Skip to content

Commit 3166d07

Browse files
bwatters-r7bwatters-r7
authored
Merge pull request rapid7#19982 from jvoisin/find_apps
Improve a bit modules/post/linux/gather/enum_protections.rb
2 parents 10e8cbb + c3c62e5 commit 3166d07

File tree

1 file changed

+212
-60
lines changed

1 file changed

+212
-60
lines changed

‎modules/post/linux/gather/enum_protections.rb‎

Lines changed: 212 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,11 @@ def run
4242
print_status 'Finding system protections...'
4343
check_hardening
4444

45-
print_status 'Finding installed applications...'
46-
find_apps
45+
print_status 'Finding installed applications via their executables...'
46+
find_exes
47+
48+
print_status 'Finding installed applications via their configuration files...'
49+
find_config
4750

4851
if framework.db.active
4952
print_status 'System protections saved to notes.'
@@ -60,93 +63,242 @@ def report(data)
6063
end
6164

6265
def check_hardening
63-
if aslr_enabled?
64-
r = 'ASLR is enabled'
65-
print_good r
66-
report r
66+
begin
67+
if aslr_enabled?
68+
r = 'ASLR is enabled'
69+
print_good r
70+
report r
71+
end
72+
rescue RuntimeError => e
73+
vprint_status("#{e}")
6774
end
6875

69-
if exec_shield_enabled?
70-
r = 'Exec-Shield is enabled'
71-
print_good r
72-
report r
76+
begin
77+
if exec_shield_enabled?
78+
r = 'Exec-Shield is enabled'
79+
print_good r
80+
report r
81+
end
82+
rescue RuntimeError => e
83+
vprint_status("#{e}")
7384
end
7485

75-
if kaiser_enabled?
76-
r = 'KAISER is enabled'
77-
print_good r
78-
report r
86+
begin
87+
if kaiser_enabled?
88+
r = 'KAISER is enabled'
89+
print_good r
90+
report r
91+
end
92+
rescue RuntimeError => e
93+
vprint_status("#{e}")
7994
end
8095

81-
if smep_enabled?
82-
r = 'SMEP is enabled'
83-
print_good r
84-
report r
96+
begin
97+
if smep_enabled?
98+
r = 'SMEP is enabled'
99+
print_good r
100+
report r
101+
end
102+
rescue RuntimeError => e
103+
vprint_status("#{e}")
85104
end
86105

87-
if smap_enabled?
88-
r = 'SMAP is enabled'
89-
print_good r
90-
report r
106+
begin
107+
if smap_enabled?
108+
r = 'SMAP is enabled'
109+
print_good r
110+
report r
111+
end
112+
rescue RuntimeError => e
113+
vprint_status("#{e}")
91114
end
92115

93-
if lkrg_installed?
94-
r = 'LKRG is installed'
95-
print_good r
96-
report r
116+
begin
117+
if lkrg_installed?
118+
r = 'LKRG is installed'
119+
print_good r
120+
report r
121+
end
122+
rescue RuntimeError => e
123+
vprint_status("#{e}")
97124
end
98125

99-
if grsec_installed?
100-
r = 'grsecurity is installed'
101-
print_good r
102-
report r
126+
begin
127+
if grsec_installed?
128+
r = 'grsecurity is installed'
129+
print_good r
130+
report r
131+
end
132+
rescue RuntimeError => e
133+
vprint_status("#{e}")
103134
end
104135

105-
if pax_installed?
106-
r = 'PaX is installed'
107-
print_good r
108-
report r
136+
begin
137+
if pax_installed?
138+
r = 'PaX is installed'
139+
print_good r
140+
report r
141+
end
142+
rescue RuntimeError => e
143+
vprint_status("#{e}")
109144
end
110145

111-
if selinux_installed?
112-
if selinux_enforcing?
113-
r = 'SELinux is installed and enforcing'
114-
else
115-
r = 'SELinux is installed, but in permissive mode'
146+
begin
147+
if selinux_installed?
148+
if selinux_enforcing?
149+
r = 'SELinux is installed and enforcing'
150+
else
151+
r = 'SELinux is installed, but in permissive mode'
152+
end
153+
print_good r
154+
report r
116155
end
117-
print_good r
118-
report r
156+
rescue RuntimeError => e
157+
vprint_status("#{e}")
119158
end
120159

121-
if yama_installed?
122-
if yama_enabled?
123-
r = 'Yama is installed and enabled'
124-
else
125-
r = 'Yama is installed, but not enabled'
160+
begin
161+
if yama_installed?
162+
if yama_enabled?
163+
r = 'Yama is installed and enabled'
164+
else
165+
r = 'Yama is installed, but not enabled'
166+
end
167+
print_good r
168+
report r
126169
end
127-
print_good r
128-
report r
170+
rescue RuntimeError => e
171+
vprint_status("#{e}")
129172
end
130173
end
131174

132-
def find_apps
133-
apps = %w[
134-
truecrypt bulldog ufw iptables fw-settings logrotate logwatch
135-
chkrootkit clamav snort tiger firestarter avast lynis
136-
rkhunter tcpdump webmin jailkit pwgen proxychains bastille
137-
psad wireshark nagios apparmor oz-seccomp honeyd thpot
138-
aa-status gradm gradm2 getenforce aide tripwire paxctl
139-
paxctld paxtest firejail auditd
140-
]
141-
142-
apps.each do |app|
175+
def find_exes
176+
apps = {
177+
'aa-status' => 'AppArmor',
178+
'aide' => 'Advanced Intrusion Detection Environment (AIDE)',
179+
'apparmor' => 'AppArmor',
180+
'auditd' => 'auditd',
181+
'avast' => 'Avast',
182+
'bastille' => 'Bastille',
183+
'bulldog' => 'Bulldog',
184+
'chkrootkit' => 'chkrootkit',
185+
'clamav' => 'ClamAV',
186+
'elastic-agent' => 'Elastic Security',
187+
'firejail' => 'Firejail',
188+
'firestarter' => 'Firestarted',
189+
'fw-settings' => 'Uncomplicated FireWall (UFW)',
190+
'getenforce' => 'SELinux',
191+
'gradm' => 'grsecurity',
192+
'gradm2' => 'grsecurity',
193+
'honeyd' => 'Honeyd',
194+
'iptables' => 'iptables',
195+
'jailkit' => 'jailkit',
196+
'logrotate' => 'logrotate',
197+
'logwatch' => 'logwatch',
198+
'lynis' => 'lynis',
199+
'nagios' => 'nagios',
200+
'oz-seccomp' => 'OZ',
201+
'paxctl' => 'PaX',
202+
'paxctld' => 'PaX',
203+
'paxtest' => 'PaX',
204+
'proxychains' => 'ProxyChains',
205+
'psad' => 'psad',
206+
'rkhunter' => 'rkhunter',
207+
'snort' => 'snort',
208+
'tcpdump' => 'tcpdump',
209+
'thpot' => 'thpot',
210+
'tiger' => 'tiger',
211+
'tripwire' => 'tripwire',
212+
'ufw' => 'Uncomplicated FireWall (UFW)',
213+
'wireshark' => 'Wireshark'
214+
}
215+
216+
apps.each do |app, appname|
143217
next unless command_exists? app
144218

145219
path = cmd_exec "command -v #{app}"
146220
next unless path.start_with? '/'
147221

148222
print_good "#{app} found: #{path}"
149-
report path
223+
report "#{appname}: #{path}"
224+
end
225+
end
226+
227+
def find_config
228+
apps = {
229+
'/bin/logrhythm' => 'LogRhythm Axon',
230+
'/etc/aide/aide.conf' => 'Advanced Intrusion Detection Environment (AIDE)',
231+
'/etc/chkrootkit' => 'chkrootkit [chkrootkit -q]',
232+
'/etc/clamd.d/scan.conf' => 'ClamAV',
233+
'/etc/fluent-bit' => 'Fluent Bit Log Collector',
234+
'/etc/freshclam.conf' => 'ClamAV',
235+
'/etc/init.d/avast' => 'Avast',
236+
'/etc/init.d/avgd' => 'AVG',
237+
'/etc/init.d/ds_agent' => 'Trend Micro Deep Instinct',
238+
'/etc/init.d/fortisiem-linux-agent' => 'Fortinet FortiSIEM',
239+
'/etc/init.d/kics' => 'Kaspersky Industrial CyberSecurity',
240+
'/etc/init.d/limacharlie' => 'LimaCharlie Agent',
241+
'/etc/init.d/qualys-cloud-agent' => 'Qualys EDR Cloud Agent',
242+
'/etc/init.d/scsm' => 'LogRhythm System Monitor',
243+
'/etc/init.d/sisamdagent' => 'Symantec EDR',
244+
'/etc/init.d/splx' => 'Trend Micro Server Protect',
245+
'/etc/init.d/threatconnect-envsvr' => 'ThreatConnect',
246+
'/etc/logrhythm' => 'LogRhythm Axon',
247+
'/etc/opt/f-secure' => 'WithSecure (F-Secure)',
248+
'/etc/otelcol-sumo/sumologic.yaml' => 'Sumo Logic OTEL Collector',
249+
'/etc/rkhunter.conf' => 'rkhunter',
250+
'/etc/safedog/sdsvrd.conf' => 'Safedog',
251+
'/etc/safedog/server/conf/sdsvrd.conf' => 'Safedog',
252+
'/etc/tripwire' => 'TripWire',
253+
'/opt/COMODO' => 'Comodo AV',
254+
'/opt/CrowdStrike' => 'CrowdShite',
255+
'/opt/FortiEDRCollector' => 'Fortinet FortiEDR',
256+
'/opt/FortiEDRCollector/scripts/fortiedrconfig.sh' => 'Fortinet FortiEDR',
257+
'/opt/McAfee' => 'FireEye/McAfee/Trellix Agent',
258+
'/opt/SumoCollector' => 'Sumo Logic Cloud SIEM',
259+
'/opt/Symantec' => 'Symantec EDR',
260+
'/opt/Tanium' => 'Tanium',
261+
'/opt/Trellix' => 'FireEye/McAfee/Trellix SIEM Collector',
262+
'/opt/avg' => 'AVG',
263+
'/opt/bitdefender-security-tools/bin/bdconfigure' => 'Bitdefender EDR',
264+
'/opt/cisco/amp/bin/ampcli ' => 'Cisco Secure Endpoint',
265+
'/opt/cisco/amp/bin/ampcli' => 'Cisco Secure Endpoint',
266+
'/opt/cyberark' => 'CyberArk',
267+
'/opt/ds_agent/dsa' => 'Trend Micro Deep Security Agent',
268+
'/opt/f-secure' => 'WithSecure (F-Secure)',
269+
'/opt/fireeye' => 'FireEye/Trellix EDR',
270+
'/opt/fortinet/fortisiem' => 'Fortinet FortiSIEM',
271+
'/opt/isec' => 'FireEye/Trellix Endpoint Security',
272+
'/opt/kaspersky' => 'Kaspersky',
273+
'/opt/logrhythm/scsm' => 'LogRhythm System Monitor',
274+
'/opt/secureworks' => 'Secureworks',
275+
'/opt/sentinelone/bin/sentinelctl' => 'SentinelOne',
276+
'/opt/splunkforwarder' => 'Splunk',
277+
'/opt/threatbook/OneAV' => 'threatbook.OneAV',
278+
'/opt/threatconnect-envsvr/' => 'ThreatConnect',
279+
'/opt/traps/bin/cytool' => 'Palo Alto Networks Cortex XDR',
280+
'/sf/edr/agent/bin/edr_agent' => 'Sangfor EDR',
281+
'/titan/agent/agent_update.sh' => 'Titan Agent',
282+
'/usr/bin/linep' => 'Group-iB XDR Endpoint Agent',
283+
'/usr/bin/oneav_start' => 'threatbook.OneAV',
284+
'/usr/lib/Acronis' => 'Acronis Cyber Protect',
285+
'/usr/lib/symantec/status.sh' => 'Symantec Linux Agent',
286+
'/usr/local/bin/intezer-analyze' => 'Intezer',
287+
'/usr/local/qualys' => 'Qualys EDR Cloud Agent',
288+
'/usr/local/rocketcyber' => 'Kseya RocketCyber',
289+
'/var/lib/avast/Setup/avast.vpsupdate' => 'Avast',
290+
'/var/log/checkpoint' => 'Checkpoint',
291+
'/var/pt' => 'PT Swarm'
292+
}
293+
294+
apps.each do |path, appname|
295+
next unless file_exist?(path) || directory?(path)
296+
297+
print_good "#{appname} found: #{path}"
298+
report "#{appname}: #{path}"
299+
rescue RuntimeError
300+
print_bad("Unable to determine state of #{appname}")
301+
next
150302
end
151303
end
152304
end

0 commit comments

Comments
 (0)