49 lines
1.2 KiB
Go
49 lines
1.2 KiB
Go
package check
|
||
|
||
import (
|
||
"fmt"
|
||
"os/exec"
|
||
"strings"
|
||
|
||
"github.com/toolkits/slice"
|
||
)
|
||
|
||
func SetUid() bool {
|
||
suspicious := false
|
||
whitelist := []string{
|
||
"pam_timestamp_check", "unix_chkpwd", "ping", "mount", "umount", "sudo", "su", "pt_chown", "ssh-keysign", "at", "passwd", "chsh", "crontab", "chfn",
|
||
"usernetctl", "staprun", "newgrp", "chage", "dhcp", "helper", "pkexec", "top", "Xorg", "nvidia-modprobe", "quota", "login", "security_authtrampoline",
|
||
"authopen", "traceroute6", "traceroute", "ps", "auth_pam_tool", "Xorg.wrap", "gpasswd", "mount.cifs", "mount.nfs", "ping6", "pppd", "fusermount3",
|
||
"ntfs-3g",
|
||
}
|
||
c := exec.Command(
|
||
"bash", "-c",
|
||
"find / ! -path '/proc/*' -type f -perm -4000 2>/dev/null",
|
||
)
|
||
|
||
output, err := c.CombinedOutput()
|
||
|
||
if err != nil {
|
||
fmt.Println(err.Error())
|
||
return suspicious
|
||
}
|
||
|
||
fileInfos := strings.Split(string(output), "\n")
|
||
if len(fileInfos) != 0 {
|
||
suspicious = true
|
||
fmt.Println("主机含有非常见suid程序，请确认")
|
||
}
|
||
for _, info := range fileInfos {
|
||
if info == "" {
|
||
continue
|
||
}
|
||
tmp := strings.Split(info, "/")
|
||
if !slice.ContainsString(whitelist, tmp[len(tmp)-1]) {
|
||
fmt.Println(info)
|
||
}
|
||
}
|
||
|
||
return suspicious
|
||
|
||
}
|