Skip to content
This repository was archived by the owner on Mar 14, 2026. It is now read-only.

Commit d00f4cd

Browse files
dmccrthydmccrthy
authored
Merge pull request #10 from UNHCSC/linux-userAudit-and-Restore
Linux user audit and restore
2 parents a367c77 + b7dd496 commit d00f4cd

4 files changed

Lines changed: 263 additions & 1 deletion

File tree

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,4 @@ On Windows you can use this command to download the scripts and extract them:
1818

1919
```powershell
2020
powershell -c "Invoke-WebRequest -Uri (Invoke-RestMethod -Uri https://api.github.com/repos/UNHCSC/ccdc2026/releases/latest).zipball_url -OutFile scripts.zip; Expand-Archive -Path .\scripts.zip -DestinationPath ."
21-
```
21+
```

‎linux/testList.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Test 1001 wheel /home/Test
2+
Test2 1002 normal /home/Test2

‎linux/uScrubber.sh‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
#!/usr/bin/env bash
2+
3+
if [[ $EUID -ne 0 ]]; then
4+
echo "This script must be executed with sudo."
5+
exit 1
6+
fi
7+
8+
echo "Do you have an account list? [y/N] "
9+
10+
read inputFlag
11+
echo "Starting Scrubber..."
12+
printf "%s\n"
13+
if [[ "${inputFlag,,}" != "y" ]]; then
14+
15+
allUsers="/etc/passwd"
16+
accessableUsers=()
17+
declare -A user
18+
19+
wheelMembers=$(getent group wheel | cut -d: -f4)
20+
sudoMembers=$(getent group sudo 2>/dev/null | cut -d: -f4)
21+
rootMembers=$(getent group root | cut -d: -f4)
22+
23+
if [ ! -f "$allUsers" ]; then
24+
echo "Error: It might be time for poker with Red Team ;-;, File Not Found || $allUsers"
25+
exit 1
26+
fi
27+
28+
echo "Located Users"
29+
printf "%s\n" "----------"
30+
31+
# Tries to eliminate all service accounts and anything with the nologin directory
32+
while IFS=: read -r username password uid gid gecos home shell; do
33+
if (( uid >= 1 && uid < 1000 )); then
34+
continue
35+
fi
36+
37+
noLoginFlag=false
38+
if [[ "$shell" == */nologin ]]; then
39+
noLoginFlag=true
40+
echo -e "\033[0;41mThis User Has An Unaccessible Shell (Please Verify)\033[0m"
41+
fi
42+
43+
privilege="normal"
44+
45+
if (( uid == 0 )); then
46+
privilege="root"
47+
echo -e "\033[0;41mThis User Has Root Access (Please Verify)\033[0m"
48+
49+
elif [[ ",$wheelMembers," == *",$username,"* ]]; then
50+
privilege="wheel"
51+
echo -e "\033[0;33mThis User Has Sudo Access (Please Verify)\033[0m"
52+
53+
elif [[ ",$sudoMembers," == *",$username,"* ]]; then
54+
privilege="sudo"
55+
echo -e "\033[0;33mThis User Has Sudo Access (Please Verify)\033[0m"
56+
57+
elif [[ ",$rootMembers," == *",$username,"* ]]; then
58+
privilege="root"
59+
echo -e "\033[0;41mThis User Has Root Access (Please Verify)\033[0m"
60+
fi
61+
62+
accessibleUsers+=("$username")
63+
64+
user["$username,uid"]="$uid"
65+
user["$username,gid"]="$gid"
66+
user["$username,home"]="$home"
67+
user["$username,shell"]="$shell"
68+
user["$username,nologin"]="$noLoginFlag"
69+
user["$username,privilege"]="$privilege"
70+
71+
printf "User: %s\n" "$username"
72+
printf " UID: %s\n" "$uid"
73+
printf " GID: %s\n" "$gid"
74+
printf " Home: %s\n" "$home"
75+
printf " Shell: %s\n" "$shell"
76+
printf " Privilege: %s\n\n" "$privilege"
77+
78+
done < "$allUsers"
79+
80+
printf "%s\n" "----------"
81+
82+
echo "Would you like to alter any account privledges? [y/N]"
83+
84+
user_exists() {
85+
local search="$1"
86+
for user in "${accessibleUsers[@]}"; do
87+
if [[ "$user" == "$search" ]]; then
88+
return 0
89+
fi
90+
done
91+
return 1
92+
}
93+
94+
read inputFlag
95+
if [[ "${inputFlag,,}" == "y" ]]; then
96+
while true; do
97+
echo "Which user would you like to edit? (or type 'exit')"
98+
read targetUser
99+
100+
if [[ "$targetUser" == "exit" ]]; then
101+
break
102+
fi
103+
104+
if ! user_exists "$targetUser"; then
105+
echo "User not found in accessible user list."
106+
continue
107+
fi
108+
109+
currentPriv="${user["$targetUser,privilege"]}"
110+
111+
echo "Current privilege: $currentPriv"
112+
echo "1) Grant sudo"
113+
echo "2) Remove sudo"
114+
echo "3) Cancel"
115+
read choice
116+
117+
case "$choice" in
118+
1)
119+
usermod -aG sudo "$targetUser"
120+
user["$targetUser,privilege"]="sudo access"
121+
echo "Sudo granted."
122+
;;
123+
2)
124+
gpasswd -d "$targetUser" sudo
125+
user["$targetUser,privilege"]="normal"
126+
echo "Sudo removed."
127+
;;
128+
3)
