-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathMatrixScan.sh
More file actions
2122 lines (1909 loc) · 75.5 KB
/
MatrixScan.sh
File metadata and controls
2122 lines (1909 loc) · 75.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/bash
# MatrixScan - A Matrix-themed Linux privilege escalation checker
# "Red pill for your system"
# ANSI color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
PURPLE='\033[0;35m'
CYAN='\033[0;36m'
WHITE='\033[0;37m'
BOLD='\033[1m'
UNDERLINE='\033[4m'
BLINK='\033[5m'
NC='\033[0m' # No Color
MATRIX_GREEN='\033[38;5;46m'
# Global variables
redPill=false # Verbose mode (red pill shows you how deep the rabbit hole goes)
blueprintFile="matrixscan_report.txt" # Report file (the blueprint of the Matrix)
htmlReport="matrixscan_report.html" # HTML report file
jsonReport="matrixscan_report.json" # JSON report file
csvReport="matrixscan_report.csv" # CSV report file
anomalies=() # Found vulnerabilities (anomalies in the Matrix)
searchPatterns=() # Checklist (patterns to search for in the Matrix)
privEscVectors=() # Identified privilege escalation vectors
generateHtml=false # Whether to generate HTML report
generateJson=false # Whether to generate JSON report
generateCsv=false # Whether to generate CSV report
quickScan=false # Whether to perform a quick scan
targetedScan=false # Whether to perform a targeted scan
focusedChecks=() # Specific checks to focus on
skipChecks=() # Checks to skip
showProgress=true # Whether to show progress indicators
interactiveMode=false # Whether to enable interactive exploration
scanStartTime=$(date +%s) # Start time of the scan
totalChecks=16 # Total number of main check categories
currentCheck=0 # Current check being performed
exportVulns=false # Whether to export only vulnerabilities
scanDepth="normal" # Depth of the scan (quick, normal, deep)
quietMode=false # Whether to run in quiet mode (minimal output)
compareMode=false # Whether to compare with previous scan
previousReport="" # Path to previous report for comparison
remoteMode=false # Whether to scan a remote system
remoteHost="" # Remote host to scan
remoteUser="" # Remote user for SSH
remoteKey="" # SSH key for remote access
remotePort=22 # SSH port for remote access
scanId=$(date +%Y%m%d%H%M%S) # Unique scan ID
# Scan stats
startTime=$(date +%s)
endTime=0
scanDuration=0
# Severity levels
CRITICAL="CRITICAL"
HIGH="HIGH"
MEDIUM="MEDIUM"
LOW="LOW"
INFO="INFO"
# Function to show a stylized progress bar
showProgressBar() {
local percent=$1
local width=50
local num_filled=$(( width * percent / 100 ))
local num_empty=$(( width - num_filled ))
printf "\r["
printf "%${num_filled}s" | tr ' ' '='
printf ">"
printf "%${num_empty}s" | tr ' ' ' '
printf "] %3d%%" "$percent"
}
# Update the progress of the scan
updateProgress() {
if [ "$showProgress" = true ] && [ "$quietMode" = false ]; then
((currentCheck++))
local percent=$((currentCheck * 100 / totalChecks))
showProgressBar $percent
fi
}
# Banner function
showBanner() {
if [ "$quietMode" = false ]; then
echo -e "${MATRIX_GREEN}"
echo -e "███╗ ███╗ █████╗ ████████╗██████╗ ██╗██╗ ██╗███████╗ ██████╗ █████╗ ███╗ ██╗"
echo -e "████╗ ████║██╔══██╗╚══██╔══╝██╔══██╗██║╚██╗██╔╝██╔════╝██╔════╝██╔══██╗████╗ ██║"
echo -e "██╔████╔██║███████║ ██║ ██████╔╝██║ ╚███╔╝ ███████╗██║ ███████║██╔██╗ ██║"
echo -e "██║╚██╔╝██║██╔══██║ ██║ ██╔══██╗██║ ██╔██╗ ╚════██║██║ ██╔══██║██║╚██╗██║"
echo -e "██║ ╚═╝ ██║██║ ██║ ██║ ██║ ██║██║██╔╝ ██╗███████║╚██████╗██║ ██║██║ ╚████║"
echo -e "╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═╝╚═╝ ╚═╝╚══════╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═══╝${NC}"
echo -e "${MATRIX_GREEN}\"Red pill for your system\" | Version 2.0 - The One Edition${NC}"
echo ""
fi
}
# Usage function - Morpheus explains how to use the tool
morpheusGuide() {
echo "Usage: $0 [options]"
echo ""
echo "General Options:"
echo " -h, --help Show this help message and exit"
echo " -r, --redpill Take the red pill (enable verbose output)"
echo " -q, --quiet Quiet mode, minimal output (for scripted use)"
