自动探测linux的溢出版本

2013-08-30 09:16:38 65 kevin200 7575

#!/usr/bin/perl

=head1 USAGE

        $ Local_Exploit_Checker [-h] [-k kernel]

        [-h] help

        [-k] kernel Eg. 2.6.28 

=head1 AUTHOR



use Getopt::Std;



$VERSION="0.6";

my $khost="";

my %opts;

getopt('k,h',\%opts);



if (exists $opts{h}){ &usage;}



if (exists $opts{k}){

        $khost=$opts{k};

}else{

        $khost = `uname -r |cut -d"-" -f1`; 

        chomp($khost);

} 

print "\nKernel local: $khost\n\n"; 



sub usage{

        print "Linux Exploit Suggester $VERSION\n";

        print "Usage: \t$0  [-h] [-k kernel]\n";

        print "\t[-h] help (this message)\n";

        print "\t[-k] kernel number eg. 2.6.28\n"; 

}



my %h; 

$h{'w00t'} = { vuln=>['2.4.10','2.4.16','2.4.17','2.4.18','2.4.19','2.4.20','2.4.21'] }; 

$h{'brk'} = { vuln=>['2.4.10','2.4.18','2.4.19','2.4.20','2.4.21','2.4.22'] }; 

$h{'ave'} = { vuln=>['2.4.19','2.4.20'] }; 

$h{'elflbl'} = { vuln=>['2.4.29'],mil=>"http://www.exploit-db.com/exploits/744/" }; 

$h{'elfdump'} = { vuln=>['2.4.27'] };

$h{'elfcd'} = {vuln=>['2.6.12']}; 

$h{'expand_stack'} = { vuln=>['2.4.29'] }; 

$h{'h00lyshit'} = { vuln=>['2.6.8','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16'],cve=>"2006-3626",mil=>"http://www.exploit-db.com/exploits/2013/"}; 

$h{'kdump'} = { vuln=>['2.6.13'] }; 

$h{'km2'} = { vuln=>['2.4.18','2.4.22'] }; 

$h{'krad'} = { vuln=>['2.6.5','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11'] }; 

$h{'krad3'} = { vuln=>['2.6.5','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11'],mil=>"http://exploit-db.com/exploits/1397" };

$h{'local26'} = { vuln=>['2.6.13'] }; 

$h{'loko'} = { vuln=>['2.4.22','2.4.23','2.4.24'] }; 

$h{'mremap_pte'} = { vuln=>['2.4.20','2.2.24','2.4.25','2.4.26','2.4.27'],mil=>"http://www.exploit-db.com/exploits/160/" }; 

$h{'newlocal'} = { vuln=>['2.4.17','2.4.19'] }; 

$h{'ong_bak'} = { vuln=>['2.6.5'] }; 

$h{'ptrace'} = { vuln=>['2.4.18','2.4.19','2.4.20','2.4.21','2.4.22']};

$h{'ptrace_kmod'} = { vuln=>['2.4.18','2.4.19','2.4.20','2.4.21','2.4.22'],cve=>"2007-4573"};

$h{'ptrace_kmod2'} = { vuln=>['2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34'],alt=>"ia32syscall,robert_you_suck",mil=>"http://www.exploit-db.com/exploits/15023/",cve=>"2010-3301"};

$h{'ptrace24'} = { vuln=>['2.4.9'] }; 

$h{'pwned'} = { vuln=>['2.6.11'] }; 

$h{'py2'} = { vuln=>['2.6.9','2.6.17','2.6.15','2.6.13'] }; 

$h{'raptor_prctl'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'],cve=>"2006-2451",mil=>"http://www.exploit-db.com/exploits/2031/" };

$h{'prctl'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'],mil=>"http://www.exploit-db.com/exploits/2004/" }; 

$h{'prctl2'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'],mil=>"http://www.exploit-db.com/exploits/2005/"};

$h{'prctl3'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'],mil=>"http://www.exploit-db.com/exploits/2006/" }; 

$h{'prctl4'} = { vuln=>['2.6.13','2.6.14','2.6.15','2.6.16','2.6.17'] ,mil=>"http://www.exploit-db.com/exploits/2011/"};

$h{'remap'} = { vuln=>['2.4.'] }; 

$h{'rip'} = { vuln=>['2.2.'] }; 

$h{'stackgrow2'} = { vuln=>['2.4.29','2.6.10'] }; 

$h{'uselib24'} = { vuln=>['2.6.10','2.4.17','2.4.22','2.4.25','2.4.27','2.4.29'] }; 