129+
echo "Cancelled."
130+
;;
131+
*)
132+
echo "Invalid option."
133+
;;
134+
esac
135+
done
136+
fi
137+
138+
echo "Would you like to copy an account list? [Y/n]"
139+
140+
read inputFlag
141+
echo ""
142+
if [[ "${inputFlag,,}" == "y" ]]; then
143+
for username in "${accessibleUsers[@]}"; do
144+
printf "%s %s %s %s\n" \
145+
"$username" \
146+
"${user["$username,uid"]}" \
147+
"${user["$username,privilege"]}" \
148+
"${user["$username,home"]}"
149+
done
150+
fi
151+
else
152+
echo "What is the file path to the account list?"
153+
while true; do
154+
read filePath
155+
echo "Are you sure it is correct? No going back after this! [Y/n]"
156+
read targetUser
157+
158+
if [[ "${targetUser,,}" == "y" ]]; then
159+
break
160+
fi
161+
done
162+
163+
if [[ -f "$filePath" ]]; then
164+
echo "processing given file"
165+
166+
while IFS=" " read -r uname userId privilege home; do
167+
echo "Processing: $uname"
168+
169+
if id "$uname" &>/dev/null; then
170+
echo "User $uname exists"
171+
else
172+
echo -e "\033[0;41mCreating user $uname\033[0m"
173+
useradd -m -u "$userId" -d "$home" "$uname"
174+
echo "$uname:reinstated123!" | chpasswd
175+
fi
176+
177+
if [[ "$privilege" == "wheel" ]]; then
178+
echo -e "\033[0;33mAdding $uname to wheel group\033[0m"
179+
usermod -aG wheel "$uname"
180+
else
181+
echo "Removing $uname from wheel group"
182+
gpasswd -d "$uname" wheel 2>/dev/null
183+
fi
184+
185+
currentHome=$(getent passwd "$uname" | cut -d: -f6)
186+
187+
if [[ "$currentHome" != "$home" ]]; then
188+
echo "Updating home directory for $uname"
189+
usermod -d "$home" -m "$uname"
190+
fi
191+
192+
done < "$filePath"
193+
else
194+
echo "Error, path not found"
195+
fi
196+
197+
fi
198+
199+
echo ""
200+
echo "Your users have been successfully scrubbed!"

‎linux/uScrubberNotes.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# UScrubber
2+
3+
UScrubber (User Scrubber) is a tool designed to simplify the modification of users in a linux environment. It contains the following functionalities:
4+
5+
1. Detect user accounts
6+
2. Modify sudo priviledges of users
7+
3. Create a backup of users
8+
4. Restore the users from a backup
9+
10+
Uscrubber performs these tasks with the aid of a user to ensure correct assumptions, it does provide error/warnings to assist the user in decision making. However, this tool IS NOT perfect. It cannot see service accounts (on purpose) and relies on the user.
11+
12+
13+
## How to perform actions with UScrubber
14+
15+
When starting the shell you will be prompted with:
16+
- Do you have an account list (a backup of users to restore)
17+
- yes = Go to restore user process
18+
- no = Go to modify user process
19+
20+
21+
### Modify User Process
22+
23+
This will initally give a list of all the users with their
24+
- Username
25+
- UID
26+
- GID
27+
- Home location
28+
- Login Shell Type
29+
- Priviledge (only checks for sudo and root)
30+
31+
afterwards, you have the ability to choose if you want to modify a user or, if everything looks good pass to the next step.
32+
33+
If you chose to modify a user you will be prompted with what user to change (username) and what priviledge they should have. Anything else must be done mannually either in the backup or by manual oversight.
34+
35+
Finally, after the users were modified you are prompted with a do you want an account list option. which
36+
- prints out your backup of the users in the terminal. This must be copied and pasted into a text document on your own device. (for red team security reasons [can be changed])
37+
38+
39+
### Restore user Process
40+
41+
This will give you a way to use an account list. (See Modify User Process for more details) Which will:
42+
- restore lost accounts with a new default password
43+
- Modifies all accounts to a previous state in the account lsit
44+
45+
IT DOES NOT
46+
- remove new accounts (use the modify user feature)
47+
48+
The format for the account list is the
49+
- Username
50+
- UID
51+
- Priviledge
52+
- Home Directory
53+
54+
Nothing else is considered. We can easily change this though to include something like the previous password.
55+
56+
57+
## Other Notes / Improvements
58+
59+
- Can alter functionalty, this is currently the first prototype
60+
- Tried taking into account red team activity, program is quite simple because of it.

0 commit comments

Comments
 (0)