#!/bin/bash
# PentestChain Auto-Generated Remediation Script — Linux/Debian
# Target: 192.168.64.2  |  Generated: 20260531_204433
# Run as root: sudo bash remediate_linux.sh
set -e

echo '[*] Updating system packages...'
apt-get update -y && apt-get upgrade -y


# ══ FTP on 192.168.64.2:21 ══
# Risk: vsftpd 2.3.4 backdoor (CVE-2011-2523) — trivial remote root shell. Anonymous FTP also exposes data.
# Fix:  Immediately replace vsftpd with a patched version. Disable anonymous access. Consider replacing FTP with SFTP entirely.
# CVEs: CVE-2011-2523, EDB-17491, EDB-49757, DEBIAN-CVE-2011-0762, DEBIAN-CVE-2011-2189
# Remove backdoored vsftpd and replace
apt-get remove vsftpd -y
apt-get install vsftpd -y
# Disable anonymous login
sed -i 's/anonymous_enable=YES/anonymous_enable=NO/' /etc/vsftpd.conf
# Restrict to local users only
echo 'local_enable=YES' >> /etc/vsftpd.conf
echo 'chroot_local_user=YES' >> /etc/vsftpd.conf
systemctl restart vsftpd
# Block FTP port from external access
ufw deny 21/tcp


# ══ SSH on 192.168.64.2:22 ══
# Risk: OpenSSH 4.7p1 is outdated and vulnerable to multiple CVEs. Default credentials (msfadmin/msfadmin) allow trivial login.
# Fix:  Upgrade OpenSSH, disable password auth, enforce key-based auth, disable root login, change default credentials.
# Harden SSH configuration
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
echo 'MaxAuthTries 3' >> /etc/ssh/sshd_config
echo 'LoginGraceTime 30' >> /etc/ssh/sshd_config
echo 'AllowUsers YOUR_USER' >> /etc/ssh/sshd_config
# Change default password immediately
passwd msfadmin
# Upgrade SSH
apt-get upgrade openssh-server -y
systemctl restart sshd


# ══ Telnet on 192.168.64.2:23 ══
# Risk: Telnet transmits all credentials and data in cleartext. Trivially interceptable. No reason to run in 2024+.
# Fix:  Disable and remove telnetd immediately. Use SSH for all remote access.
# CVEs: CVE-2021-27171, CVE-2000-1195, CVE-2022-39028, CVE-2020-8797, EDB-52524
# Disable and remove telnet
systemctl stop telnet.socket 2>/dev/null || true
systemctl disable telnet.socket 2>/dev/null || true
apt-get remove --purge telnetd telnet -y
# Block port 23
ufw deny 23/tcp


# ══ SMTP on 192.168.64.2:25 ══
# Risk: Open SMTP relay allows spam/phishing. User enumeration via VRFY/EXPN. Postfix version may have known CVEs.
# Fix:  Disable open relay, disable VRFY/EXPN, require SMTP AUTH for sending.
# CVEs: CVE-2005-0337, CVE-2023-51764, CVE-2024-27305, CVE-2004-0925
# Disable VRFY and EXPN
postconf -e 'disable_vrfy_command = yes'
# Restrict relay
postconf -e 'smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination'
# Require authentication
postconf -e 'smtpd_sasl_auth_enable = yes'
systemctl restart postfix


# ══ HTTP on 192.168.64.2:80 ══
# Risk: Apache 2.2.8 with PHP 5.2.4 — multiple critical CVEs. PHP CGI arg injection (CVE-2012-1823). Unencrypted HTTP.
# Fix:  Upgrade Apache and PHP immediately. Force HTTPS. Disable PHP CGI mode. Add security headers.
# Upgrade Apache and PHP
apt-get upgrade apache2 php -y
# Disable PHP CGI (the vulnerable interface)
a2dismod cgi
# Add security headers
cat >> /etc/apache2/conf-available/security.conf << 'EOF'
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
Header always set X-XSS-Protection '1; mode=block'
Header always set Content-Security-Policy "default-src 'self'"
ServerTokens Prod
ServerSignature Off
EOF
a2enmod headers
# Force HTTPS redirect
echo 'Redirect permanent / https://YOUR_DOMAIN/' >> /etc/apache2/sites-enabled/000-default.conf
systemctl restart apache2


# ══ RPCbind on 192.168.64.2:111 ══
# Risk: RPCbind exposes NFS and other RPC services. Combined with NFS, allows mounting remote filesystems.
# Fix:  Block port 111 externally. Restrict NFS exports to specific trusted IPs.
# CVEs: CVE-2003-1070, EDB-26887, EDB-41974, EDB-20376
# Block rpcbind from external access
ufw deny 111/tcp
ufw deny 111/udp
# If NFS is not needed, disable it
systemctl stop nfs-server rpcbind
systemctl disable nfs-server rpcbind


