.     t) thorough=1;;
  1691.     h) usage; exit;;
  1692.     *) usage; exit;;
  1693.  esac
  1694. done
  1695.  
  1696. call_each | tee -a $report 2> /dev/null
  1697. #EndOfScript
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!