echo " -i, --interactive Enable interactive mode for exploring results"
echo " --no-progress Disable progress bars and indicators"
echo ""
echo "Scan Options:"
echo " --quick Perform a quick scan (fewer checks but faster)"
echo " --deep Perform a deep scan (more thorough but slower)"
echo " --focus CHECK1,CHECK2,... Focus only on specific checks (comma-separated)"
echo " --skip CHECK1,CHECK2,... Skip specific checks (comma-separated)"
echo " -c, --compare FILE Compare results with a previous scan"
echo ""
echo "Output Options:"
echo " -o, --output FILE Save the text report to specified file (default: matrixscan_report.txt)"
echo " --html [FILE] Generate HTML report (default: matrixscan_report.html)"
echo " --json [FILE] Generate JSON report (default: matrixscan_report.json)"
echo " --csv [FILE] Generate CSV report (default: matrixscan_report.csv)"
echo " --vulns-only Export only vulnerabilities, not all scan data"
echo ""
echo "Remote Scanning:"
echo " --remote HOST Scan a remote system via SSH"
echo " --remote-user USER Username for SSH connection (default: current user)"
echo " --remote-key KEY SSH private key file for authentication"
echo " --remote-port PORT SSH port (default: 22)"
echo ""
echo "Available Checks:"
echo " system_info System information and environment"
echo " drives Drives and mount points"
echo " software Installed software and versions"
echo " network Network configuration and connections"
echo " users User information and privileges"
echo " processes Running processes"
echo " permissions File and folder permissions"
echo " cron Cron jobs and scheduled tasks"
echo " services System services"
echo " timers Systemd timers"
echo " sockets Sockets and D-Bus"
echo " sudo Sudo permissions and configuration"
echo " capabilities File capabilities"
echo " acls Access Control Lists"
echo " ssh SSH configuration and keys"
echo " files Interesting and sensitive files"
echo ""
echo "Examples:"
echo " $0 --quick # Run a quick scan"
echo " $0 --focus sudo,suid,cron # Focus on specific privilege escalation vectors"
echo " $0 --html --json # Generate reports in multiple formats"
echo " $0 --remote server.example.com # Scan a remote system"
echo " $0 --compare previous_report.txt # Compare with previous scan"
echo ""
}
# Parse command line arguments
parseArgs() {
while [[ $# -gt 0 ]]; do
case $1 in
-h|--help)
morpheusGuide
exit 0
;;
-r|--redpill)
redPill=true
shift
;;
-q|--quiet)
quietMode=true
showProgress=false
shift
;;
-i|--interactive)
interactiveMode=true
shift
;;
--no-progress)
showProgress=false
shift
;;
-o|--output)
blueprintFile="$2"
shift
shift
;;
--html)
generateHtml=true
if [ ! -z "$2" ] && [[ "$2" != -* ]]; then
htmlReport="$2"
shift
fi
shift
;;
--json)
generateJson=true
if [ ! -z "$2" ] && [[ "$2" != -* ]]; then
jsonReport="$2"
shift
fi
shift
;;
--csv)
generateCsv=true
if [ ! -z "$2" ] && [[ "$2" != -* ]]; then
csvReport="$2"
shift
fi
shift
;;
--quick)
quickScan=true
scanDepth="quick"
shift
;;
--deep)
scanDepth="deep"
shift
;;
--focus)
targetedScan=true
IFS=',' read -ra focusedChecks <<< "$2"
shift
shift
;;
--skip)
IFS=',' read -ra skipChecks <<< "$2"
shift
shift
;;
--vulns-only)
exportVulns=true
shift
;;
-c|--compare)
compareMode=true
previousReport="$2"
shift
shift
;;
--remote)
remoteMode=true
remoteHost="$2"
shift
shift
;;
--remote-user)
remoteUser="$2"
shift
shift
;;
--remote-key)
remoteKey="$2"
shift
shift
;;
--remote-port)
remotePort="$2"
shift
shift
;;
*)
echo "Unknown option: $1"
morpheusGuide
exit 1
;;
esac
done
# If no remote user specified, use current user
if [ "$remoteMode" = true ] && [ -z "$remoteUser" ]; then
remoteUser="$USER"
fi
}
# Function to check if a check should be skipped
shouldSkipCheck() {
local check="$1"
# If targeted scan and check not in focused checks, skip it
if [ "$targetedScan" = true ]; then
local found=false
for focused in "${focusedChecks[@]}"; do
if [ "$focused" = "$check" ]; then
found=true
break
fi
done
if [ "$found" = false ]; then
return 0 # Should skip
fi
fi
