From 76b678eebdf9c4e47b75e66069b71a3381413512 Mon Sep 17 00:00:00 2001 From: chenxinquan Date: Fri, 4 Aug 2023 14:27:10 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9System=E7=9A=84=E6=8A=A5?= =?UTF-8?q?=E5=91=8A=E5=8A=9F=E8=83=BD=E5=92=8C=E6=A0=BC=E5=BC=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/genmai/ExplorerBaseLine.go | 188 +++++++++++++++++----------- src/genmai/ExplorerWeb.go | 221 +++++++++++++++++++++++++++++++-- src/genmai/ReportKernel.go | 3 + src/genmai/ReportWeb.go | 9 +- 4 files changed, 341 insertions(+), 80 deletions(-) diff --git a/src/genmai/ExplorerBaseLine.go b/src/genmai/ExplorerBaseLine.go index 13a1a7a..c32f760 100644 --- a/src/genmai/ExplorerBaseLine.go +++ b/src/genmai/ExplorerBaseLine.go @@ -2,10 +2,11 @@ package genmai import ( - "golang.org/x/crypto/ssh" - "time" + // "golang.org/x/crypto/ssh" + // "time" "bytes" "log" + "os" "os/exec" "strings" sandbox "main/genmai/Sandbox" @@ -64,16 +65,25 @@ func } func -(ek *ExplorerBaseLine)EexcBaseline(execPoc string, - args ...string ) string { - cmd := exec.Command(execPoc,args...) +(ek *ExplorerBaseLine)EexcBaseline(baselineInter string,baselinePath string,execPoc string,args ...string ) string { + execPoc=baselinePath+"/"+execPoc + var arry []string + arry = append(arry,execPoc) + arry = append(arry,args...) + // 虚拟环境处理 + baselineInter = strings.TrimSpace(baselineInter) + if baselineInter == "python3" { + _,arch:=GetCurrentFw() + baselineInter = "../data/SandboxViPyEnv/"+arch+"/myenv/bin/python3" + } + cmd := exec.Command(baselineInter,arry...) var stdout, stderr bytes.Buffer cmd.Stdout = &stdout // 标准输出 cmd.Stderr = &stderr // 标准错误 err := cmd.Run() outStr, errStr := string(stdout.Bytes()), string(stderr.Bytes()) if len(errStr)!=0{ - fmt.Printf(errStr) + fmt.Println(errStr) } outStr=strings.TrimSpace(outStr) if err != nil { @@ -85,90 +95,125 @@ func func -(ek *ExplorerBaseLine)HPowerEexcBaseline(exec string,passwd string,args ...string)(result string){ - sshHost := "127.0.0.1" +(ek *ExplorerBaseLine)HPowerEexcBaseline(baselineInter string,baselinePath string,execPoc string,passwd string,args ...string)(result string){ + // sshHost := "127.0.0.1" - sshUser := "root" + // sshUser := "root" - sshPassword := passwd + // sshPassword := passwd - sshType := "password" + // sshType := "password" - sshPort := 22 + // sshPort := 22 - //创建sshp登陆配置 + // //创建sshp登陆配置 - config := &ssh.ClientConfig{ + // config := &ssh.ClientConfig{ - Timeout: 5*time.Second,//ssh 连接time out 时间一秒钟, 如果ssh验证错误 会在一秒内返回 + // Timeout: 5*time.Second,//ssh 连接time out 时间一秒钟, 如果ssh验证错误 会在一秒内返回 - User: sshUser, + // User: sshUser, - HostKeyCallback: ssh.InsecureIgnoreHostKey(), //这个可以, 但是不够安全 + // HostKeyCallback: ssh.InsecureIgnoreHostKey(), //这个可以, 但是不够安全 - //HostKeyCallback: hostKeyCallBackFunc(h.Host), + // //HostKeyCallback: hostKeyCallBackFunc(h.Host), - } + // } - // - var command string - for i:=0;i>>",err) + // if err != nil { + // log.Fatalf("cmd.Run() failed with %s\n", errStr) + // } + return outStr } //func @@ -189,11 +234,14 @@ func } /////////////// // starting explore + // get currer path + path,_:=os.Getwd() + path = path+"/"+ek.ExplorerCommon.EcConfigFilePrefix var vul string for _, im := range config.SiteRequests.ImArray { if config.Power=="root"{ if len(ek.Passwd)!=0{ - vul=ek.HPowerEexcBaseline(im.Exec,ek.Passwd,im.Args...) + vul=ek.HPowerEexcBaseline(im.Inter,path,im.Exec,ek.Passwd,im.Args...) }else{ infoWarn:="BaseLine warning: "+config.Id+" High power password is none "+",Can't use for high privilege baseline scan" fmt.Printf("%c[%d;%d;%dm%s%c[0m\n", 0x1B, 0, 0, 33, infoWarn, 0x1B) @@ -201,24 +249,24 @@ func return } }else{ - vul=ek.EexcBaseline(im.Exec, im.Args...) + vul=ek.EexcBaseline(im.Inter,path,im.Exec, im.Args...) } for i:=0;iProcess() error! rc = ", rc) + + /* */ + return rc + } + config, rc1 := es.GetExplorerConfigWeb() + rc = rc1 + if (nil != rc) { + A_DEBUG_ERROR("exploreWithPath()-> "+ + "GetExplorerConfigWeb() error ! rc = ", + rc ) + /* */ + return rc + } // if (nil != ... + + /////////////////////////////// + // Expire timer + var expiretime int + if (0 != config.SiteRequests.Implement.ExpireTime) { + expiretime = config.SiteRequests.Implement.ExpireTime + } else { + expiretime = 20 // 默认为五秒 + } // if (0 != ... + /* */ + f := func() { + // 想杀死整个进程组，而不是单个进程，需要传递负整数形式 + syscall.Kill(-interio.Cmd.Process.Pid, syscall.SIGKILL) + A_DEBUG_WARNING("ID:", config.Id, + "takes too long! (Expiredtime = ", expiretime, "seconds)") + + } + /* */ + timer_ := time.AfterFunc(time.Duration(expiretime) * time.Second, f) + /* */ + defer timer_.Stop() + + for _, itr := range config.SiteRequests.Implement.Inter { + icmd := itr[ : inter.INTERPRETER_CMD_LEN] + icmd_len := len(icmd) + for a:=0; a < 100000; a++ { + ; + } + switch (icmd) { + case inter.INTERPRETER_CMD_SEND: + interio.Send(itr[ icmd_len : ] + "\n") + // TODO:remove it: just for debug + A_DEBUG_INFO("iio:", inter.INTERPRETER_CMD_SEND, itr[ icmd_len : ]) + + case inter.INTERPRETER_CMD_RECV: + // TODO + //out, rc_t := interio.Recv( icmd_len ) + interio.Recv( len(itr[ icmd_len :]) ) + // TODO:remove it: just for debug + A_DEBUG_INFO("iio:", inter.INTERPRETER_CMD_RECV, itr[ icmd_len : ]) + + case inter.INTERPRETER_CMD_RECVUNTIL: + interio.RecvUntil( itr[ icmd_len : ] ) + // TODO:remove it: just for debug + A_DEBUG_INFO("iio:", inter.INTERPRETER_CMD_RECVUNTIL, itr[ icmd_len : ]) + + //case ">.": + // A_DEBUG_INFO(">.") + // + //case "GetExplorerConfigWeb() "+ + "error! rc = ", rc ) + /* */ + return VulnInfoCommon{}, rc + } + + /////////////// + // starting explore + for _, im := range config.SiteRequests.ImArray { + rc = es.exploreWithPath(im.Inter,im.InterArgs,es.ExplorerCommon.EcConfigFilePrefix + + string(os.PathSeparator)+im.Exec,im.Args... ) + /* */ + if rc.Error() =="Poc Check Successfully!"{ + expvul.VICId = config.Id + expvul.VICBelong = config.Belong + expvul.VICPocHazardLevel = config.PocHazardLevel + expvul.VICSource = config.Source + expvul.VICSiteInfo = config.SiteInfo + } + + } // for _, im ... + // ending explore + /////////////// + + return expvul, nil +} + +/////////////////////////////// +// override functions diff --git a/src/genmai/ReportKernel.go b/src/genmai/ReportKernel.go index 525e164..683a37f 100644 --- a/src/genmai/ReportKernel.go +++ b/src/genmai/ReportKernel.go @@ -64,6 +64,9 @@ GetTemplateReportKernel() (*ReportKernel) { RCRepairedNums: 0, RCNotFixedNums: 0, RCNotExecPocNums: 0, + RCRisk_kernel_h_nums: 0, + RCRisk_kernel_m_nums: 0, + RCRisk_kernel_l_nums: 0, RCExploredMode: "RCExploredMode", RCExploredVersion: "RCExploredVersion", RCExploredRevision: "RCExploredRevision", diff --git a/src/genmai/ReportWeb.go b/src/genmai/ReportWeb.go index e7c562c..708a199 100644 --- a/src/genmai/ReportWeb.go +++ b/src/genmai/ReportWeb.go @@ -42,7 +42,6 @@ VulnInfoWeb struct { VulnInfoCommon } - func GetTemplateReportWeb() (*ReportWeb) { var expvuls []VulnInfoCommon @@ -64,6 +63,10 @@ GetTemplateReportWeb() (*ReportWeb) { RCContainer: "RCContainer", /* */ RCExploredTimeAt: time.Now(), + RCExecPocNums: 0, + RCRepairedNums: 0, + RCNotFixedNums: 0, + RCNotExecPocNums: 0, RCExploredMode: "RCExploredMode", RCExploredVersion: "RCExploredVersion", RCExploredRevision: "RCExploredRevision", @@ -108,6 +111,6 @@ GetTemplateVulnInfoWeb() (*VulnInfoWeb) { //////////////////////////////////////////////////////////////// // ReportBase methods func -(rw *ReportWeb)GetReportCommon() ReportCommon { - return rw.ReportCommon +(rs *ReportWeb)GetReportCommon() ReportCommon { + return rs.ReportCommon }