()
Inspect systemd socket unit files
Inspect systemd socket unit files
Inspect systemd socket unit files
def uptux_check_socket_units():
    """Inspect systemd socket unit files"""
    units = set()
    mask = '*.socket'
    units = find_system_files(known_dirs=SYSTEMD_DIRS,
                              search_mask=mask)

    tee("Found {} socket units to analyse...\n".format(len(units)),
        box='ok')

    # Test for write access to any socket files.
    # Will resolve symlinks to their target and also check for broken links.
    text = 'Found writeable socket unit files:'
    text2 = 'Found writeable directories referred to by broken symlinks'
    box = 'vuln'
    tee("")
    tee("Checking permissions on socket unit files...",
        box='ok')
    check_file_permissions(file_paths=units,
                           files_message_text=text,
                           dirs_message_text=text2,
                           message_box=box)

    # Check for write access to any socket files created by a service.
    # This can be interesting - I've seen a systemd service run a REST
    # API on a AF_UNIX socket. This would be missed by normal privesc
    # checks.
    # Thhs regex below is used to extract command lines.
    regex = re.compile(r'^Listen.*?=[!@+-]*(.*?$)',
                       re.MULTILINE)

   # We don't pass message info to this function as we need to perform more
    # processing on the output to determine what is writeable.
    tee("")
    tee("Checking for write access to AF_UNIX sockets...",
        box='ok')
    socket_files = regex_vuln_search(file_paths=units,
                                     regex=regex,
                                     message_text='',
                                     message_box='')

    # Another helper function to take the extracted commands and check for
    # write permissions.
    text = ('You have write access to AF_UNIX socket files invoked by a'
            ' systemd service.\n'
            'This could be interesting. \n'
            'You can attach to these files to look for an exploitable API.')
    box = 'sus'
    check_command_permission(commands=socket_files,
                             message_text=text,
                             message_box=box)
def uptux_check_socket_units ( ) : units = set ( ) mask = '*.socket' units = find_system_files ( known_dirs = SYSTEMD_DIRS , search_mask = mask ) tee ( "Found {} socket units to analyse...\n" . format ( len ( units ) ) , box = 'ok' ) # Test for write access to any socket files. # Will resolve symlinks to their target and also check for broken links. text = 'Found writeable socket unit files:' text2 = 'Found writeable directories referred to by broken symlinks' box = 'vuln' tee ( "" ) tee ( "Checking permissions on socket unit files..." , box = 'ok' ) check_file_permissions ( file_paths = units , files_message_text = text , dirs_message_text = text2 , message_box = box ) # Check for write access to any socket files created by a service. # This can be interesting - I've seen a systemd service run a REST # API on a AF_UNIX socket. This would be missed by normal privesc # checks. # Thhs regex below is used to extract command lines. regex = re . compile ( r'^Listen.*?=[!@+-]*(.*?$)' , re . MULTILINE ) # We don't pass message info to this function as we need to perform more # processing on the output to determine what is writeable. tee ( "" ) tee ( "Checking for write access to AF_UNIX sockets..." , box = 'ok' ) socket_files = regex_vuln_search ( file_paths = units , regex = regex , message_text = '' , message_box = '' ) # Another helper function to take the extracted commands and check for # write permissions. text = ( 'You have write access to AF_UNIX socket files invoked by a' ' systemd service.\n' 'This could be interesting. \n' 'You can attach to these files to look for an exploitable API.' ) box = 'sus' check_command_permission ( commands = socket_files , message_text = text , message_box = box )