Path: blob/master/documentation/modules/post/linux/gather/enum_protections.md
57468 views
Vulnerable Application
This module enumerates system hardening and security protections on a Linux target. It requires an existing session on any Linux host.
It checks for:
Kernel hardening: ASLR, SMEP, SMAP, KPTI, KAISER, Exec-Shield, kernel pointer restrictions, dmesg restrictions, unprivileged BPF restrictions, and user namespace availability.
Security modules: SELinux (with enforcing/permissive state), Yama, grsecurity, PaX, and LKRG.
Security software: Antivirus, IDS/IPS, firewalls, EDR agents, sandboxes, and monitoring tools - detected via both executable paths and configuration file/directory presence.
Results are saved as notes in the database when a database is connected.
Verification Steps
Start msfconsole
Get a session via exploit of your choice
Do:
use post/linux/gather/enum_protectionsDo:
set SESSION <session>Do:
runYou should see output listing detected kernel protections, security modules, installed security executables, and configuration files.