Skip to content

Commit c16c5de

Browse files
carlospolopcarlospolop
committed
f
1 parent be3fe91 commit c16c5de

File tree

1 file changed

+62
-63
lines changed

1 file changed

+62
-63
lines changed

‎linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/16_Crontab_UI_misconfig.sh‎

Lines changed: 62 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -51,77 +51,76 @@ if ! [ "$SEARCH_IN_FOLDER" ]; then
5151
fi
5252

5353
# If no candidates detected, exit quietly
54-
if [ -z "$candidates" ]; then
55-
exit 0
56-
fi
57-
58-
# Iterate candidates and extract interesting data
59-
printf "%s\n" "$candidates" | while read -r svc; do
60-
[ -n "$svc" ] || continue
61-
# Ensure suffix .service if missing
62-
case "$svc" in
63-
*.service) : ;;
64-
*) svc="$svc.service" ;;
65-
esac
66-
67-
state=""
68-
user=""
69-
if command -v systemctl >/dev/null 2>&1; then
70-
state=$(systemctl is-active "$svc" 2>/dev/null)
71-
user=$(systemctl show "$svc" -p User 2>/dev/null | cut -d= -f2)
72-
fi
73-
74-
[ -z "$state" ] && state="unknown"
75-
[ -z "$user" ] && user="unknown"
76-
77-
echo "Service: $svc (state: $state, User: $user)" | sed -${E} "s,root,${SED_RED},g"
78-
79-
# Read Environment from systemd (works even if file unreadable in many setups)
80-
envvals=$(systemctl show "$svc" -p Environment 2>/dev/null | cut -d= -f2-)
81-
if [ -n "$envvals" ]; then
82-
basic_user=$(printf "%s\n" "$envvals" | tr ' ' '\n' | grep -E '^BASIC_AUTH_USER=' | head -n1 | cut -d= -f2-)
83-
basic_pwd=$(printf "%s\n" "$envvals" | tr ' ' '\n' | grep -E '^BASIC_AUTH_PWD=' | head -n1 | cut -d= -f2-)
84-
dbpath=$(printf "%s\n" "$envvals" | tr ' ' '\n' | grep -E '^CRON_DB_PATH=' | head -n1 | cut -d= -f2-)
85-
port=$(printf "%s\n" "$envvals" | tr ' ' '\n' | grep -E '^PORT=' | head -n1 | cut -d= -f2-)
86-
87-
if [ -n "$basic_user" ] || [ -n "$basic_pwd" ]; then
88-
uprint="$basic_user"
89-
pprint="$basic_pwd"
90-
[ -n "$basic_pwd" ] && pprint="$basic_pwd"
91-
echo " └─ Basic-Auth credentials in Environment: user='${uprint}' pwd='${pprint}'" | sed -${E} "s,pwd='[^']*',${SED_RED_YELLOW},g"
54+
if [ "$candidates" ]; then
55+
56+
# Iterate candidates and extract interesting data
57+
printf "%s\n" "$candidates" | while read -r svc; do
58+
[ -n "$svc" ] || continue
59+
# Ensure suffix .service if missing
60+
case "$svc" in
61+
*.service) : ;;
62+
*) svc="$svc.service" ;;
63+
esac
64+
65+
state=""
66+
user=""
67+
if command -v systemctl >/dev/null 2>&1; then
68+
state=$(systemctl is-active "$svc" 2>/dev/null)
69+
user=$(systemctl show "$svc" -p User 2>/dev/null | cut -d= -f2)
9270
fi
9371

94-
if [ -n "$dbpath" ]; then
95-
echo " └─ CRON_DB_PATH: $dbpath"
96-
fi
72+
[ -z "$state" ] && state="unknown"
73+
[ -z "$user" ] && user="unknown"
9774

