Update linuxprivchecker.sh #10

alibkaba · 2018-01-13T23:42:57Z

updated version of Update linuxprivchecker.sh Update linuxprivchecker.sh #8
I removed colors for now because when you ">" output to a file, the color characters are present in that file and breaks things up.
I changed [+] to OK and [-] to FAILED. Since this is for the pentesting community, maybe we don't need OK/FAILED because [+] and [-] is understood?
Fixed the Related Shell Escape Sequences issue
Replaced printf with echo because it didn't play well with % in outputs from ${cmdRESULT%?}.
@5aru @linted

- updated version of Update linuxprivchecker.sh #8 - I removed colors for now because when you ">" output to a file, the color characters are present in that file and breaks things up. - I changed [+] to OK and [-] to FAILED. Since this is for the pentesting community, maybe we don't need OK/FAILED because [+] and [-] is understood? - Fixed the Related Shell Escape Sequences issue - Replaced printf with echo because it didn't play well with % in outputs from ${cmdRESULT%?}.

alibkaba · 2018-01-20T18:19:30Z

Hey @5aru @linted, I would like to share my thoughts about using this pull request script in my oscp exam:

Our script worked with no issues and completed (I did not use the vuln scan function).
I also used unix-privesc-check 1.4 & 1.1 but it froze or never completed the standard and detailed run.
Putting colors in the command is pointless.
The output has so much information that I think most will copy it to a text editor for a thorough analysis and the use of a search function of that editor.
And as I mentioned before, the use of colors with ">" (script.sh > output.tx) introduces weird characters.
I definitely prefer the [OK] & [FAILED] over [+] or [-].
I had so much data, looking for those tiny [+] [*] [-] [!] and etc. smooshed with the other characters would have taken more time out of my exam and hurt my eyes.
The use of [OK] & [FAILED] in combination with the space between them certainly made it easy to scan through the data fast.
The ${sectionLINE} (line 40) wasn't noticeable, therefore hard to determine which section I was in.
I think the section line could be extended and use better obvious characters over the "-".
Maybe something like this? (I typed it manually and if you scroll fast enough, you will notice that you are in a different section)

I plan on putting some changes through the script in the next few days since.

Whurbin · 2018-01-20T19:17:10Z

I apologize that I'd not gotten back to you sooner. I originally saw the pull request, but it was late at night, so I didn't touch it, and I'd forgotten about it by the next day.

I agree that including the colors in the output was a bit pointless, but it was innocuous, which is why I didn't really oppose it at first.

I really don't mind the [OK], [FAILED] notations. My only real comment is that [-],[+] are kind of the unwritten standard and that it kind of breaks away from the standard. This is kind of like the above point; it's kind of innocuous.

Finally, I agree that the section headers are kind of hard to notice as you're scrolling past. Usually I do something to the affect of the example you presented above. I chose not to do that when porting the script from python primarily to keep everything looking like the initial python script.

I feel that most of these are purely aesthetic and don't really impact the actual functionality of the script apart from minor bugs. All in all, I do think it is more easy to read with the exception of line 215 which is just a lot to consume. However, it's purpose is still quite clear.
@linted, do you have any qualms with what I've noted?

@alibkaba, hope your OSCP exam went well.

Whurbin · 2018-01-20T19:20:14Z

linuxprivchecker.sh

-	echo -ne "perl-->\tperl -e 'exec \"/bin/bash\";'\n" | sed 's|^|    |'
-fi
+  systemNAME="Related Shell Escape Sequences";
+  cmdRESPONSE "if [ -x "$(command -v vi)" ]; then echo -ne \"vi-->\t:!bash\n\"; echo -ne \"vi-->\t:set shell=/bin/bash:shell\n\"; fi; if [ -x "$(command -v vim)" ]; then echo -ne \"vim-->\t:!bash\n\" | sed 's|^|    |'; echo -ne \"vim-->\t:set shell=/bin/bash:shell\n\" | sed 's|^|    |'; fi; if [ -x "$(command -v awk)" ]; then echo -ne \"awk-->\tawk 'BEGIN {system(\"/bin/bash\")}'\n\" | sed 's|^|    |'; fi; if [ -x "$(command -v perl)" ]; then echo -ne \"perl-->\tperl -e 'exec \"/bin/bash\";'\n\" | sed 's|^|    |'; fi; if [ -x "$(command -v python)" ]; then echo -ne \"python-->\tpython -c '__import__(\"os\").system(\"/bin/bash\")'\n\" | sed 's|^|    |'; fi; if [ -x "$(command -v find)" ]; then echo -ne \"find->\tfind / -exec /usr/bin/awk 'BEGIN {system(\"/bin/bash\")}' \\;\n\" | sed 's|^|    |'; fi; if [ -x "$(command -v nmap)" ]; then echo -ne \"nmap-->\t--interactive\n\" | sed 's|^|    |'; fi";


This is just a lot to consume. It's not unclear, but quite a bit a first glance. I imagine it was done this way to make it easy to pass to cmdRESPONSE

@5aru No worries, I'm not in a rush here....so take your time...no one is going to die :)

And yes, its so that it can get passed into that cmdRESPONSE and not repeat the Related Shell Escape Sequences for each.
The code is the same, I just push it all in one line and added \ for the double quotations.

oh man, that's ugly. Is there anyway to make that multiple lines without having to break it up? I would like for this script to be easy to read. Personally I think if its easy to read even for people who don't know bash that will make the credibility of the script to improve. I know a couple pen testers who don't know code and a complicated line like this would definetly turn them away. However if we can't split it up without a ton of encoding, then this will have to work.

