T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/pf.py:31- Finding
Persistent Device Fingerprinting Used as an Authorization Credential
- Content
View full analysis
str: """基于本机特征生成稳定匿名 ID（同一台机器恒定）。优先级同后端 mcp_server。""" parts = [] for p in ("/etc/machine-id", "/var/lib/dbus/machine-id", "/etc/hostid"): try: with open(p, "r", encoding="utf-8", errors="ignore") as f: val = f.read().strip() if val: parts.append(f"mid={val}") break except Exception: pass if not parts: try: import winreg with winreg.OpenKey( winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\Microsoft\Cryptography", ) as k: parts.append("wg=" + winreg.QueryValueEx(k, "MachineGuid")[0]) except Exception: pass if not parts: import getpass import platform import socket import uuid as _uuid node = _uuid.getnode() mac = ":".join(f"{(node >> (8 * i)) & 0xff:02x}" for i in reversed(range(6))) parts.append( f"fb={socket.gethostname()}|{mac}|{getpass.getuser()}|{platform.system()}" ) raw = "|".join(parts) h = hashlib.sha256(raw.encode("utf-8")).hexdigest() return f"{h[0:8]}-{h[8:12]}-{h[12:16]}-{h[16:20]}-{h[20:32]}" ``` ```python if AID: headers["X-Anonymous-Id"] = AID ``` ### Technical Analysis The script reads stable operating-system identifiers from `/etc/machine-id`, `/var/lib/dbus/machine-id`, `/etc/hostid`, or the Windows `MachineGuid`. If those values are unavailable, it collects the hostname, MAC address, local username, and operating-system name. This behavior constitutes local environment reconnaissance. Although the collected source string is hashed before t ...[truncated 1868 chars]- Remediation
View remediation