first commit
This commit is contained in:
commit
488a3acab4
28
README.md
Normal file
28
README.md
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
first add the users that are authorized to the end of usersnorm (BUT KEEP THE EXISTING ONES) (all users that should be on the system)
|
||||
then add any system users that might be unusually tied to the system you are currently working on (extra applications/things i might have missed)
|
||||
|
||||
run the command in "usefulcommands.txt" to list all users, and paste that into userstest (idk why i havent automated this yet, i havent touched this script in like a year lol)
|
||||
|
||||
run "debiandetox.sh", respond yes or no appropriately (read the users you are removing before you remove them, most likely it is a system user that is just there due to an extra program)
|
||||
|
||||
what the script does
|
||||
|
||||
attempts to remove common forbidden applications (outputs the removed applications to removedapps.txt, in order to allow for you to fix your fuckup)
|
||||
|
||||
installs and enables ufw
|
||||
|
||||
changes password settings for users in "/etc/login.defs"
|
||||
|
||||
enables tcp_syncookies in /etc/sysctl.conf
|
||||
|
||||
turns off root login in ssh
|
||||
|
||||
turns on autoupdate (IMPORTANT: SEPERATE FROM GUI AUTOUPDATE)
|
||||
|
||||
attempts to remove users that shouldnt be on the machine (outputs removed users to removedusers.txt)
|
||||
|
||||
installs and enables freshclam (currently borked, but it probably wouldnt give points anyways)
|
||||
|
||||
usually gets around 20 points round 1, 10 points in round 2, 5 points in round 3
|
||||
|
||||
usefulcommands.txt is probably going to help you more than the script tbh
|
||||
125
debiandetox.sh
Normal file
125
debiandetox.sh
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
#! /bin/bash
|
||||
#CYBERPATRIOT DEBIAN-DETOX MERCER ISLAND RED TEAM SCRIPT v0.2
|
||||
|
||||
sudo apt update
|
||||
sudo apt upgrade
|
||||
|
||||
|
||||
|
||||
#removing packages that match keyword, asking user for confirmation just in case
|
||||
sudo dpkg --get-selections | grep -i 'shark\|hydra\|nginx\|Samba\|snmp\|Nfs\|sendmail\|Xinetd\|crack\|telnet\|apache' | tr -d "[:blank:]" | sed 's/install//g' |
|
||||
while read -r CURRENT_LINE
|
||||
do
|
||||
echo "purge this package $CURRENT_LINE?"
|
||||
read response < /dev/tty
|
||||
if [[ $response =~ ^[Yy]$ ]]
|
||||
then
|
||||
echo "$CURRENT_LINE" >> removedapps.txt
|
||||
yes | sudo apt purge $CURRENT_LINE
|
||||
else
|
||||
echo "skipped removal"
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
#prints out packages that don't adhere to default ubuntu install
|
||||
LINEA=1
|
||||
LINEB=1
|
||||
|
||||
while read -r CURRENT_LINEA
|
||||
do
|
||||
MATCH=0
|
||||
while read -r CURRENT_LINEB
|
||||
do
|
||||
if [ "$CURRENT_LINEA" == "$CURRENT_LINEB" ]
|
||||
then
|
||||
((MATCH++))
|
||||
fi
|
||||
((LINEB++))
|
||||
done < "packnorm.txt"
|
||||
if [ $MATCH -eq 0 ]
|
||||
then
|
||||
echo "$CURRENT_LINEA is sus"
|
||||
fi
|
||||
((LINEA++))
|
||||
done <<< "$( sudo dpkg --get-selections | tr -d "[:blank:]" | sed 's/install//g')"
|
||||
|
||||
#installs ufw and enables it
|
||||
sudo apt install ufw
|
||||
sudo ufw enable
|
||||
|
||||
#changes the password settings for all the users to be more secure
|
||||
sudo sed -i "s/\(^PASS_MAX_DAYS* *\).*/\1 15/" /etc/login.defs
|
||||
sudo sed -i "s/\(^PASS_MIN_DAYS* *\).*/\1 1/" /etc/login.defs
|
||||
sudo sed -i "s/\(^PASS_WARN_AGE* *\).*/\1 5/" /etc/login.defs
|
||||
|
||||
#turns on cookie protection or some shit idk
|
||||
sudo sed -i "s/\(^net.ipv4.tcp_syncookies*=*\).*/\11/" /etc/sysctl.conf
|
||||
|
||||
#turns off root login in ssh
|
||||
sudo sed -i "s/\(^PermitRootLogin* *\).*/\1 no/" /etc/ssh/sshd_config
|
||||
|
||||
#Turns on autoupdate
|
||||
sudo sed -i 's/\(^APT::Periodic::Update-Package-Lists* *\).*/\1 "1";/' /etc/apt/apt.conf.d/10periodic
|
||||
|
||||
#removes all bad users
|
||||
LINEA=1
|
||||
LINEB=1
|
||||
|
||||
while read -r CURRENT_LINEA
|
||||
do
|
||||
MATCH=0
|
||||
while read -r CURRENT_LINEB
|
||||
do
|
||||
if [ "$CURRENT_LINEA" == "$CURRENT_LINEB" ]
|
||||
then
|
||||
((MATCH++))
|
||||
fi
|
||||
((LINEB++))
|
||||
done < "usersnorm.txt"
|
||||
if [ $MATCH -eq 0 ]
|
||||
then
|
||||
echo "kill the user $CURRENT_LINEA?"
|
||||
read response < /dev/tty
|
||||
if [[ $response =~ ^[Yy]$ ]]
|
||||
then
|
||||
echo "$CURRENT_LINEA" >> removedusers.txt
|
||||
yes | sudo deluser "$CURRENT_LINEA"
|
||||
echo "user $CURRENT_LINEA combusted"
|
||||
else
|
||||
echo "skipped removal"
|
||||
fi
|
||||
fi
|
||||
((LINEA++))
|
||||
done <<< "$(awk -F':' '{ print $1}' /etc/passwd)"
|
||||
|
||||
#removes all non admins
|
||||
LINEA=1
|
||||
LINEB=1
|
||||
|
||||
while read -r CURRENT_LINEA
|
||||
do
|
||||
MATCH=0
|
||||
while read -r CURRENT_LINEB
|
||||
do
|
||||
if [ "$CURRENT_LINEA" == "$CURRENT_LINEB" ]
|
||||
then
|
||||
((MATCH++))
|
||||
fi
|
||||
((LINEB++))
|
||||
done < "sudonorm.txt"
|
||||
if [ $MATCH -eq 0 ]
|
||||
then
|
||||
echo "kill the user $CURRENT_LINEA?"
|
||||
read response < /dev/tty
|
||||
if [[ $response =~ ^[Yy]$ ]]
|
||||
then
|
||||
echo "$CURRENT_LINEA" >> removedusers.txt
|
||||
yes | sudo deluser "$CURRENT_LINEA" sudo
|
||||
echo "user $CURRENT_LINEA has been un-sudoed"
|
||||
else
|
||||
echo "skipped removal"
|
||||
fi
|
||||
fi
|
||||
((LINEA++))
|
||||
done <<< "$(grep '^sudo:.*$' /etc/group | cut -d: -f4)"
|
||||
74
script/debiandetox.sh
Normal file
74
script/debiandetox.sh
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
#! /bin/bash
|
||||
#CYBERPATRIOT DEBIAN-DETOX MERCER ISLAND RED TEAM SCRIPT v0.2
|
||||
|
||||
sudo apt update
|
||||
sudo apt upgrade
|
||||
|
||||
#removing packages that match keyword, asking user for confirmation just in case
|
||||
sudo dpkg --get-selections | grep -i 'shark\|hydra\|nginx\|Samba\|snmp\|Nfs\|sendmail\|Xinetd\|crack\|telnet\|apache' | tr -d "[:blank:]" | sed 's/install//g' |
|
||||
while read -r CURRENT_LINE
|
||||
do
|
||||
echo "purge this package $CURRENT_LINE?"
|
||||
read response < /dev/tty
|
||||
if [[ $response =~ ^[Yy]$ ]]
|
||||
then
|
||||
echo "$CURRENT_LINE" >> removedapps.txt
|
||||
yes | sudo apt purge $CURRENT_LINE
|
||||
else
|
||||
echo "skipped removal"
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
#installs ufw and enables it
|
||||
sudo apt install ufw
|
||||
sudo ufw enable
|
||||
|
||||
#changes the password settings for all the users to be more secure
|
||||
sudo sed -i "s/\(^PASS_MAX_DAYS* *\).*/\1 15/" /etc/login.defs
|
||||
sudo sed -i "s/\(^PASS_MIN_DAYS* *\).*/\1 1/" /etc/login.defs
|
||||
sudo sed -i "s/\(^PASS_WARN_AGE* *\).*/\1 5/" /etc/login.defs
|
||||
|
||||
#turns on cookie protection or some shit idk
|
||||
sudo sed -i "s/\(^net.ipv4.tcp_syncookies*=*\).*/\11/" /etc/sysctl.conf
|
||||
|
||||
#turns off root login in ssh
|
||||
sudo sed -i "s/\(^PermitRootLogin* *\).*/\1 no/" /etc/ssh/sshd_config
|
||||
|
||||
#Turns on autoupdate
|
||||
sudo sed -i 's/\(^APT::Periodic::Update-Package-Lists* *\).*/\1 "1";/' /etc/apt/apt.conf.d/10periodic
|
||||
|
||||
#removes all bad users
|
||||
LINEA=1
|
||||
LINEB=1
|
||||
|
||||
while read -r CURRENT_LINEA
|
||||
do
|
||||
MATCH=0
|
||||
while read -r CURRENT_LINEB
|
||||
do
|
||||
if [ "$CURRENT_LINEA" == "$CURRENT_LINEB" ]
|
||||
then
|
||||
((MATCH++))
|
||||
fi
|
||||
((LINEB++))
|
||||
done < "usersnorm.txt"
|
||||
if [ $MATCH -eq 0 ]
|
||||
then
|
||||
echo "kill the user $CURRENT_LINEA?"
