自动探测linux的溢出版本

2013-08-30 09:16:38 65 kevin200 6873

#!/usr/bin/perl

=head1 USAGE

        $ Local_Exploit_Checker [-h] [-k kernel]

        [-h] help

        [-k] kernel Eg. 2.6.28 

=head1 AUTHOR



use Getopt::Std;



$VERSION="0.6";

my $khost="";

my %opts;

getopt('k,h',\%opts);



if (exists $opts{h}){ &usage;}



if (exists $opts{k}){

        $khost=$opts{k};

}else{

        $khost = `uname -r |cut -d"-" -f1`; 

        chomp($khost);

} 

print "\nKernel local: $khost\n\n"; 



sub usage{

        print "Linux Exploit Suggester $VERSION\n";

        print "Usage: \t$0  [-h] [-k kernel]\n";

        print "\t[-h] help (this message)\n";

        print "\t[-k] kernel number eg. 2.6.28\n"; 

}



my %h; 

$h{'w00t'} = { vuln=>['2.4.10','2.4.16','2.4.17','2.4.18','2.4.19','2.4.20','2.4.21'] }; 

$h{'brk'} = { vuln=>['2.4.10','2.4.18','2.4.19','2.4.20','2.4.21','2.4.22'] }; 

$h{'ave'} = { vuln=>['2.4.19','2.4.20'] }; 

$h{'elflbl'} = { vuln=>['2.4.29'],mil=>"http://www.exploit-db.com/exploits/744/" }; 

$h{'elfdump'} = { vuln=>['2.4.27'] };

$h{'elfcd'} = {vuln=>['2.6.12']}; 

$h{'expand_stack'} = { vuln=>['2.4.29'] }; 

$h{'h00lyshit'} = { vuln=>['2.6.8','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16'],cve=>"2006-3626",mil=>"http://www.exploit-db.com/exploits/2013/"}; 

$h{'kdump'} = { vuln=>['2.6.13'] }; 

$h{'km2'} = { vuln=>['2.4.18','2.4.22'] }; 

$h{'krad'} = { vuln=>['2.6.5','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11'] }; 

$h{'krad3'} = { vuln=>['2.6.5','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11'],mil=>"http://exploit-db.com/exploits/1397" };

$h{'local26'} = { vuln=>['2.6.13'] }; 

$h{'loko'} = { vuln=>['2.4.22','2.4.23','2.4.24'] }; 

$h{'mremap_pte'} = { vuln=>['2.4.20','2.2.24','2.4.25','2.4.26','2.4.27'],mil=>"http://www.exploit-db.com/exploits/160/" }; 

$h{'newlocal'} = { vuln=>['2.4.17','2.4.19'] }; 

$h{'ong_bak'} = { vuln=>['2.6.5'] }; 

$h{'ptrace'} = { vuln=>['2.4.18','2.4.19','2.4.20','2.4.21','2.4.22']};

$h{'ptrace_kmod'} = { vuln=>['2.4.18','2.4.19','2.4.20','2.4.21','2.4.22'],cve=>"2007-4573"};

$h{'ptrace_kmod2'} = { vuln=>['2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34'],alt=>"ia32syscall,robert_you_suck",mil=>"http://www.exploit-db.com/exploits/15023/",cve=>"2010-3301"};

$h{'ptrace24'} = { vuln=>['2.4.9'] }; 

$h{'pwned'} = { vuln=>['2.6.11'] }; 

$h{'py2'} = { vuln=>['2.6.9','2.6.17','2.6.15','2.6.13'] }; 

$h{'raptor_prctl'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'],cve=>"2006-2451",mil=>"http://www.exploit-db.com/exploits/2031/" };

$h{'prctl'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'],mil=>"http://www.exploit-db.com/exploits/2004/" }; 

$h{'prctl2'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'],mil=>"http://www.exploit-db.com/exploits/2005/"};

$h{'prctl3'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'],mil=>"http://www.exploit-db.com/exploits/2006/" }; 

$h{'prctl4'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'] ,mil=>"http://www.exploit-db.com/exploits/2011/"};

$h{'remap'} = { vuln=>['2.4.'] }; 

$h{'rip'} = { vuln=>['2.2.'] }; 

$h{'stackgrow2'} = { vuln=>['2.4.29','2.6.10'] }; 

$h{'uselib24'} = { vuln=>['2.6.10','2.4.17','2.4.22','2.4.25','2.4.27','2.4.29'] }; 

