staubgeborener/cve-2020-11932Verifique a CVE-2020-11932 (ubuntu server) e teste o host relacionado a esta vulnerabilidade
Verifique CVE-2020-11932 e teste o host relacionado a esta vulnerabilidade
git clone https://github.com/Staubgeborener/CVE-2020-11932
cd CVE-2020-11932
chmod +x cve-2020-11932.sh
./cve-2020-11932.sh
bash <(curl -s https://raw.githubusercontent.com/Staubgeborener/CVE-2020-11932/master/cve-2020-11932.sh)
Isto é uma espécie de prova de conceito da vulnerabilidade CVE-2020-11932. É possível que o Ubuntu Server registre a senha da criptografia de disco completo LUKS em . Este foi testado no .
Ubuntu Server 20.04Criptografia LUKS (LVM) criada com a senha T0pS3cr3tP4ssw0rd. Podemos encontrar cinco arquivos que contêm a senha em texto simples sudo grep -Rl "T0pS3cr3tP4ssw0rd" /:
user@encryptiontest:~$ sudo grep -Rl "T0pS3cr3tP4ssw0rd" /
/var/log/installer/subiquity-curtin-install.conf
/var/log/installer/curtin-install-cfg.yaml
/var/log/installer/curtin-install.log
/var/log/installer/installer-journal.txt
/var/log/installer/autoinstall-user-data
user@encryptiontest:~$ grep "T0pS3cr3tP4ssw0rd" /var/log/installer/subiquity-curtin-install.conf
- {volume: partition-2, key: T0pS3cr3tP4ssw0rd, preserve: false, type: dm_crypt,
user@encryptiontest:~$ sudo grep T0pS3cr3tP4ssw0rd /var/log/installer/curtin-install-cfg.yaml
[sudo] password for user:
key: T0pS3cr3tP4ssw0rd
user@encryptiontest:~$ sudo grep "T0pS3cr3tP4ssw0rd" /var/log/installer/curtin-install.log
get_path_to_storage_volume for volume dm_crypt-0({'volumel: 'partition-2', 'key': T0pS3cr3tP4ssw0rd, 'preserve': False, 'type': 'dm_crypt', 'id': 'dm_crypt-0'})
user@encryptiontest:~$ sudo grep -o "T0pS3cr3tP4ssw0rd" /var/log/installer/installer-journal.txt
T0pS3cr3tP4ssw0rd
T0pS3cr3tP4ssw0rd
user@encryptiontest:~$ sudo grep T0pS3cr3tP4ssw0rd /var/log/installer/autoinstall-user-data
- {volume: partition-2, key: T0pS3cr3tP4ssw0rd, preserve: false, type: dm_crypt,
root@encryptiontest:/home/user# ./CVE-2020-11932.sh
Checking subiquity-curtin-install.conf:
volume: partition-2, key: T0pS3cr3tP4ssw0rd, preserve: false, type: dm_crypt
⇒ Após executar cve-2020-11932.sh você obterá uma saída como esta:
Checking curtin-install-cfg.yaml:
key: T0pS3cr3tP4ssw0rd
Checking curtin-install.log:
get_path_to_storage_volume for volume dm_crypt-0({'volume': 'partition-2', 'key': 'T0pS3cr3tP4ssw0rd', 'preserve': False, 'type': 'dm_crypt', 'id': 'dm_crypt-01'})
Checking installer-journal.txt:
'T0pS3cr3tP4ssw0rd', 'preserve': False, 'type': 'dm_crypt', 'id': 'dm_crypt-0'}, {'name': 'ubuntu-vg', 'devices': ['dm_crypt-0'], 'preserve': False, 'type': 'lvm_volgroup', 'id': lvm_volgroup-0', 'name': 'ubuntu-lv', 'volgroup': lvm_volgroup-0', 'size': '42949672966', 'preserve': False, 'type': 'lvm_partition', 'id': lvm_partition-01, {'fstype': 'ext4', 'volume': lvm_partition-0'
'T0pS3cr3tP4ssw0rd'
Checking autoinstall-user-data:
{volume: partition-2, key: T0pS3cr3tP4ssw0rd, preserve: false, type: dm_crypt
CVE-2020-11932 vulnerability on this Ubuntu Release: 20.04 !
Found: key1: T0pS3cr3tP4ssw0rd
key2: T0pS3cr3tP4ssw0rd
key3: get_path_to_storage_volume for volume dm_crypt-0({'volumel: 'partition-2', 'key': 'T0pS3cr3tP4ssw0rd', 'preserve': False, 'type': 'dm_crypt', 'id': 'dm_crypt-0'})
key4: T0pS3cr3tP4ssw0rd
T0pS3cr3tP4ssw0rd
key5: T0pS3cr3tP4ssw0rd
Este projeto está licenciado sob a Licença MIT. Dê uma olhada no arquivo de licença para mais informações.