# If check is in skip list, skip it
for skip in "${skipChecks[@]}"; do
if [ "$skip" = "$check" ]; then
return 0 # Should skip
fi
done
# Check scan depth
if [ "$scanDepth" = "quick" ]; then
# Skip more time-consuming checks in quick mode
case "$check" in
"acls"|"files"|"capabilities")
return 0 # Should skip
;;
esac
fi
return 1 # Should not skip
}
# Log function for output
logMessage() {
local level="$1"
local message="$2"
local color=""
case $level in
"INFO")
color="${GREEN}"
;;
"WARNING")
color="${YELLOW}"
;;
"ANOMALY")
color="${RED}"
;;
"SECTION")
color="${MATRIX_GREEN}"
;;
"SUBSECTION")
color="${CYAN}"
;;
"CRITICAL")
color="${RED}${BOLD}"
;;
"HIGH")
color="${RED}"
;;
"MEDIUM")
color="${YELLOW}"
;;
"LOW")
color="${BLUE}"
;;
*)
color="${WHITE}"
;;
esac
# Print to console if not in quiet mode
if [ "$quietMode" = false ]; then
echo -e "${color}[${level}]${NC} ${message}"
fi
# Add to report file
echo "[${level}] ${message}" >> "$blueprintFile"
}
# Add to checklist (searching patterns in the Matrix)
addToPattern() {
local item="$1"
local status="$2"
local detail="$3"
searchPatterns+=("${item}|${status}|${detail}")
}
# Add to vulnerabilities (anomalies in the Matrix)
addToAnomalies() {
local anomaly="$1"
local detail="$2"
local severity="$3"
local vector="$4"
local remediation="$5"
local exploitCommand="$6"
anomalies+=("${anomaly}|${detail}|${severity}|${vector}|${remediation}|${exploitCommand}")
}
# Add to privilege escalation vectors
addToPrivEscVectors() {
local vector="$1"
local description="$2"
local severity="$3"
local exploitation="$4"
local exploitCommand="$5"
privEscVectors+=("${vector}|${description}|${severity}|${exploitation}|${exploitCommand}")
}
# Verbose output function (taking the red pill shows you more of the Matrix)
showWithRedPill() {
local message="$1"
if [ "$redPill" = true ] && [ "$quietMode" = false ]; then
echo -e "${PURPLE}[DEEP_MATRIX]${NC} ${message}"
echo "[DEEP_MATRIX] ${message}" >> "$blueprintFile"
fi
}
# Section header with animation
animatedSection() {
local title="$1"
if [ "$quietMode" = false ] && [ "$showProgress" = true ]; then
echo ""
echo -ne "${MATRIX_GREEN}[+] Scanning ${title}${NC}"
for i in {1..3}; do
echo -ne "${MATRIX_GREEN}.${NC}"
sleep 0.1
done
echo ""
fi
}
# Function to execute command locally or remotely
executeCommand() {
local command="$1"
local output=""
if [ "$remoteMode" = true ]; then
# Build SSH command
local sshCmd="ssh"
if [ ! -z "$remoteKey" ]; then
sshCmd+=" -i $remoteKey"
fi
sshCmd+=" -p $remotePort $remoteUser@$remoteHost"
# Execute command remotely
output=$(eval "$sshCmd \"$command\"" 2>/dev/null)
else
# Execute command locally
output=$(eval "$command" 2>/dev/null)
fi
echo "$output"
}
# Run command and get output (interrogating the Matrix)
interrogateMatrix() {
local cmd="$1"
local output=""
showWithRedPill "Running command: $cmd"
output=$(executeCommand "$cmd")
echo "$output"
}
# Check system information (the foundation of the Matrix)
analyzeMatrixCore() {
if shouldSkipCheck "system_info"; then
return
fi
animatedSection "System Information"
logMessage "SECTION" "System Information (Matrix Core)"
# Kernel information
logMessage "SUBSECTION" "Kernel Information (Matrix Version)"
kernelInfo=$(interrogateMatrix "uname -a")
echo "$kernelInfo"
addToPattern "Kernel Information" "ANALYZED" "$kernelInfo"
# Check for kernel exploits
kernelVersion=$(uname -r)
showWithRedPill "Kernel version: $kernelVersion"
# Check for common kernel exploits
if [[ "$kernelVersion" =~ ^2\.6\. ]]; then
addToAnomalies "Kernel Exploit" "Kernel version 2.6.x detected, potentially vulnerable to DirtyCow (CVE-2016-5195)" "$CRITICAL" "KERNEL_EXPLOIT" "Upgrade the kernel to the latest version" "gcc -pthread dirty.c -o dirty && ./dirty"
addToPrivEscVectors "Kernel Exploitation" "The system is running kernel version 2.6.x which is vulnerable to DirtyCow (CVE-2016-5195). This can be exploited to gain root privileges." "$CRITICAL" "Straightforward with publicly available exploits" "gcc -pthread dirty.c -o dirty && ./dirty"
fi
if [[ "$kernelVersion" =~ ^3\.1[0-9]\. ]]; then
