sica-fondt/knowledge/cyber-skills/skills/performing-privilege-escalation-assessment/scripts/agent.py

#!/usr/bin/env python3
"""Agent for performing privilege escalation assessment.

Enumerates potential privilege escalation vectors on Linux systems
including SUID binaries, sudo misconfigurations, writable cron jobs,
capabilities, and kernel version checks.
"""

import subprocess
import shlex
import json
import sys
from pathlib import Path
from datetime import datetime


class PrivescAssessmentAgent:
    """Enumerates privilege escalation vectors on Linux systems."""

    def __init__(self, output_dir):
        self.output_dir = Path(output_dir)
        self.output_dir.mkdir(parents=True, exist_ok=True)
        self.findings = []

    def _run(self, cmd, timeout=30):
        """Execute a command and return output."""
        try:
            # Strip shell stderr redirects and detect shell operators
            clean_cmd = cmd.replace("2>/dev/null", "").strip()
            needs_shell = any(op in clean_cmd for op in ("|", ";", "&&", "||"))
            result = subprocess.run(
                clean_cmd if needs_shell else shlex.split(clean_cmd),
                shell=needs_shell, capture_output=True, text=True, timeout=timeout
            )
            return result.stdout.strip()
        except (subprocess.TimeoutExpired, FileNotFoundError, ValueError):
            return ""

    def get_system_info(self):
        """Gather system information for kernel exploit matching."""
        return {
            "hostname": self._run("hostname"),
            "kernel": self._run("uname -r"),
            "arch": self._run("uname -m"),
            "os_release": self._run("cat /etc/os-release 2>/dev/null | head -5"),
            "current_user": self._run("whoami"),
            "user_id": self._run("id"),
            "groups": self._run("groups"),
        }

    def check_sudo(self):
        """Check sudo configuration for escalation vectors."""
        sudo_l = self._run("sudo -l 2>/dev/null")
        findings = []

        gtfobins_dangerous = [
            "vim", "vi", "nano", "less", "more", "find", "nmap", "python",
            "python3", "perl", "ruby", "awk", "gawk", "env", "ftp",
            "man", "mount", "strace", "ltrace", "zip", "tar",
            "bash", "sh", "dash", "ash", "zsh", "tclsh",
        ]

        if "NOPASSWD" in sudo_l:
            for line in sudo_l.splitlines():
                if "NOPASSWD" in line:
                    for binary in gtfobins_dangerous:
                        if binary in line.lower():
                            finding = {
                                "type": "sudo_nopasswd",
                                "severity": "Critical",
                                "binary": binary,
                                "line": line.strip(),
                                "technique": "T1548.003",
                                "exploit": f"sudo {binary} (see GTFOBins)",
                            }
                            findings.append(finding)
                            self.findings.append(finding)
        return {"sudo_output": sudo_l, "dangerous_entries": findings}

    def find_suid_binaries(self):
        """Find SUID binaries that may allow escalation."""
        suid_output = self._run("find / -perm -4000 -type f 2>/dev/null")
        binaries = suid_output.splitlines()

        gtfobins_suid = [
            "nmap", "vim", "find", "bash", "more", "less", "nano",
            "cp", "mv", "python", "perl", "ruby", "env",
            "pkexec", "at", "strace", "taskset",
        ]

        findings = []
        for binary in binaries:
            name = Path(binary).name
            is_exploitable = name in gtfobins_suid
            if is_exploitable:
                finding = {
                    "type": "suid_binary",
                    "severity": "High",
                    "path": binary,
                    "name": name,
                    "technique": "T1548.001",
                    "exploit": f"SUID {name} (see GTFOBins)",
                }
                findings.append(finding)
                self.findings.append(finding)

        return {"total_suid": len(binaries), "exploitable": findings, "all_suid": binaries}

    def check_capabilities(self):
        """Find binaries with elevated Linux capabilities."""
        cap_output = self._run("getcap -r / 2>/dev/null")
        findings = []
        dangerous_caps = ["cap_setuid", "cap_dac_override", "cap_sys_admin",
                         "cap_sys_ptrace", "cap_net_raw"]

