Last active
April 22, 2020 15:04
-
-
Save whit3rabbit/71a9ff19e4de95e83d537e19fd6309a9 to your computer and use it in GitHub Desktop.
Go - File Path walk searching for files with suid bit set
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "fmt" | |
| "os" | |
| "path/filepath" | |
| "regexp" | |
| "syscall" | |
| ) | |
| type SuidFile struct { | |
| FileMode string | |
| FilePermissions string | |
| FilePath string | |
| } | |
| var FileList []SuidFile | |
| func uidForFileInfo(fi os.FileInfo) int { | |
| return int(fi.Sys().(*syscall.Stat_t).Uid) | |
| } | |
| func findSUID() filepath.WalkFunc { | |
| return func(path string, file os.FileInfo, err error) error { | |
| if err != nil { | |
| return nil | |
| } | |
| if !file.IsDir() { | |
| filePath := path | |
| fileMode := fmt.Sprintf("%s", file.Mode()) // Convert to string | |
| filePerm := fmt.Sprintf("%04o", file.Mode().Perm()) // Convert to string | |
| if err != nil { | |
| fmt.Println(err) | |
| } | |
| patternRegex := "^u" // This checks if sticky bit is set as first character | |
| isStickyBitSet, _ := regexp.MatchString(patternRegex, fileMode) // Return true if it is set | |
| if isStickyBitSet { | |
| uid := uidForFileInfo(file) | |
| if uid == 0 { | |
| fmt.Printf("%v %v %s\n", fileMode, filePerm, filePath) // For debug | |
| file := SuidFile{ | |
| FileMode: fileMode, | |
| FilePermissions: filePerm, | |
| FilePath: filePath} | |
| FileList = append(FileList, file) // TODO: For future use (json) | |
| } | |
| } | |
| } | |
| return nil | |
| } | |
| } | |
| func main() { | |
| // Equivalent find / -uid 0 -perm -4000 -type f 2>/dev/null | |
| dirPath := "/" | |
| err := filepath.Walk(dirPath, findSUID()) | |
| if err != nil { | |
| fmt.Println(err) | |
| } | |
| fmt.Println(FileList) // TODO: For future use (json) | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment