Fix/Feat(SSH): SSH agentless procfs scanning now working properly

Author: yunginnanet

hash.go

@@ -153,35 +153,51 @@ func (m *MultiHasher) HashFile(path string) (map[HashType]string, error) {
 	var err error
 	var fSize int64
 	var f io.ReadCloser
-	var hashResults = make(map[HashType]string, len(m.todo))
+
 	if f, fSize, err = preCheckFilepath(path); err != nil {
-		return hashResults, err
+		return nil, err
 	}
 
-	defer func() {
-		_ = f.Close()
-	}()
-
 	if fSize > int64(constMaxFileSize) {
-		return hashResults, NewErrFileTooLarge(path, fSize)
+		return nil, errors.Join(f.Close(), NewErrFileTooLarge(path, fSize))
 	}
 
-	return m.Hash(f)
+	res, herr := m.Hash(f)
+
+	return res, errors.Join(f.Close(), herr)
 }
 
-func (cfg *config) runEnabledHashers(file *File) error {
+func (cfg *config) multHasher(file *File) *MultiHasher {
 	if file.Checksums == nil {
 		file.Checksums = new(Checksums)
 	}
 
-	mh := NewMultiHasher(cfg.hashers...)
+	return NewMultiHasher(cfg.hashers...)
+}
 
-	results, err := mh.HashFile(file.Path)
-	if err != nil {
-		return err
+func (f *File) setHashes(hashes map[HashType]string) {
+	if hashes == nil {
+		return
 	}
-	for ht, res := range results {
-		file.Checksums.Set(ht, res)
+	for ht, h := range hashes {
+		f.Checksums.Set(ht, h)
 	}
-	return nil
+}
+
+func (cfg *config) runEnabledHashersOnPath(file *File) error {
+	mh := cfg.multHasher(file)
+
+	results, err := mh.HashFile(file.Path)
+	file.setHashes(results)
+
+	return err
+}
+
+func (cfg *config) runEnabledHashersOnBytes(file *File, r io.Reader) error {
+	mh := cfg.multHasher(file)
+
+	results, err := mh.Hash(r)
+	file.setHashes(results)
+
+	return err
 }

pkg/ssh/io.go

@@ -1,96 +1,111 @@
 package ssh
 
 import (
+	"bytes"
+	"context"
 	"errors"
 	"golang.org/x/crypto/ssh"
 	"io"
 	"path/filepath"
 	"strconv"
-	"sync"
 )
 
-func (s *SSH) procReadLink(sesh *ssh.Session, pid int) (procfs, abs string) {
-	procFSPath := filepath.Join("/proc", strconv.Itoa(pid), "exe")
-	var pthB = []byte(procFSPath)
-	rlCmd := "readlink -f " + procFSPath
-	var err error
-	if pthB, err = s.Run(sesh, rlCmd); err != nil {
-		s.verbLn("[io] readlink -f error: %s", err)
-		pthB = []byte(procFSPath)
+const getPIDs = `bash -c 'for proc in /proc/*/exe; do if test -r "$proc" > /dev/null; then echo -n "$proc" | grep -v self | tr -d "/exeproc" | tr "\n" " "; fi; done'`
+
+func (s *SSH) whoami(sesh *ssh.Session) (string, error) {
+	var whoiam = ""
+	usr, err := s.Run(sesh, "whoami")
+	if usr != nil {
+		whoiam = string(bytes.TrimSpace(usr))
 	}
-	return procFSPath, string(pthB)
+	return whoiam, err
 }
 
-// GetSessions returns a slice of SSH sessions.
-// It creates the sessions concurrently.
-func (s *SSH) GetSessions(i int) ([]*ssh.Session, error) {
-	var wg = new(sync.WaitGroup)
-	wg.Add(i)
-	var seshi = make([]*ssh.Session, i)
-	var errs = make([]error, i)
-	for j := 0; j < i; j++ {
-		if s.Closed() {
-			s.verbLn("[session] parent is closed")
-			return nil, io.ErrClosedPipe
+// GetPIDs returns a list of process IDs from the remote host that the user has access to.
+func (s *SSH) GetPIDs() ([]int, error) {
+	var (
+		pids = make([]int, 0)
+		ps   []byte
+		err  error
+		sesh *ssh.Session
+	)
+
+	if sesh, err = s.GetSession(context.Background()); err != nil {
+		return nil, err
+	}
+
+	if ps, err = s.Run(sesh, getPIDs); err != nil {
+		return nil, err
+	}
+
+	for _, p := range bytes.Fields(ps) {
+		var pid int
+		if pid, err = strconv.Atoi(string(p)); err == nil {
+			pids = append(pids, pid)
 		}
-		go func(e int) {
-			s.traceLn("[session] creating session %d", e)
-			seshi[e], errs[e] = s.client.NewSession()
-			wg.Done()
-		}(j)
 	}
-	wg.Wait()
-	return seshi, errors.Join(errs...)
+
+	s.verbLn("found %d PIDs with read permissions: %+v", len(pids), pids)
+
+	return pids, nil
 }
 
