secureScripts.1

.\" Automatically generated by Pandoc 2.5
.\"
.TH "" "" "" "" ""
.hy
.SH secureScripts
.PP
secureScripts is a small set of tools designed to monitor some basic
system functions and locate possible vulnerabilities.
This set of tools is based on pentesting techniques for learning reasons
.SS Install
.IP
.nf
\f[C]
git clone https://github.com/alohl669/secureScripts.git
\f[R]
.fi
.SS showCommands
.IP
.nf
\f[C]
cd secureScripts/scripts/showCommands
\f[R]
.fi
.SS Description
.PP
showCommands is a tool to discover the processes that go in and out of
execution.
This is useful for identifying vulnerabilities and/or malicious
applications.
One of its most useful examples is for discovering CRON processes.
The tool has the ability to use exclusion and inclusion filters and the
ability to add and remove them easily.
If a more detailed edition is desired, the txt files that are created
can be modified.
.SS usage
.IP
.nf
\f[C]
Usage:  ./showCommands.sh [[\-h] | [\-b] | [\-w] | [\-a] | [\-e] | [\-r] | [\-d]] 
        ./showCommands.sh [\-h]

        \-b      See excluded filters 
        \-w      See filters included 
        \-a      Adds a filter to inclusion list. [showCommands.sh \-a <filter>]
        \-e      Adds a filter to exclusion list. [showCommands.sh \-e <filter>]
        \-r      Remove all filters
        \-d      Document the output in a \[dq]report.txt\[dq] file
        \-h      help 

Examples: if we wanted to simply look for only those processes executed by CRON, we would simply need
\&./showCommands.sh \-a CRON
\&./showCommands.sh
\f[R]
.fi
.RS
.PP
The application is based on an infinite loop and as a consequence brings
with it an excessive consumption of CPU, we will have to look for
alternatives
.RE
.SS suidFinder
.PP
Simple file search with SUID bit and GTFOBINS references
.IP
.nf
\f[C]
cd secureScripts/scripts/suidFinder && \[rs]
\&./suidFinder.sh
\f[R]
.fi
.SS shFinder
.PP
Simple search for *.sh scripts of privileged users with wrongly set
permissions
.IP
.nf
\f[C]
cd secureScripts/scripts/shFinder && \[rs]
\&./shFinder.sh
\f[R]
.fi
.SS capFinder
.PP
Simple capabilities search engine
.IP
.nf
\f[C]
cd secureScripts/scripts/capFinder && \[rs]
\&./capFinder.sh
\f[R]
.fi