unix-privesc-check-1.4/0000755000000000000000000000000011112334013013550 5ustar rootrootunix-privesc-check-1.4/unix-privesc-check0000755000000000000000000010770111112334013017213 0ustar rootroot#!/bin/sh # unix-privesc-check - Checks Unix system for simple privilege escalations # Copyright (C) 2008 pentestmonkey@pentestmonkey.net # # # License # ------- # This tool may be used for legal purposes only. Users take full responsibility # for any actions performed using this tool. The author accepts no liability # for damage caused by this tool. If you do not accept these condition then # you are prohibited from using this tool. # # In all other respects the GPL version 2 applies: # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 as # published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License along # with this program; if not, write to the Free Software Foundation, Inc., # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # # You are encouraged to send comments, improvements or suggestions to # me at pentestmonkey@pentestmonkey.net # # # Description # ----------- # Auditing tool to check for weak file permissions and other problems that # may allow local attackers to escalate privileges. # # It is intended to be run by security auditors and pentetration testers # against systems they have been engaged to assess, and also by system # admnisitrators who want to check for "obvious" misconfigurations. It # can even be run as a cron job so you can check regularly for misconfigurations # that might be introduced. # # Ensure that you have the appropriate legal permission before running it # someone else's system. # # TODO List # --------- # There's still plenty that this script doesn't do... # - Doesn't work for shell scripts! These appear as "/bin/sh my.sh" in the process listing. # This script only checks the perms of /bin/sh. Not what we're after. :-( # - Similarly for perl scripts. Probably python, etc. too. # - Check /proc/pid/cmdline for absolute path names. Check security of these (e.g. /etc/snmp/snmpd.conf) # - Check everything in root's path - how to find root's path? # - /proc/pid/maps, smaps are readable and lists some shared objects. We should check these. # - /proc/pid/fd contain symlinks to all open files (but you can't see other people FDs) # - check for trust relationships in /etc/hosts.equiv # - NFS imports / exports / automounter # - Insecure stuff in /etc/fstab (e.g. allowing users to mount file systems) # - Inspecting people's PATH. tricky. maybe read from /proc/pid/environ, .bashrc, /etc/profile, .bash_profile # - Check if /etc/init.d/* scripts are readable. Advise user to audit them if they are. # - .exrc? # - X11 trusts, apache passwd files, mysql trusts? # - Daemons configured in an insecure way: tftpd, sadmind, rexd # - World writable dirs aren't as bad if the sticky bit is set. Check for this before reporting vulns. # - Maybe do a strings of binaries (and their .so's?) # - Do a better job of parsing cron lines - search for full paths # - Maybe LDPATHs from /etc/env.d # - Check if ldd, ld.so.conf changes have broken this script on non-linux systems. # - Avoid check certain paths e.g. /-/_ clearly isn't a real directory. # - create some sort of readable report # - indicate when it's likely a result is a false positive and when it's not. # - Skip pseudo processes e.g. [usb-storage] # - File permission on kernel modules # - Replace calls to echo with a my_echo func. Should be passed a string and an "importance" value: # - my_echo 1 "This is important and should always be printed out" # - my_echo 2 "This is less important and should only be printed in verbose mode" # - We check some files / dirs multiple times. Slow. Can we implement a cache? # - grep for PRIVATE KEY to find private ssh and ssl keys. Where to grep? # - check SGID programs VERSION="1.4" HOME_DIR_FILES=".netrc .ssh/id_rsa .ssh/id_dsa .rhosts .shosts .my.cnf .ssh/authorized_keys .bash_history .sh_history .forward" CONFIG_FILES="/etc/passwd /etc/group /etc/master.passwd /etc/inittab /etc/inetd.conf /etc/xinetd.con /etc/xinetd.d/* /etc/contab /etc/fstab /etc/profile /etc/sudoers" PGDIRS="/usr/local/pgsql/data ~postgres/postgresql/data ~postgres/data ~pgsql/data ~pgsql/pgsql/data /var/lib/postgresql/data /etc/postgresql/8.2/main /var/lib/pgsql/data" get_owner () { GET_OWNER_FILE=$1 GET_OWNER_RETURN=`ls -lLd "$GET_OWNER_FILE" | awk '{print $3}'` } get_group () { GET_GROUP_FILE=$1 GET_GROUP_RETURN=`ls -lLd "$GET_GROUP_FILE" | awk '{print $4}'` } usage () { echo "unix-privesc-check v$VERSION ( http://pentestmonkey.net/tools/unix-privesc-check )" echo echo "Usage: unix-privesc-check { standard | detailed }" echo echo '"standard" mode: Speed-optimised check of lots of security settings.' echo echo '"detailed" mode: Same as standard mode, but also checks perms of open file' echo ' handles and called files (e.g. parsed from shell scripts,' echo ' linked .so files). This mode is slow and prone to false ' echo ' positives but might help you find more subtle flaws in 3rd' echo ' party programs.' echo echo "This script checks file permissions and other settings that could allow" echo "local users to escalate privileges." echo echo "Use of this script is only permitted on systems which you have been granted" echo "legal permission to perform a security assessment of. Apart from this " echo "condition the GPL v2 applies." echo echo "Search the output for the word 'WARNING'. If you don't see it then this" echo "script didn't find any problems." echo } banner () { echo "Starting unix-privesc-check v$VERSION ( http://pentestmonkey.net/tools/unix-privesc-check )" echo echo "This script checks file permissions and other settings that could allow" echo "local users to escalate privileges." echo echo "Use of this script is only permitted on systems which you have been granted" echo "legal permission to perform a security assessment of. Apart from this " echo "condition the GPL v2 applies." echo echo "Search the output below for the word 'WARNING'. If you don't see it then" echo "this script didn't find any problems." echo } MODE=$1 if [ ! "$MODE" = "standard" ] && [ ! "$MODE" = "detailed" ]; then usage exit 0 fi # Parse any full paths from $1 (config files, progs, dirs). # Check the permissions on each of these. check_called_programs () { CCP_MESSAGE_STACK=$1 CCP_FILE=$2 CCP_USER=$3 CCP_PATH=$4 # optional # Check the perms of the supplied file regardless # The caller doesn't want to have to call check_perms as well as check_called_programs check_perms "$CCP_MESSAGE_STACK" "$CCP_FILE" "$CCP_USER" "$CCP_PATH" # Skip the slow check if we're in quick mode if [ "$MODE" = "standard" ]; then return 0; fi # Check if file is text or not IS_TEXT=`file "$CCP_FILE" | grep -i text` IS_DYNBIN=`file "$CCP_FILE" | grep -i 'dynamically linked'` # Process shell scripts (would also work on config files that reference other files) if [ ! -z "$IS_TEXT" ]; then # Parse full paths from file - ignoring commented lines CALLED_FILES=`grep -v '^#' "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u` for CALLED_FILE in $CALLED_FILES; do # echo "$CCP_FILE contains a reference to $CALLED_FILE. Checking perms." check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" done else # Process dynamically linked binaries if [ ! -z "$IS_DYNBIN" ]; then CALLED_FILES=`ldd "$CCP_FILE" 2>/dev/null | grep '/' | sed 's/[^\/]*\//\//' | cut -f 1 -d ' '` for CALLED_FILE in $CALLED_FILES; do check_perms "$CCP_MESSAGE_STACK $CCP_FILE uses the library $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" done # Strings binary to look for hard-coded config files # or other programs that might be called. for CALLED_FILE in `strings "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u`; do check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" done fi fi } # Parse any full paths from $1 (config files, progs, dirs). # Check the permissions on each of these. check_called_programs_suid () { CCP_FILE=$1 CCP_PATH=$2 # optional get_owner $CCP_FILE; CCP_USER=$GET_OWNER_RETURN CCP_MESSAGE_STACK="$CCP_FILE is SUID $CCP_USER." LS=`ls -l $CCP_FILE` echo "Checking SUID-$CCP_USER program $CCP_FILE: $LS" # Don't check perms of executable itself # check_perms "$CCP_MESSAGE_STACK" "$CCP_FILE" "$CCP_USER" "$CCP_PATH" # Check if file is text or not IS_TEXT=`file "$CCP_FILE" | grep -i text` IS_DYNBIN=`file "$CCP_FILE" | grep -i 'dynamically linked'` # Process shell scripts (would also work on config files that reference other files) if [ ! -z "$IS_TEXT" ]; then # Skip the slow check if we're in quick mode if [ "$MODE" = "standard" ]; then return 0; fi # Parse full paths from file - ignoring commented lines CALLED_FILES=`grep -v '^#' "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u` for CALLED_FILE in $CALLED_FILES; do # echo "$CCP_FILE contains a reference to $CALLED_FILE. Checking perms." check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" done else # Process dynamically linked binaries if [ ! -z "$IS_DYNBIN" ]; then CALLED_FILES=`ldd "$CCP_FILE" 2>/dev/null | grep '/' | sed 's/[^\/]*\//\//' | cut -f 1 -d ' '` for CALLED_FILE in $CALLED_FILES; do check_perms "$CCP_MESSAGE_STACK $CCP_FILE uses the library $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" done # Skip the slow check if we're in quick mode if [ "$MODE" = "standard" ]; then return 0; fi # Strings binary to look for hard-coded config files # or other programs that might be called. for CALLED_FILE in `strings "$CCP_FILE" | sed -e 's/^[^\/]*//' -e 's/["'\'':}$]/\x0a/g' | grep '/' | sed -e 's/[ \*].