./misc/suidchecker.py

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
#!/usr/bin/python
#Uses the linux find cmd to locate all suid/sgid files
#and monitors checksums for changes on these files.
#d3hydr8[at]gmail[dot]com
 
import os, sys, pwd, getopt, StringIO, commands, md5, time
 
def sumfile(fobj):
	m= md5.new()
	while True:
		d= fobj.read(8096)
		if not d:
			break
		m.update(d)
	return m.hexdigest()
 
def md5sum(fname):
	if fname == '-':
		ret = sumfile(sys.stdin)
	else:
		try:
			f = open(fname, 'rb')
		except:
			return 'Failed to open file'
		ret = sumfile(f)
		f.close()
	return ret
 
def title():
	print "\n   d3hydr8[at]gmail[dot]com SuidChecker v1.0"
	print "----------------------------------------------"
 
def timer():
	now = time.localtime(time.time())
	return time.asctime(now)
 
suids = []
suidsdic = {}
 
if len(sys.argv) != 2:
	title()
	print "\n[-] Need a time\n"
	sys.exit(1) 
 
title()
cmdsuids = StringIO.StringIO(commands.getstatusoutput('find / \( -perm -02000 -o -perm -04000 \) -ls')[1]).readlines()
for suid in cmdsuids:
	file = "/"+suid.split("/",1)[1][:-1]
	if os.path.isfile(file) == True:
		suids.append(file)
 
print "[+] Found:",len(suids),"suids\n"
print "[+] Monitoring...\n"
 
for fname in suids:
	hash =  md5sum(fname)
	suidsdic[fname] = hash
 
while 1:
	time.sleep(int(sys.argv[1]))
	for k,v in suidsdic.items():
		hash =  md5sum(k)
		if hash != v:
			print "\n[-] Found a change:",k
			print "[-] From:",v
			print "[-] To:",hash
			print "[-] Time:",timer(),"\n"
			suidsdic[k] = hash
 
 
 
 

Back