addToAnomalies "Kernel Exploit" "Kernel version 3.1x.x detected, potentially vulnerable to overlayfs (CVE-2015-1328)" "$CRITICAL" "KERNEL_EXPLOIT" "Upgrade the kernel to the latest version" "gcc overlayfs_exploit.c -o overlayfs_exploit && ./overlayfs_exploit"
addToPrivEscVectors "Kernel Exploitation" "The system is running kernel version 3.1x.x which is vulnerable to overlayfs (CVE-2015-1328). This can be exploited to gain root privileges." "$CRITICAL" "Straightforward with publicly available exploits" "gcc overlayfs_exploit.c -o overlayfs_exploit && ./overlayfs_exploit"
fi
if [[ "$kernelVersion" =~ ^4\.[0-9]\. ]]; then
addToAnomalies "Kernel Exploit" "Kernel version 4.x.x detected, check for eBPF or other 4.x kernel exploits" "$HIGH" "KERNEL_EXPLOIT" "Upgrade the kernel to the latest version" "gcc ebpf_exploit.c -o ebpf_exploit && ./ebpf_exploit"
addToPrivEscVectors "Kernel Exploitation" "The system is running kernel version 4.x.x which might be vulnerable to eBPF exploits. Version-specific checking is required." "$HIGH" "Requires version-specific exploit code" "gcc ebpf_exploit.c -o ebpf_exploit && ./ebpf_exploit"
fi
# OS information
logMessage "SUBSECTION" "OS Information (Matrix Architecture)"
osInfo=$(interrogateMatrix "cat /etc/issue")
osRelease=$(interrogateMatrix "cat /etc/*-release")
echo "$osInfo"
echo "$osRelease"
addToPattern "OS Information" "ANALYZED" "$osInfo"
# PATH information
logMessage "SUBSECTION" "PATH Information (Pathways in the Matrix)"
pathInfo=$(interrogateMatrix "echo $PATH | tr \":\" \"\n\"")
echo "$pathInfo"
# Check for writable directories in PATH
while IFS= read -r directory; do
if [ -w "$directory" ]; then
addToAnomalies "Writable PATH" "Directory in PATH is writable: $directory" "$HIGH" "WRITABLE_PATH" "Remove write permissions from the directory or remove it from PATH" "echo '#!/bin/bash\n/bin/bash' > $directory/ls && chmod +x $directory/ls"
addToPrivEscVectors "Writable PATH Abuse" "A directory in the PATH ($directory) is writable. This allows for creating or modifying executables that may be run by other users including root." "$HIGH" "Create a malicious executable with the same name as a commonly used command" "echo '#!/bin/bash\n/bin/bash' > $directory/ls && chmod +x $directory/ls"
fi
done <<< "$pathInfo"
addToPattern "Writable PATH Check" "ANALYZED" ""
# Environment variables
logMessage "SUBSECTION" "Environment Variables (Matrix Code Parameters)"
envInfo=$(interrogateMatrix "env")
showWithRedPill "$envInfo"
# Check for sensitive information in environment variables
if echo "$envInfo" | grep -i "key\|password\|secret\|token\|credential" > /dev/null; then
addToAnomalies "Sensitive Environment Variables" "Found sensitive information in environment variables" "$MEDIUM" "SENSITIVE_INFO" "Remove sensitive information from environment variables" ""
fi
addToPattern "Environment Variables Check" "ANALYZED" ""
# sudo version
logMessage "SUBSECTION" "Sudo Version (Agent Program Version)"
sudoVersion=$(interrogateMatrix "sudo -V | head -n 1")
echo "$sudoVersion"
# Check for vulnerable sudo versions
if [[ "$sudoVersion" =~ 1\.8\.[0-9]\. ]]; then
addToAnomalies "Sudo Vulnerability" "Sudo version potentially vulnerable to CVE-2019-14287 (sudo < 1.8.28)" "$HIGH" "SUDO_VULNERABILITY" "Upgrade sudo to version 1.8.28 or later" "sudo -u#-1 /bin/bash"
addToPrivEscVectors "Sudo Vulnerability Exploitation" "The system is running a sudo version potentially vulnerable to CVE-2019-14287. This can be exploited to gain root privileges by using a user ID of -1 or 4294967295." "$HIGH" "Requires sudo privileges with specific configuration" "sudo -u#-1 /bin/bash"
fi
if [[ "$sudoVersion" =~ 1\.8\.2[0-7] ]]; then
addToAnomalies "Sudo Vulnerability" "Sudo version potentially vulnerable to CVE-2019-18634 (sudo < 1.8.26)" "$HIGH" "SUDO_VULNERABILITY" "Upgrade sudo to version 1.8.26 or later" "exploits/sudo_cve-2019-18634.sh"