# ══ NetBIOS/SMB on 192.168.64.2:139 ══
# Risk: Samba 3.0.20 — CVE-2007-2447 (usermap_script) allows unauthenticated remote root command execution.
# Fix:  Upgrade Samba immediately. Disable SMBv1. Block ports 139/445 from external access.
# Upgrade Samba to patched version
apt-get upgrade samba -y
# Disable SMBv1 and restrict protocol
cat >> /etc/samba/smb.conf << 'EOF'
[global]
min protocol = SMB2
smb encrypt = required
restrict anonymous = 2
EOF
systemctl restart smbd nmbd
# Block from external access
ufw deny 139/tcp
ufw deny 445/tcp


# ══ SMB on 192.168.64.2:445 ══
# Risk: Samba 3.0.20 (CVE-2007-2447). Also check MS17-010 EternalBlue if Windows target.
# Fix:  Upgrade Samba. Disable SMBv1. Block externally.
apt-get upgrade samba -y
echo -e '[global]\nmin protocol = SMB2\nrestrict anonymous = 2' >> /etc/samba/smb.conf
systemctl restart smbd
ufw deny 445/tcp


# ══ rexec on 192.168.64.2:512 ══
# Risk: R-services (rexec/rlogin/rsh) use trust-based authentication — trivially bypassable. No encryption.
# Fix:  Disable all R-services. Replace with SSH.
# Remove R-services completely
apt-get remove --purge rsh-server rsh-client -y
# Clear .rhosts and hosts.equiv trust files
find / -name '.rhosts' -delete 2>/dev/null
find / -name 'hosts.equiv' -delete 2>/dev/null
ufw deny 512/tcp && ufw deny 513/tcp && ufw deny 514/tcp


# ══ rlogin on 192.168.64.2:513 ══
# Risk: rlogin uses .rhosts trust files — no real authentication. Allows login without password.
# Fix:  Remove .rhosts files and disable rlogin service.
# CVEs: CVE-1999-0036, CVE-1999-0180, CVE-1999-1152, CVE-1999-1034, CVE-1999-1142
apt-get remove --purge rsh-server -y
find / -name '.rhosts' -delete 2>/dev/null
ufw deny 513/tcp


# ══ rsh on 192.168.64.2:514 ══
# Risk: RSH allows command execution via trust files. Equivalent to unauthenticated remote shell.
# Fix:  Remove .rhosts, disable rsh, use SSH instead.
apt-get remove --purge rsh-server -y
find / -name '.rhosts' -delete 2>/dev/null
ufw deny 514/tcp


# ══ Java RMI on 192.168.64.2:1099 ══
# Risk: Java RMI registry exposes remote method invocation — can lead to deserialization RCE.
# Fix:  Disable Java RMI if not needed. If required, restrict access via firewall to trusted hosts only.
# Block RMI from external access
ufw deny 1099/tcp
# In Java app, set -Djava.rmi.server.hostname=127.0.0.1
# Use Java Security Manager to restrict RMI


# ══ Bindshell (Ingreslock) on 192.168.64.2:1524 ══
# Risk: Port 1524 is a root backdoor shell on Metasploitable 2 — anyone can connect and get root.
# Fix:  This is a deliberately placed backdoor. Kill the process and block the port immediately.
# Kill the bindshell process
fuser -k 1524/tcp
# Block the port
ufw deny 1524/tcp
# Check for other backdoors
netstat -tlnp | grep -v 'sshd\|apache\|nginx\|mysql\|postgres'


# ══ NFS on 192.168.64.2:2049 ══
# Risk: NFS exports may expose sensitive directories including /root, /home, /etc. No auth on NFSv3.
# Fix:  Restrict NFS exports to specific trusted IPs. Never export /root or /. Require Kerberos auth.
# CVEs: EDB-10202, EDB-42305
# Check what is exported
cat /etc/exports
# Restrict exports to specific IPs (replace 0.0.0.0 with actual trusted IP)
# Edit /etc/exports: change *(rw) to 192.168.1.0/24(rw,no_root_squash)
# Add no_root_squash removal and restrict:
sed -i 's/\*/192.168.1.0\/24/g' /etc/exports
sed -i 's/no_root_squash/root_squash/g' /etc/exports
exportfs -ra
# Block from external access
ufw deny 2049/tcp && ufw deny 2049/udp