        for line in cap_output.splitlines():
            for cap in dangerous_caps:
                if cap in line:
                    finding = {
                        "type": "capability",
                        "severity": "High",
                        "line": line.strip(),
                        "capability": cap,
                        "technique": "T1548",
                    }
                    findings.append(finding)
                    self.findings.append(finding)
                    break
        return findings

    def check_writable_cron(self):
        """Check for writable cron jobs or scripts."""
        findings = []
        cron_paths = [
            "/etc/crontab", "/etc/cron.d", "/etc/cron.daily",
            "/etc/cron.hourly", "/etc/cron.weekly", "/etc/cron.monthly",
            "/var/spool/cron/crontabs",
        ]

        for cpath in cron_paths:
            p = Path(cpath)
            if p.is_file() and os.access(str(p), os.W_OK):
                finding = {
                    "type": "writable_cron",
                    "severity": "Critical",
                    "path": cpath,
                    "technique": "T1053.003",
                }
                findings.append(finding)
                self.findings.append(finding)
            elif p.is_dir():
                for f in p.iterdir():
                    if f.is_file():
                        content = f.read_text(errors="ignore")
                        for line in content.splitlines():
                            if line.strip() and not line.startswith("#"):
                                parts = line.split()
                                if len(parts) >= 6:
                                    script = parts[5]
                                    if Path(script).exists() and os.access(script, os.W_OK):
                                        finding = {
                                            "type": "writable_cron_script",
                                            "severity": "Critical",
                                            "cron_file": str(f),
                                            "script": script,
                                            "technique": "T1053.003",
                                        }
                                        findings.append(finding)
                                        self.findings.append(finding)
        return findings

    def check_writable_passwd(self):
        """Check if /etc/passwd or /etc/shadow is writable."""
        findings = []
        import os
        for path in ["/etc/passwd", "/etc/shadow"]:
            if os.path.exists(path) and os.access(path, os.W_OK):
                finding = {
                    "type": "writable_auth_file",
                    "severity": "Critical",
                    "path": path,
                    "technique": "T1078.003",
                    "exploit": f"Add root user to {path}",
                }
                findings.append(finding)
                self.findings.append(finding)
        return findings

    def check_kernel_exploits(self):
        """Match kernel version against known exploits."""
        kernel = self._run("uname -r")
        exploits = []

        known_vulns = [
            ("5.8", "5.16.11", "CVE-2022-0847", "DirtyPipe"),
            ("2.6.22", "4.8.3", "CVE-2016-5195", "DirtyCow"),
            ("4.6", "5.13", "CVE-2021-22555", "Netfilter heap OOB"),
        ]

        try:
            parts = kernel.split(".")
            major, minor = int(parts[0]), int(parts[1])
            patch = int(parts[2].split("-")[0]) if len(parts) > 2 else 0
        except (ValueError, IndexError):
            return exploits

        for min_ver, max_ver, cve, name in known_vulns:
            exploits.append({
                "cve": cve,
                "name": name,
                "affected_range": f"{min_ver} - {max_ver}",
                "kernel": kernel,
                "note": "Verify applicability before testing",
            })
        return exploits

    def generate_report(self):
        """Run all enumeration checks and generate report."""
        import os
        report = {
            "report_date": datetime.utcnow().isoformat(),
            "system_info": self.get_system_info(),
            "sudo_check": self.check_sudo(),
            "suid_binaries": self.find_suid_binaries(),
            "capabilities": self.check_capabilities(),
            "writable_cron": self.check_writable_cron(),
            "writable_auth": self.check_writable_passwd(),
            "kernel_exploits": self.check_kernel_exploits(),
            "total_findings": len(self.findings),
            "critical_findings": len([f for f in self.findings if f.get("severity") == "Critical"]),
            "high_findings": len([f for f in self.findings if f.get("severity") == "High"]),
        }

        report_path = self.output_dir / "privesc_assessment.json"
        with open(report_path, "w") as f:
            json.dump(report, f, indent=2)
        print(json.dumps(report, indent=2))
        return report


def main():
    output_dir = sys.argv[1] if len(sys.argv) > 1 else "./privesc_output"
    agent = PrivescAssessmentAgent(output_dir)
    agent.generate_report()


if __name__ == "__main__":
    main()