diff --git a/data/BaseLine/BaseLine.yaml b/data/BaseLine/BaseLine.yaml index 6a87020..b164d96 100644 --- a/data/BaseLine/BaseLine.yaml +++ b/data/BaseLine/BaseLine.yaml @@ -1,6 +1,6 @@ ConfigFilePrefix: /home/test/桌面/genmai/data/BaseLine/ Type: baseline -RootPasswd: +RootPasswd: sbcj1999 ExplorerItems: - ConfigFile: UserAnalysis/checkUser.yaml #检测root权限用户 - ConfigFile: UserAnalysis/checkGid.yaml #检测特权组用户 @@ -9,4 +9,6 @@ ExplorerItems: - ConfigFile: UserAnalysis/checkRootAuthorizedKeys.yaml #检测root是否是免密登录的公钥 - ConfigFile: UserAnalysis/checkSshPwdAnalysis.yaml #检测ssh空密码登录 - ConfigFile: UserAnalysis/checkShadowFile.yaml #检测shadow文件权限 - - ConfigFile: UserAnalysis/checkPasswdFile.yaml #检测Passwd文件权限 \ No newline at end of file + - ConfigFile: UserAnalysis/checkPasswdFile.yaml #检测Passwd文件权限 + - ConfigFile: UserAnalysis/checkSshBruteProtectionAnalysis.yaml #检测ssh暴力破解防护是否开启 + - ConfigFile: FileCheck/CheckFileJurisdiction.yaml \ No newline at end of file diff --git a/data/BaseLine/FileCheck/CheckFileJurisdiction.yaml b/data/BaseLine/FileCheck/CheckFileJurisdiction.yaml new file mode 100644 index 0000000..6f3bd44 --- /dev/null +++ b/data/BaseLine/FileCheck/CheckFileJurisdiction.yaml @@ -0,0 +1,16 @@ +FormatVer: 20220411 +Id: CheckFileJurisdiction +Belong: baseline +SiteInfo: + Name: 检测root目录下存在777权限的文件 +Power : "root" +SiteRequests: + Implement: + ImArray: + - Exec : find + Args : + - /root + - -perm 777 + Inter: + - "" #判断输出为空为不存在 + Condition: None \ No newline at end of file diff --git a/data/BaseLine/UserAnalysis/checkEmpty.yaml b/data/BaseLine/UserAnalysis/checkEmpty.yaml index b6d5331..d4f8c13 100644 --- a/data/BaseLine/UserAnalysis/checkEmpty.yaml +++ b/data/BaseLine/UserAnalysis/checkEmpty.yaml @@ -7,8 +7,10 @@ Power : "root" SiteRequests: Implement: ImArray: - - Exec : - Args : "awk -F: 'length($2)==0 {print $1}' /etc/shadow" + - Exec : awk + Args : + - "-F: " + - "'length($2)==0 {print $1}' /etc/shadow" Inter: - "" #判断输出为空为不存在 Condition: None \ No newline at end of file diff --git a/data/BaseLine/UserAnalysis/checkGid.yaml b/data/BaseLine/UserAnalysis/checkGid.yaml index 7c19081..e61bcc3 100644 --- a/data/BaseLine/UserAnalysis/checkGid.yaml +++ b/data/BaseLine/UserAnalysis/checkGid.yaml @@ -7,8 +7,10 @@ Power : SiteRequests: Implement: ImArray: - - Exec : - Args : "cat /etc/passwd | grep '/bin/bash' | awk -F: '$4==0 {print $1}' 2>/dev/null" + - Exec : /bin/bash + Args : + - "-c" + - "cat /etc/passwd | grep '/bin/bash' | awk -F: '$4==0 {print $1}' 2>/dev/null" Inter: - "root" #判断输出为'uid=0(root)'为不存在 Condition: None diff --git a/data/BaseLine/UserAnalysis/checkPasswdFile.yaml b/data/BaseLine/UserAnalysis/checkPasswdFile.yaml index 3c86887..c13a71c 100644 --- a/data/BaseLine/UserAnalysis/checkPasswdFile.yaml +++ b/data/BaseLine/UserAnalysis/checkPasswdFile.yaml @@ -7,9 +7,10 @@ Power : SiteRequests: Implement: ImArray: - - Exec : - Args : "ls -l /etc/passwd |awk '{print $1}'" - Power : + - Exec : /bin/bash + Args : + - "-c" + - "ls -l /etc/passwd |awk '{print $1}'" Inter: - "-rw-r--r--" #判断输出为'-rw-r--r--'为不存在 Condition: None diff --git a/data/BaseLine/UserAnalysis/checkRootAuthorizedKeys.yaml b/data/BaseLine/UserAnalysis/checkRootAuthorizedKeys.yaml index c66c3e8..1aeb4c3 100644 --- a/data/BaseLine/UserAnalysis/checkRootAuthorizedKeys.yaml +++ b/data/BaseLine/UserAnalysis/checkRootAuthorizedKeys.yaml @@ -7,8 +7,10 @@ Power : "root" SiteRequests: Implement: ImArray: - - Exec : - Args : "find /root/.ssh/ -name authorized_keys" + - Exec : find + Args : + - /root/.ssh/ + - -name authorized_keys Inter: - "" #判断输出为空为不存在 Condition: None \ No newline at end of file diff --git a/data/BaseLine/UserAnalysis/checkShadowFile.yaml b/data/BaseLine/UserAnalysis/checkShadowFile.yaml index c17bc0e..70f39bc 100644 --- a/data/BaseLine/UserAnalysis/checkShadowFile.yaml +++ b/data/BaseLine/UserAnalysis/checkShadowFile.yaml @@ -7,8 +7,10 @@ Power : SiteRequests: Implement: ImArray: - - Exec : - Args : "ls -l /etc/shadow |awk '{print $1}'" + - Exec : /bin/bash + Args : + - "-c" + - "ls -l /etc/shadow |awk '{print $1}'" Power : Inter: - "-rw-r-----" #判断输出为'-rw-r--r--'为不存在 diff --git a/data/BaseLine/UserAnalysis/checkSshBruteProtectionAnalysis.yaml b/data/BaseLine/UserAnalysis/checkSshBruteProtectionAnalysis.yaml new file mode 100644 index 0000000..0bdf653 --- /dev/null +++ b/data/BaseLine/UserAnalysis/checkSshBruteProtectionAnalysis.yaml @@ -0,0 +1,16 @@ +FormatVer: 20220411 +Id: checkSshBruteProtectionAnalysis +Belong: baseline +SiteInfo: + Name: 检测ssh暴力破解防护是否开启 +Power : +SiteRequests: + Implement: + ImArray: + - Exec : /bin/bash + Args : + - "-c" + - "grep -i maxauthtries /etc/ssh/sshd_config| awk '{print $1}'" + Inter: + - "#MaxAuthTries" #判断输出为'#MaxAuthTries'为不存在 + Condition: None \ No newline at end of file diff --git a/data/BaseLine/UserAnalysis/checkSshPwdAnalysis.yaml b/data/BaseLine/UserAnalysis/checkSshPwdAnalysis.yaml index 39529ec..06a9f9f 100644 --- a/data/BaseLine/UserAnalysis/checkSshPwdAnalysis.yaml +++ b/data/BaseLine/UserAnalysis/checkSshPwdAnalysis.yaml @@ -7,9 +7,10 @@ Power : SiteRequests: Implement: ImArray: - - Exec : - Args : "grep -i empty /etc/ssh/sshd_config" - Power : + - Exec : /bin/bash + Args : + - "-c" + - "grep -i empty /etc/ssh/sshd_config" Inter: - "#PermitEmptyPasswords no" #判断输出为'-rw-r--r--'为不存在 - "#PermitEmptyPasswords yes" diff --git a/data/BaseLine/UserAnalysis/checkUser.yaml b/data/BaseLine/UserAnalysis/checkUser.yaml index a1094bc..62be824 100644 --- a/data/BaseLine/UserAnalysis/checkUser.yaml +++ b/data/BaseLine/UserAnalysis/checkUser.yaml @@ -7,9 +7,10 @@ Power : SiteRequests: Implement: ImArray: - - Exec : - Args : "awk -F: '$3==0 {print $1}' /etc/passwd 2>/dev/null" - Power : + - Exec : /bin/bash + Args : + - "-c" + - "awk -F: '$3==0 {print $1}' /etc/passwd 2>/dev/null" Inter: - "root" #判断输出为'uid=0(root)'为不存在 Condition: None diff --git a/data/BaseLine/UserAnalysis/checkUserAuthorizedKeys.yaml b/data/BaseLine/UserAnalysis/checkUserAuthorizedKeys.yaml index 1ea0908..77117df 100644 --- a/data/BaseLine/UserAnalysis/checkUserAuthorizedKeys.yaml +++ b/data/BaseLine/UserAnalysis/checkUserAuthorizedKeys.yaml @@ -7,8 +7,9 @@ Power : "root" SiteRequests: Implement: ImArray: - - Exec : - Args : "find /home -path '/home/*/.box' -prune -o -name 'authorized_keys' -print" + - Exec : find + Args : + - "/home -path '/home/*/.box' -prune -o -name 'authorized_keys' -print" Inter: - "" #判断输出为空为不存在 Condition: None \ No newline at end of file diff --git a/data/KernelPocs/KernelPocs.yaml b/data/KernelPocs/KernelPocs.yaml index 7dea793..254f620 100644 --- a/data/KernelPocs/KernelPocs.yaml +++ b/data/KernelPocs/KernelPocs.yaml @@ -2,6 +2,6 @@ ConfigFilePrefix: ../data/KernelPocs/ Type: kernel ExplorerItems: - ConfigFile: CVE-2021-3156/CVE-2021-3156.yaml -# - ConfigFile: CVE-2021-22555/CVE-2021-22555.yaml + - ConfigFile: CVE-2021-22555/CVE-2021-22555.yaml - ConfigFile: CVE-2022-2588/CVE-2022-2588.yaml -# - ConfigFile: CVE-2022-2639/CVE-2022-2639.yaml + - ConfigFile: CVE-2022-2639/CVE-2022-2639.yaml diff --git a/src/exp_dir/data b/src/exp_dir/data new file mode 100644 index 0000000..e69de29 diff --git a/src/exp_dir/data2 b/src/exp_dir/data2 new file mode 100644 index 0000000..e69de29 diff --git a/src/exp_dir/uaf b/src/exp_dir/uaf new file mode 120000 index 0000000..460aa0e --- /dev/null +++ b/src/exp_dir/uaf @@ -0,0 +1 @@ +./data \ No newline at end of file diff --git a/src/genmai/ExplorerBaseLine.go b/src/genmai/ExplorerBaseLine.go index ed6a967..c8773ff 100644 --- a/src/genmai/ExplorerBaseLine.go +++ b/src/genmai/ExplorerBaseLine.go @@ -66,8 +66,7 @@ func func (ek *ExplorerBaseLine)EexcBaseline(execPoc string, args ...string ) string { - cmdStr:=args[0] - cmd := exec.Command("/bin/bash", "-c", cmdStr) + cmd := exec.Command(execPoc,args...) var stdout, stderr bytes.Buffer cmd.Stdout = &stdout // 标准输出 cmd.Stderr = &stderr // 标准错误 @@ -86,7 +85,7 @@ func func -(ek *ExplorerBaseLine)HPowerEexcBaseline(command string,passwd string)(result string){ +(ek *ExplorerBaseLine)HPowerEexcBaseline(exec string,passwd string,args ...string)(result string){ sshHost := "127.0.0.1" sshUser := "root" @@ -111,6 +110,12 @@ func } + // + var command string + for i:=0;i