From af74cbb8d384dc3ac642c8c8f15939233bf48c0a Mon Sep 17 00:00:00 2001 From: Arnaud Rebillout Date: Mon, 7 Sep 2026 21:32:45 +0700 Subject: [PATCH] New upstream version 1.6+git20170904.00e0d54 --- CHANGELOG | 82 ++++++- unix-privesc-check | 539 ++++++++++++++++++++++++++++++++++++++------- 2 files changed, 531 insertions(+), 90 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 7926008..9018526 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,13 +1,79 @@ +2010-12-30 unix-privesc-check trunk + +* Bug fix: Cleaned up a typo +* Added support for fscaps +* Updated CHANGELOG + +-- Tim Brown + +2010-11-09 unix-privesc-check trunk + +* Bug fix: False positive if svn.simple directory is empty + +-- + +2010-11-04 unix-privesc-check trunk + +* Added unique issue numbers. Should help to generate reports + +-- + +2010-04-17 unix-privesc-check trunk + +* Bug fix: Now checks HP-UX swap permissions correctly +* Bug fix: Cleaned up a few typos + +-- Tim Brown + +2010-09-27 unix-privesc-check trunk + +* Added check for cleartext subversion passwords in home directory + +-- + +2010-01-06 unix-privesc-check trunk + +* Added support for exploit mitigations (HP-UX and Solaris) +* Checks if shadow and passwd are writable, thanks jdv +* Checks for SetUID shell scripts which might be racey +* Improved NX and SSP checks (Linux only) +* Bug fix: Cleaned up a few typos + +-- Tim Brown + +2009-09-23 unix-privesc-check trunk + +* Bug fix: Cron jobs starting with '(' parsed properly +* Checks perms on Java classpath + +-- + +2009-09-06 unix-privesc-check trunk + +* Added MMAP allows map to 0 exploit mitigation (Linux ATM) +* Added SELinux exploit mitigation (Linux only) + +-- Tim Brown + +2009-07-30 unix-privesc-check v1.5 + +* Initial AIX support added +* Check for exploit mitigations (Linux only ATM) +* Brain dumped some more interesting things to check for into TODOs +* Bug fix: Fixed typos in comments +* Added SSP exploit mitigation (Linux only ATM) + +-- Tim Brown 2008-11-23 unix-privesc-check v1.4 -* Added check of file perms of shared libraries used by SUID programs. -* Tidied output slightly. +* Added check of file perms of shared libraries used by SUID programs +* Tidied output slightly 2008-11-09 unix-privesc-check v1.3 * Bug fix: Parts of the script only worked with /bin/bash and not /bin/sh -* Bug fix: Fixed typos in reporting for privescs via cron. +* Bug fix: Fixed typos in reporting for privescs via cron 2008-07-06 unix-privesc-check v1.2 @@ -19,9 +85,9 @@ should now be on one line so you can grep for 'WARNING' and still understand the results * Check of file perms on open file handles of running processes -* Check for running SSH agent. Lists keys if possible. -* Check for public and private SSH keys in home directories. -* Check for running GPG agent. +* Check for running SSH agent. Lists keys if possible +* Check for public and private SSH keys in home directories +* Check for running GPG agent * Check for cron jobs in /var/spool/cron/tabs * Extra non-priv check for local postgres trusts * Bug fix: lanscan now used on HPUX to get interface names @@ -30,8 +96,8 @@ 2008-04-17 unix-privesc-check v1.1 -* Added check for accounts with no password in /etc/passwd -* Record some basic info about the host (hostname, uname -a, interface IPs) +* Added check for accounts with no password in /etc/passwd +* Record some basic info about the host (hostname, uname -a, interface IPs) 2008-02-01 unix-privesc-check v1.0 diff --git a/unix-privesc-check b/unix-privesc-check index b4bfc80..c5942ee 100755 --- a/unix-privesc-check +++ b/unix-privesc-check @@ -1,6 +1,7 @@ #!/bin/sh # unix-privesc-check - Checks Unix system for simple privilege escalations # Copyright (C) 2008 pentestmonkey@pentestmonkey.net +# Copyright (C) 2009 timb@nth-dimension.org.uk # # # License @@ -34,9 +35,9 @@ # Auditing tool to check for weak file permissions and other problems that # may allow local attackers to escalate privileges. # -# It is intended to be run by security auditors and pentetration testers +# It is intended to be run by security auditors and penetration testers # against systems they have been engaged to assess, and also by system -# admnisitrators who want to check for "obvious" misconfigurations. It +# administrators who want to check for "obvious" misconfigurations. It # can even be run as a cron job so you can check regularly for misconfigurations # that might be introduced. # @@ -52,13 +53,17 @@ # - Check /proc/pid/cmdline for absolute path names. Check security of these (e.g. /etc/snmp/snmpd.conf) # - Check everything in root's path - how to find root's path? # - /proc/pid/maps, smaps are readable and lists some shared objects. We should check