search

liamg / traitor

:arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock
MIT License
6.71k stars 578 forks source link

Hardening advice #15

Open samhh opened 3 years ago

samhh commented 3 years ago

If/when exploits are found you're left to your own devices. It'd be really useful if there was a catalogue of advice somewhere about resolving these exploits, perhaps in this project's wiki?

liamg commented 3 years ago

Yep, really cool idea. I guess it'd be cool if the advice was output by the tool as well, to speed up remediation.

prologic commented 3 years ago

It might be possible to utilise things Dev-Sec.io here, perhaps even in conjunction with a project I recently created inspired by Chef Inspec shops. Example of which can be found here which partially implements the Linux baseline for security/hardening.

If a suitable repository were created with (for example) shops specs for a variety of vulnerabilities, what to check for, how to fix said vulnerability, this tool trator could simply link to the spec required to fix the problem -- maybe even run it.