-// CloseSessions closes a slice of SSH sessions.
-func (s *SSH) CloseSessions(sesh []*ssh.Session) error {
-	var wg = new(sync.WaitGroup)
-	wg.Add(len(sesh))
-	var errs = make([]error, len(sesh))
-	for j := 0; j < len(sesh); j++ {
-		if s.Closed() {
-			s.verbLn("[session] parent is closed")
-			return io.ErrClosedPipe
-		}
-		go func(e int) {
-			if sesh[e] == nil {
-				s.traceLn("[session] session %d is nil", e)
-				wg.Done()
-				return
-			}
-			s.traceLn("[session] closing session %d", e)
-			errs[e] = sesh[e].Close()
-			wg.Done()
-		}(j)
+func (s *SSH) procReadLink(sesh *ssh.Session, pid int) (procfs, abs string) {
+	procFSPath := filepath.Join("/proc", strconv.Itoa(pid), "exe")
+	var pthB = []byte(procFSPath)
+
+	var err error
+	if pthB, err = s.Run(sesh, "readlink -f "+procFSPath); err != nil {
+		pthB = []byte(procFSPath)
 	}
-	wg.Wait()
-	return errors.Join(errs...)
+
+	s.verbLn("procfs path: %s", string(pthB))
+
+	return procFSPath, string(bytes.TrimSpace(pthB))
 }
 
 // ReadProc reads the executable of a process from the remote host.
 func (s *SSH) ReadProc(pid int) (path string, data []byte, err error) {
-	s.traceLn("[io] reading procfs, PID %d...", pid)
+	s.traceLn("reading procfs, PID %d...", pid)
 	if s.Closed() {
-		s.verbLn("[io] parent is closed")
+		s.verbLn("parent is closed")
 		return "", nil, io.ErrClosedPipe
 	}
 
-	seshi, err := s.GetSessions(2)
-	if err != nil {
-		return "", nil, err
+	var seshi = make([]*ssh.Session, 2)
+	ctx, cancel := context.WithTimeout(context.Background(), s.tout)
+	for i := range seshi {
+		var sesh *ssh.Session
+		if sesh, err = s.GetSession(ctx); err != nil {
+			cancel()
+			return "", nil, err
+		}
+		seshi[i] = sesh
 	}
 
 	proc, abs := s.procReadLink(seshi[0], pid)
 	data, err = s.Run(seshi[1], "cat "+proc)
 
+	cancel()
 	return abs, data, err
 }
 
 // Run executes a command on the remote host.
 func (s *SSH) Run(sesh *ssh.Session, cmd string) (output []byte, err error) {
 	s.verbLn("$ " + cmd)
-	output, err = sesh.Output(cmd)
+	if output, err = sesh.Output(cmd); err != nil {
+		s.verbLn("run error: %s", err.Error())
+	}
+	if errors.Is(err, io.EOF) {
+		err = nil
+	}
+
 	cerr := sesh.Close()
+	if errors.Is(cerr, io.EOF) {
+		cerr = nil
+	}
+
+	s.verbLn("\tresulting output: %d bytes", len(output))
+
 	return output, errors.Join(err, cerr)
 }

pkg/ssh/session.go

@@ -0,0 +1,45 @@
+package ssh
+
+import (
+	"context"
+	"golang.org/x/crypto/ssh"
+	"io"
+	"time"
+)
+
+func (s *SSH) createSessions() {
+	s.traceLn("creating sessions...")
+	for {
+		if s.closed.Load() || s.client == nil {
+			s.traceLn("end of session creation")
+			return
+		}
+		time.Sleep(100 * time.Millisecond)
+		sesh, err := s.client.NewSession()
+		if err != nil {
+			s.verbLn("error creating session: %v", err)
+			time.Sleep(1 * time.Second)
+			continue
+		}
+		select {
+		case s.sessions <- sesh:
+			s.traceLn("created session %p", sesh)
+		default:
+			_ = sesh.Close()
+			time.Sleep(1 * time.Second)
+		}
+	}
+}
+
+// GetSession returns a session from the SSH connection.
+func (s *SSH) GetSession(ctx context.Context) (*ssh.Session, error) {
+	if s.closed.Load() {
+		return nil, io.ErrClosedPipe
+	}
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case sesh := <-s.sessions:
+		return sesh, nil
+	}
+}