diff --git a/modules/S10_binaries_basic_check.sh b/modules/S10_binaries_basic_check.sh index 8ecb0a32..c604f545 100755 --- a/modules/S10_binaries_basic_check.sh +++ b/modules/S10_binaries_basic_check.sh @@ -35,6 +35,8 @@ S10_binaries_basic_check() { local IFS=" " IFS=" " read -r -a VUL_FUNC_GREP <<<"$(echo -e "${lVULNERABLE_FUNCTIONS}" | sed ':a;N;$!ba;s/\n/ -e /g')" + write_csv_log "binary" "interesting function count" + if [[ "${lVULNERABLE_FUNCTIONS}" == "C_N_F" ]]; then print_output "[!] Config not found" elif [[ -n "${lVULNERABLE_FUNCTIONS}" ]]; then @@ -54,6 +56,7 @@ S10_binaries_basic_check() { lVUL_FUNC="$(echo "${lVUL_FUNC}" | sed -e 's/[[:space:]]\+/\t/g')" print_output "$(indent "${lVUL_FUNC}")" done + write_csv_log "${lBINARY}" "${#lVUL_FUNC_RESULT_ARR[@]}" lCOUNTER=$((lCOUNTER + 1)) fi done < <(grep ";ELF" "${P99_CSV_LOG}" | cut -d ';' -f2 | sort -u || true) diff --git a/modules/S26_kernel_vuln_verifier.sh b/modules/S26_kernel_vuln_verifier.sh index 5a19eb83..e8d80cc5 100755 --- a/modules/S26_kernel_vuln_verifier.sh +++ b/modules/S26_kernel_vuln_verifier.sh @@ -52,6 +52,8 @@ S26_kernel_vuln_verifier() { # extract kernel version get_kernel_version_csv_data_s24 "${S24_CSV_LOG}" + write_csv_log "CVE" "CVSS" "kernel version" "vulnerable path" "verification method" + local lKERNEL_DATA="" local lKERNEL_ELF_EMBA_ARR=() local lALL_KVULNS_ARR=() @@ -507,6 +509,7 @@ symbol_verifier() { print_output "${lOUTx}" write_log "${lOUTx}" "${LOG_PATH_MODULE}/kernel_verification_${lK_VERSION}_detailed.log" echo "${lCVE} (${lCVSS}) - ${lK_VERSION} - exported symbol verified - ${lK_PATH}" >>"${LOG_PATH_MODULE}""/${lCVE}_symbol_verified.txt" + write_csv_log "${lCVE}" "${lCVSS}" "${lK_VERSION}" "${lK_PATH}" "exported symbol" lVULN_FOUND=1 break fi @@ -524,6 +527,7 @@ symbol_verifier() { print_output "${lOUTx}" write_log "${lOUTx}" "${LOG_PATH_MODULE}/kernel_verification_${lK_VERSION}_detailed.log" echo "${lCVE} (${lCVSS}) - ${lK_VERSION} - exported symbol verified (gpl) - ${lK_PATH}" >>"${LOG_PATH_MODULE}""/${lCVE}_symbol_verified.txt" + write_csv_log "${lCVE}" "${lCVSS}" "${lK_VERSION}" "${lK_PATH}" "exported symbol (GPL)" lVULN_FOUND=1 break fi @@ -542,6 +546,7 @@ compile_verifier() { if grep -q "${lK_PATH}" "${LOG_PATH_MODULE}"/kernel-compile-files_verified.log; then print_output "[+] ${ORANGE}${lCVE}${GREEN} (${ORANGE}${lCVSS}${GREEN}) - ${ORANGE}${lK_PATH}${GREEN} verified - compiled path${NC}" echo "${lCVE} (${lCVSS}) - ${lK_VERSION} - compiled path verified - ${lK_PATH}" >>"${LOG_PATH_MODULE}""/${lCVE}_compiled_verified.txt" + write_csv_log "${lCVE}" "${lCVSS}" "${lK_VERSION}" "${lK_PATH}" "compiled path" fi } diff --git a/modules/S55_history_file_check.sh b/modules/S55_history_file_check.sh index a9d47fd5..8d05b627 100755 --- a/modules/S55_history_file_check.sh +++ b/modules/S55_history_file_check.sh @@ -26,12 +26,15 @@ S55_history_file_check() { mapfile -t lHIST_FILES_ARR < <(config_find "${CONFIG_DIR}""/history_files.cfg") + write_csv_log "history file" + if [[ "${lHIST_FILES_ARR[0]-}" == "C_N_F" ]]; then print_output "[!] Config not found" elif [[ "${#lHIST_FILES_ARR[@]}" -ne 0 ]]; then print_output "[+] Found history files:" for lHIST_FILE in "${lHIST_FILES_ARR[@]}"; do print_output "$(indent "$(orange "$(print_path "${lHIST_FILE}")")")" + write_csv_log "${lHIST_FILE}" done else print_output "[-] No history files found" diff --git a/modules/S65_config_file_check.sh b/modules/S65_config_file_check.sh index fcd0d1da..78d3a673 100755 --- a/modules/S65_config_file_check.sh +++ b/modules/S65_config_file_check.sh @@ -24,6 +24,8 @@ S65_config_file_check() { local lNEG_LOG=0 export CONF_FILES_ARR=() + write_csv_log "type" "file" + scan_config check_fstab @@ -46,6 +48,7 @@ scan_config() { print_output "[+] Found ""${#CONF_FILES_ARR[@]}"" possible configuration files:" for lCONFIG_FILE in "${CONF_FILES_ARR[@]}"; do print_output "$(indent "$(orange "$(print_path "${lCONFIG_FILE}")")")" + write_csv_log "config file" "${lCONFIG_FILE}" done else print_output "[-] No configuration files found" @@ -68,6 +71,7 @@ check_fstab() { print_output "[+] Found ""${#FSTAB_USER_FILES[@]}"" fstab files with user details included:" for lFSTAB_FILE in "${FSTAB_USER_FILES[@]}"; do print_output "$(indent "$(print_path "${lFSTAB_FILE}")")" + write_csv_log "fstab user details" "${lFSTAB_FILE}" done print_ln "no_log" else @@ -78,6 +82,7 @@ check_fstab() { print_output "[+] Found ""${#FSTAB_PASS_FILES[@]}"" fstab files with password credentials included:" for lFSTAB_FILE in "${FSTAB_PASS_FILES[@]}"; do print_output "$(indent "$(print_path "${lFSTAB_FILE}")")" + write_csv_log "fstab password" "${lFSTAB_FILE}" done print_ln "no_log" else diff --git a/modules/S75_network_check.sh b/modules/S75_network_check.sh index 8d1bc116..a2ef961d 100755 --- a/modules/S75_network_check.sh +++ b/modules/S75_network_check.sh @@ -24,6 +24,8 @@ S75_network_check() { export NET_CFG_FOUND=0 + write_csv_log "network config type" "file" + check_resolv check_iptables check_snmp @@ -45,6 +47,7 @@ check_resolv() { if [[ -e "${lRES_INFO_P}" ]]; then lCHECK=1 print_output "[+] DNS config ""$(print_path "${lRES_INFO_P}")" + write_csv_log "resolv.conf" "${lRES_INFO_P}" lDNS_INFO=$(grep "nameserver" "${lRES_INFO_P}" 2>/dev/null || true) if [[ "${lDNS_INFO}" ]]; then @@ -70,6 +73,7 @@ check_iptables() { if [[ -e "${lIPT_INFO_P}" ]]; then lCHECK=1 print_output "[+] iptables config ""$(print_path "${lIPT_INFO_P}")" + write_csv_log "iptables" "${lIPT_INFO_P}" ((NET_CFG_FOUND += 1)) fi done @@ -93,6 +97,7 @@ check_snmp() { if [[ -e "${lSNMP_CONF_P}" ]]; then lCHECK=1 print_output "[+] SNMP config ""$(print_path "${lSNMP_CONF_P}")" + write_csv_log "snmp" "${lSNMP_CONF_P}" mapfile -t lFIND_ARR < <(awk '/^com2sec/ { print $4 }' "${lSNMP_CONF_P}") if [[ "${#lFIND_ARR[@]}" -ne 0 ]]; then print_output "[*] com2sec line/s:" @@ -122,6 +127,7 @@ check_network_configs() { print_output "[+] Found ""${#lNETWORK_CONFS_ARR[@]}"" possible network configs:" for lNW_CONF in "${lNETWORK_CONFS_ARR[@]}"; do print_output "$(indent "$(orange "$(print_path "${lNW_CONF}")")")" + write_csv_log "network config" "${lNW_CONF}" ((NET_CFG_FOUND += 1)) done else diff --git a/modules/S80_cronjob_check.sh b/modules/S80_cronjob_check.sh index abcc003f..3ae97cd6 100755 --- a/modules/S80_cronjob_check.sh +++ b/modules/S80_cronjob_check.sh @@ -27,6 +27,8 @@ S80_cronjob_check() { local lCJ_FILE="" local lCT_VAR="" + write_csv_log "type" "path" + mapfile -t lCJ_FILE_PATH_ARR < <(mod_path "/ETC_PATHS/cron") for lCJ_FILE in "${lCJ_FILE_PATH_ARR[@]}"; do if [[ -e "${lCJ_FILE}" ]]; then @@ -37,6 +39,7 @@ S80_cronjob_check() { if [[ "${lCRONJOBS}" ]]; then print_output "[+] Cronjobs:" print_output "$(indent "${lCRONJOBS}")" + write_csv_log "cronjob" "${lCJ_FILE}" ((lRESULTS += 1)) fi fi @@ -50,6 +53,7 @@ S80_cronjob_check() { if [[ "${lCRONJOBWWPERMS}" ]]; then print_output "[+] World-writable cron jobs and file contents:" print_output "$(indent "${lCRONJOBWWPERMS}")" + write_csv_log "world-writable cronjob" "${lCJ_FILE}" ((lRESULTS += 1)) fi fi @@ -64,6 +68,7 @@ S80_cronjob_check() { if [[ "${lCRONTABVALUE}" ]]; then print_output "[+] Crontab content:" print_output "$(indent "${lCRONTABVALUE}")" + write_csv_log "crontab" "${lCJ_FILE}" ((lRESULTS += 1)) fi fi @@ -79,6 +84,7 @@ S80_cronjob_check() { if [[ "${lCRONTABVAR}" ]]; then print_output "[+] Anything interesting in ""$(print_path "${lCT_VAR}")" print_output "$(indent "${lCRONTABVAR}")" + write_csv_log "crontab spool" "${lCT_VAR}" ((lRESULTS += 1)) fi done @@ -95,6 +101,7 @@ S80_cronjob_check() { if [[ "${lANACRONJOBS}" ]]; then print_output "[+] Anacron jobs and associated file permissions:" print_output "$(indent "${lANACRONJOBS}")" + write_csv_log "anacron job" "${lCJ_FILE}" ((lRESULTS += 1)) fi fi @@ -109,6 +116,7 @@ S80_cronjob_check() { if [[ "${lANACRONTAB}" ]]; then print_output "[+] When were jobs last executed (""$(print_path "${lCT_VAR}")"")" print_output "$(indent "${lANACRONTAB}")" + write_csv_log "anacron spool" "${lCT_VAR}" ((lRESULTS += 1)) fi done diff --git a/modules/S90_mail_check.sh b/modules/S90_mail_check.sh index fe0b11c1..276d566e 100755 --- a/modules/S90_mail_check.sh +++ b/modules/S90_mail_check.sh @@ -27,6 +27,8 @@ S90_mail_check() { local lELEM="" local lMAILS="" + write_csv_log "type" "path" + mapfile -t lMAILS_PATH_ARR < <(find "${FIRMWARE_PATH}" -xdev -type d -iwholename "/var/mail") for lELEM in "${lMAILS_PATH_ARR[@]}"; do if [[ -e "${lELEM}" ]]; then @@ -35,6 +37,7 @@ S90_mail_check() { if [[ -n "${lMAILS}" ]]; then print_output "[+] Content of ""$(print_path "${lELEM}")"":" print_output "$(indent "$(orange "${lMAILS}")")" + write_csv_log "mail dir" "${lELEM}" ((lFINDING += 1)) fi fi @@ -51,6 +54,7 @@ S90_mail_check() { if [[ -n "${lMAILS_ROOT}" ]]; then print_output "[+] Content of ""$(print_path "${lELEM}")"":" print_output "$(indent "$(orange "${lMAILS_ROOT}")")" + write_csv_log "root mailbox" "${lELEM}" ((lFINDING += 1)) fi fi