Documentation
¶
Index ¶
- Constants
- Variables
- func AttemptRemoteExec(user, cmd string) map[string][]sshLoginSuccess
- func GetArp() []netlink.Neigh
- func IsContainer() bool
- func SetSSHControlMaster(user string) (bool, error)
- func StalkLocalLogin(user string, action LocalLoginStalkAction) error
- func StalkRemoteLogin(p StalkRemoteLoginParams) error
- func UnsetSSHControlMaster(user string) error
- type AVDiscoverer
- type Av
- type FilePerm
- type Host
- type LoadedKernelModule
- type LocalLoginStalkAction
- type NetConn
- type NetProto
- type OSSECAV
- type Output
- type Process
- type RkHunterAV
- type SamhainAV
- type SophosAV
- type SshPrivateKey
- type StalkRemoteLoginAction
- type StalkRemoteLoginParams
- type TripwireAV
- type Watch
- type Who
Constants ¶
const ( L4ProtoTcp = iota L4ProtoUdp = iota )
string parameter is the user who logged into a remote system.
const ( L3ProtoIpv4 = iota L3ProtoIpv6 = iota )
Variables ¶
var ( // Antivirus systems we detect AVSystems = []AVDiscoverer{ OSSECAV{}, SophosAV{}, TripwireAV{}, SamhainAV{}, } // The typical location where auditd looks for its ruleset AuditdRules = "/etc/audit/audit.rules" // The typical location utmp stores login information UtmpPath = "/var/run/utmp" SSHControlMasterDirective = `` /* 143-byte string literal not displayed */ TmpSSHSocketPattern = "/tmp/ssh-*/agent.*" )
Functions ¶
func AttemptRemoteExec ¶
AttemptRemoteExec will wait for signs that a user that can be hijacked is logged in. This means either a user with an ssh-agent running or with a ControlMaster socket active.
func IsContainer ¶
func IsContainer() bool
IsContainer looks at init's cgroup and total process count to guess at whether we're in a container. These are basically informed *guesses*.
func SetSSHControlMaster ¶
SetSSHControlMaster places a ControlMaster directive in the user's ssh config file. bool return value is true if the config file is created, false if it already exists. If err != nil, bool return value can't be trusted.
func StalkLocalLogin ¶
func StalkLocalLogin(user string, action LocalLoginStalkAction) error
StalkLocalLogin performs an action when a specific user logs in at any point in the future. If user == "*", any user will trigger the action.
func StalkRemoteLogin ¶
func StalkRemoteLogin(p StalkRemoteLoginParams) error
StalkRemoteLogin attempts to log into a remote system via two methods: 1. If the presence of an ssh-agent is detected, attempt to use it to log into the same host. 2. [not implemented] If the Control Master socket is recently created, attempt to use it
func UnsetSSHControlMaster ¶
UnsetSSHControlMaster removes the ControlMaster directive from user's ssh config file
Types ¶
type AVDiscoverer ¶
type AVDiscoverer interface {
// Filesystem paths of binaries
Paths() []string
// Running processes
Procs() []Process
// Loaded kernel modules
KernelModules() []LoadedKernelModule
// Name of the AV system
Name() string
}
Each AV system implements this interface to expose artifacts of the detected system. These functions only yield artifacts that are present/running on the system.
type Av ¶
type Av struct {
Paths []string
Procs []Process
KernelModules []LoadedKernelModule
Name string
}
Av houses information regarding detected AV
type LoadedKernelModule ¶
type LoadedKernelModule struct {
// contains filtered or unexported fields
}
LoadedKernelModule houses information regarding a kernel module that is currently loaded
type LocalLoginStalkAction ¶
string parameter is the user who logged into this system.
type OSSECAV ¶
type OSSECAV struct {
AVDiscoverer
}
func (OSSECAV) KernelModules ¶
func (o OSSECAV) KernelModules() []LoadedKernelModule
KernelModules returns an empty list as OSSEC doesn't use kernel modules.
type RkHunterAV ¶
type RkHunterAV struct {
AVDiscoverer
}
func (RkHunterAV) KernelModules ¶
func (t RkHunterAV) KernelModules() []LoadedKernelModule
KernelModules returns an empty list as Tripwire doesn't use kernel modules.
func (RkHunterAV) Name ¶
func (t RkHunterAV) Name() string
func (RkHunterAV) Paths ¶
func (t RkHunterAV) Paths() []string
func (RkHunterAV) Procs ¶
func (t RkHunterAV) Procs() []Process
type SamhainAV ¶
type SamhainAV struct {
AVDiscoverer
}
func (SamhainAV) KernelModules ¶
func (o SamhainAV) KernelModules() []LoadedKernelModule
type SophosAV ¶
type SophosAV struct {
AVDiscoverer
}
func (SophosAV) KernelModules ¶
func (o SophosAV) KernelModules() []LoadedKernelModule
type SshPrivateKey ¶
func GetSSHKeys ¶
func GetSSHKeys(dirs string, sleep int) []SshPrivateKey
GetSSHKeys looks for readable ssh private keys. Optionally sleep for `sleep` milliseconds to evade detection.
type StalkRemoteLoginAction ¶
type StalkRemoteLoginParams ¶
type StalkRemoteLoginParams struct {
// Function to execute when the stalked user logs into the local system.
Action StalkRemoteLoginAction
// Attempt to login only to hosts that match this regex.
HostRegex string
// Limit login attempts. If login attempt reaches this limit, stop attempting logins.
LoginLimit uint
// Frequency to look for the user to be logged in
PollFrequency uint
// Command to execute on remote host upon successful login.
RemoteCommand string
// Only attempt logins as this user. If user is "*", try to stalk any user.
User string
}
StalkRemoteLoginParams holds options for the StalkRemoteLogin functionality.
type TripwireAV ¶
type TripwireAV struct {
AVDiscoverer
}
func (TripwireAV) KernelModules ¶
func (t TripwireAV) KernelModules() []LoadedKernelModule
KernelModules returns an empty list as Tripwire doesn't use kernel modules.
func (TripwireAV) Name ¶
func (t TripwireAV) Name() string
func (TripwireAV) Paths ¶
func (t TripwireAV) Paths() []string
func (TripwireAV) Procs ¶
func (t TripwireAV) Procs() []Process
type Watch ¶
type Watch struct {
// Path being watched.
Path string
// Action the watch is looking for, i.e. read/write/execute. For example "wa" would detect file writes or appendages.
Action string
}
Watch holds the information for which the system is attempting to detect access.
func GetAuditWatches ¶
GetAuditWatches fetches a list of watches that auditd currently has on filesystem paths.
Source Files