From 4058159391a96ceb2763481863b6b41615ac624d Mon Sep 17 00:00:00 2001 From: m-1-k-3 Date: Sun, 2 Apr 2023 16:10:49 +0200 Subject: [PATCH 1/4] L20 snmp checks --- config/trickest_blacklist.txt | 5 +++ modules/L20_snmp_checks.sh | 84 +++++++++++++++++++++++++++-------- 2 files changed, 70 insertions(+), 19 deletions(-) diff --git a/config/trickest_blacklist.txt b/config/trickest_blacklist.txt index de2f76af2..344265055 100644 --- a/config/trickest_blacklist.txt +++ b/config/trickest_blacklist.txt @@ -59,3 +59,8 @@ RxXwx3x/Redteam CVEDB/PoC-List vmmaltsev/13.1 Zhivarev/13-01-hw +7hang/cyber-security-interview +Eduardmihai1997/VulnerabilityManagement +PotterXma/linux-deployment-standard +paramint/AD-Attack-Defense +BSG9432/Districts-2023 diff --git a/modules/L20_snmp_checks.sh b/modules/L20_snmp_checks.sh index e364ec7e5..7d3a8a6af 100755 --- a/modules/L20_snmp_checks.sh +++ b/modules/L20_snmp_checks.sh @@ -38,7 +38,8 @@ L20_snmp_checks() { return fi fi - check_live_snmp "$IP_ADDRESS_" + check_basic_snmp "$IP_ADDRESS_" + check_snmp_vulns "$IP_ADDRESS_" else print_output "[!] No IP address found" fi @@ -49,36 +50,41 @@ L20_snmp_checks() { fi } -check_live_snmp() { +check_basic_snmp() { local IP_ADDRESS_="${1:-}" sub_module_title "SNMP enumeration for emulated system with IP $ORANGE$IP_ADDRESS_$NC" if command -v snmp-check > /dev/null; then print_output "[*] SNMP scan with community name ${ORANGE}public$NC" - snmp-check -w "$IP_ADDRESS_"| tee "$LOG_PATH_MODULE"/snmp-check-public-"$IP_ADDRESS_".txt + snmp-check -w "$IP_ADDRESS_" >> "$LOG_PATH_MODULE"/snmp-check-public-"$IP_ADDRESS_".txt if [[ -f "$LOG_PATH_MODULE"/snmp-check-public-"$IP_ADDRESS_".txt ]]; then - cat "$LOG_PATH_MODULE"/snmp-check-public-"$IP_ADDRESS_".txt >> "$LOG_FILE" + write_link "$LOG_PATH_MODULE"/snmp-check-public-"$IP_ADDRESS_".txt + cat "$LOG_PATH_MODULE"/snmp-check-public-"$IP_ADDRESS_".txt fi print_ln print_output "[*] SNMP scan with community name ${ORANGE}private$NC" - snmp-check -c private -w "$IP_ADDRESS_"| tee "$LOG_PATH_MODULE"/snmp-check-private-"$IP_ADDRESS_".txt + snmp-check -c private -w "$IP_ADDRESS_" >> "$LOG_PATH_MODULE"/snmp-check-private-"$IP_ADDRESS_".txt if [[ -f "$LOG_PATH_MODULE"/snmp-check-private-"$IP_ADDRESS_".txt ]]; then - cat "$LOG_PATH_MODULE"/snmp-check-private-"$IP_ADDRESS_".txt >> "$LOG_FILE" - fi - else - print_output "[*] SNMP scan with community name ${ORANGE}public$NC" - snmpwalk -v2c -c public "$IP_ADDRESS_" .iso | tee "$LOG_PATH_MODULE"/snmpwalk-public-"$IP_ADDRESS_".txt || true - if [[ -f "$LOG_PATH_MODULE"/snmp-check-public-"$IP_ADDRESS_".txt ]]; then - cat "$LOG_PATH_MODULE"/snmpwalk-public-"$IP_ADDRESS_".txt >> "$LOG_FILE" - fi - print_ln - print_output "[*] SNMP scan with community name ${ORANGE}private$NC" - snmpwalk -v2c -c private "$IP_ADDRESS_" .iso | tee "$LOG_PATH_MODULE"/snmapwalk-private-"$IP_ADDRESS_".txt || true - if [[ -f "$LOG_PATH_MODULE"/snmp-check-private-"$IP_ADDRESS_".txt ]]; then - cat "$LOG_PATH_MODULE"/snmpwalk-private-"$IP_ADDRESS_".txt >> "$LOG_FILE" + write_link "$LOG_PATH_MODULE"/snmp-check-private-"$IP_ADDRESS_".txt + cat "$LOG_PATH_MODULE"/snmp-check-private-"$IP_ADDRESS_".txt fi fi + + print_output "[*] SNMP walk with community name ${ORANGE}public$NC" + snmpwalk -v2c -c