#!/usr/bin/env python3 # written by sqall # twitter: https://twitter.com/sqall01 # blog: https://h4des.org # github: https://github.com/sqall01 # # Licensed under the MIT License. """ Short summary: Searches for hidden ELF files in the filesystem. Usually, ELF binaries are not hidden in a Linux environment. Requirements: None """ import os import sys from typing import List from lib.step_state import StepLocation, load_step_state, store_step_state from lib.util import output_error, output_finding from lib.util_file import FileLocation, apply_directory_whitelist, apply_file_whitelist # Read configuration. try: from config.config import ALERTR_FIFO, FROM_ADDR, TO_ADDR, STATE_DIR from config.search_hidden_exe import ACTIVATED, SEARCH_IN_STEPS, SEARCH_LOCATIONS, \ HIDDEN_EXE_DIRECTORY_WHITELIST, HIDDEN_EXE_FILE_WHITELIST STATE_DIR = os.path.join(os.path.dirname(__file__), STATE_DIR, os.path.basename(__file__)) except: ALERTR_FIFO = None FROM_ADDR = None TO_ADDR = None ACTIVATED = True SEARCH_IN_STEPS = False SEARCH_LOCATIONS = ["/"] HIDDEN_EXE_DIRECTORY_WHITELIST = [] HIDDEN_EXE_FILE_WHITELIST = [] STATE_DIR = os.path.join("/tmp", os.path.basename(__file__)) def search_hidden_exe_files(): # Decide where to output results. print_output = False if ALERTR_FIFO is None and FROM_ADDR is None and TO_ADDR is None: print_output = True if not ACTIVATED: if print_output: print("Module deactivated.") return step_state_data = {} try: step_state_data = load_step_state(STATE_DIR) except Exception as e: output_error(__file__, str(e)) return # Reset step if we do not search in steps but everything. if not SEARCH_IN_STEPS: step_state_data["next_step"] = 0 if not SEARCH_LOCATIONS: SEARCH_LOCATIONS.append("/") # Gather all search locations. search_locations = [] # type: List[StepLocation] # If SEARCH_IN_STEPS is active, build a list of directories to search in if SEARCH_IN_STEPS: for search_location in SEARCH_LOCATIONS: # Add parent directory as non-recursive search location in order to search in it without going deeper. search_locations.append(StepLocation(search_location, False)) # Add all containing subdirectories as recursive search locations. elements = os.listdir(search_location) elements.sort() for element in elements: path = os.path.join(search_location, element) if os.path.isdir(path): search_locations.append(StepLocation(path, True)) # If we do not search in separated steps, just add each directory as a recursive search location. else: for search_location in SEARCH_LOCATIONS: search_locations.append(StepLocation(search_location, True)) # Reset index if it is outside the search locations. if step_state_data["next_step"] >= len(search_locations): step_state_data["next_step"] = 0 while True: search_location_obj = search_locations[step_state_data["next_step"]] # Get all hidden ELF files. if search_location_obj.search_recursive: fd = os.popen("find %s -type f -iname \".*\" -exec echo -n \"{} \" \\; -exec head -c 4 {} \\; -exec echo \"\" \\; | grep -P \"\\x7fELF\"" % search_location_obj.location) else: fd = os.popen("find %s -maxdepth 1 -type f -iname \".*\" -exec echo -n \"{} \" \\; -exec head -c 4 {} \\; -exec echo \"\" \\; | grep -P \"\\x7fELF\"" % search_location_obj.location) output_raw = fd.read().strip() fd.close() if output_raw != "": hidden_files = [] # type: List[FileLocation] output_list = output_raw.split("\n") for output_entry in output_list: file_location = output_entry[:-5] hidden_files.append(FileLocation(file_location)) dir_whitelist = [FileLocation(x) for x in HIDDEN_EXE_DIRECTORY_WHITELIST] file_whitelist = [FileLocation(x) for x in HIDDEN_EXE_FILE_WHITELIST] hidden_files = apply_directory_whitelist(dir_whitelist, hidden_files) hidden_files = apply_file_whitelist(file_whitelist, hidden_files) if hidden_files: message = "Hidden ELF file(s) found:\n\n" message += "\n".join(["File: %s" % x.location for x in hidden_files]) output_finding(__file__, message) step_state_data["next_step"] += 1 # Stop search if we are finished. if SEARCH_IN_STEPS or step_state_data["next_step"] >= len(search_locations): break try: store_step_state(STATE_DIR, step_state_data) except Exception as e: output_error(__file__, str(e)) if __name__ == '__main__': is_init_run = False if len(sys.argv) == 2: if sys.argv[1] == "--init": is_init_run = True # Script does not need to establish a state. if not is_init_run: search_hidden_exe_files()