addToPrivEscVectors "Sudo Vulnerability Exploitation" "The system is running a sudo version potentially vulnerable to CVE-2019-18634 (buffer overflow). This can be exploited to gain root privileges." "$HIGH" "Requires specific sudo configuration" "exploits/sudo_cve-2019-18634.sh"
fi
addToPattern "Sudo Version Check" "ANALYZED" "$sudoVersion"
# Signature verification
logMessage "SUBSECTION" "Signature Verification (Matrix Authentication)"
dmesgSig=$(interrogateMatrix "dmesg | grep -i \"signature\"")
if [[ "$dmesgSig" == *"signature verification failed"* ]]; then
addToAnomalies "Signature Verification Failed" "System may be vulnerable to module loading exploits" "$MEDIUM" "MODULE_LOADING" "Ensure module signature verification is enabled and working correctly" ""
fi
addToPattern "Signature Verification Check" "ANALYZED" ""
updateProgress
}
# Check drives and mounts (the physical constructs of the Matrix)
analyzeDrives() {
if shouldSkipCheck "drives"; then
return
fi
animatedSection "Drives and Mounts"
logMessage "SECTION" "Drives and Mounts (Matrix Constructs)"
# List mounted drives
logMessage "SUBSECTION" "Mounted Drives (Active Constructs)"
mountedDrives=$(interrogateMatrix "mount")
showWithRedPill "$mountedDrives"
# Check for NFS shares with no_root_squash
if echo "$mountedDrives" | grep "no_root_squash" > /dev/null; then
addToAnomalies "NFS no_root_squash" "Found NFS share with no_root_squash option" "$HIGH" "NFS_PRIVILEGE_ESCALATION" "Reconfigure NFS to use root_squash option" "mkdir /tmp/nfs_exploit && mount -t nfs NFSHOSTIP:/shared /tmp/nfs_exploit && echo '#!/bin/bash\nchmod u+s /bin/bash' > /tmp/nfs_exploit/exploit.sh && chmod +x /tmp/nfs_exploit/exploit.sh && /tmp/nfs_exploit/exploit.sh && /bin/bash -p"
addToPrivEscVectors "NFS Privilege Escalation" "NFS share with no_root_squash option detected. This can be exploited to gain root privileges by creating SUID binaries on the NFS share." "$HIGH" "Requires access to the NFS mount point" "mkdir /tmp/nfs_exploit && mount -t nfs NFSHOSTIP:/shared /tmp/nfs_exploit && echo '#!/bin/bash\nchmod u+s /bin/bash' > /tmp/nfs_exploit/exploit.sh && chmod +x /tmp/nfs_exploit/exploit.sh && /tmp/nfs_exploit/exploit.sh && /bin/bash -p"
fi
addToPattern "Mounted Drives Check" "ANALYZED" ""
# Check for unmounted drives
logMessage "SUBSECTION" "Unmounted Drives (Dormant Constructs)"
if [ -f "/etc/fstab" ]; then
fstabEntries=$(interrogateMatrix "cat /etc/fstab")
showWithRedPill "$fstabEntries"
# Check for credentials in fstab
if echo "$fstabEntries" | grep -i "user\|password\|credentials" > /dev/null; then
addToAnomalies "FSTAB Credentials" "Found credentials in /etc/fstab" "$MEDIUM" "SENSITIVE_INFO" "Remove credentials from fstab or use a more secure authentication method" ""
fi
# Look for unmounted drives
currentMounts=$(mount | awk '{print $1}')
while read -r line; do
if [[ $line =~ ^[^#] ]]; then
device=$(echo "$line" | awk '{print $1}')
if ! echo "$currentMounts" | grep -q "$device"; then
addToAnomalies "Unmounted Drive" "Drive in fstab not currently mounted: $device" "$LOW" "ENUMERATION" "This is informational only" ""
fi
fi
done <<< "$fstabEntries"
fi
addToPattern "FSTAB Check" "ANALYZED" ""
updateProgress
}
# Remaining functions would continue in the same way, with updated features like progress indicators,
# better output formatting, and exploit command examples.
# For brevity, not all functions are shown here but would follow the same pattern.
# Generate an executive summary of the findings
generateExecutiveSummary() {
local criticalCount=0
local highCount=0
local mediumCount=0
local lowCount=0
local infoCount=0
# Count findings by severity
for anomaly in "${anomalies[@]}"; do
IFS='|' read -r name detail severity vector remediation exploit <<< "$anomaly"
case $severity in
"$CRITICAL") ((criticalCount++)) ;;
"$HIGH") ((highCount++)) ;;
"$MEDIUM") ((mediumCount++)) ;;
"$LOW") ((lowCount++)) ;;
"$INFO") ((infoCount++)) ;;
esac
done
echo -e "${MATRIX_GREEN}${BOLD}EXECUTIVE SUMMARY${NC}"
echo -e "${BOLD}==================${NC}"
echo ""
echo -e "MatrixScan has completed analysis of the system and identified potential privilege escalation vectors."
echo ""
echo -e "${BOLD}Findings Summary:${NC}"
echo -e "${RED}${BOLD}Critical: $criticalCount${NC}"
echo -e "${RED}High: $highCount${NC}"
echo -e "${YELLOW}Medium: $mediumCount${NC}"
echo -e "${BLUE}Low: $lowCount${NC}"
echo -e "${GREEN}Info: $infoCount${NC}"
echo ""
# Calculate risk score (simple weighted formula)
local riskScore=$((criticalCount * 100 + highCount * 40 + mediumCount * 10 + lowCount * 2))
local riskLevel=""
local riskColor=""
if [ $riskScore -gt 200 ]; then
riskLevel="CRITICAL"
riskColor="${RED}${BOLD}"
elif [ $riskScore -gt 100 ]; then
riskLevel="HIGH"
riskColor="${RED}"
elif [ $riskScore -gt 50 ]; then
riskLevel="MEDIUM"
riskColor="${YELLOW}"
elif [ $riskScore -gt 10 ]; then
riskLevel="LOW"
riskColor="${BLUE}"
else
riskLevel="MINIMAL"
riskColor="${GREEN}"
fi
echo -e "${BOLD}Overall Risk Assessment:${NC} ${riskColor}$riskLevel${NC} (Score: $riskScore)"
echo ""
# Print scan statistics
echo -e "${BOLD}Scan Statistics:${NC}"
echo "Scan duration: $scanDuration seconds"
echo "Total checks performed: ${#searchPatterns[@]}"
echo "Scan depth: $scanDepth"
echo ""
# Print privilege escalation vectors if any were found
if [ ${#privEscVectors[@]} -gt 0 ]; then
echo -e "${BOLD}Top Privilege Escalation Vectors:${NC}"
# Sort vectors by severity (critical first, then high, etc.)
local criticalVectors=()
local highVectors=()
local mediumVectors=()
local lowVectors=()
for vector in "${privEscVectors[@]}"; do
IFS='|' read -r name description severity exploitation exploit <<< "$vector"
case $severity in
"$CRITICAL")
criticalVectors+=("$vector")
;;
"$HIGH")
highVectors+=("$vector")
;;
"$MEDIUM")
mediumVectors+=("$vector")
;;
"$LOW")
lowVectors+=("$vector")
;;
esac
done
# Display vectors by severity, limited to top 3 per category
local count=0
# Critical vectors
for vector in "${criticalVectors[@]}"; do
IFS='|' read -r name description severity exploitation exploit <<< "$vector"
echo -e "${RED}${BOLD}[$severity] $name${NC}"
echo " - $description"
echo " - Exploitation: $exploitation"
if [ ! -z "$exploit" ]; then
echo -e " - ${UNDERLINE}Exploit:${NC} $exploit"
fi
echo ""
((count++))
if [ $count -ge 3 ]; then
echo -e " ${BOLD}...and $(( ${#criticalVectors[@]} - 3 )) more critical vectors${NC}"
break
fi
done
# High vectors if we have room
if [ $count -lt 5 ]; then
count=0
for vector in "${highVectors[@]}"; do
IFS='|' read -r name description severity exploitation exploit <<< "$vector"
echo -e "${RED}[$severity] $name${NC}"
echo " - $description"
echo " - Exploitation: $exploitation"
if [ ! -z "$exploit" ]; then
echo -e " - ${UNDERLINE}Exploit:${NC} $exploit"
fi
echo ""
((count++))
if [ $count -ge 2 ]; then
if [ ${#highVectors[@]} -gt 2 ]; then
echo -e " ${BOLD}...and $(( ${#highVectors[@]} - 2 )) more high severity vectors${NC}"
fi
break
fi
done
fi
else
echo -e "${GREEN}No clear privilege escalation vectors were identified.${NC}"
fi
echo -e "${BOLD}Recommendations:${NC}"
echo "1. Address all Critical and High severity findings immediately."
echo "2. Review Medium severity findings as part of a regular security maintenance process."
echo "3. Implement security best practices to prevent future vulnerabilities."
