()
Look for web servers on UNIX domain sockets
Look for web servers on UNIX domain sockets
Look for web servers on UNIX domain sockets
def uptux_check_socket_apis():
    """Look for web servers on UNIX domain sockets"""
    # Use Linux ss tool to find sockets in listening state
    command = 'ss -xlp -H state listening'
    output = shell_exec(command)

    # We get Unicode back from the above command, let's fix
    output = str(output)

    root_sockets = []
    socket_replies = {}

    # We want to grab all the strings that look like socket paths
    sockets = re.findall(r' (/.*?) ', output)
    abstract_sockets = re.findall(r' (@.*?) ', output)

    for socket_path in sockets:
        # For now, we are only interested in sockets owned by root
        if os.path.exists(socket_path) and os.stat(socket_path).st_uid == 0:
            root_sockets.append(socket_path)

    tee("Trying to connect to {} unix sockets owned by uid 0..."
        .format(len(root_sockets)), box='ok')
    tee("")

    # Cycle through each and try to send a raw HTTP GET
    for socket_target in root_sockets:

        # Define a raw HTTP GET request
        http_get = ('GET / HTTP/1.1\r\n'
                    'Host: localhost\r\n'
                    '\r\n\r\n')

        # Try to interact with the socket like a web API
        client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
        client.settimeout(5)
        try:
            client.connect(socket_target)
            client.sendall(http_get.encode())

            reply = client.recv(8192).decode()

            # If we get a reply to this, we assume it is an API
            if reply:
                socket_replies[socket_target] = reply

        except (socket.error, UnicodeDecodeError):
            continue

    # If we have some replies, print to console
    # Hack-ish string replacement to get a nice indent
    if socket_replies:
        tee("The following root-owned sockets replied as follows",
            box='sus')
        for socket_path in socket_replies:
            tee("  " + socket_path + ":")
            tee("    " + socket_replies[socket_path]
                .replace('\n', '\n    '))
            tee("")
def uptux_check_socket_apis ( ) : # Use Linux ss tool to find sockets in listening state command = 'ss -xlp -H state listening' output = shell_exec ( command ) # We get Unicode back from the above command, let's fix output = str ( output ) root_sockets = [ ] socket_replies = { } # We want to grab all the strings that look like socket paths sockets = re . findall ( r' (/.*?) ' , output ) abstract_sockets = re . findall ( r' (@.*?) ' , output ) for socket_path in sockets : # For now, we are only interested in sockets owned by root if os . path . exists ( socket_path ) and os . stat ( socket_path ) . st_uid == 0 : root_sockets . append ( socket_path ) tee ( "Trying to connect to {} unix sockets owned by uid 0..." . format ( len ( root_sockets ) ) , box = 'ok' ) tee ( "" ) # Cycle through each and try to send a raw HTTP GET for socket_target in root_sockets : # Define a raw HTTP GET request http_get = ( 'GET / HTTP/1.1\r\n' 'Host: localhost\r\n' '\r\n\r\n' ) # Try to interact with the socket like a web API client = socket . socket ( socket . AF_UNIX , socket . SOCK_STREAM ) client . settimeout ( 5 ) try : client . connect ( socket_target ) client . sendall ( http_get . encode ( ) ) reply = client . recv ( 8192 ) . decode ( ) # If we get a reply to this, we assume it is an API if reply : socket_replies [ socket_target ] = reply except ( socket . error , UnicodeDecodeError ) : continue # If we have some replies, print to console # Hack-ish string replacement to get a nice indent if socket_replies : tee ( "The following root-owned sockets replied as follows" , box = 'sus' ) for socket_path in socket_replies : tee ( "  " + socket_path + ":" ) tee ( "    " + socket_replies [ socket_path ] . replace ( '\n' , '\n    ' ) ) tee ( "" )