Last active
July 26, 2016 12:49
-
-
Save jobbin/e56ede16f092fa75675f907cf1ba5748 to your computer and use it in GitHub Desktop.
(意外と簡単)EC2とDockerを使って、脆弱性診断ツールVulsを触ってみました! ref: http://qiita.com/jobbin/items/468770283df7fb203637
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ sudo yum update -y |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ sudo yum -y install docker | |
| $ sudo pip install -U docker-compose | |
| $ sudo yum -y install git |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ sudo docker exec -t vuls vuls prepare -config=conf/config.toml | |
| INFO[0000] Start Preparing (config: conf/config.toml) | |
| [Jul 25 16:34:19] INFO [localhost] Detecting OS... | |
| [Jul 25 16:34:19] INFO [localhost] Detecting OS of servers... | |
| [Jul 25 16:34:20] INFO [localhost] (1/1) Detected: 172-31-21-119: amazon 2016.03 | |
| [Jul 25 16:34:20] INFO [localhost] Detecting OS of containers... | |
| [Jul 25 16:34:20] INFO [localhost] SSH-able servers are below... | |
| 172-31-21-119 | |
| [Jul 25 16:34:20] INFO [localhost] Installing... | |
| [Jul 25 16:34:20] INFO [172-31-21-119] Nothing to do | |
| [Jul 25 16:34:20] INFO [localhost] Success |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ sudo docker exec -t vuls scripts/scan_for_vulsrepo.sh | |
| INFO[0000] Start scanning | |
| INFO[0000] config: /opt/vuls/conf/config.toml | |
| INFO[0000] cve-dictionary: /opt/vuls/cve.sqlite3 | |
| [Jul 25 16:34:31] INFO [localhost] Validating Config... | |
| [Jul 25 16:34:31] INFO [localhost] Detecting Server/Contianer OS... | |
| [Jul 25 16:34:31] INFO [localhost] Detecting OS of servers... | |
| [Jul 25 16:34:32] INFO [localhost] (1/1) Detected: 172-31-21-119: amazon 2016.03 | |
| [Jul 25 16:34:32] INFO [localhost] Detecting OS of containers... | |
| [Jul 25 16:34:32] INFO [localhost] SSH-able servers are below... | |
| 172-31-21-119 | |
| [Jul 25 16:34:32] INFO [localhost] Detecting Platforms... | |
| [Jul 25 16:34:32] INFO [localhost] (1/1) 172-31-21-119 is running on aws | |
| [Jul 25 16:34:32] INFO [localhost] Scanning vulnerabilities... | |
| [Jul 25 16:34:32] INFO [localhost] Check required packages for scanning... | |
| [Jul 25 16:34:32] INFO [localhost] Scanning vulnerable OS packages... | |
| [Jul 25 16:34:33] INFO [172-31-21-119] Fetching CVE details... | |
| [Jul 25 16:34:33] INFO [172-31-21-119] Done | |
| [Jul 25 16:34:33] INFO [localhost] Scanning vulnerable software specified in the CPE... | |
| [Jul 25 16:34:33] INFO [localhost] Insert to DB... | |
| [Jul 25 16:34:33] INFO [localhost] Reporting... | |
| 172-31-21-119 (amazon2016.03) | |
| ============================= | |
| No unsecure packages. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ docker --version | |
| Docker version 1.11.2, build b9f10c9/1.11.2 | |
| $ docker-compose -v | |
| docker-compose version 1.7.1, build 6c29830 | |
| $ git --version | |
| git version 2.7.4 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ sudo service docker start |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ git clone https://github.com/future-architect/vuls.git |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ cd vuls/setup/docker | |
| $ sudo /usr/local/bin/docker-compose -p docker -f docker-compose.yml up -d | |
| $ sudo docker ps |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [servers] | |
| [servers.172-31-21-119] | |
| host = "172.31.21.119" | |
| user = "ec2-user" | |
| keyPath = "conf/*****.pem" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ sudo docker exec -t vuls scripts/fetch_nvd_all.sh | |
| 0 / 1 [-----------------------------] 0.00%[Jul 25 16:06:26] INFO Fetching... https://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-2002.xml.gz | |
| ... | |
| ... | |
| ... | |
| [Jul 25 16:19:26] INFO Refreshed 6297 Nvds. | |
| 0 / 1 [-----------------------------] 0.00%[Jul 25 16:19:26] INFO Fetching... https://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-2016.xml.gz | |
| [Jul 25 16:19:30] INFO Fetched 3109 CVEs | |
| [Jul 25 16:19:30] INFO Opening DB. datafile: /opt/vuls/cve.sqlite3 | |
| [Jul 25 16:19:30] INFO Migrating DB | |
| [Jul 25 16:19:30] INFO Inserting CVEs... | |
| 3109 / 3109 [===================================================================================================================================] 100.00% 14s | |
| [Jul 25 16:19:45] INFO Refreshed 3109 Nvds. | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ sudo docker exec -t vuls vuls prepare -config=conf/config.toml | |
| INFO[0000] Start Preparing (config: conf/config.toml) | |
| [Jul 25 16:23:26] INFO [localhost] Detecting OS... | |
| [Jul 25 16:23:26] INFO [localhost] Detecting OS of servers... | |
| [Jul 25 16:23:26] INFO [localhost] (1/1) Detected: 172-31-21-119: amazon 2016.03 | |
| [Jul 25 16:23:26] INFO [localhost] Detecting OS of containers... | |
| [Jul 25 16:23:26] INFO [localhost] SSH-able servers are below... | |
| 172-31-21-119 | |
| [Jul 25 16:23:26] INFO [localhost] Installing... | |
| [Jul 25 16:23:26] INFO [172-31-21-119] Nothing to do | |
| [Jul 25 16:23:26] INFO [localhost] Success |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ sudo docker exec -t vuls scripts/scan_for_vulsrepo.sh | |
| INFO[0000] Start scanning | |
| INFO[0000] config: /opt/vuls/conf/config.toml | |
| INFO[0000] cve-dictionary: /opt/vuls/cve.sqlite3 | |
| [Jul 25 16:23:32] INFO [localhost] Validating Config... | |
| [Jul 25 16:23:32] INFO [localhost] Detecting Server/Contianer OS... | |
| [Jul 25 16:23:32] INFO [localhost] Detecting OS of servers... | |
| [Jul 25 16:23:32] INFO [localhost] (1/1) Detected: 172-31-21-119: amazon 2016.03 | |
| [Jul 25 16:23:32] INFO [localhost] Detecting OS of containers... | |
| [Jul 25 16:23:32] INFO [localhost] SSH-able servers are below... | |
| 172-31-21-119 | |
| [Jul 25 16:23:32] INFO [localhost] Detecting Platforms... | |
| [Jul 25 16:23:32] INFO [localhost] (1/1) 172-31-21-119 is running on aws | |
| [Jul 25 16:23:32] INFO [localhost] Scanning vulnerabilities... | |
| [Jul 25 16:23:32] INFO [localhost] Check required packages for scanning... | |
| [Jul 25 16:23:32] INFO [localhost] Scanning vulnerable OS packages... | |
| [Jul 25 16:23:34] INFO [172-31-21-119] Fetching CVE details... | |
| [Jul 25 16:23:34] INFO [172-31-21-119] Done | |
| [Jul 25 16:23:34] INFO [localhost] Scanning vulnerable software specified in the CPE... | |
| [Jul 25 16:23:34] INFO [localhost] Insert to DB... | |
| [Jul 25 16:23:46] INFO [localhost] Reporting... | |
| 172-31-21-119 (amazon2016.03) | |
| ============================= | |
| CVE-2016-1762 10.0 (High) libxml2 in Apple iOS before 9.3, OS X before 10.11.4, Safari before 9.1, tvOS before | |
| 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or | |
| cause a denial of service (memory corruption) via a crafted XML document. | |
| CVE-2016-4448 10.0 (High) Format string vulnerability in libxml2 before 2.9.4 allows attackers to have | |
| unspecified impact via format string specifiers in unknown vectors. | |
| CVE-2016-1978 7.5 (High) Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in | |
| Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox | |
| before 44.0, allows remote attackers to cause a denial of service or possibly have | |
| unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time | |
| of high memory consumption. | |
| CVE-2016-0758 7.2 (High) Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local | |
| users to gain privileges via crafted ASN.1 data. | |
| CVE-2016-4557 7.2 (High) The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux | |
| kernel before 4.5.5 does not properly maintain an fd data structure, which allows | |
| local users to gain privileges or cause a denial of service (use-after-free) via | |
| crafted BPF instructions that reference an incorrect file descriptor. | |
| CVE-2016-4565 7.2 (High) The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on | |
| the write system call, which allows local users to cause a denial of service (kernel | |
| memory write operation) or possibly have unspecified other impact via a uAPI | |
| interface. | |
| ... | |
| ... | |
| ... | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment