API tools faq
paste
Advertisement
Guest User

Root

a guest
Jul 22nd, 2018
1,535
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 66.04 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2.  
  3. #
  4. # Copyright (c) 2016-2018, mzet
  5. #
  6. # linux-exploit-suggester.sh comes with ABSOLUTELY NO WARRANTY.
  7. # This is free software, and you are welcome to redistribute it
  8. # under the terms of the GNU General Public License. See LICENSE
  9. # file for usage of this software.
  10. #
  11.  
  12. VERSION=v0.9
  13.  
  14. # bash colors
  15. #txtred="\e[0;31m"
  16. txtred="\e[91;1m"
  17. txtgrn="\e[1;32m"
  18. txtgray="\e[1;30m"
  19. txtblu="\e[0;36m"
  20. txtrst="\e[0m"
  21. bldwht='\e[1;37m'
  22. bldblu='\e[1;34m'
  23. yellow='\e[1;93m'
  24. lightyellow='\e[0;93m'
  25.  
  26. # input data
  27. UNAME_A=""
  28.  
  29. # parsed data for current OS
  30. KERNEL=""
  31. OS=""
  32. DISTRO=""
  33. ARCH=""
  34. PKG_LIST=""
  35.  
  36. # kernel config
  37. KCONFIG=""
  38.  
  39. CVELIST_FILE=""
  40.  
  41. opt_fetch_bins=false
  42. opt_fetch_srcs=false
  43. opt_kernel_version=false
  44. opt_uname_string=false
  45. opt_pkglist_file=false
  46. opt_cvelist_file=false
  47. opt_checksec_mode=false
  48. opt_full=false
  49. opt_summary=false
  50. opt_kernel_only=false
  51. opt_userspace_only=false
  52. opt_show_dos=false
  53. opt_skip_more_checks=false
  54. opt_skip_pkg_versions=false
  55.  
  56. ARGS=
  57. SHORTOPTS="hVfbsu:k:dp:g"
  58. LONGOPTS="help,version,full,fetch-binaries,fetch-sources,uname:,kernel:,show-dos,pkglist-file:,short,kernelspace-only,userspace-only,skip-more-checks,skip-pkg-versions,cvelist-file:,checksec"
  59.  
  60. ## exploits database
  61. declare -a EXPLOITS
  62. declare -a EXPLOITS_USERSPACE
  63.  
  64. ############ LINUX KERNELSPACE EXPLOITS ####################
  65. n=0
  66.  
  67. EXPLOITS[((n++))]=$(cat <<EOF
  68. Name: ${txtgrn}[CVE-2004-1235]${txtrst} elflbl
  69. Reqs: pkg=linux-kernel,ver=2.4.29
  70. Tags:
  71. analysis-url: http://isec.pl/vulnerabilities/isec-0021-uselib.txt
  72. bin-url: https://web.archive.org/web/20111103042904/http://tarantula.by.ru/localroot/2.6.x/elflbl
  73. exploit-db: 744
  74. EOF
  75. )
  76.  
  77. EXPLOITS[((n++))]=$(cat <<EOF
  78. Name: ${txtgrn}[CVE-2004-1235]${txtrst} uselib()
  79. Reqs: pkg=linux-kernel,ver=2.4.29
  80. Tags:
  81. analysis-url: http://isec.pl/vulnerabilities/isec-0021-uselib.txt
  82. exploit-db: 778
  83. Comments: Known to work only for 2.4 series (even though 2.6 is also vulnerable)
  84. EOF
  85. )
  86.  
  87. EXPLOITS[((n++))]=$(cat <<EOF
  88. Name: ${txtgrn}[CVE-2004-1235]${txtrst} krad3
  89. Reqs: pkg=linux-kernel,ver>=2.6.5,ver<=2.6.11
  90. Tags:
  91. exploit-db: 1397
  92. EOF
  93. )
  94.  
  95. EXPLOITS[((n++))]=$(cat <<EOF
  96. Name: ${txtgrn}[CVE-2004-0077]${txtrst} mremap_pte
  97. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.2
  98. Tags:
  99. exploit-db: 160
  100. EOF
  101. )
  102.  
  103. EXPLOITS[((n++))]=$(cat <<EOF
  104. Name: ${txtgrn}[CVE-2006-2451]${txtrst} raptor_prctl
  105. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  106. Tags:
  107. exploit-db: 2031
  108. EOF
  109. )
  110.  
  111. EXPLOITS[((n++))]=$(cat <<EOF
  112. Name: ${txtgrn}[CVE-2006-2451]${txtrst} prctl
  113. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  114. Tags:
  115. exploit-db: 2004
  116. EOF
  117. )
  118.  
  119. EXPLOITS[((n++))]=$(cat <<EOF
  120. Name: ${txtgrn}[CVE-2006-2451]${txtrst} prctl2
  121. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  122. Tags:
  123. exploit-db: 2005
  124. EOF
  125. )
  126.  
  127. EXPLOITS[((n++))]=$(cat <<EOF
  128. Name: ${txtgrn}[CVE-2006-2451]${txtrst} prctl3
  129. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  130. Tags:
  131. exploit-db: 2006
  132. EOF
  133. )
  134.  
  135. EXPLOITS[((n++))]=$(cat <<EOF
  136. Name: ${txtgrn}[CVE-2006-2451]${txtrst} prctl4
  137. Reqs: pkg=linux-kernel,ver>=2.6.13,ver<=2.6.17
  138. Tags:
  139. exploit-db: 2011
  140. EOF
  141. )
  142.  
  143. EXPLOITS[((n++))]=$(cat <<EOF
  144. Name: ${txtgrn}[CVE-2006-3626]${txtrst} h00lyshit
  145. Reqs: pkg=linux-kernel,ver>=2.6.8,ver<=2.6.16
  146. Tags:
  147. bin-url: https://web.archive.org/web/20111103042904/http://tarantula.by.ru/localroot/2.6.x/h00lyshit
  148. exploit-db: 2013
  149. EOF
  150. )
  151.  
  152. EXPLOITS[((n++))]=$(cat <<EOF
  153. Name: ${txtgrn}[CVE-2008-0600]${txtrst} vmsplice1
  154. Reqs: pkg=linux-kernel,ver>=2.6.17,ver<=2.6.24
  155. Tags:
  156. exploit-db: 5092
  157. EOF
  158. )
  159.  
  160. EXPLOITS[((n++))]=$(cat <<EOF
  161. Name: ${txtgrn}[CVE-2008-0600]${txtrst} vmsplice2
  162. Reqs: pkg=linux-kernel,ver>=2.6.23,ver<=2.6.24
  163. Tags:
  164. exploit-db: 5093
  165. EOF
  166. )
  167.  
  168. EXPLOITS[((n++))]=$(cat <<EOF
  169. Name: ${txtgrn}[CVE-2008-4210]${txtrst} ftrex
  170. Reqs: pkg=linux-kernel,ver>=2.6.11,ver<=2.6.22
  171. Tags:
  172. exploit-db: 6851
  173. Comments: world-writable sgid directory and shell that does not drop sgid privs upon exec (ash/sash) are required
  174. EOF
  175. )
  176.  
  177. EXPLOITS[((n++))]=$(cat <<EOF
  178. Name: ${txtgrn}[CVE-2008-4210]${txtrst} exit_notify
  179. Reqs: pkg=linux-kernel,ver>=2.6.25,ver<=2.6.29
  180. Tags:
  181. exploit-db: 8369
  182. EOF
  183. )
  184.  
  185. EXPLOITS[((n++))]=$(cat <<EOF
  186. Name: ${txtgrn}[CVE-2009-2692]${txtrst} sock_sendpage (simple version)
  187. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  188. Tags: ubuntu=7.10,RHEL=4,fedora=4|5|6|7|8|9|10|11
  189. exploit-db: 9479
  190. Comments: Works for systems with /proc/sys/vm/mmap_min_addr equal to 0
  191. EOF
  192. )
  193.  
  194. EXPLOITS[((n++))]=$(cat <<EOF
  195. Name: ${txtgrn}[CVE-2009-2692,CVE-2009-1895]${txtrst} sock_sendpage
  196. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  197. Tags: ubuntu=9.04
  198. analysis-url: https://xorl.wordpress.com/2009/07/16/cve-2009-1895-linux-kernel-per_clear_on_setid-personality-bypass/
  199. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/9435.tgz
  200. exploit-db: 9435
  201. Comments: /proc/sys/vm/mmap_min_addr needs to equal 0 OR pulseaudio needs to be installed
  202. EOF
  203. )
  204.  
  205. EXPLOITS[((n++))]=$(cat <<EOF
  206. Name: ${txtgrn}[CVE-2009-2692,CVE-2009-1895]${txtrst} sock_sendpage2
  207. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  208. Tags:
  209. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/9436.tgz
  210. exploit-db: 9436
  211. Comments: Works for systems with /proc/sys/vm/mmap_min_addr equal to 0
  212. EOF
  213. )
  214.  
  215. EXPLOITS[((n++))]=$(cat <<EOF
  216. Name: ${txtgrn}[CVE-2009-2692,CVE-2009-1895]${txtrst} sock_sendpage3
  217. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  218. Tags:
  219. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/9641.tar.gz
  220. exploit-db: 9641
  221. Comments: /proc/sys/vm/mmap_min_addr needs to equal 0 OR pulseaudio needs to be installed
  222. EOF
  223. )
  224.  
  225. EXPLOITS[((n++))]=$(cat <<EOF
  226. Name: ${txtgrn}[CVE-2009-2692,CVE-2009-1895]${txtrst} sock_sendpage (ppc)
  227. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.30
  228. Tags: ubuntu=8.10,RHEL=4|5
  229. exploit-db: 9545
  230. Comments: /proc/sys/vm/mmap_min_addr needs to equal 0
  231. EOF
  232. )
  233.  
  234. EXPLOITS[((n++))]=$(cat <<EOF
  235. Name: ${txtgrn}[CVE-2009-2698]${txtrst} udp_sendmsg (by spender)
  236. Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19
  237. Tags:
  238. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/9574.tgz
  239. exploit-db: 9574
  240. EOF
  241. )
  242.  
  243. EXPLOITS[((n++))]=$(cat <<EOF
  244. Name: ${txtgrn}[CVE-2009-2698]${txtrst} udp_sendmsg
  245. Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19
  246. Tags: debian=4
  247. exploit-db: 9575
  248. EOF
  249. )
  250.  
  251. EXPLOITS[((n++))]=$(cat <<EOF
  252. Name: ${txtgrn}[CVE-2009-2698]${txtrst} ip_append_data
  253. Reqs: pkg=linux-kernel,ver>=2.6.1,ver<=2.6.19,x86
  254. Tags: fedora=4|5|6,RHEL=4
  255. exploit-db: 9542
  256. EOF
  257. )
  258.  
  259. EXPLOITS[((n++))]=$(cat <<EOF
  260. Name: ${txtgrn}[CVE-2009-3547]${txtrst} pipe.c 1
  261. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.31
  262. Tags:
  263. exploit-db: 33321
  264. EOF
  265. )
  266.  
  267. EXPLOITS[((n++))]=$(cat <<EOF
  268. Name: ${txtgrn}[CVE-2009-3547]${txtrst} pipe.c 2
  269. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.31
  270. Tags:
  271. exploit-db: 33322
  272. EOF
  273. )
  274.  
  275. EXPLOITS[((n++))]=$(cat <<EOF
  276. Name: ${txtgrn}[CVE-2009-3547]${txtrst} pipe.c 3
  277. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.31
  278. Tags:
  279. exploit-db: 10018
  280. EOF
  281. )
  282.  
  283. EXPLOITS[((n++))]=$(cat <<EOF
  284. Name: ${txtgrn}[CVE-2010-3301]${txtrst} ptrace_kmod2
  285. Reqs: pkg=linux-kernel,ver>=2.6.26,ver<=2.6.34
  286. Tags: debian=6,ubuntu=10.04|10.10
  287. bin-url: https://web.archive.org/web/20111103042904/http://tarantula.by.ru/localroot/2.6.x/kmod2
  288. bin-url: https://web.archive.org/web/20111103042904/http://tarantula.by.ru/localroot/2.6.x/ptrace-kmod
  289. bin-url: https://web.archive.org/web/20160602192641/https://www.kernel-exploits.com/media/ptrace_kmod2-64
  290. exploit-db: 15023
  291. EOF
  292. )
  293.  
  294. EXPLOITS[((n++))]=$(cat <<EOF
  295. Name: ${txtgrn}[CVE-2010-1146]${txtrst} reiserfs
  296. Reqs: pkg=linux-kernel,ver>=2.6.18,ver<=2.6.34
  297. Tags: ubuntu=9.10
  298. exploit-db: 12130
  299. EOF
  300. )
  301.  
  302. EXPLOITS[((n++))]=$(cat <<EOF
  303. Name: ${txtgrn}[CVE-2010-2959]${txtrst} can_bcm
  304. Reqs: pkg=linux-kernel,ver>=2.6.18,ver<=2.6.36
  305. Tags: ubuntu=10.04
  306. bin-url: https://web.archive.org/web/20160602192641/https://www.kernel-exploits.com/media/can_bcm
  307. exploit-db: 14814
  308. EOF
  309. )
  310.  
  311. EXPLOITS[((n++))]=$(cat <<EOF
  312. Name: ${txtgrn}[CVE-2010-3904]${txtrst} rds
  313. Reqs: pkg=linux-kernel,ver>=2.6.30,ver<2.6.37
  314. Tags: debian=6,ubuntu=10.10|9.10,fedora=13{kernel:2.6.33.3-85.fc13.i686.PAE},ubuntu=10.04{kernel:2.6.32-21-generic}
  315. analysis-url: http://www.securityfocus.com/archive/1/514379
  316. src-url: http://web.archive.org/web/20101020044048/http://www.vsecurity.com/download/tools/linux-rds-exploit.c
  317. bin-url: https://web.archive.org/web/20160602192641/https://www.kernel-exploits.com/media/rds
  318. bin-url: https://web.archive.org/web/20160602192641/https://www.kernel-exploits.com/media/rds64
  319. exploit-db: 15285
  320. EOF
  321. )
  322.  
  323. EXPLOITS[((n++))]=$(cat <<EOF
  324. Name: ${txtgrn}[CVE-2010-3848,CVE-2010-3850,CVE-2010-4073]${txtrst} half_nelson
  325. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.36
  326. Tags: ubuntu=10.04|9.10
  327. bin-url: http://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/half-nelson3
  328. exploit-db: 17787
  329. EOF
  330. )
  331.  
  332. EXPLOITS[((n++))]=$(cat <<EOF
  333. Name: ${txtgrn}[N/A]${txtrst} caps_to_root
  334. Reqs: pkg=linux-kernel,ver>=2.6.34,ver<=2.6.36,x86
  335. Tags: ubuntu=10.10
  336. exploit-db: 15916
  337. EOF
  338. )
  339.  
  340. EXPLOITS[((n++))]=$(cat <<EOF
  341. Name: ${txtgrn}[N/A]${txtrst} caps_to_root 2
  342. Reqs: pkg=linux-kernel,ver>=2.6.34,ver<=2.6.36
  343. Tags: ubuntu=10.10
  344. exploit-db: 15944
  345. EOF
  346. )
  347.  
  348. EXPLOITS[((n++))]=$(cat <<EOF
  349. Name: ${txtgrn}[CVE-2010-4347]${txtrst} american-sign-language
  350. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.36
  351. Tags:
  352. exploit-db: 15774
  353. EOF
  354. )
  355.  
  356. EXPLOITS[((n++))]=$(cat <<EOF
  357. Name: ${txtgrn}[CVE-2010-3437]${txtrst} pktcdvd
  358. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.36
  359. Tags: ubuntu=10.04
  360. exploit-db: 15150
  361. EOF
  362. )
  363.  
  364. EXPLOITS[((n++))]=$(cat <<EOF
  365. Name: ${txtgrn}[CVE-2010-3081]${txtrst} video4linux
  366. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.33
  367. Tags: RHEL=5
  368. exploit-db: 15024
  369. EOF
  370. )
  371.  
  372. EXPLOITS[((n++))]=$(cat <<EOF
  373. Name: ${txtgrn}[CVE-2012-0056]${txtrst} memodipper
  374. Reqs: pkg=linux-kernel,ver>=3.0.0,ver<=3.1.0
  375. Tags: ubuntu=10.04|11.10
  376. analysis-url: https://git.zx2c4.com/CVE-2012-0056/about/
  377. src-url: https://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c
  378. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/memodipper
  379. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/memodipper64
  380. exploit-db: 18411
  381. EOF
  382. )
  383.  
  384. EXPLOITS[((n++))]=$(cat <<EOF
  385. Name: ${txtgrn}[CVE-2012-0056,CVE-2010-3849,CVE-2010-3850]${txtrst} full-nelson
  386. Reqs: pkg=linux-kernel,ver>=2.6.0,ver<=2.6.36
  387. Tags: ubuntu=9.10|10.04|10.10,ubuntu=10.04.1
  388. src-url: http://vulnfactory.org/exploits/full-nelson.c
  389. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/full-nelson
  390. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/full-nelson64
  391. exploit-db: 15704
  392. EOF
  393. )
  394.  
  395. EXPLOITS[((n++))]=$(cat <<EOF
  396. Name: ${txtgrn}[CVE-2013-1858]${txtrst} CLONE_NEWUSER|CLONE_FS
  397. Reqs: pkg=linux-kernel,ver=3.8,CONFIG_USER_NS=y
  398. Tags:
  399. src-url: http://stealth.openwall.net/xSports/clown-newuser.c
  400. analysis-url: https://lwn.net/Articles/543273/
  401. exploit-db: 38390
  402. author: Sebastian Krahmer
  403. Comments: CONFIG_USER_NS needs to be enabled
  404. EOF
  405. )
  406.  
  407. EXPLOITS[((n++))]=$(cat <<EOF
  408. Name: ${txtgrn}[CVE-2013-2094]${txtrst} perf_swevent
  409. Reqs: pkg=linux-kernel,ver>=2.6.32,ver<3.8.9
  410. Tags: RHEL=6,ubuntu=12.04
  411. analysis-url: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
  412. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/perf_swevent
  413. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/perf_swevent64
  414. exploit-db: 26131
  415. EOF
  416. )
  417.  
  418. EXPLOITS[((n++))]=$(cat <<EOF
  419. Name: ${txtgrn}[CVE-2013-2094]${txtrst} perf_swevent 2
  420. Reqs: pkg=linux-kernel,ver>=2.6.32,ver<3.8.9,x86_64
  421. Tags: ubuntu=12.04
  422. analysis-url: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
  423. src-url: https://cyseclabs.com/exploits/vnik_v1.c
  424. exploit-db: 33589
  425. EOF
  426. )
  427.  
  428. EXPLOITS[((n++))]=$(cat <<EOF
  429. Name: ${txtgrn}[CVE-2013-0268]${txtrst} msr
  430. Reqs: pkg=linux-kernel,ver>=2.6.18,ver<3.7.6
  431. Tags:
  432. exploit-db: 27297
  433. EOF
  434. )
  435.  
  436. EXPLOITS[((n++))]=$(cat <<EOF
  437. Name: ${txtgrn}[CVE-2013-1959]${txtrst} userns_root_sploit
  438. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<3.8.9
  439. Tags:
  440. analysis-url: http://www.openwall.com/lists/oss-security/2013/04/29/1
  441. exploit-db: 25450
  442. EOF
  443. )
  444.  
  445. EXPLOITS[((n++))]=$(cat <<EOF
  446. Name: ${txtgrn}[CVE-2013-2094]${txtrst} semtex
  447. Reqs: pkg=linux-kernel,ver>=2.6.32,ver<3.8.9
  448. Tags: RHEL=6
  449. analysis-url: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
  450. exploit-db: 25444
  451. EOF
  452. )
  453.  
  454. EXPLOITS[((n++))]=$(cat <<EOF
  455. Name: ${txtgrn}[CVE-2014-0038]${txtrst} timeoutpwn
  456. Reqs: pkg=linux-kernel,ver>=3.4.0,ver<=3.13.1,CONFIG_X86_X32=y
  457. Tags: ubuntu=13.10
  458. analysis-url: http://blog.includesecurity.com/2014/03/exploit-CVE-2014-0038-x32-recvmmsg-kernel-vulnerablity.html
  459. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/timeoutpwn64
  460. exploit-db: 31346
  461. Comments: CONFIG_X86_X32 needs to be enabled
  462. EOF
  463. )
  464.  
  465. EXPLOITS[((n++))]=$(cat <<EOF
  466. Name: ${txtgrn}[CVE-2014-0038]${txtrst} timeoutpwn 2
  467. Reqs: pkg=linux-kernel,ver>=3.4.0,ver<=3.13.1,CONFIG_X86_X32=y
  468. Tags: ubuntu=13.10|13.04
  469. analysis-url: http://blog.includesecurity.com/2014/03/exploit-CVE-2014-0038-x32-recvmmsg-kernel-vulnerablity.html
  470. exploit-db: 31347
  471. Comments: CONFIG_X86_X32 needs to be enabled
  472. EOF
  473. )
  474.  
  475. EXPLOITS[((n++))]=$(cat <<EOF
  476. Name: ${txtgrn}[CVE-2014-0196]${txtrst} rawmodePTY
  477. Reqs: pkg=linux-kernel,ver>=2.6.31,ver<=3.14.3
  478. Tags:
  479. analysis-url: http://blog.includesecurity.com/2014/06/exploit-walkthrough-cve-2014-0196-pty-kernel-race-condition.html
  480. exploit-db: 33516
  481. EOF
  482. )
  483.  
  484. EXPLOITS[((n++))]=$(cat <<EOF
  485. Name: ${txtgrn}[CVE-2014-2851]${txtrst} use-after-free in ping_init_sock() ${bldblu}(DoS)${txtrst}
  486. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<=3.14
  487. Tags:
  488. analysis-url: https://cyseclabs.com/page?n=02012016
  489. exploit-db: 32926
  490. EOF
  491. )
  492.  
  493. EXPLOITS[((n++))]=$(cat <<EOF
  494. Name: ${txtgrn}[CVE-2014-4014]${txtrst} inode_capable
  495. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<=3.13
  496. Tags: ubuntu=12.04
  497. analysis-url: http://www.openwall.com/lists/oss-security/2014/06/10/4
  498. exploit-db: 33824
  499. EOF
  500. )
  501.  
  502. EXPLOITS[((n++))]=$(cat <<EOF
  503. Name: ${txtgrn}[CVE-2014-4699]${txtrst} ptrace/sysret
  504. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<=3.8
  505. Tags: ubuntu=12.04
  506. analysis-url: http://www.openwall.com/lists/oss-security/2014/07/08/16
  507. exploit-db: 34134
  508. EOF
  509. )
  510.  
  511. EXPLOITS[((n++))]=$(cat <<EOF
  512. Name: ${txtgrn}[CVE-2014-4943]${txtrst} PPPoL2TP ${bldblu}(DoS)${txtrst}
  513. Reqs: pkg=linux-kernel,ver>=3.2,ver<=3.15.6
  514. Tags:
  515. analysis-url: https://cyseclabs.com/page?n=01102015
  516. exploit-db: 36267
  517. EOF
  518. )
  519.  
  520. EXPLOITS[((n++))]=$(cat <<EOF
  521. Name: ${txtgrn}[CVE-2014-5207]${txtrst} fuse_suid
  522. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<=3.16.1
  523. Tags:
  524. exploit-db: 34923
  525. EOF
  526. )
  527.  
  528. EXPLOITS[((n++))]=$(cat <<EOF
  529. Name: ${txtgrn}[CVE-2015-9322]${txtrst} BadIRET
  530. Reqs: pkg=linux-kernel,ver>=3.0.1,ver<3.17.5,x86_64
  531. Tags: RHEL<=7,fedora=20
  532. analysis-url: http://labs.bromium.com/2015/02/02/exploiting-badiret-vulnerability-cve-2014-9322-linux-kernel-privilege-escalation/
  533. src-url: http://site.pi3.com.pl/exp/p_cve-2014-9322.tar.gz
  534. exploit-db:
  535. author: Rafal 'n3rgal' Wojtczuk & Adam 'pi3' Zabrocki
  536. EOF
  537. )
  538.  
  539. EXPLOITS[((n++))]=$(cat <<EOF
  540. Name: ${txtgrn}[CVE-2015-3290]${txtrst} espfix64_NMI
  541. Reqs: pkg=linux-kernel,ver>=3.13,ver<4.1.6,x86_64
  542. Tags:
  543. analysis-url: http://www.openwall.com/lists/oss-security/2015/08/04/8
  544. exploit-db: 37722
  545. EOF
  546. )
  547.  
  548. EXPLOITS[((n++))]=$(cat <<EOF
  549. Name: ${txtgrn}[N/A]${txtrst} bluetooth
  550. Reqs: pkg=linux-kernel,ver<=2.6.11
  551. Tags:
  552. exploit-db: 4756
  553. EOF
  554. )
  555.  
  556. EXPLOITS[((n++))]=$(cat <<EOF
  557. Name: ${txtgrn}[CVE-2015-1328]${txtrst} overlayfs
  558. Reqs: pkg=linux-kernel,ver>=3.13.0,ver<=3.19.0
  559. Tags: ubuntu=12.04|14.04|14.10|15.04
  560. analysis-url: http://seclists.org/oss-sec/2015/q2/717
  561. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/ofs_32
  562. bin-url: https://web.archive.org/web/20160602192631/https://www.kernel-exploits.com/media/ofs_64
  563. exploit-db: 37292
  564. EOF
  565. )
  566.  
  567. EXPLOITS[((n++))]=$(cat <<EOF
  568. Name: ${txtgrn}[CVE-2015-8660]${txtrst} overlayfs (ovl_setattr)
  569. Reqs: pkg=linux-kernel,ver>=3.0.0,ver<=4.3.3
  570. Tags:
  571. analysis-url: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/
  572. exploit-db: 39230
  573. EOF
  574. )
  575.  
  576. EXPLOITS[((n++))]=$(cat <<EOF
  577. Name: ${txtgrn}[CVE-2015-8660]${txtrst} overlayfs (ovl_setattr)
  578. Reqs: pkg=linux-kernel,ver>=3.0.0,ver<=4.3.3
  579. Tags: ubuntu=14.04|15.10
  580. analysis-url: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/
  581. exploit-db: 39166
  582. EOF
  583. )
  584.  
  585. EXPLOITS[((n++))]=$(cat <<EOF
  586. Name: ${txtgrn}[CVE-2016-0728]${txtrst} keyring
  587. Reqs: pkg=linux-kernel,ver>=3.10,ver<4.4.1
  588. Tags:
  589. analysis-url: http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
  590. exploit-db: 40003
  591. Comments: Exploit takes about ~30 minutes to run. Exploit is not reliable, see: https://cyseclabs.com/blog/cve-2016-0728-poc-not-working
  592. EOF
  593. )
  594.  
  595. EXPLOITS[((n++))]=$(cat <<EOF
  596. Name: ${txtgrn}[CVE-2016-2384]${txtrst} usb-midi
  597. Reqs: pkg=linux-kernel,ver>=3.0.0,ver<=4.4.8
  598. Tags: ubuntu=14.04,fedora=22
  599. analysis-url: https://xairy.github.io/blog/2016/cve-2016-2384
  600. src-url: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-2384/poc.c
  601. exploit-db: 41999
  602. Comments: Requires ability to plug in a malicious USB device and to execute a malicious binary as a non-privileged user
  603. author: Andrey 'xairy' Konovalov
  604. EOF
  605. )
  606.  
  607. EXPLOITS[((n++))]=$(cat <<EOF
  608. Name: ${txtgrn}[N/A]${txtrst} target_offset
  609. Reqs: pkg=linux-kernel,ver>=4.4.0,ver<=4.4.0,cmd:grep -qi ip_tables /proc/modules
  610. Tags: ubuntu=16.04{kernel:4.4.0-21}
  611. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/40053.zip
  612. Comments: ip_tables.ko needs to be loaded
  613. exploit-db: 40049
  614. author: Vitaly Nikolenko (vnik)
  615. EOF
  616. )
  617.  
  618. EXPLOITS[((n++))]=$(cat <<EOF
  619. Name: ${txtgrn}[CVE-2016-4557]${txtrst} double-fdput()
  620. Reqs: pkg=linux-kernel,ver>=4.4,ver<4.5.5,CONFIG_BPF_SYSCALL=y,sysctl:kernel.unprivileged_bpf_disabled!=1
  621. Tags: ubuntu=16.04{kernel:4.4.0-21-generic}
  622. analysis-url: https://bugs.chromium.org/p/project-zero/issues/detail?id=808
  623. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/39772.zip
  624. Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1
  625. exploit-db: 40759
  626. author: Jann Horn
  627. EOF
  628. )
  629.  
  630. EXPLOITS[((n++))]=$(cat <<EOF
  631. Name: ${txtgrn}[CVE-2016-5195]${txtrst} dirtycow
  632. Reqs: pkg=linux-kernel,ver>=2.6.22,ver<=4.8.3
  633. Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},ubuntu=16.04|14.04|12.04
  634. analysis-url: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
  635. Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh
  636. exploit-db: 40611
  637. author: Phil Oester
  638. EOF
  639. )
  640.  
  641. EXPLOITS[((n++))]=$(cat <<EOF
  642. Name: ${txtgrn}[CVE-2016-5195]${txtrst} dirtycow 2
  643. Reqs: pkg=linux-kernel,ver>=2.6.22,ver<=4.8.3
  644. Tags: debian=7|8,RHEL=5|6|7,ubuntu=14.04|12.04,ubuntu=10.04{kernel:2.6.32-21-generic},ubuntu=16.04{kernel:4.4.0-21-generic}
  645. analysis-url: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
  646. ext-url: https://www.exploit-db.com/download/40847.cpp
  647. Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh
  648. exploit-db: 40839
  649. author: FireFart (author of exploit at EDB 40839); Gabriele Bonacini (author of exploit at 'ext-url')
  650. EOF
  651. )
  652.  
  653. EXPLOITS[((n++))]=$(cat <<EOF
  654. Name: ${txtgrn}[CVE-2016-8655]${txtrst} chocobo_root
  655. Reqs: pkg=linux-kernel,ver>=4.4.0,ver<4.9,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1
  656. Tags: ubuntu=(14.04|16.04){kernel:4.4.0-(21|22|24|28|31|34|36|38|42|43|45|47|51)-generic}
  657. analysis-url: http://www.openwall.com/lists/oss-security/2016/12/06/1
  658. Comments: CAP_NET_RAW capability is needed OR CONFIG_USER_NS=y needs to be enabled
  659. exploit-db: 40871
  660. author: rebel
  661. EOF
  662. )
  663.  
  664. EXPLOITS[((n++))]=$(cat <<EOF
  665. Name: ${txtgrn}[CVE-2016-9793]${txtrst} SO_{SND|RCV}BUFFORCE
  666. Reqs: pkg=linux-kernel,ver>=3.11,ver<4.8.14,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1
  667. Tags:
  668. analysis-url: https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793
  669. src-url: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-9793/poc.c
  670. Comments: CAP_NET_ADMIN caps OR CONFIG_USER_NS=y needed. No SMEP/SMAP/KASLR bypass included. Tested in QEMU only
  671. exploit-db: 41995
  672. author: Andrey 'xairy' Konovalov
  673. EOF
  674. )
  675.  
  676. EXPLOITS[((n++))]=$(cat <<EOF
  677. Name: ${txtgrn}[CVE-2017-6074]${txtrst} dccp
  678. Reqs: pkg=linux-kernel,ver>=2.6.18,ver<=4.9.11,CONFIG_IP_DCCP=[my]
  679. Tags: ubuntu=(14.04|16.04){kernel:4.4.0-62-generic}
  680. analysis-url: http://www.openwall.com/lists/oss-security/2017/02/22/3
  681. Comments: Requires Kernel be built with CONFIG_IP_DCCP enabled. Includes partial SMEP/SMAP bypass
  682. exploit-db: 41458
  683. author: Andrey 'xairy' Konovalov
  684. EOF
  685. )
  686.  
  687. EXPLOITS[((n++))]=$(cat <<EOF
  688. Name: ${txtgrn}[CVE-2017-7308]${txtrst} af_packet
  689. Reqs: pkg=linux-kernel,ver>=3.2,ver<=4.10.6,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1
  690. Tags: ubuntu=16.04{kernel:4.8.0-(34|36|39|41|42|44|45)-generic}
  691. analysis-url: https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html
  692. src-url: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-7308/poc.c
  693. ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/cve-2017-7308/CVE-2017-7308/poc.c
  694. Comments: CAP_NET_RAW cap or CONFIG_USER_NS=y needed. Modified version at 'ext-url' adds support for additional kernels
  695. exploit-db: 41994
  696. author: Andrey 'xairy' Konovalov (orginal exploit author); Brendan Coles (author of exploit update at 'ext-url')
  697. EOF
  698. )
  699.  
  700. EXPLOITS[((n++))]=$(cat <<EOF
  701. Name: ${txtgrn}[CVE-2017-16995]${txtrst} eBPF_verifier
  702. Reqs: pkg=linux-kernel,ver>=4.4,ver<=4.14.8,CONFIG_BPF_SYSCALL=y,sysctl:kernel.unprivileged_bpf_disabled!=1
  703. Tags: ubuntu=16.04.4{kernel:4.4.0-116}
  704. analysis-url: https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor
  705. Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1
  706. exploit-db: 44298
  707. author: Bruce Leidl
  708. EOF
  709. )
  710.  
  711. EXPLOITS[((n++))]=$(cat <<EOF
  712. Name: ${txtgrn}[CVE-2017-1000112]${txtrst} NETIF_F_UFO
  713. Reqs: pkg=linux-kernel,ver>=4.4,ver<=4.13,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1
  714. Tags: ubuntu=14.04{kernel:4.4.0-*},ubuntu=16.04{kernel:4.8.0-*}
  715. analysis-url: http://www.openwall.com/lists/oss-security/2017/08/13/1
  716. src-url: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-1000112/poc.c
  717. ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/cve-2017-1000112/CVE-2017-1000112/poc.c
  718. Comments: CAP_NET_ADMIN cap or CONFIG_USER_NS=y needed. SMEP/KASLR bypass included. Modified version at 'ext-url' adds support for additional distros/kernels
  719. exploit-db:
  720. author: Andrey 'xairy' Konovalov (orginal exploit author); Brendan Coles (author of exploit update at 'ext-url')
  721. EOF
  722. )
  723.  
  724. EXPLOITS[((n++))]=$(cat <<EOF
  725. Name: ${txtgrn}[CVE-2017-1000253]${txtrst} PIE_stack_corruption
  726. Reqs: pkg=linux-kernel,ver>=3.2,ver<=4.13,x86_64
  727. Tags: RHEL=6,RHEL=7{kernel:3.10.0-514.21.2|3.10.0-514.26.1}
  728. analysis-url: https://www.qualys.com/2017/09/26/linux-pie-cve-2017-1000253/cve-2017-1000253.txt
  729. src-url: https://www.qualys.com/2017/09/26/linux-pie-cve-2017-1000253/cve-2017-1000253.c
  730. exploit-db: 42887
  731. author: Qualys
  732. Comments:
  733. EOF
  734. )
  735.  
