socky.sh

socky.sh

#!/bin/sh
# Not to be confused with https://labs.portcullis.co.uk/tools/unix-socket-scanner/ which does more detailed enumeration but doesn't do permission checks

netstat -an | grep stream | awk '{print $9}' | sort | uniq | egrep -v "vms\/|^$" | while read socketname
do
	if [ -n "$(printf "${socketname}" | grep "^/")" ]
	then
		printf "==\n"
		ls -la "${socketname}"
		if [ -n "$(ls -la "${socketname}" | grep "s.......w. ")" ]
		then
			printf "E: ${socketname} is world writable\n"
			printf "\n"
			printf "QUIT\n" | socat "UNIX:${socketname}" STDIO
		else
			if [ -n "$(ls -la "${socketname}" | grep "s......r.. ")" ]
			then
				printf "E: ${socketname} is world readable\n"
				printf "\n"
				printf "QUIT\n" | socat "UNIX:${socketname}" STDIO
			fi
		fi
		printf "\n"
	else
		sudo find / -name "${socketname}" -type s 2>/dev/null | while read socketpath
		do
			printf "==\n"
			ls -la "${socketpath}"
			if [ -n "$(ls -la "${socketpath}" | grep "s.......w. ")" ]
			then
				printf "E: ${socketpath} is world writable\n"
				printf "\n"
				printf "QUIT\n" | socat "UNIX:${socketpath}" STDIO
			else
				if [ -n "$(ls -la "${socketpath}" | grep "s......r.. ")" ]
				then
					printf "E: ${socketpath} is world readable\n"
					printf "\n"
					printf "QUIT\n" | socat "UNIX:${socketpath}" STDIO
				fi
			fi
			printf "\n"
		done
	fi
done