public "$IP_ADDRESS_" .iso | tee "$LOG_PATH_MODULE"/snmpwalk-public-"$IP_ADDRESS_".txt || true + if [[ -f "$LOG_PATH_MODULE"/snmpwalk-public-"$IP_ADDRESS_".txt ]]; then + write_link "$LOG_PATH_MODULE"/snmpwalk-public-"$IP_ADDRESS_".txt + cat "$LOG_PATH_MODULE"/snmpwalk-public-"$IP_ADDRESS_".txt + fi + print_ln + print_output "[*] SNMP walk with community name ${ORANGE}private$NC" + snmpwalk -v2c -c private "$IP_ADDRESS_" .iso | tee "$LOG_PATH_MODULE"/snmapwalk-private-"$IP_ADDRESS_".txt || true + if [[ -f "$LOG_PATH_MODULE"/snmpwalk-private-"$IP_ADDRESS_".txt ]]; then + write_link "$LOG_PATH_MODULE"/snmpwalk-private-"$IP_ADDRESS_".txt + cat "$LOG_PATH_MODULE"/snmpwalk-private-"$IP_ADDRESS_".txt + fi + SNMP_UP=$(wc -l "$LOG_PATH_MODULE"/snmp* | tail -1 | awk '{print $1}') if [[ "$SNMP_UP" -gt 20 ]]; then @@ -88,6 +94,46 @@ check_live_snmp() { fi print_ln - print_output "[*] SNMP tests for emulated system with IP $ORANGE$IP_ADDRESS_$NC finished" + print_output "[*] SNMP basic tests for emulated system with IP $ORANGE$IP_ADDRESS_$NC finished" } +check_snmp_vulns() { + local IP_ADDRESS_="${1:-}" + local SNMP_UP_tmp=0 + + sub_module_title "SNMP firmadyne disclosure checks" + + print_output "[*] This module tests multiple information disclosure vulnerabilities (${ORANGE}CVE-2016-1557 / CVE-2016-1559${NC})" + + OIDs=( "iso.3.6.1.4.1.171.10.37.35.2.1.3.3.2.1.1.4" "iso.3.6.1.4.1.171.10.37.38.2.1.3.3.2.1.1.4" \ + "iso.3.6.1.4.1.171.10.37.35.4.1.1.1" "iso.3.6.1.4.1.171.10.37.37.4.1.1.1" "iso.3.6.1.4.1.171.10.37.38.4.1.1.1" \ + "iso.3.6.1.4.1.4526.100.7.8.1.5" "iso.3.6.1.4.1.4526.100.7.9.1.5" "iso.3.6.1.4.1.4526.100.7.9.1.7" \ + "iso.3.6.1.4.1.4526.100.7.10.1.7" ) + + for OID in "${OIDs[@]}"; do + print_output "[*] Testing OID ${ORANGE}${OID}${NC} on IP address $ORANGE$IP_ADDRESS_$NC ..." + snmpwalk -v 2c -c public "${IP_ADDRESS_}" "${OID}" >> "$LOG_PATH_MODULE"/snmpwalk-firmadyne_disclosure-"$IP_ADDRESS_"-"${OID}".txt || true + snmpwalk -v 1 -c public "${IP_ADDRESS_}" "${OID}" >> "$LOG_PATH_MODULE"/snmpwalk-firmadyne_disclosure-"$IP_ADDRESS_"-"${OID}".txt || true + # remove "No Such Object" entries from the counting results: + if [[ $(grep -v "No Such Object" "$LOG_PATH_MODULE"/snmpwalk-firmadyne_disclosure-"$IP_ADDRESS_"-"${OID}".txt | wc -l) -gt 0 ]]; then + print_ln + print_output "[+] Possible credential disclosure detected (${ORANGE}CVE-2016-1557 / CVE-2016-1559${GREEN}):${NC}" + tee -a "$LOG_FILE" < "$LOG_PATH_MODULE"/snmpwalk-firmadyne_disclosure-"$IP_ADDRESS_"-"${OID}".txt + print_ln + else + rm "$LOG_PATH_MODULE"/snmpwalk-firmadyne_disclosure-"$IP_ADDRESS_"-"${OID}".txt || true + fi + done + + SNMP_UP_tmp=$(wc -l "$LOG_PATH_MODULE"/snmp* | tail -1 | awk '{print $1}') + + if [[ "$SNMP_UP_tmp" -gt 20 ]]; then + SNMP_UP=1 + fi + + # TODO: check output for vulnerability and integrate it into f20/f50 + + print_ln + print_output "[*] SNMP vulnerability tests for emulated system with IP $ORANGE$IP_ADDRESS_$NC finished" + +} From 930622768897fb428b19bb0489bc454f89850e45 Mon Sep 17 00:00:00 2001 From: m-1-k-3 Date: Sun, 2 Apr 2023 17:01:35 +0200 Subject: [PATCH 2/4] update readme --- README.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 35dfdb4bf..d3cfd8bb4 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@