blob: 3a2faf3089d37d73f121bf2d5493012d44d0026a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
#!/bin/bash
echo "[*] Checking initramfs contents for potential exposure..."
INITRD=$(ls /boot/initrd.img-* | sort -V | tail -n1)
echo "[*] Found initramfs: $INITRD"
# Try gzip first, fallback to cpio-only
echo "[*] Extracting initramfs for analysis..."
TMPDIR=$(mktemp -d)
cd "$TMPDIR"
if file "$INITRD" | grep -q 'gzip'; then
gzip -cd "$INITRD" | cpio -idmu > /dev/null 2>&1
else
echo "[!] Warning: fallback to uncompressed initrd..."
cat "$INITRD" | cpio -idmu > /dev/null 2>&1
fi
# Check for risky binaries
echo "[*] Analyzing for sensitive binaries..."
FOUND=false
for bin in sh cryptsetup lvm busybox mount umount blkid; do
if find . -name "$bin" | grep -q .; then
echo "[!] ⚠ Found sensitive binary: $bin"
FOUND=true
fi
done
cd /
rm -rf "$TMPDIR"
if ! $FOUND; then
echo "[*] No critical binaries found. GRUB password not required."
exit 0
fi
# Check for existing GRUB password
if grep -q "GRUB2_PASSWORD" /etc/grub.d/40_custom; then
echo "[*] GRUB password already set. Skipping..."
exit 0
fi
# Prompt user for password
echo "[*] System is vulnerable. Setting GRUB password..."
read -s -p "Enter GRUB password: " PASSWORD
echo
read -s -p "Confirm GRUB password: " PASSWORD2
echo
if [ "$PASSWORD" != "$PASSWORD2" ]; then
echo "[!] Passwords do not match. Aborting."
exit 1
fi
# Hash password
HASH=$(echo "$PASSWORD" | grub-mkpasswd-pbkdf2 | awk '/grub.pbkdf2/{print $NF}')
unset PASSWORD PASSWORD2
if [ -z "$HASH" ]; then
echo "[!] Failed to generate password hash."
exit 1
fi
# Insert into /etc/grub.d/40_custom
echo "[*] Writing password to /etc/grub.d/40_custom..."
cat <<EOF >> /etc/grub.d/40_custom
set superusers="root"
password_pbkdf2 root $HASH
EOF
# Update GRUB
echo "[*] Updating GRUB config..."
update-grub
echo "[+] GRUB password is now active. Test by rebooting and pressing 'e' on boot menu."
|