$h{'newsmp'} = { vuln=>['2.6.'] }; 

$h{'smpracer'} = { vuln=>['2.4.29'] }; 

$h{'loginx'} = { vuln=>['2.4.22'] }; 

$h{'exp.sh'} = { vuln=>['2.6.9','2.6.10','2.6.16','2.6.13'] };   

$h{'vmsplice1'} = {vuln=>['2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.24.1'],alt=>"jessica biel",cve=>"2008-0600",mil=>"http://www.expliot-db.com/exploits/5092"};

$h{'vmsplice2'} = {vuln=>['2.6.23','2.6.24'],alt=>"diane_lane",cve=>"2008-0600", mil=>"http://www.exploit-db.com/exploits/5093"};

$h{'vconsole'} = {vuln=>['2.6.'],cve=>"2009-1046"};

$h{'sctp'} = {vuln=>['2.6.26'],cve=>"2008-4113"};

$h{'ftrex'} = {vuln=>['2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22'],cve=>"2008-4210",mil=>"http://www.exploit-db.com/exploits/6851"};

$h{'exit_notify'} =  {vuln=>['2.6.25','2.6.26','2.6.27','2.6.28','2.6.29'],mil=>"http://www.exploit-db.com/exploits/8369"};

$h{'udev'} = {vuln=>['2.6.25','2.6.26','2.6.27','2.6.28','2.6.29'],alt=>"udev <1.4.1",cve=>"2009-1185",mil=>"http://www.exploit-db.com/exploits/8478"};

$h{'sock_sendpage2'}={vuln=>['2.4.4','2.4.5','2.4.6','2.4.7','2.4.8','2.4.9','2.4.10','2.4.11','2.4.12','2.4.13','2.4.14','2.4.15','2.4.16','2.4.17','2.4.18','2.4.19','2.4.20','2.4.21','2.4.22','2.4.23','2.4.24','2.4.25','2.4.26','2.4.27','2.4.28','2.4.29','2.4.30','2.4.31','2.4.32','2.4.33','2.4.34','2.4.35','2.4.36','2.4.37','2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30'],alt=>"proto_ops",cve=>"2009-2692",mil=>"http://www.exploit-db.com/exploits/9436"};

$h{'sock_sendpage'}={vuln=>['2.4.4','2.4.5','2.4.6','2.4.7','2.4.8','2.4.9','2.4.10','2.4.11','2.4.12','2.4.13','2.4.14','2.4.15','2.4.16','2.4.17','2.4.18','2.4.19','2.4.20','2.4.21','2.4.22','2.4.23','2.4.24','2.4.25','2.4.26','2.4.27','2.4.28','2.4.29','2.4.30','2.4.31','2.4.32','2.4.33','2.4.34','2.4.35','2.4.36','2.4.37','2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30'],alt=>"wunderbar_emporium",cve=>"2009-2692",mil=>"http://www.exploit-db.com/exploits/9435"};

$h{'udp_sendmsg_32bit'}={vuln=>['2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19'],cve=>"2009-2698", mil=>"http://downloads.securityfocus.com/vulnerabilities/exploits/36108.c"};

$h{'pipe.c_32bit'}={vuln=>['2.4.4','2.4.5','2.4.6','2.4.7','2.4.8','2.4.9','2.4.10','2.4.11','2.4.12','2.4.13','2.4.14','2.4.15','2.4.16','2.4.17','2.4.18','2.4.19','2.4.20','2.4.21','2.4.22','2.4.23','2.4.24','2.4.25','2.4.26','2.4.27','2.4.28','2.4.29','2.4.30','2.4.31','2.4.32','2.4.33','2.4.34','2.4.35','2.4.36','2.4.37','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31'],cve=>"2009-3547",mil=>"http://www.securityfocus.com/data/vulnerabilities/exploits/36901-1.c"};

$h{'do_pages_move'}={vuln=>['2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31'],alt=>"sieve",cve=>"2010-0415",mil=>"Spenders Enlightenment"};

$h{'reiserfs'}={vuln=>['2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34'],cve=>"2010-1146",mil=>"http://www.exploit-db.com/exploits/12130/"};

$h{'can_bcm'}={vuln=>['2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],cve=>"2010-2959",mil=>"http://www.exploit-db.com/exploits/14814/"};

