Z. Cliffe Schreuders
5aa32d5907
fix literal new line
2017-02-22 16:16:37 +00:00
Z. Cliffe Schreuders
ad55210ddf
initial c_code example
2017-02-22 15:26:56 +00:00
thomashaw
e8f8dcece4
Team project work squashed + removed dead code
2017-02-17 14:59:07 +00:00
thomashaw
373b0bc5dc
Parameterised Website using datastores. Loads of generators and encoders. Check out the example scenarios.
2017-01-15 19:56:13 +00:00
thomashaw
e7019afa86
Fixed shellshock
2016-12-20 15:26:21 +00:00
thomashaw
0d890ee535
Corrected proftpd_133c_backdoor as it gives you a root_rwx privilege, not user_rwx privilege, shell when exploiting this vulnerability.
2016-12-20 14:55:58 +00:00
thomashaw
ad49319447
Removed leftover comment
2016-12-14 13:50:49 +00:00
thomashaw
007863e05c
weak_password_generator <type> added to the weak and common pw gens, fixed typo in account_hash_builder
2016-12-08 10:54:21 +00:00
thomashaw
17f425b37f
Multiple leaked files, new secgen_functions module encapsulating the file_leak and overshare.erb logic. Updated old modules to use the new resource type.
2016-12-08 10:43:48 +00:00
thomashaw
1595b4f3e3
NFS /etc/exports updated to allow all networks
2016-12-06 10:09:57 +00:00
thomashaw
7d7d2e2677
Rework: Moved hello_world to messages. Changed write_fact to output_type. Updated PATH constants to DIR. Changed string generators to more specific message_generator in strings_to_leak.
2016-12-05 17:15:55 +00:00
thomashaw
733c871072
Additional parameterisation. New modules: parameterised_accounts, generators and an account_encoder. Added plenty of parameters/default_inputs to currently existing vulnerability modules.
2016-11-30 18:09:22 +00:00
thomashaw
f724415cdf
Privilege changes: More specific privilege levels. r, rw, rwx for root & user.
2016-11-14 14:34:04 +00:00
thomashaw
b1ba6700d4
Vulnerability: chkrootkit 0.49 local privilege escalation
2016-11-13 22:48:21 +00:00
thomashaw
2cf329eeef
Vulnerability: Gitlist 0.4.0 webapp with RCE
2016-11-13 22:43:47 +00:00
Z. Cliffe Schreuders
9ff06fce7e
default values for parameters (modules and literal values)
2016-11-08 00:28:33 +00:00
Z. Cliffe Schreuders
4421c7d99c
Merge branch 'parameterisation'
2016-10-18 21:25:17 +01:00
Z. Cliffe Schreuders
e282dde855
Merge branch 'master' of https://github.com/cliffe/SecGen
2016-10-18 21:23:02 +01:00
Z. Cliffe Schreuders
e63aa00e0a
parameterisation
2016-10-18 21:19:47 +01:00
Jjk422
772b96436e
Changed service module samba directory from file_share to smb.
...
Changed scenario files that used the module.
Also changed the secgen.xml for samba vulnerabilities that required the module.
service::samba::secgen_metadata.xml:
Changed type in SecGen metadata for samba service module from file_share to smb, also added author.
Removed unneeded comments, changed comment from apache to samba.
scenarios::samba_service.xml
Changed comment to represent samba.
Tested and seems to be fully working for all modules/scenarios that require it.
2016-09-13 11:10:59 +01:00
Jjk422
4f53a7f770
Merge pull request #70 from thomashaw/nmap_setuid_rebase
...
Tested, exploitable although multiple exploits needed to exploit the box.
Ready to be merged.
2016-09-07 15:01:58 +01:00
thomashaw
4528467f04
Vulnerability: Nmap setuid local privilege escalation
2016-09-06 15:34:12 +01:00
Jjk422
18268af6c9
Merge pull request #69 from thomashaw/shellshock_rebase
...
Tested and seems to be fully working.
2016-09-06 15:17:28 +01:00
thomashaw
d9d785f335
Metadata: Updated shellshock privilege = none, access = local
2016-09-06 13:46:31 +01:00
Jjk422
bc9db957e3
Merge pull request #67 from thomashaw/samba_overshare_rebase
...
Happy with this branch, don't think we need to change anything so merging, although the samba service module versioning may come back to bite us, but we can deal with that when we get to it.
2016-09-06 13:15:44 +01:00
Tom
27dc5c3b9e
Merge pull request #66 from Jjk422/new_access_control_misconfigurations_uid_less_running_as_root
...
Access control vulnerability, allows less to run as root for any user.
2016-09-06 13:10:22 +01:00
Z. Cliffe Schreuders
8bbdc885a3
Merge branches 'master' and 'parameterisation' of https://github.com/cliffe/SecGen
2016-09-05 08:56:59 +01:00
thomashaw
60cd05536d
Vulnerability: Shellshock in bash & Service: apache server with cgi hosting a bash script
...