these. +# - We should also check whether libraries are in writable address space +# - AIX/Solaris executable stack +# - Is firewall DMA enabled? +# - Loadable kernel modules? # - /proc/pid/fd contain symlinks to all open files (but you can't see other people FDs) # - check for trust relationships in /etc/hosts.equiv # - NFS imports / exports / automounter # - Insecure stuff in /etc/fstab (e.g. allowing users to mount file systems) # - Inspecting people's PATH. tricky. maybe read from /proc/pid/environ, .bashrc, /etc/profile, .bash_profile # - Check if /etc/init.d/* scripts are readable. Advise user to audit them if they are. -# - .exrc? +# - .exrc? (partial support added) # - X11 trusts, apache passwd files, mysql trusts? # - Daemons configured in an insecure way: tftpd, sadmind, rexd # - World writable dirs aren't as bad if the sticky bit is set. Check for this before reporting vulns. @@ -66,6 +71,7 @@ # - Do a better job of parsing cron lines - search for full paths # - Maybe LDPATHs from /etc/env.d # - Check if ldd, ld.so.conf changes have broken this script on non-linux systems. +# - ld.so.conf has an equivelent at least on Solaris # - Avoid check certain paths e.g. /-/_ clearly isn't a real directory. # - create some sort of readable report # - indicate when it's likely a result is a false positive and when it's not. @@ -77,10 +83,19 @@ # - We check some files / dirs multiple times. Slow. Can we implement a cache? # - grep for PRIVATE KEY to find private ssh and ssl keys. Where to grep? # - check SGID programs +# - Get rid of the awk, command-to-parse-output-from | while read parta partb partc is much better +# - HPUX TCB? +# - caps on processes -VERSION="1.4" -HOME_DIR_FILES=".netrc .ssh/id_rsa .ssh/id_dsa .rhosts .shosts .my.cnf .ssh/authorized_keys .bash_history .sh_history .forward" -CONFIG_FILES="/etc/passwd /etc/group /etc/master.passwd /etc/inittab /etc/inetd.conf /etc/xinetd.con /etc/xinetd.d/* /etc/contab /etc/fstab /etc/profile /etc/sudoers" +VERSION="1.6" +SVNVERSION="$Revision$" # Don't change this line. Auto-updated. +SVNVNUM=`echo $SVNVERSION | sed 's/[^0-9]//g'` +if [ -n $SVNVNUM ]; then + VERSION="$VERSION-svn-$SVNVNUM" +fi + +HOME_DIR_FILES=".exrc .netrc .ssh/id_rsa .ssh/id_dsa .rhosts .shosts .my.cnf .ssh/authorized_keys .bash_history .sh_history .forward" +CONFIG_FILES="/etc/passwd /etc/group /etc/master.passwd /etc/inittab /etc/inetd.conf /etc/xinetd.conf /etc/xinetd.d/* /etc/crontab /etc/fstab /etc/profile /etc/sudoers /etc/hosts.equiv /etc/shosts.equiv" PGDIRS="/usr/local/pgsql/data ~postgres/postgresql/data ~postgres/data ~pgsql/data ~pgsql/pgsql/data /var/lib/postgresql/data /etc/postgresql/8.2/main /var/lib/pgsql/data" get_owner () { @@ -159,7 +174,11 @@ check_called_programs () { # Check if file is text or not IS_TEXT=`file "$CCP_FILE" | grep -i text` - IS_DYNBIN=`file "$CCP_FILE" | grep -i 'dynamically linked'` + if [ $OS = "aix" ]; then + IS_DYNBIN=`file "$CCP_FILE" | grep -i 'object module'` + else + IS_DYNBIN=`file "$CCP_FILE" | grep -i 'dynamically linked'` + fi # Process shell scripts (would also work on config files that reference other files) if [ ! -z "$IS_TEXT" ]; then @@ -173,7 +192,7 @@ check_called_programs () { # Process dynamically linked binaries if [ ! -z "$IS_DYNBIN" ]; then - CALLED_FILES=`ldd "$CCP_FILE" 2>/dev/null | grep '/' | sed 's/[^\/]*\//\//' | cut -f 1 -d ' '` + CALLED_FILES=`ldd "$CCP_FILE" 2>/dev/null | grep '/' | sed 's/[^\/]*\//\//' | cut -f 1 -d ' ' | cut -f 1 -d '('` for CALLED_FILE in $CALLED_FILES; do check_perms "$CCP_MESSAGE_STACK $CCP_FILE uses the library $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" done @@ -187,6 +206,24 @@ check_called_programs () { fi } +# Parse any full paths from $1 (config files, progs, dirs). +# Check the permissions on each of these. +check_called_programs_suid_sgid () { + CCP_FILE=$1 + + is_suid $CCP_FILE # sets $IS_SUID_RETURN + + if [ "$IS_SUID_RETURN" -eq 1 ]; then + check_called_programs_suid $CCP_FILE + fi + + is_sgid $CCP_FILE # sets $IS_SGID_RETURN + + if [ "$IS_SGID_RETURN" -eq 1 ]; then + check_called_programs_sgid $CCP_FILE + fi +} + # Parse any full paths from $1 (config files, progs, dirs). # Check the permissions on each of these. check_called_programs_suid () { @@ -216,7 +253,7 @@ check_called_programs_suid () { CALLED_FILES=`grep -v '^#' "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u` for CALLED_FILE in $CALLED_FILES; do # echo "$CCP_FILE contains a reference to $CALLED_FILE. Checking perms." - check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" + check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" root "$CCP_PATH" done else # Process dynamically linked binaries @@ -224,7 +261,7 @@ check_called_programs_suid () { CALLED_FILES=`ldd "$CCP_FILE" 2>/dev/null | grep '/' | sed 's/[^\/]*\//\//' | cut -f 1 -d ' '` for CALLED_FILE in $CALLED_FILES; do - check_perms "$CCP_MESSAGE_STACK $CCP_FILE uses the library $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" + check_perms "$CCP_MESSAGE_STACK $CCP_FILE uses the library $CALLED_FILE." "$CALLED_FILE" root "$CCP_PATH" done # Skip the slow check if we're in quick mode @@ -235,20 +272,127 @@ check_called_programs_suid () { # Strings binary to look for hard-coded config files # or other programs that might be called. for CALLED_FILE in `strings "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u`; do - check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" + check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" root "$CCP_PATH" done fi fi } -# Check if $1 can be changed by users who are not $2 +# Parse any full paths from $1 (config files, progs, dirs). +# Check the permissions on each of these. +check_called_programs_sgid () { + CCP_FILE=$1 + CCP_PATH=$2 # optional + + get_group $CCP_FILE; CCP_GROUP=$GET_GROUP_RETURN + CCP_MESSAGE_STACK="$CCP_FILE is SGID $CCP_GROUP." + LS=`ls -l $CCP_FILE` + echo "Checking SGID-$CCP_GROUP program $CCP_FILE: $LS" + + # Don't check perms of executable itself + # check_perms "$CCP_MESSAGE_STACK" "$CCP_FILE" "$CCP_USER" "$CCP_PATH" + + # Check if file is text or not + IS_TEXT=`file "$CCP_FILE" | grep -i text` + IS_DYNBIN=`file "$CCP_FILE" | grep -i 'dynamically linked'` + + # Process shell scripts (would also work on config files that reference other files) + if [ ! -z "$IS_TEXT" ]; then + # Skip the slow check if we're in quick mode + if [ "$MODE" = "standard" ]; then + return 0; + fi + + # Parse full paths from file - ignoring commented lines + CALLED_FILES=`grep -v '^#' "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u` + for CALLED_FILE in $CALLED_FILES; do + # echo "$CCP_FILE contains a reference to $CALLED_FILE. Checking perms." + check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" root "$CCP_PATH" + done + else + # Process dynamically linked binaries + if [ ! -z "$IS_DYNBIN" ]; then + + CALLED_FILES=`ldd "$CCP_FILE" 2>/dev/null | grep '/' | sed 's/[^\/]*\//\//' | cut -f 1 -d ' '` + for CALLED_FILE in $CALLED_FILES; do + check_perms "$CCP_MESSAGE_STACK $CCP_FILE uses the library $CALLED_FILE." "$CALLED_FILE" root "$CCP_PATH" + done + + # Skip the slow check if we're in quick mode + if [ "$MODE" = "standard" ]; then + return 0; + fi + + # Strings binary to look for hard-coded config files + # or other programs that might be called. + for CALLED_FILE in `strings "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u`; do + check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" root "$CCP_PATH" + done + fi + fi +} + +# Parse any full paths from $1 (config files, progs, dirs). +# Check the permissions on each of these. +check_called_programs_fscaps () { + CCP_FILE=$1 + CCP_PATH=$2 # optional + + CCP_MESSAGE_STACK="$CCP_FILE has fscaps." + LS=`ls -l $CCP_FILE` + echo "Checking fscaps program $CCP_FILE: $LS" + + # Don't check perms of executable itself + # check_perms "$CCP_MESSAGE_STACK" "$CCP_FILE" "$CCP_PATH" + + # Check if file is text or not + IS_TEXT=`file "$CCP_FILE" | grep -i text` + IS_DYNBIN=`file "$CCP_FILE" | grep -i 'dynamically linked'` + + # Process shell scripts (would also work on config files that reference other files) + if [ ! -z "$IS_TEXT" ]; then + # Skip the slow check if we're in quick mode + if [ "$MODE" = "standard" ]; then + return 0; + fi + + # Parse full paths from file - ignoring commented lines + CALLED_FILES=`grep -v '^#' "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u` + for CALLED_FILE in $CALLED_FILES; do + # echo "$CCP_FILE contains a reference to $CALLED_FILE. Checking perms." + check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "root" "$CCP_PATH" + done + else + # Process dynamically linked binaries + if [ ! -z "$IS_DYNBIN" ]; then + + CALLED_FILES=`ldd "$CCP_FILE" 2>/dev/null | grep '/' | sed 's/[^\/]*\//\//' | cut -f 1 -d ' '` + for CALLED_FILE in $CALLED_FILES; do + check_perms "$CCP_MESSAGE_STACK $CCP_FILE uses the library $CALLED_FILE." "$CALLED_FILE" "root" "$CCP_PATH" + done + + # Skip the slow check if we're in quick mode + if [ "$MODE" = "standard" ]; then + return 0; + fi + + # Strings binary to look for hard-coded config files + # or other programs that might be called. + for CALLED_FILE in `strings "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u`; do + check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "root" "$CCP_PATH" + done + fi + fi +} + +# Check if $2 can be changed by users who are not $3 check_perms () { CP_MESSAGE_STACK=$1 CHECK_PERMS_FILE=$2 CHECK_PERMS_USER=$3 CHECK_PERMS_PATH=$4 # optional - if [ ! -f "$CHECK_PERMS_FILE" ] && [ ! -d "$CHECK_PERMS_FILE" ] && [ ! -b "$CHECK_PERMS_FILE" ]; then + if [ ! -f "$CHECK_PERMS_FILE" ] && [ ! -d "$CHECK_PERMS_FILE" ] && [ ! -b "$CHECK_PERMS_FILE" ] && [ ! -c "$CHECK_PERMS_FILE" ]; then CHECK_PERMS_FOUND=0 if [ ! -z "$CHECK_PERMS_PATH" ]; then # Look for it in the supplied path @@ -287,7 +431,7 @@ check_read_perms () { CHECK_PERMS_FILE=$2 CHECK_PERMS_USER=$3 - if [ ! -f "$CHECK_PERMS_FILE" ] && [ ! -b "$CHECK_PERMS_FILE" ]; then + if [ ! -f "$CHECK_PERMS_FILE" ] && [ ! -b "$CHECK_PERMS_FILE" ] && [ ! -c "$CHECK_PERMS_FILE" ]; then echo "ERROR: File $CHECK_PERMS_FILE doesn't exist" return 0 fi @@ -302,7 +446,7 @@ perms_secure_read () { PERMS_SECURE_FILE=$2 PERMS_SECURE_USER=$3 - if [ ! -b "$PERMS_SECURE_FILE" ] && [ ! -f "$PERMS_SECURE_FILE" ] && [ ! -d "$PERMS_SECURE_FILE" ]; then + if [ ! -b "$PERMS_SECURE_FILE" ] && [ ! -f "$PERMS_SECURE_FILE" ] && [ ! -d "$PERMS_SECURE_FILE" ] && [ ! -c "$PERMS_SECURE_FILE" ]; then echo "ERROR: No such file or directory: $PERMS_SECURE_FILE. Skipping." return 0 fi @@ -322,7 +466,7 @@ perms_secure () { PERMS_SECURE_FILE=$2 PERMS_SECURE_USER=$3 - if [ ! -d "$PERMS_SECURE_FILE" ] && [ ! -f "$PERMS_SECURE_FILE" ] && [ ! -b "$PERMS_SECURE_FILE" ]; then + if [ ! -d "$PERMS_SECURE_FILE" ] && [ ! -f "$PERMS_SECURE_FILE" ] && [ ! -b "$PERMS_SECURE_FILE" ] && [ ! -c "$PERMS_SECURE_FILE" ]; then # echo "ERROR: No such file or directory: $PERMS_SECURE_FILE. Skipping." return 0 fi @@ -346,7 +490,7 @@ only_user_can_write () { # can always grant themselves write access get_owner $O_FILE; O_FILE_USER=$GET_OWNER_RETURN if [ ! "$O_USER" = "$O_FILE_USER" ] && [ ! "$O_FILE_USER" = "root" ]; then - echo "WARNING: $O_MESSAGE_STACK The user $O_FILE_USER can write to $O_FILE" + echo "[UPC001] WARNING: $O_MESSAGE_STACK The user $O_FILE_USER can write to $O_FILE" fi } @@ -361,11 +505,33 @@ group_can_write () { # check the group actually has some members other than $O_USER group_has_other_members "$O_FILE_GROUP" "$O_USER"; # sets OTHER_MEMBERS to 1 or 0 if [ "$OTHER_MEMBERS" = "1" ]; then - echo "WARNING: $O_MESSAGE_STACK The group $O_FILE_GROUP can write to $O_FILE" + echo "[UPC002] WARNING: $O_MESSAGE_STACK The group $O_FILE_GROUP can write to $O_FILE" fi fi } +is_suid () { + O_FILE=$1 + + P=`ls -lLd $O_FILE | cut -c 4` + if [ "$P" = "s" ]; then + IS_SUID_RETURN=1 + else + IS_SUID_RETURN=0 + fi +} + +is_sgid () { + O_FILE=$1 + + P=`ls -lLd $O_FILE | cut -c 7` + if [ "$P" = "s" ]; then + IS_SGID_RETURN=1 + else + IS_SGID_RETURN=0 + fi +} + group_has_other_members () { G_GROUP=$1 G_USER=$2 @@ -410,9 +576,9 @@ world_can_write () { if [ "$P" = "w" ]; then if [ "$S" = "t" ]; then - echo "WARNING: $O_MESSAGE_STACK World write is set for $O_FILE (but sticky bit set)" + echo "[UPC003] WARNING: $O_MESSAGE_STACK World write is set for $O_FILE (but sticky bit set)" else - echo "WARNING: $O_MESSAGE_STACK World write is set for $O_FILE" + echo "[UPC004] WARNING: $O_MESSAGE_STACK World write is set for $O_FILE" fi fi } @@ -426,7 +592,7 @@ only_user_can_read () { # can always grant themselves read access get_owner $O_FILE; O_FILE_USER=$GET_OWNER_RETURN if [ ! "$O_USER" = "$O_FILE_USER" ] && [ ! "$O_FILE_USER" = "root" ]; then - echo "WARNING: $O_MESSAGE_STACK The user $O_FILE_USER can read $O_FILE" + echo "[UPC005] WARNING: $O_MESSAGE_STACK The user $O_FILE_USER can read $O_FILE" fi } @@ -441,7 +607,7 @@ group_can_read () { # check the group actually has some members other than $O_USER group_has_other_members "$O_FILE_GROUP" "$O_USER"; # sets OTHER_MEMBERS to 1 or 0 if [ "$OTHER_MEMBERS" = "1" ]; then - echo "WARNING: $O_MESSAGE_STACK The group $O_FILE_GROUP can read $O_FILE" + echo "[UPC006] WARNING: $O_MESSAGE_STACK The group $O_FILE_GROUP can read $O_FILE" fi fi } @@ -453,7 +619,7 @@ world_can_read () { P=`ls -lLd $O_FILE | cut -c 8` if [ "$P" = "w" ]; then - echo "WARNING: $O_MESSAGE_STACK World read is set for $O_FILE" + echo "[UPC007] WARNING: $O_MESSAGE_STACK World read is set for $O_FILE" fi } @@ -474,6 +640,9 @@ elif [ -x /usr/sbin/sam -o -x /usr/bin/sam ]; then elif [ -f /etc/master.passwd ]; then OS="bsd" SHADOW="/etc/master.passwd" +elif [ -f /etc/security/user ]; then + OS="aix" + SHADOW="/etc/security/passwd" else OS="linux" SHADOW="/etc/shadow" @@ -504,7 +673,7 @@ section "Recording uname" uname -a section "Recording Interface IP addresses" -if [ $OS = 'hpux' ]; then +if [ "$OS" = "hpux" ]; then for IFACE in `lanscan | grep x | awk '{print $5}' 2>/dev/null`; do ifconfig $IFACE 2>/dev/null done @@ -515,31 +684,58 @@ fi section "Checking if external authentication is allowed in /etc/passwd" FLAG=`grep '^+:' /etc/passwd` if [ -n "$FLAG" ]; then - echo "WARNING: /etc/passwd allows external authentcation:" - grep '^+:' /etc/passwd + echo "[UPC008] WARNING: /etc/passwd allows external authentcation:" + grep '^+' /etc/passwd EXT_AUTH=1 else echo "No +:... line found in /etc/passwd" fi -section "Checking nsswitch.conf for addition authentication methods" -if [ -r "/etc/nsswitch.conf" ]; then - NIS=`grep '^passwd' /etc/nsswitch.conf | grep 'nis'` - if [ -n "$NIS" ]; then - echo "WARNING: NIS is used for authentication on this system" - EXT_AUTH=1 - fi - LDAP=`grep '^passwd' /etc/nsswitch.conf | grep 'ldap'` - if [ -n "$LDAP" ]; then - echo "WARNING: LDAP is used for authentication on this system" - EXT_AUTH=1 - fi - - if [ -z "$NIS" ] && [ -z "$LDAP" ]; then - echo "Neither LDAP nor NIS are used for authentication" +section "Checking nsswitch.conf/netsvc.conf for addition authentication methods" +if [ "$OS" = "aix" ]; then + if [ -r "/etc/netsvc.conf" ]; then + # ldap_nis Uses LDAP NIS services for resolving names + # nis4 Uses NIS services for resolving only IPv4 addresses + # nis6 Uses NIS services for resolving only IPv6 addresses + # nis+4 Uses NIS plus services for resolving only IPv4 addresses + # nis+6 Uses NIS plus services for resolving only IPv6 addresses + # ldap4 Uses LDAP services for resolving only IPv4 addresses + # ldap6 Uses LDAP services for resolving only IPv6 addresses + # ldap_nis4 Uses NIS LDAP services for resolving only IPv4 addresses + # ldap_nis6 Uses NIS LDAP services for resolving only IPv6 addresses + # ldap Uses LDAP services for resolving names + NIS=`grep '^host' /etc/netsvc.conf | grep 'nis'` + if [ -n "$NIS" ]; then + echo "[UPC009] WARNING: NIS is used for authentication on this system" + EXT_AUTH=1 + fi + LDAP=`grep '^host' /etc/netsvc.conf | grep 'ldap'` + if [ -n "$LDAP" ]; then + echo "[UPC010] WARNING: LDAP is used for authentication on this system" + EXT_AUTH=1 + fi + else + echo "ERROR: File /etc/netsvc.conf isn't readable. Skipping checks." fi else - echo "ERROR: File /etc/nsswitch.conf isn't readable. Skipping checks." + if [ -r "/etc/nsswitch.conf" ]; then + NIS=`grep '^passwd' /etc/nsswitch.conf | grep 'nis'` + if [ -n "$NIS" ]; then + echo "[UPC011] WARNING: NIS is used for authentication on this system" + EXT_AUTH=1 + fi + LDAP=`grep '^passwd' /etc/nsswitch.conf | grep 'ldap'` + if [ -n "$LDAP" ]; then + echo "[UPC012] WARNING: LDAP is used for authentication on this system" + EXT_AUTH=1 + fi + + if [ -z "$NIS" ] && [ -z "$LDAP" ]; then + echo "Neither LDAP nor NIS are used for authentication" + fi + else + echo "ERROR: File /etc/nsswitch.conf isn't readable. Skipping checks." + fi fi # Check important config files aren't writable @@ -551,13 +747,19 @@ for FILE in $CONFIG_FILES; do done section "Checking if $SHADOW is readable" -check_read_perms "/etc/shadow holds authentication data" $SHADOW root +check_read_perms "$SHADOW holds authentication data" $SHADOW root + +section "Checking if $SHADOW is writable" +check_perms "$SHADOW can be written to" $SHADOW root + +section "Checking if /etc/passwd is writable" +check_perms "/etc/passwd can be written to" /etc/passwd root section "Checking for password hashes in /etc/passwd" -FLAG=`grep -v '^[^:]*:[x\*]*:' /etc/passwd | grep -v '^#'` +FLAG=`grep -v '^[^:]*:[!x\*]*:' /etc/passwd | grep -v '^#'` if [ -n "$FLAG" ]; then - echo "WARNING: There seem to be some password hashes in /etc/passwd" - grep -v '^[^:]*:[x\*]*:' /etc/passwd | grep -v '^#' + echo "[UPC013] WARNING: There seem to be some password hashes in /etc/passwd" + grep -v '^[^:]*:[!x\*]*:' /etc/passwd | grep -v '^#' EXT_AUTH=1 else echo "No password hashes found in /etc/passwd" @@ -569,7 +771,7 @@ section "Checking account settings" if [ -r "/etc/passwd" ]; then OPEN=`grep "^[^:][^:]*::" /etc/passwd | cut -f 1 -d ":"` if [ -n "$OPEN" ]; then - echo "WARNING: The following accounts have no password:" + echo "[UPC014] WARNING: The following accounts have no password:" grep "^[^:][^:]*::" /etc/passwd | cut -f 1 -d ":" fi fi @@ -581,7 +783,7 @@ if [ -r "$SHADOW" ]; then USER=`echo "$LINE" | awk '{print $1}'` STATUS=`echo "$LINE" | awk '{print $2}'` if [ "$STATUS" = "NP" ]; then - echo "WARNING: User $USER doesn't have a password" + echo "[UPC015] WARNING: User $USER doesn't have a password" fi done elif [ "$OS" = "solaris" ]; then @@ -590,7 +792,7 @@ if [ -r "$SHADOW" ]; then USER=`echo "$LINE" | awk '{print $1}'` STATUS=`echo "$LINE" | awk '{print $2}'` if [ "$STATUS" = "NP" ]; then - echo "WARNING: User $USER doesn't have a password" + echo "[UPC016] WARNING: User $USER doesn't have a password" fi done fi @@ -620,7 +822,7 @@ if [ -f "/etc/sudoers" ] && [ -r "/etc/sudoers" ]; then echo "Checking if sudo is configured" SUDO_USERS=`grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep -v '^[ \t]*Default' | grep =` if [ ! -z "$SUDO_USERS" ]; then - echo "WARNING: Sudo is configured. Manually check nothing unsafe is allowed:" + echo "[UPC017] WARNING: Sudo is configured. Manually check nothing unsafe is allowed:" grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep = | grep -v '^[ \t]*Default' fi @@ -628,7 +830,7 @@ if [ -f "/etc/sudoers" ] && [ -r "/etc/sudoers" ]; then echo "Checking sudo users need a password" SUDO_NOPASSWD=`grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep NOPASSWD` if [ ! -z "$SUDO_NOPASSWD" ]; then - echo "WARNING: Some users can use sudo without a password:" + echo "[UPC018] WARNING: Some users can use sudo without a password:" grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep NOPASSWD fi else @@ -636,10 +838,19 @@ else fi section "Checking permissions on swap file(s)" -for SWAP in `swapon -s | grep -v '^Filename' | cut -f 1 -d ' '`; do - check_perms "$SWAP is used for swap space." $SWAP root - check_read_perms "$SWAP is used for swap space." $SWAP root -done +if [ "$OS" = "hpux" ]; then + for SWAP in `swapinfo| grep -v '^dev' | awk '{print $9}'`; do + check_perms "$SWAP is used for swap space." $SWAP root + check_read_perms "$SWAP is used for swap space." $SWAP root + done +else + if [ "$OS" != "aix" ]; then + for SWAP in `swapon -s | grep -v '^Filename' | cut -f 1 -d ' '`; do + check_perms "$SWAP is used for swap space." $SWAP root + check_read_perms "$SWAP is used for swap space." $SWAP root + done + fi +fi section "Checking programs run from inittab" if [ -f "/etc/inittab" ] && [ -r "/etc/inittab" ]; then @@ -658,24 +869,24 @@ for DIR in $PGDIRS; do AUTH=`echo "$LINE" | awk '{print $NF}'` if [ "$AUTH" = "trust" ]; then PGTRUST=1 - echo "WARNING: Postgres trust configured in $DIR/pg_hba.conf: $LINE" + echo "[UPC019] WARNING: Postgres trust configured in $DIR/pg_hba.conf: $LINE" fi done fi done -PGVER1=`psql -U postgres template1 -c 'select version()' 2>/dev/null | grep version` +PGVER1=`psql -w -U postgres template1 -c 'select version()' 2>/dev/null | grep version` if [ -n "$PGVER1" ]; then PGTRUST=1 - echo "WARNING: Can connect to local postgres database as \"postgres\" without a password" + echo "[UPC020] WARNING: Can connect to local postgres database as \"postgres\" without a password" fi -PGVER2=`psql -U pgsql template1 -c 'select version()' 2>/dev/null | grep version` +PGVER2=`psql -w -U pgsql template1 -c 'select version()' 2>/dev/null | grep version` if [ -n "$PGVER2" ]; then PGTRUST=1 - echo "WARNING: Can connect to local postgres database as \"pgsql\" without a password" + echo "[UPC021] WARNING: Can connect to local postgres database as \"pgsql\" without a password" fi if [ -z "$PGTRUST" ]; then @@ -711,6 +922,12 @@ elif [ "$OS" = "solaris" ]; then check_perms "$DEVICE is a mounted file system." $DEVICE root fi done + + NFS=`mount -v | grep -i ' nfs '` + if [ -n "$NFS" ]; then + echo "[UPC022] WARNING: This system is an NFS client. Check for nosuid and nodev options." + mount -v | grep -i NFS + fi elif [ "$OS" = "hpux" ]; then mount | while read LINE do @@ -724,9 +941,15 @@ elif [ "$OS" = "hpux" ]; then NFS=`mount | grep NFS` if [ -n "$NFS" ]; then - echo "WARNING: This system is an NFS client. Check for nosuid and nodev options." + echo "[UPC022] WARNING: This system is an NFS client. Check for nosuid and nodev options." mount | grep NFS fi +elif [ "$OS" = "aix" ]; then + mount | grep jfs2 | while read DEVICE LINE + do + echo "Checking device $DEVICE" + check_perms "$DEVICE is a mounted file system." $DEVICE root + done fi # Check cron jobs if they're readable @@ -769,7 +992,7 @@ if [ -f "/etc/crontab" ] && [ -r "/etc/crontab" ]; then do echo "Processing crontab entry: $LINE" USER=`echo "$LINE" | awk '{print $6}'` - PROG=`echo "$LINE" | awk '{print $7}'` + PROG=`echo "$LINE" | sed 's/(//' | awk '{print $7}'` check_called_programs "$PROG is run from crontab as $USER." $PROG $USER $MYPATH done else @@ -812,7 +1035,7 @@ if [ -d "/var/spool/cron/crontabs" ]; then grep -v '^#' "$FILE" | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | while read LINE do echo "Processing crontab entry: $LINE" - PROG=`echo "$LINE" | awk '{print $6}'` + PROG=`echo "$LINE" | sed 's/(//' | awk '{print $6}'` check_called_programs "$PROG is run via cron as $USER." "$PROG" $USER done else @@ -840,7 +1063,7 @@ if [ -d "/var/spool/cron/tabs" ]; then grep -v '^#' "$FILE" | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | while read LINE do echo "Processing crontab entry: $LINE" - PROG=`echo "$LINE" | awk '{print $6}'` + PROG=`echo "$LINE" | sed 's/(//' | awk '{print $6}'` check_called_programs "$PROG is run from cron as $USER." $PROG $USER $MYPATH done else @@ -923,17 +1146,47 @@ do done done -section "Checking SUID programs" +section "Checking SUID/SGID programs" if [ "$MODE" = "detailed" ]; then - for FILE in `find / -type f -perm -04000 2>/dev/null`; do - check_called_programs_suid $FILE + for FILE in `find / -type f -perm -04000 -o -type f -perm -02000 2>/dev/null`; do + check_called_programs_suid_sgid $FILE + SUIDDCRIPT=`file $FILE | grep script` + if [ -n "$SUIDSCRIPT" ]; then + echo "[UPC023] WARNING: SetUID/SetGID shell script, may be vulnerable to race attacks" + fi done else - echo "Skipping checks of SUID programs (it's slow!). Run again in 'detailed' mode." + echo "Skipping checks of SUID/SGID programs (it's slow!). Run again in 'detailed' mode." fi +section "Checking fscaps programs" +if [ "$OS" = "linux" -a -x /sbin/getcap ]; then + if [ "$MODE" = "detailed" ]; then + for FILE in `find / -type f -perm +0011 -exec /sbin/getcap {} \; 2>/dev/null | grep "=" | awk '{print $1}'`; do + /sbin/getcap $FILE + check_called_programs_fscaps $FILE + FSCAPSSCRIPT=`file $FILE | grep script` + if [ -n "$FSCAPSSCRIPT" ]; then + echo "[UPC043] WARNING: fscaps shell script, may be vulnerable to race attacks" + fi + done + else + echo "Skipping checks of fscaps programs (it's slow!). Run again in 'detailed' mode." + fi +fi + +# Check for cleartext subversion passwords +section "Checking for cleartext subversion passwords in home directories" +for HOMEDIR in `cut -f 6 -d : /etc/passwd`; do + if [ -d "$HOMEDIR/.subversion/auth/svn.simple" ]; then + for FILE in $HOMEDIR/.subversion/auth/svn.simple/*; do + echo "[UPC024] WARNING: Cleartext subversion passsword file: $FILE" + done + fi +done + # Check for private SSH keys in home directories -section "Checking for Private SSH Keys home directories" +section "Checking for Private SSH Keys in home directories" for HOMEDIR in `cut -f 6 -d : /etc/passwd`; do if [ -d "$HOMEDIR/.ssh" ]; then PRIV_KEYS=`grep -l 'BEGIN [RD]SA PRIVATE KEY' $HOMEDIR/.ssh/* 2>/dev/null` @@ -941,9 +1194,9 @@ for HOMEDIR in `cut -f 6 -d : /etc/passwd`; do for KEY in $PRIV_KEYS; do ENC_KEY=`grep -l 'ENCRYPTED' "$KEY" 2>/dev/null` if [ -n "$ENC_KEY" ]; then - echo "WARNING: Encrypted Private SSH Key Found in $KEY" + echo "[UPC025] WARNING: Encrypted private SSH key found in $KEY" else - echo "WARNING: Unencrypted Private SSH Key Found in $KEY" + echo "[UPC026] WARNING: Unencrypted private SSH key found in $KEY" fi done fi @@ -951,28 +1204,38 @@ for HOMEDIR in `cut -f 6 -d : /etc/passwd`; do done # Check for public SSH keys in home directories -section "Checking for Public SSH Keys home directories" +section "Checking for Public SSH Keys in home directories" for HOMEDIR in `cut -f 6 -d : /etc/passwd`; do if [ -r "$HOMEDIR/.ssh/authorized_keys" ]; then KEYS=`grep '^ssh-' $HOMEDIR/.ssh/authorized_keys 2>/dev/null` if [ -n "$KEYS" ]; then - echo "WARNING: Public SSH Key Found in $HOMEDIR/.ssh/authorized_keys" + echo "[UPC027] WARNING: Public SSH Key Found in $HOMEDIR/.ssh/authorized_keys" fi fi done +section "Checking classpath permissions for Java processes" +ps -ef | grep -i '\-classpath' | grep -v grep | while read LINE +do + U=`echo $LINE | awk '{print $1}'` + CLASSPATH=`echo $LINE | sed 's/.*classpath //' | sed 's/ .*//'` + for P in `echo $CLASSPATH | sed 's/:/ /g'`; do + check_perms "$P is in the classpath for a java process run by $U." "$P" $U + done +done + # Check for any SSH agents running on the box section "Checking for SSH agents" AGENTS=`ps -ef | grep ssh-agent | grep -v grep` if [ -n "$AGENTS" ]; then - echo "WARNING: There are SSH agents running on this system:" + echo "[UPC028] WARNING: There are SSH agents running on this system:" ps -ef | grep ssh-agent | grep -v grep # for PID in `ps aux | grep ssh-agent | grep -v grep | awk '{print $2}'`; do for SOCK in `ls /tmp/ssh-*/agent.* 2>/dev/null`; do SSH_AUTH_SOCK=$SOCK; export SSH_AUTH_SOCK AGENT_KEYS=`ssh-add -l | grep -v 'agent has no identities.' 2>/dev/null` if [ -n "$AGENT_KEYS" ]; then - echo "WARNING: SSH Agent has keys loaded [SSH_AUTH_SOCK=$SSH_AUTH_SOCK]" + echo "[UPC029] WARNING: SSH Agent has keys loaded [SSH_AUTH_SOCK=$SSH_AUTH_SOCK]" ssh-add -l fi done @@ -984,7 +1247,7 @@ fi section "Checking for GPG agents" AGENTS=`ps -ef | grep gpg-agent | grep -v grep` if [ -n "$AGENTS" ]; then - echo "WARNING: There are GPG agents running on this system:" + echo "[UPC030] WARNING: There are GPG agents running on this system:" ps aux | grep gpg-agent | grep -v grep else echo "No GPG agents found" @@ -1007,7 +1270,7 @@ for DIR in /etc/init.d /etc/rc.d /usr/local/etc/rc.d; do done section "Checking if running programs are writable" -if [ $OS = "solaris" ]; then +if [ "$OS" = "solaris" ]; then # use the output of ps command ps -ef -o user,comm | while read LINE do @@ -1015,7 +1278,15 @@ if [ $OS = "solaris" ]; then PROG=`echo "$LINE" | awk '{print $2}'` check_called_programs "$PROG is currently running as $USER." "$PROG" "$USER" done -elif [ $OS = "bsd" ]; then +elif [ "$OS" = "aix" ]; then + # use the output of ps command + ps -ef -o user,comm | while read LINE + do + USER=`echo "$LINE" | awk '{print $1}'` + PROG=`echo "$LINE" | awk '{print $2}'` + check_called_programs "`which $PROG` is currently running as $USER." "`which $PROG`" "$USER" + done +elif [ "$OS" = "bsd" ]; then # use the output of ps command ps aux | while read LINE do @@ -1023,7 +1294,7 @@ elif [ $OS = "bsd" ]; then PROG=`echo "$LINE" | awk '{print $11}'` check_called_programs "$PROG is currently running as $USER." "$PROG" "$USER" done -elif [ $OS = "hpux" ]; then +elif [ "$OS" = "hpux" ]; then # use the output of ps command ps -ef | while read LINE do @@ -1037,9 +1308,9 @@ elif [ $OS = "hpux" ]; then check_called_programs "$PROG is currently running as $USER." "$PROG2" "$USER" fi done -elif [ $OS = "linux" ]; then +elif [ "$OS" = "linux" ]; then # use the /proc file system - for PROCDIR in /proc/[0-9]*; do + for PROCDIR in /proc/[0-9]*; do unset PROGPATH PID=`echo $PROCDIR | cut -f 3 -d /` echo ------------------------ @@ -1073,7 +1344,7 @@ elif [ $OS = "linux" ]; then check_called_programs "$PROGPATH is currently running as $OWNER." $PROGPATH $OWNER fi - if [ "$MODE" == "detailed" ]; then + if [ "$MODE" = "detailed" ]; then for FILE in $PROCDIR/fd/*; do F=`echo "$FILE" | sed 's/^.*\///'` if [ "$F" = "*" ]; then @@ -1084,3 +1355,107 @@ elif [ $OS = "linux" ]; then fi done fi + +section "Checking exploit mitigation" +if [ "$MODE" = "detailed" ]; then + if [ "$OS" = "solaris" ]; then + NX=`grep noexec_user_stack /etc/system | grep -v _log | grep 1` + if [ -z "$NX" ]; then + echo "[UPC031] WARNING: No NX" + fi + + NXLOG=`grep noexec_user_stack_log /etc/system | grep 1` + if [ -z "$NXLOG" ]; then + echo "[UPC032] WARNING: No NX logging" + fi + + AUDIT=`grep c2audit:audit_load /etc/system | grep 1` + if [ -z "$AUDIT" ]; then + echo "[UPC033] WARNING: Auditing not enabled" + fi + fi + if [ "$OS" = "aix" ]; then + false + fi + if [ "$OS" = "hpux" ]; then + NX=`kmtune -q executable_stack | grep executable_stack | awk '{print $2}'` + if [ "$NX" -eq 1 ]; then + echo "[UPC034] WARNING: No NX" + elif [ "$NX" -eq 2 ]; then + echo "[UPC035] WARNING: NX set to logging only" + fi + fi + if [ "$OS" = "linux" ]; then + ASLR=`sysctl kernel.randomize_va_space | awk '{print $3}'` + if [ "$ASLR" -eq 0 ]; then + echo "[UPC036] WARNING: No ASLR" + elif [ "$ASLR" -eq 1 ]; then + echo "[UPC037] WARNING: Conservative ASLR" + fi + + MMAP=`cat /proc/sys/vm/mmap_min_addr` + if [ "$MMAP" -eq 0 -o "$MMAP" = "" ]; then + echo "[UPC038] WARNING: mmap allows map to 0" + fi + + if [ ! -f /selinux/enforce ]; then + echo "[UPC039] WARNING: SELinux does not enforce" + fi + + for PROCDIR in /proc/[0-9]*; do + unset PROGPATH + PID=`echo $PROCDIR | cut -f 3 -d /` + echo ------------------------ + echo "PID: $PID" + if [ -d "$PROCDIR" ]; then + if [ -r "$PROCDIR/exe" ]; then + PROGPATH=`ls -l "$PROCDIR/exe" 2>&1 | sed 's/ (deleted)//' | awk '{print $NF}'` + else + if [ -r "$PROCDIR/cmdline" ]; then + P=`cat $PROCDIR/cmdline | tr "\0" = | cut -f 1 -d = | grep '^/'` + if [ -z "$P" ]; then + echo "ERROR: Can't find full path of running program: "`cat $PROCDIR/cmdline` + else + PROGPATH=$P + fi + else + echo "ERROR: Can't find full path of running program: "`cat $PROCDIR/cmdline` + continue + fi + fi + else + echo "ERROR: Can't find full path of running process. Process has gone." + continue + fi + if [ -n "$PROGPATH" ]; then + echo "Program path: $PROGPATH" + NX=`grep stack $PROCDIR/maps | grep -v "rw-"` + if [ -n "$NX" ]; then + echo "[UPC040] WARNING: NX not enabled" + fi + + SSP=`objdump -D $PROCDIR/exe | grep stack_chk` + if [ -z "$SSP" ]; then + echo "[UPC041] WARNING: SSP not enabled" + fi + fi + done + find / \( -perm -u+s -o -perm -g+s \) -type f | while read PROGPATH; do + echo "Program path: $PROGPATH" + ls -la $PROGPATH + + SSP=`objdump -D $PROGPATH | grep stack_chk` + if [ -z "$SSP" ]; then + echo "[UPC042] WARNING: SSP not enabled" + fi + done + find / -type f -exec /sbin/getcap {} \; 2>/dev/null | grep "=" | awk '{print $1}' | while read PROGPATH; do + echo "Program path: $PROGPATH" + /sbin/getcap $PROGPATH + SSP=`objdump -D $PROGPATH | grep stack_chk` + if [ -z "$SSP" ]; then + echo "[UPC042] WARNING: SSP not enabled" + fi + done + fi +fi