98-
# Check listener bound to localhost
99-
[ -z "$port" ] && port=8000
100-
if command -v ss >/dev/null 2>&1; then
101-
if ss -ltn 2>/dev/null | grep -qE "127\.0\.0\.1:${port}[[:space:]]"; then
102-
echo " └─ Listener detected on 127.0.0.1:${port} (likely Crontab UI)."
75+
echo "Service: $svc (state: $state, User: $user)" | sed -${E} "s,root,${SED_RED},g"
76+
77+
# Read Environment from systemd (works even if file unreadable in many setups)
78+
envvals=$(systemctl show "$svc" -p Environment 2>/dev/null | cut -d= -f2-)
79+
if [ -n "$envvals" ]; then
80+
basic_user=$(printf "%s\n" "$envvals" | tr ' ' '\n' | grep -E '^BASIC_AUTH_USER=' | head -n1 | cut -d= -f2-)
81+
basic_pwd=$(printf "%s\n" "$envvals" | tr ' ' '\n' | grep -E '^BASIC_AUTH_PWD=' | head -n1 | cut -d= -f2-)
82+
dbpath=$(printf "%s\n" "$envvals" | tr ' ' '\n' | grep -E '^CRON_DB_PATH=' | head -n1 | cut -d= -f2-)
83+
port=$(printf "%s\n" "$envvals" | tr ' ' '\n' | grep -E '^PORT=' | head -n1 | cut -d= -f2-)
84+
85+
if [ -n "$basic_user" ] || [ -n "$basic_pwd" ]; then
86+
uprint="$basic_user"
87+
pprint="$basic_pwd"
88+
[ -n "$basic_pwd" ] && pprint="$basic_pwd"
89+
echo " └─ Basic-Auth credentials in Environment: user='${uprint}' pwd='${pprint}'" | sed -${E} "s,pwd='[^']*',${SED_RED_YELLOW},g"
10390
fi
104-
else
105-
if netstat -tnl 2>/dev/null | grep -qE "127\.0\.0\.1:${port}[[:space:]]"; then
106-
echo " └─ Listener detected on 127.0.0.1:${port} (likely Crontab UI)."
91+
92+
if [ -n "$dbpath" ]; then
93+
echo " └─ CRON_DB_PATH: $dbpath"
10794
fi
108-
fi
10995

110-
# If we know DB path, try to read crontab.db for obvious secrets and check perms
111-
if [ -n "$dbpath" ] && [ -d "$dbpath" ] && [ -r "$dbpath" ]; then
112-
dbfile="$dbpath/crontab.db"
113-
if [ -f "$dbfile" ]; then
114-
perms=$(ls -ld "$dbpath" 2>/dev/null | awk '{print $1, $3, $4}')
115-
echo " └─ DB dir perms: $perms"
116-
if [ -w "$dbpath" ] || [ -w "$dbfile" ]; then
117-
echo " └─ Writable by current user -> potential job injection!" | sed -${E} "s,.*,${SED_RED},g"
96+
# Check listener bound to localhost
97+
[ -z "$port" ] && port=8000
98+
if command -v ss >/dev/null 2>&1; then
99+
if ss -ltn 2>/dev/null | grep -qE "127\.0\.0\.1:${port}[[:space:]]"; then
100+
echo " └─ Listener detected on 127.0.0.1:${port} (likely Crontab UI)."
101+
fi
102+
else
103+
if netstat -tnl 2>/dev/null | grep -qE "127\.0\.0\.1:${port}[[:space:]]"; then
104+
echo " └─ Listener detected on 127.0.0.1:${port} (likely Crontab UI)."
105+
fi
106+
fi
107+
108+
# If we know DB path, try to read crontab.db for obvious secrets and check perms
109+
if [ -n "$dbpath" ] && [ -d "$dbpath" ] && [ -r "$dbpath" ]; then
110+
dbfile="$dbpath/crontab.db"
111+
if [ -f "$dbfile" ]; then
112+
perms=$(ls -ld "$dbpath" 2>/dev/null | awk '{print $1, $3, $4}')
113+
echo " └─ DB dir perms: $perms"
114+
if [ -w "$dbpath" ] || [ -w "$dbfile" ]; then
115+
echo " └─ Writable by current user -> potential job injection!" | sed -${E} "s,.*,${SED_RED},g"
116+
fi
117+
echo " └─ Inspecting $dbfile for embedded secrets in commands (zip -P / --password / pass/token/secret)..."
118+
grep -E "-P[[:space:]]+\S+|--password[[:space:]]+\S+|[Pp]ass(word)?|[Tt]oken|[Ss]ecret" "$dbfile" 2>/dev/null | head -n 20 | sed -${E} "s,(${SED_RED_YELLOW}),\1,g"
118119
fi
119-
echo " └─ Inspecting $dbfile for embedded secrets in commands (zip -P / --password / pass/token/secret)..."
120-
grep -E "-P[[:space:]]+\S+|--password[[:space:]]+\S+|[Pp]ass(word)?|[Tt]oken|[Ss]ecret" "$dbfile" 2>/dev/null | head -n 20 | sed -${E} "s,(${SED_RED_YELLOW}),\1,g"
121120
fi
122121
fi
123-
fi
124-
echo ""
125-
done
122+
echo ""
123+
done
124+
fi
126125
fi
127126

0 commit comments

Comments
 (0)