  736. ############ USERSPACE EXPLOITS ###########################
  737. n=0
  738.  
  739. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  740. Name: ${txtgrn}[CVE-2004-0186]${txtrst} samba
  741. Reqs: pkg=samba,ver<=2.2.8
  742. Tags:
  743. exploit-db: 23674
  744. EOF
  745. )
  746.  
  747. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  748. Name: ${txtgrn}[CVE-2009-1185]${txtrst} udev
  749. Reqs: pkg=udev,cmd:[[ -f /etc/udev/rules.d/95-udev-late.rules || -f /lib/udev/rules.d/95-udev-late.rules ]]
  750. Tags: ubuntu=8.10|9.04
  751. exploit-db: 8572
  752. Comments: Version<1.4.1 vulnerable but distros use own versioning scheme. Manual verification needed
  753. EOF
  754. )
  755.  
  756. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  757. Name: ${txtgrn}[CVE-2009-1185]${txtrst} udev 2
  758. Reqs: pkg=udev
  759. Tags:
  760. exploit-db: 8478
  761. Comments: SSH access to non privileged user is needed. Version<1.4.1 vulnerable but distros use own versioning scheme. Manual verification needed
  762. EOF
  763. )
  764.  
  765. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  766. Name: ${txtgrn}[CVE-2010-0832]${txtrst} PAM MOTD
  767. Reqs: pkg=libpam-modules,ver<=1.1.1
  768. Tags: ubuntu=9.10|10.04
  769. exploit-db: 14339
  770. Comments: SSH access to non privileged user is needed
  771. EOF
  772. )
  773.  
  774. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  775. Name: ${txtgrn}[CVE-2011-1485]${txtrst} pkexec
  776. Reqs: pkg=polkit,ver=0.96
  777. Tags: RHEL=6,ubuntu=10.04|10.10
  778. exploit-db: 17942
  779. EOF
  780. )
  781.  
  782. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  783. Name: ${txtgrn}[CVE-2012-0809]${txtrst} death_star (sudo)
  784. Reqs: pkg=sudo,ver>=1.8.0,ver<=1.8.3
  785. Tags: fedora=16
  786. analysis-url: http://seclists.org/fulldisclosure/2012/Jan/att-590/advisory_sudo.txt
  787. exploit-db: 18436
  788. EOF
  789. )
  790.  
  791. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  792. Name: ${txtgrn}[CVE-2014-0476]${txtrst} chkrootkit
  793. Reqs: pkg=chkrootkit,ver<0.50
  794. Tags:
  795. analysis-url: http://seclists.org/oss-sec/2014/q2/430
  796. exploit-db: 33899
  797. Comments: Rooting depends on the crontab (up to one day of dealy)
  798. EOF
  799. )
  800.  
  801. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  802. Name: ${txtgrn}[CVE-2014-5119]${txtrst} __gconv_translit_find
  803. Reqs: pkg=glibc|libc6,x86
  804. Tags: debian=6
  805. analysis-url: http://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-edition.html
  806. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/34421.tar.gz
  807. exploit-db: 34421
  808. EOF
  809. )
  810.  
  811. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  812. Name: ${txtgrn}[CVE-2015-1862]${txtrst} newpid (abrt)
  813. Reqs: pkg=abrt,cmd:grep -qi abrt /proc/sys/kernel/core_pattern
  814. Tags: fedora=20
  815. analysis-url: http://openwall.com/lists/oss-security/2015/04/14/4
  816. src-url: https://gist.githubusercontent.com/taviso/0f02c255c13c5c113406/raw/eafac78dce51329b03bea7167f1271718bee4dcc/newpid.c
  817. exploit-db: 36746
  818. EOF
  819. )
  820.  
  821. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  822. Name: ${txtgrn}[CVE-2015-3315]${txtrst} raceabrt
  823. Reqs: pkg=abrt,cmd:grep -qi abrt /proc/sys/kernel/core_pattern
  824. Tags: fedora=19|20|21,RHEL=7
  825. analysis-url: http://seclists.org/oss-sec/2015/q2/130
  826. src-url: https://gist.githubusercontent.com/taviso/fe359006836d6cd1091e/raw/32fe8481c434f8cad5bcf8529789231627e5074c/raceabrt.c
  827. exploit-db: 36747
  828. EOF
  829. )
  830.  
  831. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  832. Name: ${txtgrn}[CVE-2015-1318]${txtrst} newpid (apport)
  833. Reqs: pkg=apport,ver>=2.13,ver<=2.17,cmd:grep -qi apport /proc/sys/kernel/core_pattern
  834. Tags: ubuntu=14.04
  835. analysis-url: http://openwall.com/lists/oss-security/2015/04/14/4
  836. src-url: https://gist.githubusercontent.com/taviso/0f02c255c13c5c113406/raw/eafac78dce51329b03bea7167f1271718bee4dcc/newpid.c
  837. exploit-db: 36746
  838. EOF
  839. )
  840.  
  841. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  842. Name: ${txtgrn}[CVE-2015-1318]${txtrst} newpid (apport) 2
  843. Reqs: pkg=apport,ver>=2.13,ver<=2.17,cmd:grep -qi apport /proc/sys/kernel/core_pattern
  844. Tags: ubuntu=14.04.2
  845. analysis-url: http://openwall.com/lists/oss-security/2015/04/14/4
  846. exploit-db: 36782
  847. EOF
  848. )
  849.  
  850. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  851. Name: ${txtgrn}[CVE-2015-3202]${txtrst} fuse (fusermount)
  852. Reqs: pkg=fuse,ver<2.9.3
  853. Tags: debian=7.0|8.0,ubuntu=*
  854. analysis-url: http://seclists.org/oss-sec/2015/q2/520
  855. exploit-db: 37089
  856. Comments: Needs cron or system admin interaction
  857. EOF
  858. )
  859.  
  860. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  861. Name: ${txtgrn}[CVE-2015-1815]${txtrst} setroubleshoot
  862. Reqs: pkg=setroubleshoot,ver<3.2.22
  863. Tags: fedora=21
  864. exploit-db: 36564
  865. EOF
  866. )
  867.  
  868. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  869. Name: ${txtgrn}[CVE-2015-3246]${txtrst} userhelper
  870. Reqs: pkg=libuser,ver<=0.60
  871. Tags: RHEL<=7,centos<=7,fedora<=22
  872. analysis-url: https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt
  873. exploit-db: 37706
  874. EOF
  875. )
  876.  
  877. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  878. Name: ${txtgrn}[CVE-2015-6565]${txtrst} not_an_sshnuke
  879. Reqs: pkg=openssh-server,ver>=6.8,ver<=6.9
  880. Tags:
  881. analysis-url: http://www.openwall.com/lists/oss-security/2017/01/26/2
  882. exploit-db: 41173
  883. author: Federico Bento
  884. Comments: Needs admin interaction (root user needs to login via ssh to trigger exploitation)
  885. EOF
  886. )
  887.  
  888. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  889. Name: ${txtgrn}[CVE-2016-1240]${txtrst} tomcat-rootprivesc-deb.sh
  890. Reqs: pkg=tomcat
  891. Tags: debian=8,ubuntu=16.04
  892. analysis-url: https://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html
  893. src-url: http://legalhackers.com/exploits/tomcat-rootprivesc-deb.sh
  894. exploit-db: 40450
  895. author: Dawid Golunski
  896. Comments: Affects only Debian-based distros
  897. EOF
  898. )
  899.  
  900. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  901. Name: ${txtgrn}[CVE-2016-1247]${txtrst} nginxed-root.sh
  902. Reqs: pkg=nginx|nginx-full
  903. Tags: debian=8,ubuntu=14.04|16.04|16.10
  904. analysis-url: https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html
  905. src-url: https://legalhackers.com/exploits/CVE-2016-1247/nginxed-root.sh
  906. exploit-db: 40768
  907. author: Dawid Golunski
  908. Comments: Rooting depends on cron.daily (up to 24h of dealy). Affected: deb8: <1.6.2; 14.04: <1.4.6; 16.04: 1.10.0
  909. EOF
  910. )
  911.  
  912. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  913. Name: ${txtgrn}[CVE-2016-1531]${txtrst} perl_startup (exim)
  914. Reqs: pkg=exim,ver<4.86.2
  915. Tags:
  916. analysis-url: http://www.exim.org/static/doc/CVE-2016-1531.txt
  917. exploit-db: 39549
  918. EOF
  919. )
  920.  
  921. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  922. Name: ${txtgrn}[CVE-2016-1531]${txtrst} perl_startup (exim) 2
  923. Reqs: pkg=exim,ver<4.86.2
  924. Tags:
  925. analysis-url: http://www.exim.org/static/doc/CVE-2016-1531.txt
  926. exploit-db: 39535
  927. EOF
  928. )
  929.  
  930. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  931. Name: ${txtgrn}[CVE-2016-4989]${txtrst} setroubleshoot 2
  932. Reqs: pkg=setroubleshoot
  933. Tags: RHEL=6|7
  934. analysis-url: https://c-skills.blogspot.com/2016/06/lets-feed-attacker-input-to-sh-c-to-see.html
  935. src-url: https://github.com/stealth/troubleshooter/raw/master/straight-shooter.c
  936. exploit-db:
  937. EOF
  938. )
  939.  
  940. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  941. Name: ${txtgrn}[CVE-2016-5425]${txtrst} tomcat-RH-root.sh
  942. Reqs: pkg=tomcat
  943. Tags: RHEL=7
  944. analysis-url: http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html
  945. src-url: http://legalhackers.com/exploits/tomcat-RH-root.sh
  946. exploit-db: 40488
  947. author: Dawid Golunski
  948. Comments: Affects only RedHat-based distros
  949. EOF
  950. )
  951.  
  952. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  953. Name: ${txtgrn}[CVE-2016-6663,CVE-2016-6664|CVE-2016-6662]${txtrst} mysql-exploit-chain
  954. Reqs: pkg=mysql-server|mariadb-server,ver<5.5.52
  955. Tags: ubuntu=16.04.1
  956. analysis-url: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html
  957. src-url: http://legalhackers.com/exploits/CVE-2016-6663/mysql-privesc-race.c
  958. exploit-db: 40678
  959. author: Dawid Golunski
  960. Comments: Also MariaDB ver<10.1.18 and ver<10.0.28 affected
  961. EOF
  962. )
  963.  
  964. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  965. Name: ${txtgrn}[CVE-2016-9566]${txtrst} nagios-root-privesc
  966. Reqs: pkg=nagios,ver<4.2.4
  967. Tags:
  968. analysis-url: https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.html
  969. src-url: https://legalhackers.com/exploits/CVE-2016-9566/nagios-root-privesc.sh
  970. exploit-db: 40921
  971. author: Dawid Golunski
  972. Comments: Allows priv escalation from nagios user or nagios group
  973. EOF
  974. )
  975.  
  976. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  977. Name: ${txtgrn}[CVE-2017-0358]${txtrst} ntfs-3g-modprobe
  978. Reqs: pkg=ntfs-3g
  979. Tags: ubuntu=16.04|16.10,debian=7|8
  980. analysis-url: https://bugs.chromium.org/p/project-zero/issues/detail?id=1072
  981. src-url: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/41356.zip
  982. exploit-db: 41356
  983. author: Jann Horn
  984. Comments: Distros use own versioning scheme. Manual verification needed. Linux headers must be installed. System must have at least two CPU cores.
  985. EOF
  986. )
  987.  
  988. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  989. Name: ${txtgrn}[CVE-2017-1000367]${txtrst} Sudoer-to-root
  990. Reqs: pkg=sudo,ver<=1.8.20,cmd:[ -f /usr/sbin/getenforce ]
  991. Tags: RHEL=7{sudo:1.8.6p7}
  992. analysis-url: https://www.sudo.ws/alerts/linux_tty.html
  993. src-url: https://www.qualys.com/2017/05/30/cve-2017-1000367/linux_sudo_cve-2017-1000367.c
  994. exploit-db: 42183
  995. author: Qualys
  996. Comments: Needs to be sudoer. Works only on SELinux enabled systems
  997. EOF
  998. )
  999.  