$h{'newsmp'} = { vuln=>['2.6.'] }; 

$h{'smpracer'} = { vuln=>['2.4.29'] }; 

$h{'loginx'} = { vuln=>['2.4.22'] }; 

$h{'exp.sh'} = { vuln=>['2.6.9','2.6.10','2.6.16','2.6.13'] };   

$h{'vmsplice1'} = {vuln=>['2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.24.1'],alt=>"jessica biel",cve=>"2008-0600",mil=>"http://www.expliot-db.com/exploits/5092"};

$h{'vmsplice2'} = {vuln=>['2.6.23','2.6.24'],alt=>"diane_lane",cve=>"2008-0600", mil=>"http://www.exploit-db.com/exploits/5093"};

$h{'vconsole'} = {vuln=>['2.6.'],cve=>"2009-1046"};

$h{'sctp'} = {vuln=>['2.6.26'],cve=>"2008-4113"};

$h{'ftrex'} = {vuln=>['2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22'],cve=>"2008-4210",mil=>"http://www.exploit-db.com/exploits/6851"};

$h{'exit_notify'} =  {vuln=>['2.6.25','2.6.26','2.6.27','2.6.28','2.6.29'],mil=>"http://www.exploit-db.com/exploits/8369"};

$h{'udev'} = {vuln=>['2.6.25','2.6.26','2.6.27','2.6.28','2.6.29'],alt=>"udev <1.4.1",cve=>"2009-1185",mil=>"http://www.exploit-db.com/exploits/8478"};

$h{'sock_sendpage2'}={vuln=>['2.4.4','2.4.5','2.4.6','2.4.7','2.4.8','2.4.9','2.4.10','2.4.11','2.4.12','2.4.13','2.4.14','2.4.15','2.4.16','2.4.17','2.4.18','2.4.19','2.4.20','2.4.21','2.4.22','2.4.23','2.4.24','2.4.25','2.4.26','2.4.27','2.4.28','2.4.29','2.4.30','2.4.31','2.4.32','2.4.33','2.4.34','2.4.35','2.4.36','2.4.37','2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30'],alt=>"proto_ops",cve=>"2009-2692",mil=>"http://www.exploit-db.com/exploits/9436"};

$h{'sock_sendpage'}={vuln=>['2.4.4','2.4.5','2.4.6','2.4.7','2.4.8','2.4.9','2.4.10','2.4.11','2.4.12','2.4.13','2.4.14','2.4.15','2.4.16','2.4.17','2.4.18','2.4.19','2.4.20','2.4.21','2.4.22','2.4.23','2.4.24','2.4.25','2.4.26','2.4.27','2.4.28','2.4.29','2.4.30','2.4.31','2.4.32','2.4.33','2.4.34','2.4.35','2.4.36','2.4.37','2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30'],alt=>"wunderbar_emporium",cve=>"2009-2692",mil=>"http://www.exploit-db.com/exploits/9435"};

$h{'udp_sendmsg_32bit'}={vuln=>['2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19'],cve=>"2009-2698", mil=>"http://downloads.securityfocus.com/vulnerabilities/exploits/36108.c"};

$h{'pipe.c_32bit'}={vuln=>['2.4.4','2.4.5','2.4.6','2.4.7','2.4.8','2.4.9','2.4.10','2.4.11','2.4.12','2.4.13','2.4.14','2.4.15','2.4.16','2.4.17','2.4.18','2.4.19','2.4.20','2.4.21','2.4.22','2.4.23','2.4.24','2.4.25','2.4.26','2.4.27','2.4.28','2.4.29','2.4.30','2.4.31','2.4.32','2.4.33','2.4.34','2.4.35','2.4.36','2.4.37','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31'],cve=>"2009-3547",mil=>"http://www.securityfocus.com/data/vulnerabilities/exploits/36901-1.c"};

$h{'do_pages_move'}={vuln=>['2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31'],alt=>"sieve",cve=>"2010-0415",mil=>"Spenders Enlightenment"};

$h{'reiserfs'}={vuln=>['2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34'],cve=>"2010-1146",mil=>"http://www.exploit-db.com/exploits/12130/"};

$h{'can_bcm'}={vuln=>['2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],cve=>"2010-2959",mil=>"http://www.exploit-db.com/exploits/14814/"};

$h{'rds'}={vuln=>['2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],mil=>"http://www.exploit-db.com/exploits/15285/",cve=>"2010-3904"};

$h{'half_nelson'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],alt=>"econet",cve=>"2010-3848",mil=>"http://www.exploit-db.com/exploits/6851"};