*//' | grep '^/[a-zA-Z0-9_/-]*$' | sort -u`; do check_perms "$CCP_MESSAGE_STACK $CCP_FILE contains the string $CALLED_FILE." "$CALLED_FILE" "$CCP_USER" "$CCP_PATH" done fi fi } # Check if $1 can be changed by users who are not $2 check_perms () { CP_MESSAGE_STACK=$1 CHECK_PERMS_FILE=$2 CHECK_PERMS_USER=$3 CHECK_PERMS_PATH=$4 # optional if [ ! -f "$CHECK_PERMS_FILE" ] && [ ! -d "$CHECK_PERMS_FILE" ] && [ ! -b "$CHECK_PERMS_FILE" ]; then CHECK_PERMS_FOUND=0 if [ ! -z "$CHECK_PERMS_PATH" ]; then # Look for it in the supplied path for DIR in `echo "$CHECK_PERMS_PATH" | sed 's/:/ /g'`; do if [ -f "$DIR/$CHECK_PERMS_FILE" ]; then CHECK_PERMS_FOUND=1 CHECK_PERMS_FILE="$DIR/$CHECK_PERMS_FILE" break fi done fi #if [ "$CHECK_PERMS_FOUND" = "0" ]; then # echo "ERROR: File $CHECK_PERMS_FILE doesn't exist. Checking parent path anyway." # # return 0 # fi fi C=`echo "$CHECK_PERMS_FILE" | cut -c 1` if [ ! "$C" = "/" ]; then echo "ERROR: Can't find absolute path for $CHECK_PERMS_FILE. Skipping." return 0 fi echo " Checking if anyone except $CHECK_PERMS_USER can change $CHECK_PERMS_FILE" while [ -n "$CHECK_PERMS_FILE" ]; do perms_secure "$CP_MESSAGE_STACK" $CHECK_PERMS_FILE $CHECK_PERMS_USER CHECK_PERMS_FILE=`echo $CHECK_PERMS_FILE | sed 's/\/[^\/]*$//'` done } # Check if $1 can be read by users who are not $2 check_read_perms () { CP_MESSAGE_STACK=$1 CHECK_PERMS_FILE=$2 CHECK_PERMS_USER=$3 if [ ! -f "$CHECK_PERMS_FILE" ] && [ ! -b "$CHECK_PERMS_FILE" ]; then echo "ERROR: File $CHECK_PERMS_FILE doesn't exist" return 0 fi echo " Checking if anyone except $CHECK_PERMS_USER can read file $CHECK_PERMS_FILE" perms_secure_read "$CP_MESSAGE_STACK" "$CHECK_PERMS_FILE" "$CHECK_PERMS_USER" } perms_secure_read () { PS_MESSAGE_STACK=$1 PERMS_SECURE_FILE=$2 PERMS_SECURE_USER=$3 if [ ! -b "$PERMS_SECURE_FILE" ] && [ ! -f "$PERMS_SECURE_FILE" ] && [ ! -d "$PERMS_SECURE_FILE" ]; then echo "ERROR: No such file or directory: $PERMS_SECURE_FILE. Skipping." return 0 fi # Check if owner is different (but ignore root ownership, that's OK) only_user_can_read "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE $PERMS_SECURE_USER # Check group read perm (but ignore root group, that's OK) group_can_read "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE $PERMS_SECURE_USER # Check world read perm world_can_read "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE } perms_secure () { PS_MESSAGE_STACK=$1 PERMS_SECURE_FILE=$2 PERMS_SECURE_USER=$3 if [ ! -d "$PERMS_SECURE_FILE" ] && [ ! -f "$PERMS_SECURE_FILE" ] && [ ! -b "$PERMS_SECURE_FILE" ]; then # echo "ERROR: No such file or directory: $PERMS_SECURE_FILE. Skipping." return 0 fi # Check if owner is different (but ignore root ownership, that's OK) only_user_can_write "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE $PERMS_SECURE_USER # Check group write perm (but ignore root group, that's OK) group_can_write "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE $PERMS_SECURE_USER # Check world write perm world_can_write "$PS_MESSAGE_STACK" $PERMS_SECURE_FILE } only_user_can_write () { O_MESSAGE_STACK=$1 O_FILE=$2 O_USER=$3 # We just need to check the owner really as the owner # can always grant themselves write access get_owner $O_FILE; O_FILE_USER=$GET_OWNER_RETURN if [ ! "$O_USER" = "$O_FILE_USER" ] && [ ! "$O_FILE_USER" = "root" ]; then echo "WARNING: $O_MESSAGE_STACK The user $O_FILE_USER can write to $O_FILE" fi } group_can_write () { O_MESSAGE_STACK=$1 O_FILE=$2 O_USER=$3 # ignore group write access $3 is only member of group get_group $O_FILE; O_FILE_GROUP=$GET_GROUP_RETURN P=`ls -lLd $O_FILE | cut -c 6` if [ "$P" = "w" ] && [ ! "$O_GROUP" = "root" ]; then # check the group actually has some members other than $O_USER group_has_other_members "$O_FILE_GROUP" "$O_USER"; # sets OTHER_MEMBERS to 1 or 0 if [ "$OTHER_MEMBERS" = "1" ]; then echo "WARNING: $O_MESSAGE_STACK The group $O_FILE_GROUP can write to $O_FILE" fi fi } group_has_other_members () { G_GROUP=$1 G_USER=$2 # If LDAP/NIS is being used this script can't check group memberships # we therefore assume the worst. if [ "$EXT_AUTH" = 1 ]; then OTHER_MEMBERS=1 return 1 