$h{'rds'}={vuln=>['2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],mil=>"http://www.exploit-db.com/exploits/15285/",cve=>"2010-3904"};

$h{'half_nelson'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],alt=>"econet",cve=>"2010-3848",mil=>"http://www.exploit-db.com/exploits/6851"};

$h{'half_nelson1'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],alt=>"econet",cve=>"2010-3848",mil=>"http://www.exploit-db.com/exploits/17787/"};

$h{'half_nelson2'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],alt=>"econet",cve=>"2010-3850",mil=>"http://www.exploit-db.com/exploits/17787/"};

$h{'half_nelson3'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],alt=>"econet",cve=>"2010-4073",mil=>"http://www.exploit-db.com/exploits/17787/"};

$h{'caps_to_root'} = {vuln=>['2.6.34','2.6.35','2.6.36'],cve=>"n/a",mil=>"http://www.exploit-db.com/exploits/15916/"};

$h{'american-sign-language'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],cve=>"2010-4347",mil=>"http://www.securityfocus.com/bid/45408/"};

$h{'pktcdvd'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],cve=>"2010-3437",mil=>"http://www.exploit-db.com/exploits/15150/"};

$h{'video4linux'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33'],cve=>"2010-3081",mil=>"http://www.exploit-db.com/exploits/15024/"};

$h{'memodipper'} = {vuln=>['2.6.39','3.0.0','3.0.1','3.0.2','3.0.3','3.0.4','3.0.5','3.0.6','3.1.0'],cve=>"2012-0056",mil=>"http://www.exploit-db.com/exploits/18411/"};

$h{'semtex'}={vuln=>['2.6.37','2.6.38','2.6.39','3.0.0','3.0.1','3.0.2','3.0.3','3.0.4','3.0.5','3.0.6','3.1.0'],cve=>"2013-2094",mil=>"http://www.exploit-db.com/download/25444/&#8206;"};

$h{'perf_swevent'}={vuln=>['3.0.0','3.0.1','3.0.2','3.0.3','3.0.4','3.0.5','3.0.6','3.1.0','3.2','3.3','3.4.0','3.4.1','3.4.2','3.4.3','3.4.4','3.4.5','3.4.6','3.4.8','3.4.9','3.5','3.6','3.7','3.8.0','3.8.1','3.8.2','3.8.3','3.8.4','3.8.5','3.8.6','3.8.7','3.8.8','3.8.9'],cve=>"2013-2094",mil=>"http://www.exploit-db.com/download/26131"};



&run_main; 



sub run_main { 

print "Possible Exploits:\n";

foreach my $key(keys %h){ 

        foreach my $kernel ( @{ $h{$key}->{vuln} }){ 

#                printf "DEBUG:vuln:%s kernel:%s lk:%s\n", $key,$kernel,$khost;

                if($khost=~/^$kernel$/){ 

                         chop($kernel) if ($kernel=~/.$/); 

                         print "[+] ".$key;

                        $alt=$h{$key}->{alt};

                        $cve=$h{$key}->{cve};

                        $mlw=$h{$key}->{mil};

                        if ((length ($alt) >0)||(length ($cve) >0)){print "\n";}

                        if (length ($alt) >0){ print "   Alt: $alt ";} 

                        if (length ($cve) >0){ print "   CVE-$cve";}

                        if (length ($mlw) >0){ print "\n   Source: $mlw";}

                        print "\n"; 