  1000. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1001. Name: ${txtgrn}[CVE-2017-1000367]${txtrst} sudopwn
  1002. Reqs: pkg=sudo,ver<=1.8.20,cmd:[ -f /usr/sbin/getenforce ]
  1003. Tags:
  1004. analysis-url: https://www.sudo.ws/alerts/linux_tty.html
  1005. src-url: https://raw.githubusercontent.com/c0d3z3r0/sudo-CVE-2017-1000367/master/sudopwn.c
  1006. exploit-db:
  1007. author: c0d3z3r0
  1008. Comments: Needs to be sudoer. Works only on SELinux enabled systems
  1009. EOF
  1010. )
  1011.  
  1012. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1013. Name: ${txtgrn}[CVE-2017-1000366,CVE-2017-1000370]${txtrst} linux_ldso_hwcap
  1014. Reqs: pkg=glibc|libc6,ver<=2.25,x86
  1015. Tags:
  1016. analysis-url: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
  1017. src-url: https://www.qualys.com/2017/06/19/stack-clash/linux_ldso_hwcap.c
  1018. exploit-db: 42274
  1019. author: Qualys
  1020. Comments: Uses "Stack Clash" technique, works against most SUID-root binaries
  1021. EOF
  1022. )
  1023.  
  1024. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1025. Name: ${txtgrn}[CVE-2017-1000366,CVE-2017-1000371]${txtrst} linux_ldso_dynamic
  1026. Reqs: pkg=glibc|libc6,ver<=2.25,x86
  1027. Tags: debian=9|10,ubuntu=14.04.5|16.04.2|17.04,fedora=23|24|25
  1028. analysis-url: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
  1029. src-url: https://www.qualys.com/2017/06/19/stack-clash/linux_ldso_dynamic.c
  1030. exploit-db: 42276
  1031. author: Qualys
  1032. Comments: Uses "Stack Clash" technique, works against most SUID-root PIEs
  1033. EOF
  1034. )
  1035.  
  1036. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1037. Name: ${txtgrn}[CVE-2017-1000366,CVE-2017-1000379]${txtrst} linux_ldso_hwcap_64
  1038. Reqs: pkg=glibc|libc6,ver<=2.25,x86_64
  1039. Tags: debian=7.7|8.5|9.0,ubuntu=14.04.2|16.04.2|17.04,fedora=22|25,centos=7.3.1611
  1040. analysis-url: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
  1041. src-url: https://www.qualys.com/2017/06/19/stack-clash/linux_ldso_hwcap_64.c
  1042. exploit-db: 42275
  1043. author: Qualys
  1044. Comments: Uses "Stack Clash" technique, works against most SUID-root binaries
  1045. EOF
  1046. )
  1047.  
  1048. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1049. Name: ${txtgrn}[CVE-2017-1000370,CVE-2017-1000371]${txtrst} linux_offset2lib
  1050. Reqs: pkg=glibc|libc6,ver<=2.25,x86
  1051. Tags:
  1052. analysis-url: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
  1053. src-url: https://www.qualys.com/2017/06/19/stack-clash/linux_offset2lib.c
  1054. exploit-db: 42273
  1055. author: Qualys
  1056. Comments: Uses "Stack Clash" technique
  1057. EOF
  1058. )
  1059.  
  1060. EXPLOITS_USERSPACE[((n++))]=$(cat <<EOF
  1061. Name: ${txtgrn}[CVE-2018-1000001]${txtrst} RationalLove
  1062. Reqs: pkg=glibc|libc6,ver<2.27,CONFIG_USER_NS=y,sysctl:kernel.unprivileged_userns_clone==1,x86_64
  1063. Tags: debian=9{glibc:2.24-11+deb9u1},ubuntu=16.04.3{glibc:2.23-0ubuntu9}
  1064. analysis-url: https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
  1065. src-url: https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/RationalLove.c
  1066. Comments: kernel.unprivileged_userns_clone=1 required
  1067. exploit-db: 43775
  1068. author: halfdog
  1069. EOF
  1070. )
  1071.  
  1072. ###########################################################
  1073. ## security related HW/kernel features
  1074. ###########################################################
  1075. n=0
  1076.  
  1077. FEATURES[((n++))]=$(cat <<EOF
  1078. section: Kernel protection mechanisms:
  1079. EOF
  1080. )
  1081.  
  1082. FEATURES[((n++))]=$(cat <<EOF
  1083. feature: GCC stack protector support
  1084. available: CONFIG_CC_STACKPROTECTOR=y
  1085. analysis-url: https://github.com/mzet-/les-res/blob/master/features/stackprotector-regular.md
  1086. EOF
  1087. )
  1088.  
  1089. FEATURES[((n++))]=$(cat <<EOF
  1090. feature: GCC stack protector STRONG support
  1091. available: CONFIG_CC_STACKPROTECTOR_STRONG=y,ver>=3.14
  1092. analysis-url: https://github.com/mzet-/les-res/blob/master/features/stackprotector-strong.md
  1093. EOF
  1094. )
  1095.  
  1096. FEATURES[((n++))]=$(cat <<EOF
  1097. feature: Low address space to protect from user allocation
  1098. available: CONFIG_DEFAULT_MMAP_MIN_ADDR=[0-9]+
  1099. enabled: sysctl:vm.mmap_min_addr!=0
  1100. analysis-url: https://github.com/mzet-/les-res/blob/master/features/mmap_min_addr.md
  1101. EOF
  1102. )
  1103.  
  1104. FEATURES[((n++))]=$(cat <<EOF
  1105. feature: Hiding kernel pointers in /proc/kallsyms
  1106. available: ver>=2.6.28
  1107. enabled: sysctl:kernel.kptr_restrict!=0
  1108. analysis-url: https://github.com/mzet-/les-res/blob/master/features/kptr_restrict.md
  1109. EOF
  1110. )
  1111.  
  1112. FEATURES[((n++))]=$(cat <<EOF
  1113. feature: Restrict unprivileged access to kernel syslog
  1114. available: ver>=2.6.37
  1115. enabled: sysctl:kernel.dmesg_restrict!=0
  1116. analysis-url: https://github.com/mzet-/les-res/blob/master/features/dmesg_restrict.md
  1117. EOF
  1118. )
  1119.  
  1120. FEATURES[((n++))]=$(cat <<EOF
  1121. feature: Supervisor Mode Execution Protection (SMEP) support
  1122. available: ver>=3.0,cmd:grep -qi smep /proc/cpuinfo
  1123. enabled: cmd:grep -qi smep /proc/cpuinfo
  1124. analysis-url: https://github.com/mzet-/les-res/blob/master/features/smep.md
  1125. EOF
  1126. )
  1127.  
  1128. FEATURES[((n++))]=$(cat <<EOF
  1129. feature: Supervisor Mode Access Prevention (SMAP) support
  1130. available: ver>=3.7,cmd:grep -qi smap /proc/cpuinfo
  1131. enabled: cmd:grep -qi smap /proc/cpuinfo
  1132. analysis-url: https://github.com/mzet-/les-res/blob/master/features/smap.md
  1133. EOF
  1134. )
  1135.  
  1136. FEATURES[((n++))]=$(cat <<EOF
  1137. feature: Randomize the address of the kernel image (KASLR)
  1138. available: CONFIG_RANDOMIZE_BASE=y
  1139. analysis-url: https://github.com/mzet-/les-res/blob/master/features/kaslr.md
  1140. EOF
  1141. )
  1142.  
  1143. FEATURES[((n++))]=$(cat <<EOF
  1144. feature: Hardened user copy support
  1145. available: CONFIG_HARDENED_USERCOPY=y
  1146. analysis-url: https://github.com/mzet-/les-res/blob/master/features/hardened_usercopy.md
  1147. EOF
  1148. )
  1149.  
  1150. FEATURES[((n++))]=$(cat <<EOF
  1151. feature: Make kernel text and rodata read-only
  1152. available: CONFIG_STRICT_KERNEL_RWX=y
  1153. analysis-url: https://github.com/mzet-/les-res/blob/master/features/strict_kernel_rwx.md
  1154. EOF
  1155. )
  1156.  
  1157. FEATURES[((n++))]=$(cat <<EOF
  1158. feature: Set loadable kernel module data as NX and text as RO
  1159. available: CONFIG_STRICT_MODULE_RWX=y
  1160. analysis-url: https://github.com/mzet-/les-res/blob/master/features/strict_module_rwx.md
  1161. EOF
  1162. )
  1163.  
  1164. FEATURES[((n++))]=$(cat <<EOF
  1165. feature: Restrict /dev/mem access
  1166. available: CONFIG_STRICT_DEVMEM=y
  1167. analysis-url: https://github.com/mzet-/les-res/blob/master/features/strict_devmem.md
  1168. EOF
  1169. )
  1170.  
  1171. FEATURES[((n++))]=$(cat <<EOF
  1172. feature: Restrict I/O access to /dev/mem
  1173. available: CONFIG_IO_STRICT_DEVMEM=y
  1174. analysis-url: https://github.com/mzet-/les-res/blob/master/features/io_strict_devmem.md
  1175. EOF
  1176. )
  1177.  
  1178. FEATURES[((n++))]=$(cat <<EOF
  1179. section: Attack Surface:
  1180. EOF
  1181. )
  1182.  
  1183. FEATURES[((n++))]=$(cat <<EOF
  1184. feature: Support for /dev/mem access
  1185. available: CONFIG_DEVMEM=y
  1186. analysis-url: https://github.com/mzet-/les-res/blob/master/features/devmem.md
  1187. EOF
  1188. )
  1189.  
  1190. FEATURES[((n++))]=$(cat <<EOF
  1191. feature: Support for /dev/kmem access
  1192. available: CONFIG_DEVKMEM=y
  1193. analysis-url: https://github.com/mzet-/les-res/blob/master/features/devkmem.md
  1194. EOF
  1195. )
  1196.  
  1197. FEATURES[((n++))]=$(cat <<EOF
  1198. feature: User namespaces for unprivileged accounts
  1199. available: CONFIG_USER_NS=y
  1200. enabled: sysctl:kernel.unprivileged_userns_clone==1
  1201. analysis-url: https://github.com/mzet-/les-res/blob/master/features/user_ns.md
  1202. EOF
  1203. )
  1204.  
  1205. FEATURES[((n++))]=$(cat <<EOF
  1206. feature: Unprivileged access to bpf() system call
  1207. available: CONFIG_BPF_SYSCALL=y
  1208. enabled: sysctl:kernel.unprivileged_bpf_disabled!=1
  1209. analysis-url: https://github.com/mzet-/les-res/blob/master/features/bpf_syscall.md
  1210. EOF
  1211. )
  1212.  
  1213. version() {
  1214. echo "linux-exploit-suggester "$VERSION", mzet, http://z-labs.eu, February 2018"
  1215. }
  1216.  
  1217. usage() {
  1218. echo "Usage: linux-exploit-suggester.sh [OPTIONS]"
  1219. echo
  1220. echo " -V | --version - print version of this script"
  1221. echo " -h | --help - print this help"
  1222. echo " -k | --kernel <version> - provide kernel version"
  1223. echo " -u | --uname <string> - provide 'uname -a' string"
  1224. echo " --skip-more-checks - do not perform additional checks (kernel config, sysctl) to determine if exploit is applicable"
  1225. echo " --skip-pkg-versions - skip checking for exact userspace package version (helps to avoid false negatives)"
  1226. echo " -p | --pkglist-file <file> - provide file with 'dpkg -l' or 'rpm -qa' command output"
  1227. echo " --cvelist-file <file> - provide file with Linux kernel CVEs list"
  1228. echo " --checksec - list security related features for your HW/kernel"
  1229. echo " -s | --fetch-sources - automatically downloads source for matched exploit"
  1230. echo " -b | --fetch-binaries - automatically downloads binary for matched exploit if available"
  1231. echo " -f | --full - show full info about matched exploit"
  1232. echo " -g | --short - show shorten info about matched exploit"
  1233. echo " --kernelspace-only - show only kernel vulnerabilities"
  1234. echo " --userspace-only - show only userspace vulnerabilities"
  1235. echo " -d | --show-dos - show also DoSes in results"
  1236. }
  1237.  
