T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/server-audit.sh:10- Finding
Privileged remote reconnaissance defaults to the root account
- Content
View full analysis
Vulnerability Details
File Location:
scripts/server-audit.sh, lines 10–124
Vulnerability Type:T05: Unauthorized Access and Privilege Escalation
Risk Level: Mediumbash HOST="${1:?❌ 用法: bash server-audit.sh <host> [user]}" USER="${2:-root}" TMPFILE=$(mktemp) trap "rm -f $TMPFILE" EXIT echo "🔍 正在巡检 ${USER}@${HOST} ..." ssh -o ConnectTimeout=10 "${USER}@${HOST}" bash -s > "$TMPFILE" << 'AUDIT_SCRIPT' systemctl list-units --type=service --state=running --no-pager --legend=no 2>/dev/null ss -tlnp 2>/dev/null firewall-cmd --list-all 2>/dev/null || echo "(未配置)" for f in /etc/nginx/conf.d/*.conf /www/server/nginx/conf/vhost/*.conf; do [ -f "$f" ] && echo "[$f]" && grep -E "server_name|listen|root" "$f" 2>/dev/null done grep -E "^PermitRootLogin|^PasswordAuthentication|^Port|^PubkeyAuthentication|^MaxAuthTries" /etc/ssh/sshd_config 2>/dev/null || echo "(使用默认配置)" lastb 2>/dev/null | head -5 || echo "(无记录)" crontab -l 2>/dev/null || echo "(无用户 crontab)" for f in /etc/cron.d/*; do [ -f "$f" ] && echo "[$f]" && cat "$f" done ps aux --sort=-%mem | head -12Technical Analysis
The optional SSH username defaults to
root. Consequently, an invocation that supplies only a host automatically attempts to execute every audit operation with the highest remote privilege level. Although privileged visibility may improve audit completeness, making root the default does not follow least-privilege principles.Many operations, including operating-system discovery, service enumeration, basic port inspection, and software version checks, can be conducted using an unprivileged audit account. Only checks requiring additional access should receive narrowly scoped elevation.
The collected output can include security-sensitive operational information:
- Listening ports and associated process identities
- Firewall rules and ...[truncated 2746 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the implicit root default and require the caller to provide an explicit SSH username.
- Prefer a dedicated, unprivileged audit account as the documented and enforced default operating model.
- Separate ordinary inventory checks from privileged checks. Use narrowly scoped
sudorules for only the commands that genuinely require elevated visibility. - Make collection of failed-login records, process arguments, cron contents, and full configuration details explicitly opt-in.
- Redact likely credentials, tokens, usernames, internal addresses, and sensitive command arguments before displaying or storing results.
- Avoid printing complete cron files by default. Report metadata and suspicious patterns instead, with a separate authorized mode for full contents.
- Configure SSH with strict host-key verification, an explicit known-hosts policy, noninteractive authentication, and an allowlist of approved target hosts where appropriate.
- Store generated reports with permissions such as
0600, document their retention period, and securely delete them when no longer required. - Add a pre-execution warning describing the information that will be collected and require confirmation before using a privileged SSH identity.
- Correct the final status message claiming that raw data remains at the temporary path, because the EXIT trap deletes that file when the script terminates.