Windows checksec equivalent
August 11, 2019 ยท View on GitHub
import lief from sys import argv import colorama
def _color_print(name): colorama.init(autoreset=True) def color_print(func): def wrapper(*args, **kwargs): ret = func(*args, **kwargs) if ret != False: color = colorama.Fore.GREEN else: color = colorama.Fore.RED print(color+name+": %s" % (ret)) return wrapper return color_print
class PESecurity: def init(self, pe): self.pe = pe self.optional_header = pe.optional_header self.characteristics = self.optional_header.dll_characteristics_lists self.display_results()
@_color_print("ASLR")
def aslr(self):
if lief.PE.DLL_CHARACTERISTICS.DYNAMIC_BASE in self.characteristics:
return True
else:
return False
@_color_print("SafeSEH")
def seh(self):
if lief.PE.DLL_CHARACTERISTICS.NO_SEH in self.characteristics:
return True
else:
return False
@_color_print("DEP")
def dep(self):
if lief.PE.DLL_CHARACTERISTICS.NX_COMPAT in self.characteristics:
return True
else:
return False
@_color_print("ControlFlowGuard")
def cfg(self):
if lief.PE.DLL_CHARACTERISTICS.GUARD_CF in self.characteristics:
return True
else:
return False
@_color_print("HighEntropyVA")
def high_entropy_va(self):
if lief.PE.DLL_CHARACTERISTICS.HIGH_ENTROPY_VA in self.characteristics:
return True
else:
return False
def display_results(self):
self.aslr()
self.seh()
self.dep()
self.cfg()
self.high_entropy_va()
class ELFSecurity: # lief.segments (GNU_RELRO && DT_BIND_NOW -> full relro) # lief.segments (GNU_RELRO -> partial relro) # lief.sections (__stack_chk_fail -> stack canary) def init(self, elf): self.elf = elf self.fortified_function = [] self.display_results()
@_color_print("RELRO")
def relro(self):
try:
self.elf.get(lief.ELF.SEGMENT_TYPES.GNU_RELRO)
if self.elf.get(lief.ELF.DYNAMIC_TAGS.BIND_NOW):
return "FULL Relro"
else:
return "Partial Relro"
except:
return False
@_color_print("Stack Canary")
def canary(self):
try:
self.elf.get_symbol("__stack_chk_fail")
return True
except:
return False
@_color_print("NX")
def nx(self):
try:
if self.elf.get(lief.ELF.SEGMENT_TYPES.GNU_STACK).flags == 6:
return True
except:
return False
@_color_print("Pie")
def pie(self):
return self.elf.is_pie
@_color_print("RPATH")
def rpath(self):
try:
if elf.get(lief.ELF.DYNAMIC_TAGS.RPATH):
return True
except:
return "No RPATH"
@_color_print("RUNPATH")
def runpath(self):
try:
if elf.get(lief.ELF.DYNAMIC_TAGS.RUNPATH):
return True
except:
return "No RUNPATH"
@_color_print("Fortify")
def fortify(self):
func_fortified = 0
for function in self.elf.symbols:
if function.name.endswith("_chk"):
func_fortified += 1
self.fortified_function.append(function.name)
if func_fortified > 0:
return True
else:
return False
def fortified_functions(self):
print("Fortified Functions:")
for function in self.fortified_function:
print("{: >20}".format(function))
def display_results(self):
self.relro()
self.canary()
self.nx()
self.pie()
self.fortify()
self.rpath()
self.runpath()
self.fortified_functions()
class Checker: def init(self, filename): self.binary = lief.parse(filename) if lief.is_elf(filename): ELFSecurity(self.binary) if lief.is_pe(filename): PESecurity(self.binary)
b = Checker(argv[1])