                 } 

              } 

} 

}

类别手机无线

关于作者

kevin2007篇文章28篇回复

评论65次

要评论？请先登录或注册

65楼

aihuifeng888
2016-9-3 11:35

请问一下楼主 python要求用社么版本的我是2.7.9 运行这个发现代码报错

回复|@ta|踩(0)|顶(0)
64楼

涯之叶
2016-8-29 11:35

不错，谢谢分享

回复|@ta|踩(0)|顶(0)
63楼

hackdw
2016-8-27 18:42

perl脚本没有学，可惜

回复|@ta|踩(0)|顶(0)
62楼

krystalvip
2016-7-11 10:28

code能加

回复|@ta|踩(0)|顶(0)
61楼

tyjistian
2016-6-5 18:19

一直不知道这些exp是怎么对应上的。，

回复|@ta|踩(0)|顶(0)
60楼

evilsoul
2015-7-20 11:26

这个靠谱，以后遇到linux就不同手工查了~~~~说起来都是泪~~

回复|@ta|踩(0)|顶(0)
59楼

tyjistian
2015-7-15 15:57

谢谢5楼，不错。

回复|@ta|踩(0)|顶(0)
58楼

小拳头
2015-1-17 17:31

感谢楼主分享拿回去测试下

回复|@ta|踩(0)|顶(0)
57楼

wind-snow
2015-1-16 19:22

LZ好人啊，非常感谢

回复|@ta|踩(0)|顶(0)
56楼

Fiend
2015-1-12 11:58

好高大上，谢谢分享。

回复|@ta|踩(0)|顶(0)
55楼

freer
2014-1-17 12:38

这种脚本太多了，基本上就是下一对exp，一个一个编译执行，给机器造成的危害较大。

回复|@ta|踩(0)|顶(0)
54楼

goobey
2013-12-20 10:57

有用，收藏

回复|@ta|踩(0)|顶(0)
53楼

goobey
2013-12-17 17:29

xi望有其他版本的，不错，支持

回复|@ta|踩(0)|顶(0)
52楼

n1o1name
2013-12-17 13:33

分享的这个不错，谢谢。

回复|@ta|踩(0)|顶(0)
51楼

～‘仙生’
2013-12-16 17:43

千万别让哥有发贴权限！一定发套 linux高兼容的集群压力测试源码上来分享分享！！

回复|@ta|踩(0)|顶(0)
50楼

th3nksme
2013-9-28 23:35

学xi啦，非常感谢。。

回复|@ta|踩(0)|顶(0)
49楼

pr1nt
2013-9-24 15:49

介个脚本很方便的样子。。。果断收藏了。感谢楼主。

回复|@ta|踩(0)|顶(0)
48楼

litdgs
2013-9-5 20:46

mark 学xi学xi

回复|@ta|踩(0)|顶(0)
47楼

Chris
2013-9-5 00:52

這個很棒, 可以先試過這個自動化的 exploit 之後再來想其他提權的突破辦法

回复|@ta|踩(0)|顶(0)
46楼

iframe
2013-9-4 10:22

MARK，感谢分享!!!

回复|@ta|踩(0)|顶(0)

自动探测linux的溢出版本

关于作者

评论65次

请问一下楼主 python要求用社么版本的 我是2.7.9 运行这个发现代码报错

不错，谢谢分享

perl脚本没有学，可惜

code能加

一直不知道这些exp是怎么对应上的。，

这个靠谱，以后遇到linux就不同手工查了~~~~说起来都是泪~~

谢谢5楼，不错。

感谢楼主分享 拿回去测试下

LZ好人啊，非常感谢

好高大上，谢谢分享。

这种脚本太多了，基本上就是下一对exp，一个一个编译执行，给机器造成的危害较大。

有用，收藏

xi望有其他版本的，不错，支持

分享的这个不错，谢谢。

千万别让哥有发贴权限！ 一定发套 linux高兼容的集群压力测试源码上来分享分享！！

学xi啦，非常感谢。。

介个脚本很方便的样子。。。果断收藏了。 感谢楼主。

mark 学xi学xi

這個很棒, 可以先試過這個自動化的 exploit 之後再來想其他提權的突破辦法

MARK，感谢分享!!!

热门文章

渗透测试真实学院渗透思路分享

社会工程小世界找联系方式之拓展思路

安全资讯美国悬赏 1500 万美元追捕 LockBit 勒索软件头目

安全资讯号外号外！大家一定来看看！GitHub 骗局诱骗开发人员下载恶意软件

安全资讯Apex Legends 玩家担心 ALGS 黑客攻击后存在 RCE 缺陷

最新回复

精华推荐

渗透测试【渗透基础考核贴】史上最牛逼的答案原创与整理,学会这些,你就很牛逼,不服来辩。

渗透测试【保姆级教学】某金融app FRIDA hook加解密算法+jsrpc=乱杀

渗透测试初级域渗透系列 03. 常见攻击方法 - 2

渗透测试『代码审计』如何解密 PHP 代码

渗透测试upload-labs 21关通关笔记及总结

请问一下楼主 python要求用社么版本的我是2.7.9 运行这个发现代码报错

这个靠谱，以后遇到linux就不同手工查了~~说起来都是泪

感谢楼主分享拿回去测试下

千万别让哥有发贴权限！一定发套 linux高兼容的集群压力测试源码上来分享分享！！

介个脚本很方便的样子。。。果断收藏了。感谢楼主。