|
||||
read response < /dev/tty
|
||||
if [[ $response =~ ^[Yy]$ ]]
|
||||
then
|
||||
echo "$CURRENT_LINEA" >> removedusers.txt
|
||||
yes | sudo deluser "$CURRENT_LINEA"
|
||||
echo "user $CURRENT_LINEA combusted"
|
||||
else
|
||||
echo "skipped removal"
|
||||
fi
|
||||
fi
|
||||
((LINEA++))
|
||||
done <<< "$(awk -F':' '{ print $1}' /etc/passwd)"
|
||||
|
||||
#removes all non admins
|
||||
|
||||
#autoremoves all packages that are no longer required (might break something, but i dont care)
|
||||
1
script/packnorm.txt
Normal file
1
script/packnorm.txt
Normal file
|
|
@ -0,0 +1 @@
|
|||
|
||||
1
script/sudonorm.txt
Normal file
1
script/sudonorm.txt
Normal file
|
|
@ -0,0 +1 @@
|
|||
|
||||
67
script/usersnorm.txt
Normal file
67
script/usersnorm.txt
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
root
|
||||
daemon
|
||||
bin
|
||||
sys
|
||||
sync
|
||||
games
|
||||
man
|
||||
lp
|
||||
mail
|
||||
news
|
||||
uucp
|
||||
proxy
|
||||
www-data
|
||||
backup
|
||||
list
|
||||
irc
|
||||
gnats
|
||||
nobody
|
||||
systemd-network
|
||||
systemd-resolve
|
||||
messagebus
|
||||
systemd-timesync
|
||||
syslog
|
||||
_apt
|
||||
tss
|
||||
uuidd
|
||||
systemd-oom
|
||||
tcpdump
|
||||
avahi-autoipd
|
||||
usbmux
|
||||
dnsmasq
|
||||
kernoops
|
||||
cups-pk-helper
|
||||
rtkit
|
||||
whoopsie
|
||||
sssd
|
||||
speech-dispatcher
|
||||
fwupd-refresh
|
||||
nm-openvpn
|
||||
colord
|
||||
geoclue
|
||||
pulse
|
||||
hplip
|
||||
gdm
|
||||
twellick
|
||||
jplofe
|
||||
pmccleery
|
||||
wbraddock
|
||||
ealderson
|
||||
lchong
|
||||
sswailem
|
||||
pprice
|
||||
sknowles
|
||||
tcolby
|
||||
jchutney
|
||||
sweinsberg
|
||||
sjacobs
|
||||
lspencer
|
||||
mralbern
|
||||
jrobinson
|
||||
gsheldern
|
||||
coshearn
|
||||
jlaslen
|
||||
kshelvern
|
||||
jtholdon
|
||||
belkarn
|
||||
bharper
|
||||
45
usefulcommands.txt
Normal file
45
usefulcommands.txt
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
quick command list:
|
||||
|
||||
find file:
|
||||
sudo find -name "example"
|
||||
|
||||
lists all users:
|
||||
awk -F':' '{ print $1}' /etc/passwd
|
||||
|
||||
prints all administrator users:
|
||||
grep '^sudo:.*$' /etc/group | cut -d: -f4
|
||||
|
||||
add user to group:
|
||||
sudo usermod -a -G GROUP USERNAME
|
||||
|
||||
remove user from group:
|
||||
sudo deluser USERNAME GROUP
|
||||
|
||||
sign into account of user:
|
||||
sudo su - USERNAME
|
||||
|
||||
change password:
|
||||
passwd
|
||||
|
||||
check if UFW is enabled:
|
||||
sudo ufw status
|
||||
|
||||
enable ufw:
|
||||
sudo ufw enable
|
||||
|
||||
find active services:
|
||||
systemctl list-units --type=service --state=active
|
||||
|
||||
temporarily stop service:
|
||||
sudo service SERVICE stop
|
||||
sudo systemctl stop SERVICE
|
||||
|
||||
remove service:
|
||||
update-rc.d -f SERVICE remove
|
||||
sudo systemctl disable SERVICE
|
||||
|
||||
config ssh:
|
||||
sudo gedit /etc/ssh/sshd_config
|
||||
|
||||
print out whole directory tree with perms, ignoring a few directories:
|
||||
ls -Rl / -I{home,var,tmp}
|
||||
Loading…
Reference in a new issue