  1238. exitWithErrMsg() {
  1239. echo "$1" 1>&2
  1240. exit 1
  1241. }
  1242.  
  1243. # extracts all information from output of 'uname -a' command
  1244. parseUname() {
  1245. local uname=$1
  1246.  
  1247. KERNEL=$(echo "$uname" | awk '{print $3}' | cut -d '-' -f 1)
  1248. KERNEL_ALL=$(echo "$uname" | awk '{print $3}')
  1249. ARCH=$(echo "$uname" | awk '{print $(NF-1)}')
  1250.  
  1251. OS=""
  1252. echo "$uname" | grep -q -i 'deb' && OS="debian"
  1253. echo "$uname" | grep -q -i 'ubuntu' && OS="ubuntu"
  1254. echo "$uname" | grep -q -i '\.fc' && OS="fedora"
  1255. echo "$uname" | grep -q -i '\.el' && OS="RHEL"
  1256.  
  1257. # 'uname -a' output doesn't contain distribution number (at least not in case of all distros)
  1258. }
  1259.  
  1260. getPkgList() {
  1261. local distro=$1
  1262. local pkglist_file=$2
  1263.  
  1264. # take package listing from provided file & detect if it's 'rpm -qa' listing or 'dpkg -l' listing or not recognized listing
  1265. if [ "$opt_pkglist_file" = "true" -a -e "$pkglist_file" ]; then
  1266.  
  1267. # ubuntu/debian package listing file
  1268. if [ $(cat "$pkglist_file" | head -1 | grep 'Desired=Unknown/Install/Remove/Purge/Hold') ]; then
  1269. PKG_LIST=$(cat "$pkglist_file" | awk '{print $2"-"$3}' | sed 's/:amd64//g')
  1270.  
  1271. OS="debian"
  1272. [ "$(cat "$pkglist_file" | grep "ubuntu")" ] && OS="ubuntu"
  1273. # redhat package listing file
  1274. elif [ $(cat "$pkglist_file" | head -1 | grep -E '\.el[1-9]+\.') ]; then
  1275. PKG_LIST=$(cat "$pkglist_file")
  1276. OS="RHEL"
  1277. # file not recognized - skipping
  1278. else
  1279. PKG_LIST=""
  1280. fi
  1281.  
  1282. elif [ "$distro" = "debian" -o "$distro" = "ubuntu" ]; then
  1283. PKG_LIST=$(dpkg -l | awk '{print $2"-"$3}' | sed 's/:amd64//g')
  1284. elif [ "$distro" = "RHEL" -o "$distro" = "fedora" ]; then
  1285. PKG_LIST=$(rpm -qa)
  1286. else
  1287. # packages listing not available
  1288. PKG_LIST=""
  1289. fi
  1290. }
  1291.  
  1292. # from: https://stackoverflow.com/questions/4023830/how-compare-two-strings-in-dot-separated-version-format-in-bash
  1293. verComparision() {
  1294.  
  1295. if [[ $1 == $2 ]]
  1296. then
  1297. return 0
  1298. fi
  1299.  
  1300. local IFS=.
  1301. local i ver1=($1) ver2=($2)
  1302.  
  1303. # fill empty fields in ver1 with zeros
  1304. for ((i=${#ver1[@]}; i<${#ver2[@]}; i++))
  1305. do
  1306. ver1[i]=0
  1307. done
  1308.  
  1309. for ((i=0; i<${#ver1[@]}; i++))
  1310. do
  1311. if [[ -z ${ver2[i]} ]]
  1312. then
  1313. # fill empty fields in ver2 with zeros
  1314. ver2[i]=0
  1315. fi
  1316. if ((10#${ver1[i]} > 10#${ver2[i]}))
  1317. then
  1318. return 1
  1319. fi
  1320. if ((10#${ver1[i]} < 10#${ver2[i]}))
  1321. then
  1322. return 2
  1323. fi
  1324. done
  1325.  
  1326. return 0
  1327. }
  1328.  
  1329. doVersionComparision() {
  1330. local reqVersion="$1"
  1331. local reqRelation="$2"
  1332. local currentVersion="$3"
  1333.  
  1334. verComparision $currentVersion $reqVersion
  1335. case $? in
  1336. 0) currentRelation='=';;
  1337. 1) currentRelation='>';;
  1338. 2) currentRelation='<';;
  1339. esac
  1340.  
  1341. if [ "$reqRelation" == "=" ]; then
  1342. [ $currentRelation == "=" ] && return 0
  1343. elif [ "$reqRelation" == ">" ]; then
  1344. [ $currentRelation == ">" ] && return 0
  1345. elif [ "$reqRelation" == "<" ]; then
  1346. [ $currentRelation == "<" ] && return 0
  1347. elif [ "$reqRelation" == ">=" ]; then
  1348. [ $currentRelation == "=" ] && return 0
  1349. [ $currentRelation == ">" ] && return 0
  1350. elif [ "$reqRelation" == "<=" ]; then
  1351. [ $currentRelation == "=" ] && return 0
  1352. [ $currentRelation == "<" ] && return 0
  1353. fi
  1354. }
  1355.  
  1356. compareValues() {
  1357. curVal=$1
  1358. val=$2
  1359. sign=$3
  1360.  
  1361. if [ "$sign" == "==" ]; then
  1362. [ "$val" == "$curVal" ] && return 0
  1363. elif [ "$sign" == "!=" ]; then
  1364. [ "$val" != "$curVal" ] && return 0
  1365. fi
  1366.  
  1367. return 1
  1368. }
  1369.  
  1370. checkRequirement() {
  1371. #echo "Checking requirement: $1"
  1372. local IN="$1"
  1373. local pkgName="${2:4}"
  1374.  
  1375. if [[ "$IN" =~ ^pkg=.*$ ]]; then
  1376.  
  1377. # always true for Linux OS
  1378. [ ${pkgName} == "linux-kernel" ] && return 0
  1379.  
  1380. # verify if package is present
  1381. pkg=$(echo "$PKG_LIST" | grep -E -i "^$pkgName-[0-9]+" | head -1)
  1382. if [ -n "$pkg" ]; then
  1383. return 0
  1384. fi
  1385.  
  1386. elif [[ "$IN" =~ ^ver.*$ ]]; then
  1387. version="${IN//[^0-9.]/}"
  1388. rest="${IN#ver}"
  1389. operator=${rest%$version}
  1390.  
  1391. if [ "$pkgName" == "linux-kernel" -o "$opt_checksec_mode" == "true" ]; then
  1392.  
  1393. # for --cvelist-file mode skip kernel version comparision
  1394. [ "$opt_cvelist_file" = "true" ] && return 0
  1395.  
  1396. doVersionComparision $version $operator $KERNEL && return 0
  1397. else
  1398. # extract package version and check if requiremnt is true
  1399. pkg=$(echo "$PKG_LIST" | grep -E -i "^$pkgName-[0-9]+" | head -1)
  1400.  
  1401. # skip (if run with --skip-pkg-versions) version checking if package with given name is installed
  1402. [ "$opt_skip_pkg_versions" = "true" -a -n "$pkg" ] && return 0
  1403.  
  1404. # versioning:
  1405. #echo "pkg: $pkg"
  1406. pkgVersion=$(echo "$pkg" | grep -E -i -o -e '-[\.0-9\+:p]+[-\+]' | cut -d':' -f2 | sed 's/[\+-]//g' | sed 's/p[0-9]//g')
  1407. #echo "version: $pkgVersion"
  1408. #echo "operator: $operator"
  1409. #echo "required version: $version"
  1410. #echo
  1411. doVersionComparision $version $operator $pkgVersion && return 0
  1412. fi
  1413. elif [[ "$IN" =~ ^x86_64$ ]] && [ "$ARCH" == "x86_64" -o "$ARCH" == "" ]; then
  1414. return 0
  1415. elif [[ "$IN" =~ ^x86$ ]] && [ "$ARCH" == "i386" -o "$ARCH" == "i686" -o "$ARCH" == "" ]; then
  1416. return 0
  1417. elif [[ "$IN" =~ ^CONFIG_.*$ ]]; then
  1418.  
  1419. # skip if check is not applicable (-k or --uname or -p set) or if user said so (--skip-more-checks)
  1420. [ "$opt_skip_more_checks" = "true" ] && return 0
  1421.  
  1422. # if kernel config IS available:
  1423. if [ -n "$KCONFIG" ]; then
  1424. if $KCONFIG | grep -E -qi $IN; then
  1425. return 0;
  1426. # required option wasn't found, exploit is not applicable
  1427. else
  1428. return 1;
  1429. fi
  1430. # config is not available
  1431. else
  1432. return 0;
  1433. fi
  1434. elif [[ "$IN" =~ ^sysctl:.*$ ]]; then
  1435.  
  1436. # skip if check is not applicable (-k or --uname or -p modes) or if user said so (--skip-more-checks)
  1437. [ "$opt_skip_more_checks" = "true" ] && return 0
  1438.  
  1439. sysctlCondition="${IN:7}"
  1440.  
  1441. # extract sysctl entry, relation sign and required value
  1442. if echo $sysctlCondition | grep -qi "!="; then
  1443. sign="!="
  1444. elif echo $sysctlCondition | grep -qi "=="; then
  1445. sign="=="
  1446. else
  1447. exitWithErrMsg "Wrong sysctl condition. There is syntax error in your features DB. Aborting."
  1448. fi
  1449. val=$(echo "$sysctlCondition" | awk -F "$sign" '{print $2}')
  1450. entry=$(echo "$sysctlCondition" | awk -F "$sign" '{print $1}')
  1451.  
  1452. # get current setting of sysctl entry
  1453. curVal=$(/sbin/sysctl -a 2> /dev/null | grep "$entry" | awk -F'=' '{print $2}')
  1454.  
  1455. # special case for --checksec mode: return 2 if there is no such switch in sysctl
  1456. [ -z "$curVal" -a "$opt_checksec_mode" = "true" ] && return 2
  1457.  
  1458. # for other modes: skip if there is no such switch in sysctl
  1459. [ -z "$curVal" ] && return 0
  1460.  
  1461. # compare & return result
  1462. compareValues $curVal $val $sign && return 0
  1463.  
  1464. elif [[ "$IN" =~ ^cmd:.*$ ]]; then
  1465.  
  1466. # skip if check is not applicable (-k or --uname or -p modes) or if user said so (--skip-more-checks)
  1467. [ "$opt_skip_more_checks" = "true" ] && return 0
  1468.  
  1469. cmd="${IN:4}"
  1470. if eval "${cmd}"; then
  1471. return 0
  1472. fi
  1473. fi
  1474.  
  1475. return 1
  1476. }
  1477.  
  1478. getKernelConfig() {
  1479. if [ -f /proc/config.gz ] ; then
  1480. KCONFIG="zcat /proc/config.gz"
  1481. elif [ -f /boot/config-`uname -r` ] ; then
  1482. KCONFIG="cat /boot/config-`uname -r`"
  1483. elif [ -f "${KBUILD_OUTPUT:-/usr/src/linux}"/.config ] ; then
  1484. KCONFIG="cat ${KBUILD_OUTPUT:-/usr/src/linux}/.config"
  1485. else
  1486. KCONFIG=""
  1487. fi
  1488. }
  1489.  
  1490. checksecMode() {
  1491.  
  1492. # start analysis
  1493. for FEATURE in "${FEATURES[@]}"; do
  1494.  
