staubgeborener/cve-2020-11932CVE-2020-11932 (ubuntu server)를 확인하고 이 취약점과 관련된 호스트를 테스트합니다
CVE-2020-11932을 확인하고 이 취약점과 관련된 호스트를 테스트합니다.
git clone https://github.com/Staubgeborener/CVE-2020-11932
cd CVE-2020-11932
chmod +x cve-2020-11932.sh
./cve-2020-11932.sh
bash <(curl -s https://raw.githubusercontent.com/Staubgeborener/CVE-2020-11932/master/cve-2020-11932.sh)
이것은 취약점 CVE-2020-11932에 대한 개념 증명입니다. Ubuntu Server가 LUKS 전체 디스크 암호화의 비밀번호를 평문으로 로그할 가능성이 있습니다. 이 내용은 Ubuntu Server 20.04에서 테스트되었습니다.
비밀번호 T0pS3cr3tP4ssw0rd로 LUKS 암호화(LVM)를 생성했습니다. 비밀번호를 평문으로 포함하는 다섯 개의 파일을 찾을 수 있습니다: sudo grep -Rl "T0pS3cr3tP4ssw0rd" /:
user@encryptiontest:~$ sudo grep -Rl "T0pS3cr3tP4ssw0rd" /
/var/log/installer/subiquity-curtin-install.conf
/var/log/installer/curtin-install-cfg.yaml
/var/log/installer/curtin-install.log
/var/log/installer/installer-journal.txt
/var/log/installer/autoinstall-user-data
user@encryptiontest:~$ grep "T0pS3cr3tP4ssw0rd" /var/log/installer/subiquity-curtin-install.conf
- {volume: partition-2, key: T0pS3cr3tP4ssw0rd, preserve: false, type: dm_crypt,
user@encryptiontest:~$ sudo grep T0pS3cr3tP4ssw0rd /var/log/installer/curtin-install-cfg.yaml
[sudo] password for user:
key: T0pS3cr3tP4ssw0rd
user@encryptiontest:~$ sudo grep "T0pS3cr3tP4ssw0rd" /var/log/installer/curtin-install.log
get_path_to_storage_volume for volume dm_crypt-0({'volumel: 'partition-2', 'key': T0pS3cr3tP4ssw0rd, 'preserve': False, 'type': 'dm_crypt', 'id': 'dm_crypt-0'})
user@encryptiontest:~$ sudo grep -o "T0pS3cr3tP4ssw0rd" /var/log/installer/installer-journal.txt
T0pS3cr3tP4ssw0rd
T0pS3cr3tP4ssw0rd
user@encryptiontest:~$ sudo grep T0pS3cr3tP4ssw0rd /var/log/installer/autoinstall-user-data
- {volume: partition-2, key: T0pS3cr3tP4ssw0rd, preserve: false, type: dm_crypt,
root@encryptiontest:/home/user# ./CVE-2020-11932.sh
Checking subiquity-curtin-install.conf:
volume: partition-2, key: T0pS3cr3tP4ssw0rd, preserve: false, type: dm_crypt
⇒ cve-2020-11932.sh 실행 후 다음과 같은 출력을 얻게 됩니다:
Checking curtin-install-cfg.yaml:
key: T0pS3cr3tP4ssw0rd
Checking curtin-install.log:
get_path_to_storage_volume for volume dm_crypt-0({'volume': 'partition-2', 'key': 'T0pS3cr3tP4ssw0rd', 'preserve': False, 'type': 'dm_crypt', 'id': 'dm_crypt-01'})
Checking installer-journal.txt:
'T0pS3cr3tP4ssw0rd', 'preserve': False, 'type': 'dm_crypt', 'id': 'dm_crypt-0'}, {'name': 'ubuntu-vg', 'devices': ['dm_crypt-0'], 'preserve': False, 'type': 'lvm_volgroup', 'id': lvm_volgroup-0', 'name': 'ubuntu-lv', 'volgroup': lvm_volgroup-0', 'size': '42949672966', 'preserve': False, 'type': 'lvm_partition', 'id': lvm_partition-01, {'fstype': 'ext4', 'volume': lvm_partition-0'
'T0pS3cr3tP4ssw0rd'
Checking autoinstall-user-data:
{volume: partition-2, key: T0pS3cr3tP4ssw0rd, preserve: false, type: dm_crypt
CVE-2020-11932 vulnerability on this Ubuntu Release: 20.04 !
Found: key1: T0pS3cr3tP4ssw0rd
key2: T0pS3cr3tP4ssw0rd
key3: get_path_to_storage_volume for volume dm_crypt-0({'volumel: 'partition-2', 'key': 'T0pS3cr3tP4ssw0rd', 'preserve': False, 'type': 'dm_crypt', 'id': 'dm_crypt-0'})
key4: T0pS3cr3tP4ssw0rd
T0pS3cr3tP4ssw0rd
key5: T0pS3cr3tP4ssw0rd
이 프로젝트는 MIT 라이선스에 따라 라이선스가 부여됩니다. 자세한 내용은 라이선스 파일을 참조하세요.