Incorrect assumptions in account discovery #1509
Labels
Bug
An error, flaw, misbehavior or failure in the Monkey or Monkey Island.
Complexity: Low
Impact: Medium
Description
The Linux account discovery, Linux clear command history, and Linux modify shell startup files PBAs make incorrect assumptions about Linux users.
/home
/home/testuser
)In addition, these 3 PBAs duplicate the same command.
Proposed solution
Instead of running complicated shell commands which require
shell=True
(which is a security concern, see also #1118), the logic for these PBAs can be reimplemented in Python.Correcting false assumptions
/etc/passwd
using the Python pwd module and return only non-root users with the following shells:/home/[USERNAME]
The text was updated successfully, but these errors were encountered: