95 lines
1.7 KiB
Go
95 lines
1.7 KiB
Go
/*
|
|
©AngelaMos | 2026
|
|
profile.go
|
|
|
|
Scans shell initialization files for injected persistence commands
|
|
|
|
Checks system-wide and per-user shell RC files (bash, zsh, profile)
|
|
for suspicious patterns: network callbacks, encoded payloads, alias
|
|
hijacking, PATH manipulation, LD_PRELOAD exports, and background
|
|
process launchers.
|
|
|
|
MITRE ATT&CK:
|
|
T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification
|
|
*/
|
|
|
|
package scanner
|
|
|
|
import (
|
|
"path/filepath"
|
|
|
|
"github.com/CarterPerez-dev/sentinel/pkg/types"
|
|
)
|
|
|
|
const (
|
|
profileScannerName = "profile"
|
|
mitreProfile = "T1546.004"
|
|
)
|
|
|
|
var systemProfiles = []string{
|
|
"/etc/profile",
|
|
"/etc/bash.bashrc",
|
|
"/etc/zsh/zshrc",
|
|
"/etc/zsh/zprofile",
|
|
}
|
|
|
|
var userProfileFiles = []string{
|
|
".bashrc",
|
|
".bash_profile",
|
|
".bash_login",
|
|
".bash_logout",
|
|
".profile",
|
|
".zshrc",
|
|
".zprofile",
|
|
}
|
|
|
|
func init() {
|
|
Register(&ProfileScanner{})
|
|
}
|
|
|
|
type ProfileScanner struct{}
|
|
|
|
func (p *ProfileScanner) Name() string {
|
|
return profileScannerName
|
|
}
|
|
|
|
func (p *ProfileScanner) Scan(
|
|
root string,
|
|
) []types.Finding {
|
|
var findings []types.Finding
|
|
|
|
for _, path := range systemProfiles {
|
|
resolved := ResolveRoot(root, path)
|
|
findings = append(
|
|
findings,
|
|
ScanFileForPatterns(
|
|
resolved, profileScannerName, mitreProfile,
|
|
)...,
|
|
)
|
|
}
|
|
|
|
profileD := ResolveRoot(root, "/etc/profile.d")
|
|
for _, path := range ListFiles(profileD) {
|
|
findings = append(
|
|
findings,
|
|
ScanFileForPatterns(
|
|
path, profileScannerName, mitreProfile,
|
|
)...,
|
|
)
|
|
}
|
|
|
|
for _, home := range FindUserDirs(root) {
|
|
for _, name := range userProfileFiles {
|
|
path := filepath.Join(home, name)
|
|
findings = append(
|
|
findings,
|
|
ScanFileForPatterns(
|
|
path, profileScannerName, mitreProfile,
|
|
)...,
|
|
)
|
|
}
|
|
}
|
|
|
|
return findings
|
|
}
|