Hey @5aru
Thanks for the feedback and I just want to make sure that you take your time, I do this because I enjoy it and want to learn more from others like you and @linted

I totally agree with you, [-] and [+] are unwritten standards...maybe I can make some adjustments to the text right next to them so that they look cleaner.
I'll make some adjustments.

I see your points of not porting that over, the need to keep things to look like the initial python script and I failed to remember that. I'll try and remember that when coding, and maybe assist updating the python script.

Line 215 code is good but its a bit scary because it has five different if statements written in one line.
Let me see what I can do to make it readable.

I finished my exam but I know I failed it because I think I scored ~40-50. I learned a lot from it and really glad I failed because now I know what to work on.

linted

Hey, so I just ran this version on a box on hackthebox.eu. I'm sorry I don't know what all changed, but this runs way too slow. The run rate of this verses the version in master is n^2. I'm not sure what is causing but if I had to guess it's probably the way printing is being handled. @alibkaba

Whurbin · 2018-01-21T05:06:03Z

After you mentioned this, I checked the times of the current script verse the proposed script and it is a substantially longer runtime. About 10s vs 1m28s

alibkaba · 2018-01-21T06:12:54Z

linuxprivchecker.sh

+    echo "${cmdRESULT%?}";
+    echo
+  fi
+  sleep .5s;


@5aru @linted
The script has a 5 second delay for every title (line 55) command (line 72).
The delay allowed me to read things before the next cmd (personal preference). I picked this up from an OSCP troubleshooting script.
Glad you guys caught this but the speed was intentional.
Anyway by removing line 75 AND line 55, the script will be going as fast as before.

Updated [-] and [+]. Fixed Line 215 (now line 211 to 233). The code is more readable. Updated the line to be the same ####. If this looks good, I can work on the Python one to look about (if not) the same like this one. This would be an opportunity for me to get better at Python.

alibkaba · 2018-01-21T06:39:37Z

@5aru @linted
Updated [-] and [+].
I also removed the delay, the script runs as expected.
Fixed Line 215 (now line 211 to 233). The code is more readable.
Updated the title and area lines to ####. I want to add # before and after the area title but don't know how to do that. I'll look into that some other time.

If this looks good, I can work on the Python one to look about (if not) the same like this one. This would be an opportunity for me to get better at Python.

Added @5aru changes mentioned in User specific sudo permissions #11

alibkaba · 2018-01-21T22:13:23Z

Added @5aru changes mentioned in User specific sudo permissions #11

linted · 2018-01-29T01:55:32Z

@alibkaba Sorry for the wait, I was distracted with getting the exploit search server thingy working. I ran your script against what we have in master using for i in $(seq 1 10); do time $(printf '\n' | ./linuxprivchecker.sh 2>&1 1>/dev/null); done and I am proud to say that you consistantly beat what we currently have! So that covers my concerns. I'm going to aprove and merge your branch!

alibkaba · 2018-02-16T19:03:05Z

@5aru @linted I took my exam on Monday and passed it.
The script worked really well in the exam. The bash version is definitely a good one because some machine didn't have python installed.

pentestmonkey's script but that one broke a few times since it really digs deeper.
rebootuser's script as well as ours. I also noticed the structure of the script between ours and it are similar.

Anyway, have a great weekend!
Now, I'm going to work toward the OSCE.

linted · 2018-02-18T01:46:04Z

Hey man, Congrats on passing! Thats a really big deal!

I am glad that this script was able to help you on the exam! Thats the whole reason why I love working on these things. I do have to admit the real reason why we started work on this project was because we kept running to boxes on hackthebox.eu which didn't have python3 installed. from there we branched out to bash.

Anyways, good luck on your osce! that's a hard one, but I am sure you will do great!

linted requested a review from Whurbin January 20, 2018 18:25

Whurbin approved these changes Jan 20, 2018

View reviewed changes

linted self-requested a review January 21, 2018 04:53

linted self-assigned this Jan 21, 2018

linted requested changes Jan 21, 2018

View reviewed changes

alibkaba commented Jan 21, 2018

View reviewed changes

Update linuxprivchecker.sh

2715046

Added @5aru changes mentioned in User specific sudo permissions #11

alibkaba added 2 commits January 23, 2018 18:22

Merge branch 'master' into patch-2

4725a67

Update linuxprivchecker.sh

7def72c

linted approved these changes Jan 29, 2018

View reviewed changes

linted merged commit 9bd6622 into linted:master Jan 29, 2018

Update linuxprivchecker.sh #10

Update linuxprivchecker.sh #10

Uh oh!

Conversation

alibkaba commented Jan 13, 2018

Uh oh!

alibkaba commented Jan 20, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Whurbin commented Jan 20, 2018

Uh oh!

Whurbin Jan 20, 2018

Choose a reason for hiding this comment

Uh oh!

alibkaba Jan 20, 2018

Choose a reason for hiding this comment

Uh oh!

linted Jan 21, 2018

Choose a reason for hiding this comment

Uh oh!

alibkaba Jan 21, 2018

Choose a reason for hiding this comment

Uh oh!

linted left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Whurbin commented Jan 21, 2018

Uh oh!

alibkaba Jan 21, 2018

Choose a reason for hiding this comment

Uh oh!

alibkaba commented Jan 21, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alibkaba commented Jan 21, 2018

Uh oh!

linted commented Jan 29, 2018

Uh oh!

alibkaba commented Feb 16, 2018

Uh oh!

linted commented Feb 18, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

alibkaba commented Jan 20, 2018 •

edited

Loading

linted left a comment •

edited

Loading

alibkaba commented Jan 21, 2018 •

edited

Loading