  1495. # create array from current exploit here doc and fetch needed lines
  1496. i=0
  1497. # ('-r' is used to not interpret backslash used for bash colors)
  1498. while read -r line
  1499. do
  1500. arr[i]="$line"
  1501. i=$((i + 1))
  1502. done <<< "$FEATURE"
  1503.  
  1504. NAME="${arr[0]}"
  1505. PRE_NAME="${NAME:0:8}"
  1506. NAME="${NAME:9}"
  1507. if [ "${PRE_NAME}" = "section:" ]; then
  1508. echo
  1509. echo -e "${bldwht}${NAME}${txtrst}"
  1510. echo
  1511. continue
  1512. fi
  1513.  
  1514. AVAILABLE="${arr[1]}" && AVAILABLE="${AVAILABLE:11}"
  1515. ENABLE=$(echo "$FEATURE" | grep "enabled: " | awk -F'ed: ' '{print $2}')
  1516. analysis_url=$(echo "$FEATURE" | grep "analysis-url: " | awk '{print $2}')
  1517.  
  1518. # split line with availability requirements & loop thru all availability reqs one by one & check whether it is met
  1519. IFS=',' read -r -a array <<< "$AVAILABLE"
  1520. AVAILABLE_REQS_NUM=${#array[@]}
  1521. AVAILABLE_PASSED_REQ=0
  1522. for REQ in "${array[@]}"; do
  1523. if (checkRequirement "$REQ"); then
  1524. AVAILABLE_PASSED_REQ=$(($AVAILABLE_PASSED_REQ + 1))
  1525. else
  1526. break
  1527. fi
  1528. done
  1529.  
  1530. # split line with enablement requirements & loop thru all enablement reqs one by one & check whether it is met
  1531. ENABLE_PASSED_REQ=0
  1532. ENABLE_REQS_NUM=-1
  1533. noSysctl=0
  1534. if [ -n "$ENABLE" ]; then
  1535. IFS=',' read -r -a array <<< "$ENABLE"
  1536. ENABLE_REQS_NUM=${#array[@]}
  1537. for REQ in "${array[@]}"; do
  1538. checkRequirement "$REQ"
  1539. retVal=$?
  1540. if [ $retVal -eq 0 ]; then
  1541. ENABLE_PASSED_REQ=$(($ENABLE_PASSED_REQ + 1))
  1542. elif [ $retVal -eq 2 ]; then
  1543. # special case: sysctl entry is not present on given system: signal it as: N/A
  1544. noSysctl=1
  1545. break
  1546. else
  1547. break
  1548. fi
  1549. done
  1550. fi
  1551.  
  1552. feature=$(echo "$FEATURE" | grep "feature: " | cut -d' ' -f 2-)
  1553.  
  1554. available="${txtred}Available${txtrst}"
  1555. enabled=" ${txtgray}N/A${txtrst} "
  1556.  
  1557. if [ $AVAILABLE_PASSED_REQ -eq $AVAILABLE_REQS_NUM ]; then
  1558. available="${txtgrn}Available${txtrst}"
  1559. fi
  1560.  
  1561. if [ $ENABLE_PASSED_REQ -eq $ENABLE_REQS_NUM -a $noSysctl -eq 0 -a -n "$ENABLE" ]; then
  1562. enabled="${txtgrn}Enabled${txtrst}"
  1563. elif [ -n "$ENABLE" -a $noSysctl -eq 0 ]; then
  1564. enabled="${txtred}Disabled${txtrst}"
  1565. fi
  1566.  
  1567. # short (--short) output
  1568. if [ "$opt_summary" = "true" ]; then
  1569. echo -e "[ $available ][ $enabled ] $feature"
  1570. continue
  1571. fi
  1572.  
  1573. echo -e "[+] $feature"
  1574. echo -e "\n [ $available ]: $AVAILABLE"
  1575. [ -n "$ENABLE" ] && echo -e " [ $enabled ]: $ENABLE"
  1576. [ -n "$analysis_url" ] && echo -e " Feature analysis: $analysis_url"
  1577. echo
  1578.  
  1579. done
  1580.  
  1581. }
  1582.  
  1583. # parse command line parameters
  1584. ARGS=$(getopt --options $SHORTOPTS --longoptions $LONGOPTS -- "$@")
  1585. [ $? != 0 ] && exitWithErrMsg "Aborting."
  1586.  
  1587. eval set -- "$ARGS"
  1588.  
  1589. while true; do
  1590. case "$1" in
  1591. -u|--uname)
  1592. shift
  1593. UNAME_A="$1"
  1594. opt_uname_string=true
  1595. ;;
  1596. -V|--version)
  1597. version
  1598. exit 0
  1599. ;;
  1600. -h|--help)
  1601. usage
  1602. exit 0
  1603. ;;
  1604. -f|--full)
  1605. opt_full=true
  1606. ;;
  1607. -g|--short)
  1608. opt_summary=true
  1609. ;;
  1610. -b|--fetch-binaries)
  1611. opt_fetch_bins=true
  1612. ;;
  1613. -s|--fetch-sources)
  1614. opt_fetch_srcs=true
  1615. ;;
  1616. -k|--kernel)
  1617. shift
  1618. KERNEL="$1"
  1619. opt_kernel_version=true
  1620. ;;
  1621. -d|--show-dos)
  1622. opt_show_dos=true
  1623. ;;
  1624. -p|--pkglist-file)
  1625. shift
  1626. PKGLIST_FILE="$1"
  1627. opt_pkglist_file=true
  1628. ;;
  1629. --cvelist-file)
  1630. shift
  1631. CVELIST_FILE="$1"
  1632. opt_cvelist_file=true
  1633. ;;
  1634. --checksec)
  1635. opt_checksec_mode=true
  1636. ;;
  1637. --kernelspace-only)
  1638. opt_kernel_only=true
  1639. ;;
  1640. --userspace-only)
  1641. opt_userspace_only=true
  1642. ;;
  1643. --skip-more-checks)
  1644. opt_skip_more_checks=true
  1645. ;;
  1646. --skip-pkg-versions)
  1647. opt_skip_pkg_versions=true
  1648. ;;
  1649. *)
  1650. shift
  1651. if [ "$#" != "0" ]; then
  1652. exitWithErrMsg "Unknown option '$1'. Aborting."
  1653. fi
  1654. break
  1655. ;;
  1656. esac
  1657. shift
  1658. done
  1659.  
  1660. # check Bash version (associative arrays need Bash in version 4.0+)
  1661. if ((BASH_VERSINFO[0] < 4)); then
  1662. exitWithErrMsg "Script needs Bash in version 4.0 or newer. Aborting."
  1663. fi
  1664.  
  1665. # exit if both --kernel and --uname are set
  1666. [ "$opt_kernel_version" = "true" ] && [ $opt_uname_string = "true" ] && exitWithErrMsg "Switches -u|--uname and -k|--kernel are mutually exclusive. Aborting."
  1667.  
  1668. # exit if both --full and --short are set
  1669. [ "$opt_full" = "true" ] && [ $opt_summary = "true" ] && exitWithErrMsg "Switches -f|--full and -g|--short are mutually exclusive. Aborting."
  1670.  
  1671. # --cvelist-file mode is standalone mode and is not applicable when one of -k | -u | -p | --checksec switches are set
  1672. if [ "$opt_cvelist_file" = "true" ]; then
  1673. [ ! -e "$CVELIST_FILE" ] && exitWithErrMsg "Provided CVE list file does not exists. Aborting."
  1674. [ "$opt_kernel_version" = "true" ] && exitWithErrMsg "Switches -k|--kernel and --cvelist-file are mutually exclusive. Aborting."
  1675. [ "$opt_uname_string" = "true" ] && exitWithErrMsg "Switches -u|--uname and --cvelist-file are mutually exclusive. Aborting."
  1676. [ "$opt_pkglist_file" = "true" ] && exitWithErrMsg "Switches -p|--pkglist-file and --cvelist-file are mutually exclusive. Aborting."
  1677. fi
  1678.  
  1679. # --checksec mode is standalone mode and is not applicable when one of -k | -u | -p | --cvelist-file switches are set
  1680. if [ "$opt_checksec_mode" = "true" ]; then
  1681. [ "$opt_kernel_version" = "true" ] && exitWithErrMsg "Switches -k|--kernel and --checksec are mutually exclusive. Aborting."
  1682. [ "$opt_uname_string" = "true" ] && exitWithErrMsg "Switches -u|--uname and --checksec are mutually exclusive. Aborting."
  1683. [ "$opt_pkglist_file" = "true" ] && exitWithErrMsg "Switches -p|--pkglist-file and --checksec are mutually exclusive. Aborting."
  1684. fi
  1685.  
  1686. # extract kernel version and other OS info like distro name, distro version, etc. 3 possibilities here:
  1687. # case 1: --kernel set
  1688. if [ "$opt_kernel_version" == "true" ]; then
  1689. # TODO: add kernel version number validation
  1690. [ -z "$KERNEL" ] && exitWithErrMsg "Unrecognized kernel version given. Aborting."
  1691. ARCH=""
  1692. OS=""
  1693.  
  1694. # do not perform additional checks on current machine
  1695. opt_skip_more_checks=true
  1696.  
  1697. # do not consider current OS
  1698. getPkgList "" "$PKGLIST_FILE"
  1699.  
  1700. # case 2: --uname set
  1701. elif [ "$opt_uname_string" == "true" ]; then
  1702. [ -z "$UNAME_A" ] && exitWithErrMsg "uname string empty. Aborting."
  1703. parseUname "$UNAME_A"
  1704.  
  1705. # do not perform additional checks on current machine
  1706. opt_skip_more_checks=true
  1707.  
  1708. # do not consider current OS
  1709. getPkgList "" "$PKGLIST_FILE"
  1710.  
  1711. # case 3: --cvelist-file mode
  1712. elif [ "$opt_cvelist_file" = "true" ]; then
  1713.  
  1714. # get kernel configuration in this mode
  1715. [ "$opt_skip_more_checks" = "false" ] && getKernelConfig
  1716.  
  1717. # case 4: --checksec mode
  1718. elif [ "$opt_checksec_mode" = "true" ]; then
  1719.  
  1720. # this switch is not applicable in this mode
  1721. opt_skip_more_checks=false
  1722.  
  1723. # get kernel configuration in this mode
  1724. getKernelConfig
  1725. [ -z "$KCONFIG" ] && exitWithErrMsg "Kernel configuration file not available. Aborting."
  1726.  
  1727. # launch checksec mode
  1728. checksecMode
  1729.  
  1730. exit 0
  1731.  
  1732. # case 5: no --uname | --kernel | --cvelist-file | --checksec set
  1733. else
  1734.  
  1735. # --pkglist-file NOT provided: take all info from current machine
  1736. # case for vanilla execution: ./linux-exploit-suggester.sh
  1737. if [ "$opt_pkglist_file" == "false" ]; then
  1738. UNAME_A=$(uname -a)
  1739. [ -z "$UNAME_A" ] && exitWithErrMsg "uname string empty. Aborting."
  1740. parseUname "$UNAME_A"
  1741.  
  1742. # get kernel configuration in this mode
  1743. [ "$opt_skip_more_checks" = "false" ] && getKernelConfig
  1744.  
  1745. # extract distribution version from /etc/issue
  1746. [ -n "$OS" -a "$opt_skip_more_checks" = "false" ] && DISTRO=$(cat /etc/issue | grep -E -o '[0-9\.]+' | head -1)
  1747.  
  1748. # extract package listing from current OS
  1749. getPkgList "$OS" ""
  1750.  
  1751. # --pkglist-file provided: only consider userspace exploits against provided package listing
  1752. else
  1753. KERNEL=""
  1754. #TODO: extract machine arch from package listing
  1755. ARCH=""
  1756. unset EXPLOITS
  1757. declare -A EXPLOITS
  1758. getPkgList "" "$PKGLIST_FILE"
  1759.  