fi GROUP_LINE=`grep "^$G_GROUP:" /etc/group` MEMBERS=`echo "$GROUP_LINE" | cut -f 4 -d : | sed 's/,/ /g'` GID=`echo "$GROUP_LINE" | cut -f 3 -d :` EXTRA_MEMBERS=`grep "^[^:]*:[^:]*:[0-9]*:$GID:" /etc/passwd | cut -f 1 -d : | xargs echo` for M in $MEMBERS; do if [ ! "$M" = "$G_USER" ] && [ ! "$M" = "root" ]; then OTHER_MEMBERS=1 return 1 fi done for M in $EXTRA_MEMBERS; do if [ ! "$M" = "$G_USER" ] && [ ! "$M" = "root" ]; then OTHER_MEMBERS=1 return 1 fi done OTHER_MEMBERS=0 return 0 } world_can_write () { O_MESSAGE_STACK=$1 O_FILE=$2 P=`ls -lLd $O_FILE | cut -c 9` S=`ls -lLd $O_FILE | cut -c 10` if [ "$P" = "w" ]; then if [ "$S" = "t" ]; then echo "WARNING: $O_MESSAGE_STACK World write is set for $O_FILE (but sticky bit set)" else echo "WARNING: $O_MESSAGE_STACK World write is set for $O_FILE" fi fi } only_user_can_read () { O_MESSAGE_STACK=$1 O_FILE=$2 O_USER=$3 # We just need to check the owner really as the owner # can always grant themselves read access get_owner $O_FILE; O_FILE_USER=$GET_OWNER_RETURN if [ ! "$O_USER" = "$O_FILE_USER" ] && [ ! "$O_FILE_USER" = "root" ]; then echo "WARNING: $O_MESSAGE_STACK The user $O_FILE_USER can read $O_FILE" fi } group_can_read () { O_MESSAGE_STACK=$1 O_FILE=$2 O_USER=$3 get_group $O_FILE; O_FILE_GROUP=$GET_GROUP_RETURN P=`ls -lLd $O_FILE | cut -c 5` if [ "$P" = "r" ] && [ ! "$O_GROUP" = "root" ]; then # check the group actually has some members other than $O_USER group_has_other_members "$O_FILE_GROUP" "$O_USER"; # sets OTHER_MEMBERS to 1 or 0 if [ "$OTHER_MEMBERS" = "1" ]; then echo "WARNING: $O_MESSAGE_STACK The group $O_FILE_GROUP can read $O_FILE" fi fi } world_can_read () { O_MESSAGE_STACK=$1 O_FILE=$2 P=`ls -lLd $O_FILE | cut -c 8` if [ "$P" = "w" ]; then echo "WARNING: $O_MESSAGE_STACK World read is set for $O_FILE" fi } section () { echo echo '############################################' echo $1 echo '############################################' } # Guess OS if [ -x /usr/bin/showrev ]; then OS="solaris" SHADOW="/etc/shadow" elif [ -x /usr/sbin/sam -o -x /usr/bin/sam ]; then OS="hpux" SHADOW="/etc/shadow" elif [ -f /etc/master.passwd ]; then OS="bsd" SHADOW="/etc/master.passwd" else OS="linux" SHADOW="/etc/shadow" fi echo "Assuming the OS is: $OS" CONFIG_FILES="$CONFIG_FILES $SHADOW" # Set path so we can access usual directories. HPUX and some linuxes don't have sbin in the path. PATH=$PATH:/usr/bin:/bin:/sbin:/usr/sbin; export PATH # Check dependent programs are installed # Assume "which" is installed! PROGS="ls awk grep cat mount xargs file ldd strings" for PROG in $PROGS; do which $PROG 2>&1 > /dev/null if [ ! $? = "0" ]; then echo "ERROR: Dependend program '$PROG' is mising. Can't run. Sorry!" exit 1 fi done banner section "Recording hostname" hostname section "Recording uname" uname -a section "Recording Interface IP addresses" if [ $OS = 'hpux' ]; then for IFACE in `lanscan | grep x | awk '{print $5}' 2>/dev/null`; do ifconfig $IFACE 2>/dev/null done else ifconfig -a fi section "Checking if external authentication is allowed in /etc/passwd" FLAG=`grep '^+:' /etc/passwd` if [ -n "$FLAG" ]; then echo "WARNING: /etc/passwd allows external authentcation:" grep '^+:' /etc/passwd EXT_AUTH=1 else echo "No +:... line found in /etc/passwd" fi section "Checking nsswitch.conf for addition authentication methods" if [ -r "/etc/nsswitch.conf" ]; then NIS=`grep '^passwd' /etc/nsswitch.conf | grep 'nis'` if [ -n "$NIS" ]; then echo "WARNING: NIS is used for authentication on this system" EXT_AUTH=1 fi LDAP=`grep '^passwd' /etc/nsswitch.conf | grep 'ldap'` if [ -n "$LDAP" ]; then echo "WARNING: LDAP is used for authentication on this system" EXT_AUTH=1 fi if [ -z "$NIS" ] && [ -z "$LDAP" ]; then echo "Neither LDAP nor NIS are used for authentication" fi else echo "ERROR: File /etc/nsswitch.conf isn't readable. Skipping checks." fi # Check important config files aren't writable section "Checking for writable config files" for FILE in $CONFIG_FILES; do if [ -f "$FILE" ]; then check_perms "$FILE is a critical config file." "$FILE" root fi done section "Checking if $SHADOW is readable" check_read_perms "/etc/shadow holds authentication data" $SHADOW root section "Checking for password hashes in /etc/passwd" FLAG=`grep -v '^[^:]*:[x\*]*:' /etc/passwd | grep -v '^#'` if [ -n "$FLAG" ]; then echo "WARNING: There seem to be some password hashes in /etc/passwd" grep -v '^[^:]*:[x\*]*:' /etc/passwd | grep -v '^#' EXT_AUTH=1 else echo "No password hashes found in /etc/passwd" fi section "Checking account settings" # Check for something nasty like