echo ""
if [ ${#privEscVectors[@]} -gt 0 ]; then
echo -e "${BOLD}Most Important Remediations:${NC}"
# Display top 3 most critical remediations
local remCount=0
for anomaly in "${anomalies[@]}"; do
IFS='|' read -r name detail severity vector remediation exploit <<< "$anomaly"
if [ "$severity" = "$CRITICAL" ] || [ "$severity" = "$HIGH" ]; then
echo "- $remediation"
((remCount++))
if [ $remCount -ge 3 ]; then
break
fi
fi
done
fi
echo ""
echo -e "${BOLD}Detailed findings are available in the full report.${NC}"
echo ""
}
# Generate a text report with findings categorized by severity
generateTextReport() {
# Initialize the report file
> "$blueprintFile"
# Header
echo "===========================================================================" >> "$blueprintFile"
echo " MATRIXSCAN REPORT " >> "$blueprintFile"
echo "===========================================================================" >> "$blueprintFile"
echo "Scan date: $(date)" >> "$blueprintFile"
echo "Hostname: $(hostname)" >> "$blueprintFile"
echo "User: $USER" >> "$blueprintFile"
echo "Scan ID: $scanId" >> "$blueprintFile"
echo "===========================================================================" >> "$blueprintFile"
echo "" >> "$blueprintFile"
# Executive Summary
echo "EXECUTIVE SUMMARY" >> "$blueprintFile"
echo "==================" >> "$blueprintFile"
echo "" >> "$blueprintFile"
# Count findings by severity
local criticalCount=0
local highCount=0
local mediumCount=0
local lowCount=0
local infoCount=0
for anomaly in "${anomalies[@]}"; do
IFS='|' read -r name detail severity vector remediation exploit <<< "$anomaly"
case $severity in
"$CRITICAL") ((criticalCount++)) ;;
"$HIGH") ((highCount++)) ;;
"$MEDIUM") ((mediumCount++)) ;;
"$LOW") ((lowCount++)) ;;
"$INFO") ((infoCount++)) ;;
esac
done
# Calculate risk score
local riskScore=$((criticalCount * 100 + highCount * 40 + mediumCount * 10 + lowCount * 2))
local riskLevel=""
if [ $riskScore -gt 200 ]; then
riskLevel="CRITICAL"
elif [ $riskScore -gt 100 ]; then
riskLevel="HIGH"
elif [ $riskScore -gt 50 ]; then
riskLevel="MEDIUM"
elif [ $riskScore -gt 10 ]; then
riskLevel="LOW"
else
riskLevel="MINIMAL"
fi
echo "Findings Summary:" >> "$blueprintFile"
echo "Critical: $criticalCount" >> "$blueprintFile"
echo "High: $highCount" >> "$blueprintFile"
echo "Medium: $mediumCount" >> "$blueprintFile"
echo "Low: $lowCount" >> "$blueprintFile"
echo "Info: $infoCount" >> "$blueprintFile"
echo "" >> "$blueprintFile"
echo "Overall Risk Assessment: $riskLevel (Score: $riskScore)" >> "$blueprintFile"
echo "" >> "$blueprintFile"
# Privilege Escalation Vectors
echo "IDENTIFIED PRIVILEGE ESCALATION VECTORS" >> "$blueprintFile"
echo "=======================================" >> "$blueprintFile"
echo "" >> "$blueprintFile"
if [ ${#privEscVectors[@]} -gt 0 ]; then
for vector in "${privEscVectors[@]}"; do
IFS='|' read -r name description severity exploitation exploit <<< "$vector"
echo "[$severity] $name" >> "$blueprintFile"
echo " - $description" >> "$blueprintFile"
echo " - Exploitation: $exploitation" >> "$blueprintFile"
if [ ! -z "$exploit" ]; then
echo " - Exploit Command: $exploit" >> "$blueprintFile"
fi
echo "" >> "$blueprintFile"
done
else
echo "No clear privilege escalation vectors were identified." >> "$blueprintFile"
echo "" >> "$blueprintFile"
fi
# Detailed Findings by Severity
echo "DETAILED FINDINGS" >> "$blueprintFile"
echo "=================" >> "$blueprintFile"
echo "" >> "$blueprintFile"
# Critical Findings
echo "CRITICAL SEVERITY FINDINGS" >> "$blueprintFile"
echo "=========================" >> "$blueprintFile"
echo "" >> "$blueprintFile"
local criticalFound=false
for anomaly in "${anomalies[@]}"; do
IFS='|' read -r name detail severity vector remediation exploit <<< "$anomaly"
if [ "$severity" = "$CRITICAL" ]; then
criticalFound=true