$h{'half_nelson1'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],alt=>"econet",cve=>"2010-3848",mil=>"http://www.exploit-db.com/exploits/17787/"};

$h{'half_nelson2'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],alt=>"econet",cve=>"2010-3850",mil=>"http://www.exploit-db.com/exploits/17787/"};

$h{'half_nelson3'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],alt=>"econet",cve=>"2010-4073",mil=>"http://www.exploit-db.com/exploits/17787/"};

$h{'caps_to_root'} = {vuln=>['2.6.34','2.6.35','2.6.36'],cve=>"n/a",mil=>"http://www.exploit-db.com/exploits/15916/"};

$h{'american-sign-language'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],cve=>"2010-4347",mil=>"http://www.securityfocus.com/bid/45408/"};

$h{'pktcdvd'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33','2.6.34','2.6.35','2.6.36'],cve=>"2010-3437",mil=>"http://www.exploit-db.com/exploits/15150/"};

$h{'video4linux'} = {vuln=>['2.6.0','2.6.1','2.6.2','2.6.3','2.6.4','2.6.5','2.6.6','2.6.7','2.6.8','2.6.9','2.6.10','2.6.11','2.6.12','2.6.13','2.6.14','2.6.15','2.6.16','2.6.17','2.6.18','2.6.19','2.6.20','2.6.21','2.6.22','2.6.23','2.6.24','2.6.25','2.6.26','2.6.27','2.6.28','2.6.29','2.6.30','2.6.31','2.6.32','2.6.33'],cve=>"2010-3081",mil=>"http://www.exploit-db.com/exploits/15024/"};

$h{'memodipper'} = {vuln=>['2.6.39','3.0.0','3.0.1','3.0.2','3.0.3','3.0.4','3.0.5','3.0.6','3.1.0'],cve=>"2012-0056",mil=>"http://www.exploit-db.com/exploits/18411/"};

$h{'semtex'}={vuln=>['2.6.37','2.6.38','2.6.39','3.0.0','3.0.1','3.0.2','3.0.3','3.0.4','3.0.5','3.0.6','3.1.0'],cve=>"2013-2094",mil=>"http://www.exploit-db.com/download/25444/&#8206;"};

$h{'perf_swevent'}={vuln=>['3.0.0','3.0.1','3.0.2','3.0.3','3.0.4','3.0.5','3.0.6','3.1.0','3.2','3.3','3.4.0','3.4.1','3.4.2','3.4.3','3.4.4','3.4.5','3.4.6','3.4.8','3.4.9','3.5','3.6','3.7','3.8.0','3.8.1','3.8.2','3.8.3','3.8.4','3.8.5','3.8.6','3.8.7','3.8.8','3.8.9'],cve=>"2013-2094",mil=>"http://www.exploit-db.com/download/26131"};



&run_main; 



sub run_main { 

print "Possible Exploits:\n";

foreach my $key(keys %h){ 

        foreach my $kernel ( @{ $h{$key}->{vuln} }){ 

#                printf "DEBUG:vuln:%s kernel:%s lk:%s\n", $key,$kernel,$khost;

                if($khost=~/^$kernel$/){ 

                         chop($kernel) if ($kernel=~/.$/); 

                         print "[+] ".$key;

                        $alt=$h{$key}->{alt};

                        $cve=$h{$key}->{cve};

                        $mlw=$h{$key}->{mil};

                        if ((length ($alt) >0)||(length ($cve) >0)){print "\n";}

                        if (length ($alt) >0){ print "   Alt: $alt ";} 

                        if (length ($cve) >0){ print "   CVE-$cve";}

                        if (length ($mlw) >0){ print "\n   Source: $mlw";}

                        print "\n"; 