r00t::0:0::/:/bin/sh in /etc/passwd # We only need read access to /etc/passwd to be able to check this. if [ -r "/etc/passwd" ]; then OPEN=`grep "^[^:][^:]*::" /etc/passwd | cut -f 1 -d ":"` if [ -n "$OPEN" ]; then echo "WARNING: The following accounts have no password:" grep "^[^:][^:]*::" /etc/passwd | cut -f 1 -d ":" fi fi if [ -r "$SHADOW" ]; then echo "Checking for accounts with no passwords" if [ "$OS" = "linux" ]; then passwd -S -a | while read LINE do USER=`echo "$LINE" | awk '{print $1}'` STATUS=`echo "$LINE" | awk '{print $2}'` if [ "$STATUS" = "NP" ]; then echo "WARNING: User $USER doesn't have a password" fi done elif [ "$OS" = "solaris" ]; then passwd -s -a | while read LINE do USER=`echo "$LINE" | awk '{print $1}'` STATUS=`echo "$LINE" | awk '{print $2}'` if [ "$STATUS" = "NP" ]; then echo "WARNING: User $USER doesn't have a password" fi done fi else echo "File $SHADOW isn't readable. Skipping some checks." fi section "Checking library directories from /etc/ld.so.conf" if [ -f "/etc/ld.so.conf" ] && [ -r "/etc/ld.so.conf" ]; then for DIR in `grep '^/' /etc/ld.so.conf`; do check_perms "$DIR is in /etc/ld.so.conf." $DIR root done #FILES=`grep '^include' /etc/ld.so.conf | sed 's/^include *//'` #if [ ! -z "$FILES" ]; then # for DIR in `echo $FILES | xargs cat | sort -u`; do # done #fi else echo "File /etc/ld.so.conf not present. Skipping checks." fi # Check sudoers if we have permission - needs root normally section "Checking sudo configuration" if [ -f "/etc/sudoers" ] && [ -r "/etc/sudoers" ]; then echo ----------------- echo "Checking if sudo is configured" SUDO_USERS=`grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep -v '^[ \t]*Default' | grep =` if [ ! -z "$SUDO_USERS" ]; then echo "WARNING: Sudo is configured. Manually check nothing unsafe is allowed:" grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep = | grep -v '^[ \t]*Default' fi echo ----------------- echo "Checking sudo users need a password" SUDO_NOPASSWD=`grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep NOPASSWD` if [ ! -z "$SUDO_NOPASSWD" ]; then echo "WARNING: Some users can use sudo without a password:" grep -v '^#' /etc/sudoers | grep -v '^[ \t]*$' | grep NOPASSWD fi else echo "File /etc/sudoers not present. Skipping checks." fi section "Checking permissions on swap file(s)" for SWAP in `swapon -s | grep -v '^Filename' | cut -f 1 -d ' '`; do check_perms "$SWAP is used for swap space." $SWAP root check_read_perms "$SWAP is used for swap space." $SWAP root done section "Checking programs run from inittab" if [ -f "/etc/inittab" ] && [ -r "/etc/inittab" ]; then for FILE in `cat /etc/inittab | grep : | grep -v '^#' | cut -f 4 -d : | grep '/' | cut -f 1 -d ' ' | sort -u`; do check_called_programs "$FILE is run from /etc/inittab as root." $FILE root done else echo "File /etc/inittab not present. Skipping checks." fi section "Checking postgres trust relationships" for DIR in $PGDIRS; do if [ -d "$DIR" ] && [ -r "$DIR/pg_hba.conf" ]; then grep -v '^#' "$DIR/pg_hba.conf" | grep -v '^[ \t]*$' | while read LINE do AUTH=`echo "$LINE" | awk '{print $NF}'` if [ "$AUTH" = "trust" ]; then PGTRUST=1 echo "WARNING: Postgres trust configured in $DIR/pg_hba.conf: $LINE" fi done fi done PGVER1=`psql -U postgres template1 -c 'select version()' 2>/dev/null | grep version` if [ -n "$PGVER1" ]; then PGTRUST=1 echo "WARNING: Can connect to local postgres database as \"postgres\" without a password" fi PGVER2=`psql -U pgsql template1 -c 'select version()' 2>/dev/null | grep version` if [ -n "$PGVER2" ]; then PGTRUST=1 echo "WARNING: Can connect to local postgres database as \"pgsql\" without a password" fi if [ -z "$PGTRUST" ]; then echo "No postgres trusts detected" fi # Check device files for mounted file systems are secure # cat /proc/mounts | while read LINE # Doesn't work so well when LVM is used - need to be root section "Checking permissions on device files for mounted partitions" if [ "$OS" = "linux" ]; then mount | while read LINE do DEVICE=`echo "$LINE" | awk '{print $1}'` FS=`echo "$LINE" | awk '{print $5}'` if [ "$FS" = "ext2" ] || [ "$FS" = "ext3" ] ||[ "$FS" = "reiserfs" ]; then echo "Checking device $DEVICE" check_perms "$DEVICE is a mounted file system." $DEVICE root fi done elif [ "$OS" = "bsd" ]; then mount | grep ufs | while read LINE do DEVICE=`echo "$LINE" | awk '{print $1}'` echo "Checking device $DEVICE" check_perms "$DEVICE is a mounted file system." $DEVICE root done elif [ "$OS" = "solaris" ]; then mount | grep xattr | while read LINE do DEVICE=`echo "$LINE" | awk '{print $3}'` if [ ! "$DEVICE" = "swap" ]; then echo "Checking device $DEVICE" check_perms "$DEVICE is a mounted file system." $DEVICE root fi done elif [ "$OS" = "hpux" ]; then mount | while read LINE do DEVICE=`echo "$LINE" | awk '{print $3}'` C=`echo $DEVICE | cut -c 1` if [ "$C" = "/" ]; then echo "Checking device $DEVICE" check_perms "$DEVICE is a mounted file system." $DEVICE root fi done NFS=`mount | grep NFS` if [ -n "$NFS" ]; then echo "WARNING: This system is an NFS client. Check for nosuid and nodev options." mount | grep NFS fi fi # Check cron jobs if they're readable # TODO check that cron is actually running section "Checking cron job programs aren't writable (/etc/crontab)" CRONDIRS="" if [ -f "/etc/crontab" ] && [ -r "/etc/crontab" ]; then MYPATH=`grep '^PATH=' /etc/crontab | cut -f 2 -d = ` echo Crontab path is $MYPATH # Check if /etc/cron.(hourly|daily|weekly|monthly) are being used CRONDIRS=`grep -v '^#' /etc/crontab | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | grep run-crons` # Process run-parts grep -v '^#' /etc/crontab | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | grep run-parts | while read LINE do echo "Processing crontab run-parts entry: $LINE" USER=`echo "$LINE" | awk '{print $6}'` DIR=`echo "$LINE" | sed 's/.*run-parts[^()&|;\/]*\(\/[^ ]*\).*/\1/'` check_perms "$DIR holds cron jobs which are run as $USER." "$DIR" "$USER" if [ -d "$DIR" ]; then echo " Checking directory: $DIR" for FILE in $DIR/*; do FILENAME=`echo "$FILE" | sed 's/.*\///'` if [ "$FILENAME" = "*" ]; then echo " No files in this directory." continue fi check_called_programs "$FILE is run by cron as $USER." "$FILE" "$USER" done fi done # TODO bsd'd periodic: # 1 3 * * * root periodic daily # 15 4 * * 6 root periodic weekly # 30 5 1 * * root periodic monthly grep -v '^#' /etc/crontab | grep -v '^[ ]*$' | grep '[ ][^ ][^ ]*[ ][ ]*' | while read LINE do echo "Processing crontab entry: $LINE" USER=`echo "$LINE" | awk '{print $6}'` PROG=`echo "$LINE" | awk '{print $7}'` check_called_programs "$PROG is run from crontab as $USER." $PROG $USER $MYPATH done else echo "File /etc/crontab not present. Skipping checks." fi # Do this if run-crons is run from /etc/crontab if [ -n "$CRONDIRS" ]; then USER=`echo "$CRONDIRS" | awk '{print $6}'` section "Checking /etc/cron.(hourly|daily|weekly|monthly)" for DIR in hourly daily weekly monthly; do if [ -d "/etc/cron.$DIR" ]; then echo " Checking directory: /etc/cron.$DIR" for FILE in /etc/cron.$DIR/*; do FILENAME=`echo "$FILE" | sed 's/.*\///'` if [ "$FILENAME" = "*" ]; then echo "No files in this directory." continue fi check_called_programs "$FILE is run via cron as $USER." "$FILE" $USER done fi done fi section "Checking cron job programs aren't writable (/var/spool/cron/crontabs)" if [ -d "/var/spool/cron/crontabs" ]; then for FILE in /var/spool/cron/crontabs/*; do USER=`echo "$FILE" | sed 's/^.*\///'` if [ "$USER" = "*" ]; then echo "No user crontabs found in /var/spool/cron/crontabs. Skipping checks." continue fi echo "Processing crontab for $USER: $FILE" if [ -r "$FILE" ]; then MYPATH=`grep '^PATH=' "$FILE" | cut -f 2 -d = ` if [ -n "$MYPATH" ]; then echo Crontab path is $MYPATH fi grep -v '^#' "$FILE" | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | while read LINE do echo "Processing crontab entry: $LINE" PROG=`echo "$LINE" | awk '{print $6}'` check_called_programs "$PROG is run via cron as $USER." "$PROG" $USER done else echo "ERROR: Can't read file $FILE" fi done else echo "Directory /var/spool/cron/crontabs is not present. Skipping checks." fi section "Checking cron job programs aren't writable (/var/spool/cron/tabs)" if [ -d "/var/spool/cron/tabs" ]; then for FILE in /var/spool/cron/tabs/*; do USER=`echo "$FILE" | sed 's/^.*\///'` if [ "$USER" = "*" ]; then echo "No user crontabs found in /var/spool/cron/crontabs. Skipping checks." continue fi echo "Processing crontab for $USER: $FILE" if [ -r "$FILE" ]; then MYPATH=`grep '^PATH=' "$FILE" | cut -f 2 -d = ` if [ -n "$MYPATH" ]; then echo Crontab path is $MYPATH fi grep -v '^#' "$FILE" | grep -v '^[ \t]*$' | grep '[ \t][^ \t][^ \t]*[ \t][ \t]*' | while read LINE do echo "Processing crontab entry: $LINE" PROG=`echo "$LINE" | awk '{print $6}'` check_called_programs "$PROG is run from cron as $USER." $PROG $USER $MYPATH done else echo "ERROR: Can't read file $FILE" fi done else echo "Directory /var/spool/cron/tabs is not present. Skipping checks." fi # Check programs run from /etc/inetd.conf have secure permissions # TODO: check inetd is actually running section "Checking inetd programs aren't writable" if [ -f /etc/inetd.conf ] && [ -r /etc/inetd.conf ]; then grep -v '^#' /etc/inetd.conf | grep -v '^[ \t]*$' | while read LINE do USER=`echo $LINE | awk '{print $5}'` PROG=`echo $LINE | awk '{print $6}'` # could be tcpwappers ... PROG2=`echo $LINE | awk '{print $7}'` # ... and this is the real prog if [ -z "$PROG" ] || [ "$PROG" = "internal" ]; then # Not calling an external program continue fi echo Processing inetd line: $LINE if [ -f "$PROG" ]; then check_called_programs "$PROG is run from inetd as $USER." $PROG $USER fi if [ -f "$PROG2" ]; then check_called_programs "$PROG is run from inetd as $USER." $PROG2 $USER fi done else echo "File /etc/inetd.conf not present. Skipping checks." fi # Check programs run from /etc/xinetd.d/* # TODO: check xinetd is actually running section "Checking xinetd programs aren't writeable" if [ -d /etc/xinetd.d ]; then for FILE in `grep 'disable[ \t]*=[ \t]*no' /etc/xinetd.d/* | cut -f 1 -d :`; do echo Processing xinetd service file: $FILE PROG=`grep '^[ \t]*server[ \t]*=[ \t]*' $FILE | sed 's/.*server.*=[ \t]*//'` USER=`grep '^[ \t]*user[ \t]*=[ \t]*' $FILE | sed 's/.*user.*=[ \t]*//'` check_called_programs "$PROG is run from xinetd as $USER." $PROG $USER done else echo "Directory /etc/xinetd.d not present. Skipping checks." fi # Check for writable home directories section "Checking home directories aren't writable" cat /etc/passwd | grep -v '^#' | while read LINE do echo Processing /etc/passwd line: $LINE USER=`echo $LINE | cut -f 1 -d :` DIR=`echo $LINE | cut -f 6 -d :` SHELL=`echo $LINE | cut -f 7 -d :` if [ "$SHELL" = "/sbin/nologin" ] || [ "$SHELL" = "/bin/false" ]; then echo " Skipping user $USER. They don't have a shell." else if [ "$DIR" = "/dev/null" ]; then echo " Skipping /dev/null home directory" else check_perms "$DIR is the home directory of $USER." $DIR $USER fi fi done # Check for readable files in home directories section "Checking for readable sensitive files in home directories" cat /etc/passwd | while read LINE do USER=`echo $LINE | cut -f 1 -d :` DIR=`echo $LINE | cut -f 6 -d :` SHELL=`echo $LINE | cut -f 7 -d :` for FILE in $HOME_DIR_FILES; do if [ -f "$DIR/$FILE" ]; then check_read_perms "$DIR/$FILE is in the home directory of $USER." "$DIR/$FILE" $USER fi done done section "Checking SUID programs" if [ "$MODE" = "detailed" ]; then for FILE in `find / -type f -perm -04000 2>/dev/null`; do check_called_programs_suid $FILE done else echo "Skipping checks of SUID programs (it's slow!). Run again in 'detailed' mode." fi # Check for private SSH keys in home directories section "Checking for Private SSH Keys home directories" for HOMEDIR in `cut -f 6 -d : /etc/passwd`; do if [ -d "$HOMEDIR/.ssh" ]; then PRIV_KEYS=`grep -l 'BEGIN [RD]SA PRIVATE KEY' $HOMEDIR/.ssh/* 2>/dev/null` if [ -n "$PRIV_KEYS" ]; then for KEY in $PRIV_KEYS; do ENC_KEY=`grep -l 'ENCRYPTED' "$KEY" 2>/dev/null` if [ -n "$ENC_KEY" ]; then echo "WARNING: Encrypted Private SSH Key Found in $KEY" else echo "WARNING: Unencrypted Private SSH Key Found in $KEY" fi done fi fi done # Check for public SSH keys in home directories section "Checking for Public SSH Keys home directories" for HOMEDIR in `cut -f 6 -d : /etc/passwd`; do if [ -r "$HOMEDIR/.ssh/authorized_keys" ]; then KEYS=`grep '^ssh-' $HOMEDIR/.ssh/authorized_keys 2>/dev/null` if [ -n "$KEYS" ]; then echo "WARNING: Public SSH Key Found in $HOMEDIR/.ssh/authorized_keys" fi fi done # Check for any SSH agents running on the box section "Checking for SSH agents" AGENTS=`ps -ef | grep ssh-agent | grep -v grep` if [ -n "$AGENTS" ]; then echo "WARNING: There are SSH agents running on this system:" ps -ef | grep ssh-agent | grep -v grep # for PID in `ps aux | grep ssh-agent | grep -v grep | awk '{print $2}'`; do for SOCK in `ls /tmp/ssh-*/agent.* 2>/dev/null`; do SSH_AUTH_SOCK=$SOCK; export SSH_AUTH_SOCK AGENT_KEYS=`ssh-add -l | grep -v 'agent has no identities.' 2>/dev/null` if [ -n "$AGENT_KEYS" ]; then echo "WARNING: SSH Agent has keys loaded [SSH_AUTH_SOCK=$SSH_AUTH_SOCK]" ssh-add -l fi done else echo "No SSH agents found" fi # Check for any GPG agents running on the box section "Checking for GPG agents" AGENTS=`ps -ef | grep gpg-agent | grep -v grep` if [ -n "$AGENTS" ]; then echo "WARNING: There are GPG agents running on this system:" ps aux | grep gpg-agent | grep -v grep else echo "No GPG agents found" fi # Check files in /etc/init.d/* can't be modified by non-root users section "Checking startup files (init.d / rc.d) aren't writable" for DIR in /etc/init.d /etc/rc.d /usr/local/etc/rc.d; do if [ -d "$DIR" ]; then for FILE in $DIR/*; do F=`echo "$FILE" | sed 's/^.