echo "[$vector] $name" >> "$blueprintFile"
echo " - $detail" >> "$blueprintFile"
echo " - Remediation: $remediation" >> "$blueprintFile"
if [ ! -z "$exploit" ]; then
echo " - Exploit Command: $exploit" >> "$blueprintFile"
fi
echo "" >> "$blueprintFile"
fi
done
if [ "$criticalFound" = false ]; then
echo "No critical severity findings identified." >> "$blueprintFile"
echo "" >> "$blueprintFile"
fi
# High Severity Findings
echo "HIGH SEVERITY FINDINGS" >> "$blueprintFile"
echo "=====================" >> "$blueprintFile"
echo "" >> "$blueprintFile"
local highFound=false
for anomaly in "${anomalies[@]}"; do
IFS='|' read -r name detail severity vector remediation exploit <<< "$anomaly"
if [ "$severity" = "$HIGH" ]; then
highFound=true
echo "[$vector] $name" >> "$blueprintFile"
echo " - $detail" >> "$blueprintFile"
echo " - Remediation: $remediation" >> "$blueprintFile"
if [ ! -z "$exploit" ]; then
echo " - Exploit Command: $exploit" >> "$blueprintFile"
fi
echo "" >> "$blueprintFile"
fi
done
if [ "$highFound" = false ]; then
echo "No high severity findings identified." >> "$blueprintFile"
echo "" >> "$blueprintFile"
fi
# Medium Severity Findings
echo "MEDIUM SEVERITY FINDINGS" >> "$blueprintFile"
echo "=======================" >> "$blueprintFile"
echo "" >> "$blueprintFile"
local mediumFound=false
for anomaly in "${anomalies[@]}"; do
IFS='|' read -r name detail severity vector remediation exploit <<< "$anomaly"
if [ "$severity" = "$MEDIUM" ]; then
mediumFound=true
echo "[$vector] $name" >> "$blueprintFile"
echo " - $detail" >> "$blueprintFile"
echo " - Remediation: $remediation" >> "$blueprintFile"
if [ ! -z "$exploit" ]; then
echo " - Exploit Command: $exploit" >> "$blueprintFile"
fi
echo "" >> "$blueprintFile"
fi
done
if [ "$mediumFound" = false ]; then
echo "No medium severity findings identified." >> "$blueprintFile"
echo "" >> "$blueprintFile"
fi
# Low Severity Findings
echo "LOW SEVERITY FINDINGS" >> "$blueprintFile"
echo "====================" >> "$blueprintFile"
echo "" >> "$blueprintFile"
local lowFound=false
for anomaly in "${anomalies[@]}"; do
IFS='|' read -r name detail severity vector remediation exploit <<< "$anomaly"
if [ "$severity" = "$LOW" ]; then
lowFound=true
echo "[$vector] $name" >> "$blueprintFile"
echo " - $detail" >> "$blueprintFile"
echo " - Remediation: $remediation" >> "$blueprintFile"
if [ ! -z "$exploit" ]; then
echo " - Exploit Command: $exploit" >> "$blueprintFile"
fi
echo "" >> "$blueprintFile"
fi
done
if [ "$lowFound" = false ]; then
echo "No low severity findings identified." >> "$blueprintFile"
echo "" >> "$blueprintFile"
fi
# System Information
echo "SYSTEM INFORMATION" >> "$blueprintFile"
echo "=================" >> "$blueprintFile"
echo "" >> "$blueprintFile"
echo "Kernel: $(uname -r)" >> "$blueprintFile"
echo "OS: $(cat /etc/issue 2>/dev/null)" >> "$blueprintFile"
echo "User: $(id)" >> "$blueprintFile"
echo "" >> "$blueprintFile"
# Scan Summary
echo "SCAN SUMMARY" >> "$blueprintFile"
echo "===========" >> "$blueprintFile"
echo "" >> "$blueprintFile"
echo "Total checks performed: ${#searchPatterns[@]}" >> "$blueprintFile"
echo "Total findings: ${#anomalies[@]}" >> "$blueprintFile"
echo "Scan duration: $scanDuration seconds" >> "$blueprintFile"
echo "Scan depth: $scanDepth" >> "$blueprintFile"
echo "Scan completed at $(date)" >> "$blueprintFile"
echo "" >> "$blueprintFile"
echo "\"Remember: All I'm offering is the truth, nothing more.\"" >> "$blueprintFile"
}
# Generate HTML report
generateHtmlReport() {
# Count findings by severity
local criticalCount=0
local highCount=0
local mediumCount=0
local lowCount=0
local infoCount=0
for anomaly in "${anomalies[@]}"; do
IFS='|' read -r name detail severity vector remediation exploit <<< "$anomaly"
case $severity in
"$CRITICAL") ((criticalCount++)) ;;
"$HIGH") ((highCount++)) ;;