belane/linux-soft-exploit-suggester리눅스에서 취약한 소프트웨어 검색
시스템에서 취약한 소프트웨어에 대한 익스플로잇을 찾는 스크립트로, 커널 취약점뿐만 아니라 소프트웨어 패키지를 대상으로 합니다. 익스플로잇 데이터베이스를 사용하여 패키지의 보안을 평가하고 권한 상승에 도움이 되는 익스플로잇을 검색합니다.
wget https://raw.githubusercontent.com/belane/linux-soft-exploit-suggester/master/linux-soft-exploit-suggester.py
python linux-soft-exploit-suggester.py
dpkg -l > package_listrpm -qa > package_listpython linux-soft-exploit-suggester.py --file package_list --distro debian
python linux-soft-exploit-suggester.py --update
python linux-soft-exploit-suggester.py --juicy
python linux-soft-exploit-suggester.py --level 2 --type local
> python linux-soft-exploit-suggester.py --file packages --db files_exploits.csv
| _ __ _ _ | _ _ | _ | __ __ __ _ __ | _ _
|·| || |\/ (_ | ||_ |- /_)\/| \|| |·|- (_ | || )| )/_)(_ |- /_)|
||| ||_|/\ __)|_|| |_ \_ /\|_/||_|||_ __)|_||_/ |_/ \_ __) |_ \_ |
| _/ _/
[!] DNSTracer 1.9 - Buffer Overflow - local
From: dnstracer 1.9
File: /usr/share/exploitdb/platforms/linux/local/42424.py
Url: https://www.exploit-db.com/exploits/42424
[!] GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution - remote
From: wget 1.17.1
File: /usr/share/exploitdb/platforms/linux/remote/40064.txt
Url: https://www.exploit-db.com/exploits/40064
[!] GNU Screen 4.5.0 - Privilege Escalation (PoC) - local
From: screen 4.3.1
File: /usr/share/exploitdb/platforms/linux/local/41152.txt
Url: https://www.exploit-db.com/exploits/41152
[!] Ghostscript 9.21 - Type Confusion Arbitrary Command Execution (Metasploit) - local
From: ghostscript 9.21
File: /usr/share/exploitdb/platforms/linux/local/41955.rb
Url: https://www.exploit-db.com/exploits/41955
[!] MAWK 1.3.3-17 - Local Buffer Overflow - local
From: mawk 1.3.3
File: /usr/share/exploitdb/platforms/linux/local/42357.py
Url: https://www.exploit-db.com/exploits/42357
[!] Sudo 1.8.20 - 'get_process_ttyname()' Privilege Escalation - local
From: sudo 1.8.20
File: /usr/share/exploitdb/platforms/linux/local/42183.c
Url: https://www.exploit-db.com/exploits/42183
...
> python linux-soft-exploit-suggester.py -h
| _ __ _ _ | _ _ | _ | __ __ __ _ __ | _ _
|·| || |\/ (_ | ||_ |- /_)\/| \|| |·|- (_ | || )| )/_)(_ |- /_)|
||| ||_|/\ __)|_|| |_ \_ /\|_/||_|||_ __)|_||_/ |_/ \_ __) |_ \_ |
| _/ _/
linux-soft-exploit-suggester:
Search for Exploitable Software from package list.
optional arguments:
-h, --help Show this help message and exit
-f FILE, --file FILE Package list file
--clean Use clean package list, if used 'dpkg-query -W'
--duplicates Show duplicate exploits
--db DB Exploits csv file [default: files_exploits.csv]
-j, --juicy Search packages of running processes, setuid binaries and linux capabilities
--update Download latest version of exploits db
-d debian|redhat, --distro debian|redhat
Linux flavor, debian or redhat [default: debian]
--dos Include DoS exploits
--intense Include intense package name search,
when software name doesn't match package name (experimental)
-l 1-5, --level 1-5 Software version search variation [default: 1]
level 1: Same version
level 2: Micro and Patch version
level 3: Minor version
level 4: Major version
level 5: All versions
--type TYPE Exploit type; local, remote, webapps, dos.
e.g. --type local
--type remote
--filter FILTER Filter exploits by string
e.g. --filter "escalation"
usage examples:
기본 사용:
python linux-soft-exploit-suggester.py
익스플로잇 데이터베이스 업데이트:
python linux-soft-exploit-suggester.py --update
juicy 바이너리에서 패키지 검색:
python linux-soft-exploit-suggester.py --juicy
패키지 목록 또는 익스플로잇 DB 지정:
python linux-soft-exploit-suggester.py --file package_list --db files_exploits.csv
Redhat/Centos 형식 파일 사용:
python linux-soft-exploit-suggester.py --file package_list --distro redhat
메이저 버전에 대한 익스플로잇 검색:
python linux-soft-exploit-suggester.py --file package_list --level 4
원격 익스플로잇으로 필터링:
python linux-soft-exploit-suggester.py --file package_list --type remote
익스플로잇 제목에서 특정 단어 검색:
python linux-soft-exploit-suggester.py --file package_list --filter Overflow