*\///'` if [ "$F" = "*" ]; then echo "No user startup script found in $DIR. Skipping checks." continue fi echo Processing startup script $FILE check_called_programs "$FILE is run by root at startup." $FILE root done fi done section "Checking if running programs are writable" if [ $OS = "solaris" ]; then # use the output of ps command ps -ef -o user,comm | while read LINE do USER=`echo "$LINE" | awk '{print $1}'` PROG=`echo "$LINE" | awk '{print $2}'` check_called_programs "$PROG is currently running as $USER." "$PROG" "$USER" done elif [ $OS = "bsd" ]; then # use the output of ps command ps aux | while read LINE do USER=`echo "$LINE" | awk '{print $1}'` PROG=`echo "$LINE" | awk '{print $11}'` check_called_programs "$PROG is currently running as $USER." "$PROG" "$USER" done elif [ $OS = "hpux" ]; then # use the output of ps command ps -ef | while read LINE do USER=`echo "$LINE" | awk '{print $1}'` PROG1=`echo "$LINE" | awk '{print $8}'` PROG2=`echo "$LINE" | awk '{print $9}'` if [ -f "$PROG1" ]; then check_called_programs "$PROG is currently running as $USER." "$PROG1" "$USER" fi if [ -f "$PROG2" ]; then check_called_programs "$PROG is currently running as $USER." "$PROG2" "$USER" fi done elif [ $OS = "linux" ]; then # use the /proc file system for PROCDIR in /proc/[0-9]*; do unset PROGPATH PID=`echo $PROCDIR | cut -f 3 -d /` echo ------------------------ echo "PID: $PID" if [ -d "$PROCDIR" ]; then if [ -r "$PROCDIR/exe" ]; then PROGPATH=`ls -l "$PROCDIR/exe" 2>&1 | sed 's/ (deleted)//' | awk '{print $NF}'` else if [ -r "$PROCDIR/cmdline" ]; then P=`cat $PROCDIR/cmdline | tr "\0" = | cut -f 1 -d = | grep '^/'` if [ -z "$P" ]; then echo "ERROR: Can't find full path of running program: "`cat $PROCDIR/cmdline` else PROGPATH=$P fi else echo "ERROR: Can't find full path of running program: "`cat $PROCDIR/cmdline` continue fi fi get_owner $PROCDIR; OWNER=$GET_OWNER_RETURN echo "Owner: $OWNER" else echo "ERROR: Can't find OWNER. Process has gone." continue fi if [ -n "$PROGPATH" ]; then get_owner $PROGPATH; PROGOWNER=$GET_OWNER_RETURN echo "Program path: $PROGPATH" check_called_programs "$PROGPATH is currently running as $OWNER." $PROGPATH $OWNER fi if [ "$MODE" == "detailed" ]; then for FILE in $PROCDIR/fd/*; do F=`echo "$FILE" | sed 's/^.*\///'` if [ "$F" = "*" ]; then continue fi check_perms "$FILE is an open file descriptor for process $PID running as $OWNER." $FILE $OWNER done fi done fi unix-privesc-check-1.4/COPYING.GPL0000644000000000000000000004310311112334013015225 0ustar rootroot GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. unix-privesc-check-1.4/COPYING.UNIX-PRIVESC-CHECK0000644000000000000000000000050511112334013017311 0ustar rootrootThis tool may be used for legal purposes only. Users take full responsibility for any actions performed using this tool. The author accepts no liability for damage caused by this tool. If these terms are not acceptable to you, then you are not permitted to use this tool. In all other respects the GPL version 2 applies. unix-privesc-check-1.4/CHANGELOG0000644000000000000000000000262311112334013014765 0ustar rootroot 2008-11-23 unix-privesc-check v1.4 * Added check of file perms of shared libraries used by SUID programs. * Tidied output slightly. 2008-11-09 unix-privesc-check v1.3 * Bug fix: Parts of the script only worked with /bin/bash and not /bin/sh * Bug fix: Fixed typos in reporting for privescs via cron. 2008-07-06 unix-privesc-check v1.2 * Added check of library dirs (/etc/ld.so.conf) for Linux * Crude check of programs called from shell scripts * Check of libraries used by each binary program (using ldd) * Check of hard-coded paths within binaries (using strings) * More verbose WARNING messages. All the explanation for a WARNING should now be on one line so you can grep for 'WARNING' and still understand the results * Check of file perms on open file handles of running processes * Check for running SSH agent. Lists keys if possible. * Check for public and private SSH keys in home directories. * Check for running GPG agent. * Check for cron jobs in /var/spool/cron/tabs * Extra non-priv check for local postgres trusts * Bug fix: lanscan now used on HPUX to get interface names * Check if system is an NFS client (HPUX only) * Check if swap space is readable / writable 2008-04-17 unix-privesc-check v1.1 * Added check for accounts with no password in /etc/passwd * Record some basic info about the host (hostname, uname -a, interface IPs) 2008-02-01 unix-privesc-check v1.0 * Initial public release