omigood - OMIGOD! OM I GOOD? A free scanner to detect VMs vu

项目说明

omigood (OM I GOOD?)

This repository contains a free scanner to detect to one of the "OMIGOD" discovered by Wiz's threat research team, specifically C.

Original blog post from Wiz:

O

The scanner requires Azure credentials to connect to Azure APIs and, given a subscription and a resource group (or by default it will scan all the a ones), retrieves the list of Linux VMs and reports whether the machine might be .

Also make sure to check out Microsoft's own tool for this purpose:

Authentication

To authenticate against Azure APIs, both azure cli (default) and Interacti authentication are supported, check the --auth command line parameter.

Performed checks

There isn't a straightforward way to determine whether your machines are to OMI without running commands on the Linux machine itself, which is supported through Azure APIs using the RunShellScript command through an extension. Microsoft's own tool () uses this approach as well.

It's worth noting that, even if the VM is , it might not be exposing the OMI server via HTTP/HTTPS (which is the default) and, even if it does, those ports might be blocked by Azure's Network Security Groups, hence not reachable. This is not a reason to avoid patching but, if you have a lot of Linux VMs, it might be useful to know which ones are more exposed and prioritize your efforts.

omigood follows this more comprehensi and will produce a JSON output with a number of checks that you can trigger through command line options in order to determine your attack surface.

These are the checks performed by omigood:
- Check against Azure API if the VM is running Linux
- Check against Azure API if the VM is running the OMSAgentForLinux extension, which is a good hint on whether the machine might be running OMI as well.
- Check against Azure API the of the OMS Agent, as it is often correlated to the OMI . This check can be performed without running any script on the VM. OMS Agent should be at least 1.13.40. You can check out the script we run here.
- Check against Azure API the Network Security Groups of the VM, and determine (using a very simple algorithm that can trigger false positives) whether the OMI ser might be open.
- Check against Azure API the Effecti Security Groups of the of network interface and subnet) and determine whether the OMI ser might be open. This check is optional as it requires the VM to be running, higher API pri and it takes more time to run. Enable it with the -e command line option.
- Use the Azure API to run a simple bash script on the VM that determines whether the OMI server is running, its and whether it's exposed only on UNIX socket (default) or also TCP. This check is optional as it requires the VM to be running, higher API pri and it takes more time to run. Enable it with the -r command line option. Use at your own risk!
- Try to attack the machine's public IP running the /usr/bin/id command. This check is optional as it in trying to exploit the it with the -a command line option. Use it only on targets that you are authorized to test. Use it at your own risk!

Output

The generated JSON output file contains all the information on the scanned VMs: IDs, operating system, network security groups, power state, etc.

The flags ('YES'/'NO') that are relevant for the checks are:
- *check_oms_extension*: YES if OMS Agent Extension is found on the VM.
- *check_oms_*: YES if OMS Agent Extension is lower than 1.13.40.
- *check_permissi*: YES if Network Security Group rules seem to permit connections to OMI ports.
- *check_permissi*: YES if Effecti rules seem to permit connections to OMI ports. Only with -e command line option.
- *check_omi_*: YES if OMI ser was retrieved and determined to be lower than 1.6.8-1. Only with -r command line option.
- *check_omi_listening_on_tcp*: YES if OMI ser was retrieved and determined to be listening on TCP and not only UNIX sockets. Only with -r command line option.
- *check_attack_successful*: YES if the attack on the VM's Public IP was successful. Only with -r command line option.

Usage

Contributors

DISCLAIMER

The Software and code samples a on this repository are provided "as is" without warranty of any kind, either express or implied. Use at your own risk.

项目信息

开发语言：Python

Star 数：20

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕OMIGOD! OM I GOOD? A free scanner to detect VMs vulnerable to one of the "OMIGOD" vulnerabilities discovered by Wiz's threat research team, specifically CVE-2021-38647.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。