debain系统的系统用户弱密码检测不出来

Question

debain系统的系统用户弱密码检测不出来

testwill opened this issue 2 years ago · 35 comments

/opt/veinmind-tools/veinmind-weakpass/artifacts/linux-amd64/veinmind-weakpass_linux_amd64 scan 192.168.1.94:443/library/test_weakpass:0.1
INFO[0002] Start Scan Image SSH Weakpass: 192.168.1.94:443/library/test_weakpass:0.1

============================================================================================

============================================================================================

cat /etc/shadow

root::19139:0:99999:7:::
daemon::19139:0:99999:7:::
bin::19139:0:99999:7:::
sys::19139:0:99999:7:::
sync::19139:0:99999:7:::
games::19139:0:99999:7:::
man::19139:0:99999:7:::
lp::19139:0:99999:7:::
mail::19139:0:99999:7:::
news::19139:0:99999:7:::
uucp::19139:0:99999:7:::
proxy::19139:0:99999:7:::
www-data::19139:0:99999:7:::
backup::19139:0:99999:7:::
list::19139:0:99999:7:::
irc::19139:0:99999:7:::
gnats::19139:0:99999:7:::
nobody::19139:0:99999:7:::
_apt:*:19139:0:99999:7:::
nginx:!:19140:0:99999:7:::
test:$y$j9T$c/zxurpmCyM0ACN53Rsnl.$/a3a7ZXTmnZgaIFeUMB21pECYdoU.y.UJQlAULHs9/7:19191:0:99999:7:::

test用户的密码是123456

testwill commented 2 years ago

可以

Answer 1 · 2022-07-21T03:19:00.000Z

贴一下你的 os info，检查一下你的test用户密码是否为123456

Answer 2 · 2022-07-21T03:20:36.000Z

cat /etc/issue
Debian GNU/Linux 11 \n \l

Answer 3 · 2022-07-21T03:20:53.000Z

cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Answer 4 · 2022-07-21T03:27:15.000Z

你的用户密码是怎么写进去的，是直接echo 进去的还是命令生成的，我看密码格式好像不是标准格式。

Answer 5 · 2022-07-21T03:35:44.000Z

使用的 adduser

Answer 6 · 2022-07-21T03:38:22.000Z

history

1  adduser  root
2  adduser  test
3  exit
4  su root
5  exit
6  history

Answer 7 · 2022-07-21T03:41:26.000Z

passwd test,改过了？

Answer 8 · 2022-07-21T03:41:48.000Z

huzai9527 commented 2 years ago

Answer 9 · 2022-07-21T03:49:32.000Z

如果你改完密码了，但是加密模式是 $y$,这里 $y$ 加密模式还没有支持,所以不会爆出来

Answer 10 · 2022-07-21T04:00:13.000Z

应该是输入了y。那为什么Ubuntu可以呀？

Answer 11 · 2022-07-21T04:01:39.000Z

没有指定加密模式，系统自带的吗

Answer 12 · 2022-07-21T04:09:17.000Z

明白了，谢谢

Answer 13 · 2022-07-22T09:12:13.000Z

@testwill 已经支持debain ssh默认加密模式，可以在最新的pr中获取

Answer 14 · 2022-07-22T09:30:35.000Z

是哪个分支，我20号同步一下，测试还是没有检测出来

Answer 15 · 2022-07-25T03:38:10.000Z

目前分支还没有被合并，我们计划兼容其他几种新的加密模式，提前体验 y 加密可以从pr中找到具体的分支进行pull，然后尝试

Answer 16 · 2022-07-25T07:43:42.000Z

PR 已合并，tag 为 v1.4.1

Answer 17 · 2022-07-27T06:38:02.000Z

./artifacts/linux-amd64/veinmind-weakpass_linux_amd64 scan 192.168.1.94:443/library/test_weakpass:0.1

INFO[0000] start to scan mysql weakpass: 192.168.1.94:443/library/test_weakpass:0.1
INFO[0000] start to scan tomcat weakpass: 192.168.1.94:443/library/test_weakpass:0.1
INFO[0000] start to scan redis weakpass: 192.168.1.94:443/library/test_weakpass:0.1
INFO[0000] start to scan ssh weakpass: 192.168.1.94:443/library/test_weakpass:0.1

============================================================================================

============================================================================================

git branch

master

v1.4.1

Answer 18 · 2022-07-27T06:41:08.000Z

@huzai9527

Answer 19 · 2022-07-27T06:55:10.000Z

image 配置

## shadow文件弱密码行

## 扫描结果

Answer 20 · 2022-07-27T06:56:39.000Z

请确保你添加完弱密码账户后，从container打包了镜像

Answer 21 · 2022-07-27T06:57:59.000Z

你可以从你测试镜像run 一个 container，然后进去查看shadow文件中的弱密码行，是否与上图格式相同

Answer 22 · 2022-07-27T06:59:54.000Z

testwill commented 2 years ago

Answer 23 · 2022-07-27T07:03:16.000Z

不太一样，但是我的密码应该123456，我再添加一个用户看看

Answer 24 · 2022-07-27T07:06:53.000Z

docker run -it 192.168.1.94:443/library/test_weakpass:0.1 sh

passwd test

New password:
Retype new password:
passwd: password updated successfully

ca^H^H^H

sh: 2:: not found

bash

root@fe1f645ed185:/# cat /etc/shadow
root::19139:0:99999:7:::
daemon::19139:0:99999:7:::
bin::19139:0:99999:7:::
sys::19139:0:99999:7:::
sync::19139:0:99999:7:::
games::19139:0:99999:7:::
man::19139:0:99999:7:::
lp::19139:0:99999:7:::
mail::19139:0:99999:7:::
news::19139:0:99999:7:::
uucp::19139:0:99999:7:::
proxy::19139:0:99999:7:::
www-data::19139:0:99999:7:::
backup::19139:0:99999:7:::
list::19139:0:99999:7:::
irc::19139:0:99999:7:::
gnats::19139:0:99999:7:::
nobody::19139:0:99999:7:::
_apt:*:19139:0:99999:7:::
nginx:!:19140:0:99999:7:::
test:$y$j9T$DqxAtCWKtO9D/B8bzSuo3.$enEcI5aIds7Q5FSXkIBxkeyOmcnh/aZzBE0hsP7HOKA:19200:0:99999:7:::
root@fe1f645ed185:/# exit
exit