  1760. # additional checks are not applicable for this mode
  1761. opt_skip_more_checks=true
  1762. fi
  1763. fi
  1764.  
  1765. echo
  1766. echo -e "${bldwht}Available information:${txtrst}"
  1767. echo
  1768. [ -n "$KERNEL" ] && echo -e "Kernel version: ${txtgrn}$KERNEL${txtrst}" || echo -e "Kernel version: ${txtred}N/A${txtrst}"
  1769. echo "Architecture: $([ -n "$ARCH" ] && echo -e "${txtgrn}$ARCH${txtrst}" || echo -e "${txtred}N/A${txtrst}")"
  1770. echo "Distribution: $([ -n "$OS" ] && echo -e "${txtgrn}$OS${txtrst}" || echo -e "${txtred}N/A${txtrst}")"
  1771. echo -e "Distribution version: $([ -n "$DISTRO" ] && echo -e "${txtgrn}$DISTRO${txtrst}" || echo -e "${txtred}N/A${txtrst}")"
  1772.  
  1773. echo "Additional checks (CONFIG_*, sysctl entries, custom Bash commands): $([ "$opt_skip_more_checks" == "false" ] && echo -e "${txtgrn}performed${txtrst}" || echo -e "${txtred}N/A${txtrst}")"
  1774.  
  1775. if [ -n "$PKGLIST_FILE" -a -n "$PKG_LIST" ]; then
  1776. pkgListFile="${txtgrn}$PKGLIST_FILE${txtrst}"
  1777. elif [ -n "$PKGLIST_FILE" ]; then
  1778. pkgListFile="${txtred}unrecognized file provided${txtrst}"
  1779. elif [ -n "$PKG_LIST" ]; then
  1780. pkgListFile="${txtgrn}from current OS${txtrst}"
  1781. fi
  1782.  
  1783. echo -e "Package listing: $([ -n "$pkgListFile" ] && echo -e "$pkgListFile" || echo -e "${txtred}N/A${txtrst}")"
  1784.  
  1785. # handle --kernelspacy-only & --userspace-only filter options
  1786. if [ "$opt_kernel_only" = "true" -o -z "$PKG_LIST" ]; then
  1787. unset EXPLOITS_USERSPACE
  1788. declare -A EXPLOITS_USERSPACE
  1789. fi
  1790.  
  1791. if [ "$opt_userspace_only" = "true" ]; then
  1792. unset EXPLOITS
  1793. declare -A EXPLOITS
  1794. fi
  1795.  
  1796. echo
  1797. echo -e "${bldwht}Searching among:${txtrst}"
  1798. echo
  1799. echo "${#EXPLOITS[@]} kernel space exploits"
  1800. echo "${#EXPLOITS_USERSPACE[@]} user space exploits"
  1801. echo
  1802.  
  1803. echo -e "${bldwht}Possible Exploits:${txtrst}"
  1804. echo
  1805.  
  1806. # start analysis
  1807. for EXP in "${EXPLOITS[@]}" "${EXPLOITS_USERSPACE[@]}"; do
  1808.  
  1809. # create array from current exploit here doc and fetch needed lines
  1810. i=0
  1811. # ('-r' is used to not interpret backslash used for bash colors)
  1812. while read -r line
  1813. do
  1814. arr[i]="$line"
  1815. i=$((i + 1))
  1816. done <<< "$EXP"
  1817.  
  1818. REQS="${arr[1]}" && REQS="${REQS:6}"
  1819. NAME="${arr[0]}" && NAME="${NAME:6}"
  1820. TAGS="${arr[2]}" && TAGS="${TAGS:6}"
  1821.  
  1822. # split line with requirements & loop thru all reqs one by one & check whether it is met
  1823. IFS=',' read -r -a array <<< "$REQS"
  1824. REQS_NUM=${#array[@]}
  1825. PASSED_REQ=0
  1826. for REQ in "${array[@]}"; do
  1827. if (checkRequirement "$REQ" "${array[0]}"); then
  1828. PASSED_REQ=$(($PASSED_REQ + 1))
  1829. else
  1830. break
  1831. fi
  1832. done
  1833.  
  1834. # execute for exploits with all requirements met
  1835. if [ $PASSED_REQ -eq $REQS_NUM ]; then
  1836.  
  1837. # additional requirement for --cvelist-file mode: check if CVE associated with the exploit is on the CVELIST_FILE
  1838. if [ "$opt_cvelist_file" = "true" ]; then
  1839.  
  1840. # extract CVE(s) associated with given exploit (also translates ',' to '|' for easy handling multiple CVEs case - via extended regex)
  1841. cve=$(echo "$NAME" | grep '.*\[.*\].*' | cut -d 'm' -f2 | cut -d ']' -f1 | tr -d '[' | tr "," "|")
  1842. #echo "CVE: $cve"
  1843.  
  1844. # check if it's on CVELIST_FILE list, if no move to next exploit
  1845. [ ! $(cat "$CVELIST_FILE" | grep -E "$cve") ] && continue
  1846. fi
  1847.  
  1848. # process tags and highlight those that match current OS (only for deb|ubuntu|RHEL and if we know distro version - direct mode)
  1849. tags=""
  1850. if [ -n "$TAGS" -a -n "$OS" -a -n "$DISTRO" ]; then
  1851. IFS=',' read -r -a tags_array <<< "$TAGS"
  1852. TAGS_NUM=${#tags_array[@]}
  1853. for TAG in "${tags_array[@]}"; do
  1854. tag_distro=$(echo "$TAG" | cut -d'=' -f1)
  1855. tag_distro_num_all=$(echo "$TAG" | cut -d'=' -f2)
  1856. # in case of tag of form: 'ubuntu=16.04{kernel:4.4.0-21} remove kernel versioning part for comparision
  1857. tag_distro_num="${tag_distro_num_all%{*}"
  1858.  
  1859. # if distro matches:
  1860. if [ "$OS" == "$tag_distro" -a "$(echo "$DISTRO" | grep -E "$tag_distro_num")" ]; then
  1861.  
  1862. # get name (kernel or package name) and version of kernel/pkg if provided:
  1863. tag_pkg=$(echo "$tag_distro_num_all" | cut -d'{' -f 2 | tr -d '}' | cut -d':' -f 1)
  1864. tag_pkg_num=""
  1865. [ $(echo "$tag_distro_num_all" | grep '{') ] && tag_pkg_num=$(echo "$tag_distro_num_all" | cut -d'{' -f 2 | tr -d '}' | cut -d':' -f 2)
  1866.  
  1867. #[ -n "$tag_pkg_num" ] && echo "tag_pkg_num: $tag_pkg_num; kernel: $KERNEL_ALL"
  1868.  
  1869. # if pkg/kernel version is not provided:
  1870. if [ -z "$tag_pkg_num" ]; then
  1871. TAG="${lightyellow}[ ${TAG} ]${txtrst}"
  1872.  
  1873. # kernel version provided, check for match:
  1874. elif [ -n "$tag_pkg_num" -a "$tag_pkg" = "kernel" ]; then
  1875. [ $(echo "$KERNEL_ALL" | grep -E "${tag_pkg_num}") ] && TAG="${yellow}[ ${TAG} ]${txtrst}" || TAG="${lightyellow}[ $tag_distro=$tag_distro_num ]${txtrst}{kernel:$tag_pkg_num}"
  1876.  
  1877. # pkg version provided, check for match (TBD):
  1878. elif [ -n "$tag_pkg_num" -a -n "$tag_pkg" ]; then
  1879. TAG="${lightyellow}[ $tag_distro=$tag_distro_num ]${txtrst}{$tag_pkg:$tag_pkg_num}"
  1880. fi
  1881.  
  1882. fi
  1883.  
  1884. # append current tag to tags list
  1885. tags="${tags}${TAG},"
  1886. done
  1887. # trim ',' added by above loop
  1888. [ -n "$tags" ] && tags="${tags%?}"
  1889. else
  1890. tags="$TAGS"
  1891. fi
  1892.  
  1893. EXPLOIT_DB=$(echo "$EXP" | grep "exploit-db: " | awk '{print $2}')
  1894. analysis_url=$(echo "$EXP" | grep "analysis-url: " | awk '{print $2}')
  1895. ext_url=$(echo "$EXP" | grep "ext-url: " | awk '{print $2}')
  1896. comments=$(echo "$EXP" | grep "Comments: " | cut -d' ' -f 2-)
  1897. reqs=$(echo "$EXP" | grep "Reqs: " | cut -d' ' -f 2)
  1898.  
  1899. # exploit name without CVE number and without commonly used special chars
  1900. name=$(echo "$NAME" | cut -d' ' -f 2- | tr -d ' ()/')
  1901.  
  1902. src_url=$(echo "$EXP" | grep "src-url: " | awk '{print $2}')
  1903. [ -z "$src_url" ] && [ -n "$EXPLOIT_DB" ] && src_url="https://www.exploit-db.com/download/$EXPLOIT_DB"
  1904. [ -z "$src_url" ] && exitWithErrMsg "Both 'src-url' and 'exploit-db' entries are empty for '$NAME' exploit - fix that. Aborting."
  1905.  
  1906. if [ -n "$analysis_url" ]; then
  1907. details="$analysis_url"
  1908. elif $(echo "$src_url" | grep -q 'www.exploit-db.com'); then
  1909. details="https://www.exploit-db.com/exploits/$EXPLOIT_DB/"
  1910. elif [[ "$src_url" =~ ^.*tgz|tar.gz|zip$ && -n "$EXPLOIT_DB" ]]; then
  1911. details="https://www.exploit-db.com/exploits/$EXPLOIT_DB/"
  1912. else
  1913. details="$src_url"
  1914. fi
  1915.  
  1916. # skip DoS by default
  1917. dos=$(echo "$EXP" | grep -o -i "(dos")
  1918. [ "$opt_show_dos" == "false" ] && [ -n "$dos" ] && continue
  1919.  
  1920. # handles --fetch-binaries option
  1921. if [ $opt_fetch_bins = "true" ]; then
  1922. for i in $(echo "$EXP" | grep "bin-url: " | awk '{print $2}'); do
  1923. [ -f "${name}_$(basename $i)" ] && rm -f "${name}_$(basename $i)"
  1924. wget -q -k "$i" -O "${name}_$(basename $i)"
  1925. done
  1926. fi
  1927.  
  1928. # handles --fetch-sources option
  1929. if [ $opt_fetch_srcs = "true" ]; then
  1930. [ -f "${name}_$(basename $src_url)" ] && rm -f "${name}_$(basename $src_url)"
  1931. wget -q -k "$src_url" -O "${name}_$(basename $src_url)" &
  1932. fi
  1933.  
  1934. # display result (short)
  1935. if [ "$opt_summary" = "true" ]; then
  1936. [ -z "$tags" ] && tags="-"
  1937. echo -e "$NAME || $tags || $src_url"
  1938. continue
  1939. fi
  1940.  
  1941. # display result (standard)
  1942. echo -e "[+] $NAME"
  1943. echo -e "\n Details: $details"
  1944. [ -n "$tags" ] && echo -e " Tags: $tags"
  1945. echo -e " Download URL: $src_url"
  1946. [ -n "$ext_url" ] && echo -e " ext-url: $ext_url"
  1947. [ -n "$comments" ] && echo -e " Comments: $comments"
  1948.  
  1949. # handles --full filter option
  1950. if [ "$opt_full" = "true" ]; then
  1951. [ -n "$reqs" ] && echo -e " Requirements: $reqs"
  1952.  
  1953. [ -n "$EXPLOIT_DB" ] && echo -e " exploit-db: $EXPLOIT_DB"
  1954.  
  1955. author=$(echo "$EXP" | grep "author: " | cut -d' ' -f 2-)
  1956. [ -n "$author" ] && echo -e " author: $author"
  1957. fi
  1958.  
  1959. echo
  1960. fi
  1961. done
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!