                 } 

              } 

} 

}

类别手机无线

关于作者

kevin2007篇文章28篇回复

评论65次

要评论？请先登录或注册

65楼

aihuifeng888
2016-9-3 11:35

请问一下楼主 python要求用社么版本的我是2.7.9 运行这个发现代码报错

回复|@ta|踩(0)|顶(0)
64楼

涯之叶
2016-8-29 11:35

不错，谢谢分享

回复|@ta|踩(0)|顶(0)
63楼

hackdw
2016-8-27 18:42

perl脚本没有学，可惜

回复|@ta|踩(0)|顶(0)
62楼

krystalvip
2016-7-11 10:28

code能加

回复|@ta|踩(0)|顶(0)
61楼

tyjistian
2016-6-5 18:19

一直不知道这些exp是怎么对应上的。，

回复|@ta|踩(0)|顶(0)
60楼

evilsoul
2015-7-20 11:26

这个靠谱，以后遇到linux就不同手工查了~~~~说起来都是泪~~

回复|@ta|踩(0)|顶(0)
59楼

tyjistian
2015-7-15 15:57

谢谢5楼，不错。

回复|@ta|踩(0)|顶(0)
58楼

小拳头
2015-1-17 17:31

感谢楼主分享拿回去测试下

回复|@ta|踩(0)|顶(0)
57楼

wind-snow
2015-1-16 19:22

LZ好人啊，非常感谢

回复|@ta|踩(0)|顶(0)
56楼

Fiend
2015-1-12 11:58

好高大上，谢谢分享。

回复|@ta|踩(0)|顶(0)
55楼

freer
2014-1-17 12:38

这种脚本太多了，基本上就是下一对exp，一个一个编译执行，给机器造成的危害较大。

回复|@ta|踩(0)|顶(0)
54楼

goobey
2013-12-20 10:57

有用，收藏

回复|@ta|踩(0)|顶(0)
53楼

goobey
2013-12-17 17:29

xi望有其他版本的，不错，支持

回复|@ta|踩(0)|顶(0)
52楼

n1o1name
2013-12-17 13:33

分享的这个不错，谢谢。

回复|@ta|踩(0)|顶(0)
51楼

～‘仙生’
2013-12-16 17:43

千万别让哥有发贴权限！一定发套 linux高兼容的集群压力测试源码上来分享分享！！

回复|@ta|踩(0)|顶(0)
50楼

th3nksme
2013-9-28 23:35

学xi啦，非常感谢。。

回复|@ta|踩(0)|顶(0)
49楼

pr1nt
2013-9-24 15:49

介个脚本很方便的样子。。。果断收藏了。感谢楼主。

回复|@ta|踩(0)|顶(0)
48楼

litdgs
2013-9-5 20:46

mark 学xi学xi

回复|@ta|踩(0)|顶(0)
47楼

Chris
2013-9-5 00:52

這個很棒, 可以先試過這個自動化的 exploit 之後再來想其他提權的突破辦法

回复|@ta|踩(0)|顶(0)
46楼

iframe
2013-9-4 10:22

MARK，感谢分享!!!

回复|@ta|踩(0)|顶(0)

自动探测linux的溢出版本

关于作者

评论65次

请问一下楼主 python要求用社么版本的 我是2.7.9 运行这个发现代码报错

不错，谢谢分享

perl脚本没有学，可惜

code能加

一直不知道这些exp是怎么对应上的。，

这个靠谱，以后遇到linux就不同手工查了~~~~说起来都是泪~~

谢谢5楼，不错。

感谢楼主分享 拿回去测试下

LZ好人啊，非常感谢

好高大上，谢谢分享。

这种脚本太多了，基本上就是下一对exp，一个一个编译执行，给机器造成的危害较大。

有用，收藏

xi望有其他版本的，不错，支持

分享的这个不错，谢谢。

千万别让哥有发贴权限！ 一定发套 linux高兼容的集群压力测试源码上来分享分享！！

学xi啦，非常感谢。。

介个脚本很方便的样子。。。果断收藏了。 感谢楼主。

mark 学xi学xi

這個很棒, 可以先試過這個自動化的 exploit 之後再來想其他提權的突破辦法

MARK，感谢分享!!!

热门文章

渗透测试车联网攻击链路图

安全资讯致数千人伤亡的寻呼机为何能爆炸？专家：或黑客入侵致电池过载，或内部被对手安装了爆炸物

安全资讯Godzilla 无文件后门利用 Atlassian Confluence漏洞 CVE-2023-22527

安全资讯黑客入侵自行车：无线换档系统存在漏洞

最新回复

精华推荐

渗透测试内网渗透之PC控制及完美过杀毒!!!

渗透测试初级域渗透系列 - 02. 常见攻击方法 - 1

渗透测试MYSQL注入个人总结(各种骚姿势)

渗透测试记一次对Discuz官方论坛的渗透检测

逆向破解那些shellcode免杀总结

请问一下楼主 python要求用社么版本的我是2.7.9 运行这个发现代码报错

这个靠谱，以后遇到linux就不同手工查了~~说起来都是泪

感谢楼主分享拿回去测试下

千万别让哥有发贴权限！一定发套 linux高兼容的集群压力测试源码上来分享分享！！

介个脚本很方便的样子。。。果断收藏了。感谢楼主。