e^H^H^H

sh: 6: not found

exit

root@jack-virtual-machine:/home/jack/test/veinmind-tools/plugins/go/veinmind-weakpass#
root@jack-virtual-machine:/home/jack/test/veinmind-tools/plugins/go/veinmind-weakpass#
root@jack-virtual-machine:/home/jack/test/veinmind-tools/plugins/go/veinmind-weakpass# ./artifacts/linux-amd64/veinmind-weakpass_linux_amd64 scan -s ssh test 192.168.1.94:443/library/test_weakpass:0.3
INFO[0000] start to scan ssh weakpass: 192.168.1.94:443/library/test_weakpass:0.3

============================================================================================

============================================================================================

root@jack-virtual-machine:/home/jack/test/veinmind-tools/plugins/go/veinmind-weakpass# docker run -it 192.168.1.94:443/library/test_weakpass:0.3 /bin/bash
root@9fe8491dd003:/# cat /etc/shadow
root::19139:0:99999:7:::
daemon::19139:0:99999:7:::
bin::19139:0:99999:7:::
sys::19139:0:99999:7:::
sync::19139:0:99999:7:::
games::19139:0:99999:7:::
man::19139:0:99999:7:::
lp::19139:0:99999:7:::
mail::19139:0:99999:7:::
news::19139:0:99999:7:::
uucp::19139:0:99999:7:::
proxy::19139:0:99999:7:::
www-data::19139:0:99999:7:::
backup::19139:0:99999:7:::
list::19139:0:99999:7:::
irc::19139:0:99999:7:::
gnats::19139:0:99999:7:::
nobody::19139:0:99999:7:::
_apt:*:19139:0:99999:7:::
nginx:!:19140:0:99999:7:::
test:$y$j9T$DqxAtCWKtO9D/B8bzSuo3.$enEcI5aIds7Q5FSXkIBxkeyOmcnh/aZzBE0hsP7HOKA:19200:0:99999:7:::

Answer 25 · 2022-07-27T07:07:31.000Z

修改了一下也不行

Answer 26 · 2022-07-27T07:08:18.000Z

即使用同一个弱密码加密出来的结果也是不一样的

但是veinmind-weakpass 都可检查出来

Answer 27 · 2022-07-27T07:09:29.000Z

其他的镜像可以检测出来吗？还是只有debain的不可以？

Answer 28 · 2022-07-27T07:10:00.000Z

./artifacts/linux-amd64/veinmind-weakpass_linux_amd64 scan 192.168.1.94:443/library/ubuntu_weakpass:0.1

INFO[0000] start to scan mysql weakpass: docker.io/library/ubuntu_weakpass:0.1
INFO[0000] start to scan tomcat weakpass: docker.io/library/ubuntu_weakpass:0.1
INFO[0000] start to scan redis weakpass: 192.168.1.94:443/library/ubuntu_weakpass:0.1
INFO[0000] start to scan ssh weakpass: 192.168.1.94:443/library/ubuntu_weakpass:0.1
WARN[0000] {
"id": "sha256:05fb21919da1e02f515953d1ea1f3ad0d5306309c690026b6d72d4580e7c3121",
"time": "2022-07-27T15:09:52.978097211+08:00",
"level": "High",
"detect_type": "Image",
"event_type": "Risk",
"alert_type": "Weakpass",
"alert_details": [
{
"weakpass_detail": {
"username": "root",
"password": "123456",
"service": "SSH"
}
}
]
}

============================================================================================

============================================================================================

Answer 29 · 2022-07-27T07:10:44.000Z

你在container中修改密码之后，有没有commit

Answer 30 · 2022-07-27T07:10:47.000Z

你们修改的commit是哪个呀？我今天刚同步过来的，不会是代码问题吧

Answer 31 · 2022-07-27T07:11:18.000Z

有的。

docker commit fe1f645ed185 192.168.1.94:443/library/test_weakpass:0.3

sha256:04469849db2d379b6b337841fc595cd135ce93ecc9da72990d0b672dcd13e718

Answer 32 · 2022-07-27T07:12:56.000Z

上面的一个里面是有的两个/etc/shadow 中的 test是一样的。应该能看出来

Answer 33 · 2022-07-27T07:16:29.000Z

目前的master 版本就可以检测你看你的 plugins/go/veinmind-weakpass/hash/passwd_linux_dynamic.go
有无此代码

// prepare for $y$
func (pw *Password) matchYescrypto(key, hash string) bool {
        ckey := C.CString(key)
        chash := C.CString(hash)
        out := C.crypt(ckey, chash)
        C.free(unsafe.Pointer(ckey))
        C.free(unsafe.Pointer(chash))
        return C.GoString(out) == hash
}

Answer 34 · 2022-07-27T07:26:41.000Z

谢谢，有这个代码的分支确实可以了。