New scenario combines the two & is exploitable with msf module: exploit/multi/http/apache_mod_cgi_bash_env_exec
2016-09-04 22:15:28 +01:00
thomashaw
3f00728fd2
Vulnerability: samba anonymously writable share + symlink traversal
2016-09-02 19:55:42 +01:00
Jjk422
51bbf5c7c3
Should fix all errors in branch 'Access control vulnerability, allows less to run as root for any user'.
...
required:
/access_control_misconfigurations/uid_less_root/manifests/change_uid_permissions.pp:4: Comments removed.
/access_control_misconfigurations/uid_less_root/manifests/change_uid_permissions.pp:10-15: Comments removed.
optional / suggested:
/access_control_misconfigurations/uid_less_root/manifests/change_uid_permissions.pp:1: $user parameter kept, module should be able to be copied and used for other modules (changing user permissions or different files) to ensure that all code is the same and checked <-- this was my thinking anyway.
/access_control_misconfigurations/uid_less_root/manifests/change_uid_permissions.pp:2: Removed the 'String' from before the block parameter definitions.
/access_control_misconfigurations/uid_less_root/manifests/change_uid_permissions.pp:3-8(post comment removal): Indented the block by two spaces.
2016-09-01 16:36:13 +01:00
Jjk422
d49cb521cc
Access control vulnerability, allows less to run as root for any user.
...
Access_control_misconfigurations_uid_less_root.xml can be used to test this
2016-09-01 10:06:00 +01:00
Tom
c37d88e7e5
Merge pull request #64 from Jjk422/new_access_control_vulnerability_vi_running_as_root
...
Access control misconfiguration module that ensures the vi text edit…
2016-08-31 15:57:34 +01:00
Jjk422
b29c08a8b5
Fixed mislabeled secgen_metadata.xml <privilege> tag from user to root.
2016-08-31 09:42:02 +01:00
Jjk422
94d6d00112
Access control misconfiguration module that ensures the vi text editor runs at root.
...
Scenario file at access_control_misconfigurations_uid_vi_root.xml.
2016-08-29 10:36:46 +01:00
thomashaw
b8cc50b549
separated the vulnerable code out and used require to manipulate order
2016-08-18 20:58:04 +01:00
thomashaw
535017058a
unrealirc_3281_backdoor vulnerability refactored.
...
Vulnerable code now held within the service module and conditionally run based on whether the unrealirc_3281_backdoor class has been included. Reduced duplicate code.
Going to follow this pattern for misconfiguration vulnerabilities as modifying the same resources from different classes/namespaces within puppet causes issues.
2016-08-17 16:04:28 +01:00
Z. Cliffe Schreuders
0185837c7b
Module dependencies
2016-08-16 23:44:44 +01:00
thomashaw
e14a0f75df
post-dependencies tidy up
2016-08-01 18:13:30 +01:00
Tom
29b58b325f
Merge pull request #55 from cliffe/module_dependencies
...
Module dependencies
2016-07-30 11:45:29 +01:00
thomashaw
e9f1b87774
Removed testing comments
2016-07-30 11:45:06 +01:00
thomashaw
a723226865
Vulnerability: MoinMoin-1.9.5 wiki
2016-07-27 12:37:19 +01:00
Z. Cliffe Schreuders
6e6df008b9
Module dependencies
2016-07-27 09:51:13 +01:00
Jjk422
49467bcd9e
Merge pull request #45 from thomashaw/vsftpd_backdoor
...
Vulnerability: vsftpd_234_backdoor rewrite:
Tested and exploitable with vsftpd_234_backdoor vulnerability
2016-07-21 12:39:29 +01:00
thomashaw
72dad41881
Vulnerability: vsftpd_234_backdoor rewrite
2016-06-21 20:35:16 +01:00
Connor Wilson
90319741bb
Merge pull request #44 from thomashaw/unreal_ircd_rework
...
Confirmed both vulnerable and secure services running, vulnerable service is exploitable, secure service is secure. Merging.
2016-06-19 12:48:31 +01:00
thomashaw
31c49d81ff
Vulnerability: UnrealIRCd backdoor
2016-06-18 19:58:33 +01:00
thomashaw
88db89c8ef
now also removes tar.gz
2016-06-15 18:03:05 +01:00
thomashaw
ed5cdc56b7
Cleanup step
2016-06-15 18:00:58 +01:00
thomashaw
58a811a010
Vulnerability: ProFTPd 1.3.3c backdoor
2016-06-11 19:02:58 +01:00
thomashaw
8d0a2d50c6
nfs_overshare post-merge fix
2016-06-09 11:43:04 +01:00