# ══ MySQL on 192.168.64.2:3306 ══
# Risk: MySQL 5.0.51a — root account has no password. Remotely accessible. Risk of data theft and UDF exploitation.
# Fix:  Set strong root password, bind to localhost, remove anonymous users, disable remote root login.
# CVEs: CVE-2019-14939, CVE-2015-9244, GHSA-5f7m-mmpc-qhh4
# Set root password
mysqladmin -u root password 'NEW_STRONG_PASSWORD'
# Secure MySQL installation
mysql -u root -pNEW_STRONG_PASSWORD << 'EOF'
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\_%';
FLUSH PRIVILEGES;
EOF
# Bind MySQL to localhost only
sed -i 's/bind-address.*/bind-address = 127.0.0.1/' /etc/mysql/mysql.conf.d/mysqld.cnf
systemctl restart mysql
ufw deny 3306/tcp


# ══ DistCC on 192.168.64.2:3632 ══
# Risk: DistCC daemon allows arbitrary command execution as the daemon user (CVE-2004-2687). Trivial RCE.
# Fix:  Disable DistCC if not needed. If needed, restrict to trusted build hosts only.
# CVEs: CVE-2004-2687
# Stop and disable distccd
systemctl stop distcc
systemctl disable distcc
apt-get remove distcc -y
# Block port
ufw deny 3632/tcp


# ══ PostgreSQL on 192.168.64.2:5432 ══
# Risk: PostgreSQL 8.3 with default credentials (postgres/postgres). Remote access enabled. UDF exploitation possible.
# Fix:  Change default password, bind to localhost, restrict pg_hba.conf access.
# Change postgres password
su - postgres -c "psql -c \"ALTER USER postgres PASSWORD 'NEW_STRONG_PASSWORD';\""
# Bind to localhost
sed -i "s/#listen_addresses = 'localhost'/listen_addresses = 'localhost'/" /etc/postgresql/*/main/postgresql.conf
sed -i "s/listen_addresses = '\*'/listen_addresses = 'localhost'/" /etc/postgresql/*/main/postgresql.conf
# Restrict pg_hba.conf — replace 'trust' with 'md5'
sed -i 's/host.*all.*all.*0.0.0.0\/0.*trust/# removed open access/' /etc/postgresql/*/main/pg_hba.conf
systemctl restart postgresql
ufw deny 5432/tcp


# ══ VNC on 192.168.64.2:5900 ══
# Risk: VNC password is 'password' — trivial to guess. Remote desktop access to the system.
# Fix:  Set strong VNC password, restrict to localhost, use SSH tunneling for remote access.
# CVEs: CVE-2002-2088, CVE-2006-1652, CVE-2006-4309, CVE-2001-1422, CVE-2002-0994
# Set strong VNC password
vncpasswd
# Restrict VNC to localhost (use SSH tunnel to access remotely)
# Edit VNC startup to bind to 127.0.0.1 only
# In ~/.vnc/xstartup or vncserver config, add: -localhost
# Block from external access
ufw deny 5900/tcp
ufw deny 5901/tcp


# ══ X11 on 192.168.64.2:6000 ══
# Risk: X11 display is open — allows remote screenshot capture, keylogging, and GUI hijacking.
# Fix:  Disable X11 TCP access. Use SSH X11 forwarding instead.
# CVEs: CVE-2000-1169, CVE-2002-0402, CVE-2005-0084, CVE-2002-0517, CVE-2006-0577
# Disable X11 TCP connections
echo 'DisallowTCP true' >> /etc/X11/xorg.conf.d/10-security.conf
# Or start X with -nolisten tcp
sed -i 's/DAEMON_OPTS="/DAEMON_OPTS="-nolisten tcp /' /etc/X11/xinit/xserverrc
ufw deny 6000/tcp


# ══ IRC / UnrealIRCd on 192.168.64.2:6667 ══
# Risk: UnrealIRCd 3.2.8.1 contains a backdoor (CVE-2010-2075) — sending 'AB' prefix gives instant root shell.
# Fix:  Remove UnrealIRCd immediately. Verify binary checksums if reinstalling. Block IRC ports.
# CVEs: CVE-2010-2075, CVE-2016-7144, CVE-2009-4893, CVE-2017-13649, CVE-2004-0679
# Remove backdoored UnrealIRCd
systemctl stop unrealircd 2>/dev/null || true
apt-get remove --purge unrealircd -y
# Kill any remaining IRC processes
pkill -f unrealircd
# Block IRC ports
ufw deny 6667/tcp
ufw deny 6697/tcp
# If IRC is legitimately needed, download a verified clean version
# and verify its SHA256 checksum before deploying


# ══ AJP / Tomcat on 192.168.64.2:8009 ══
# Risk: AJP connector exposed (Ghostcat CVE-2020-1938) — allows reading any file from webapp root.
# Fix:  Disable AJP connector or restrict to localhost. Upgrade Tomcat.
# CVEs: CVE-2020-1938, CVE-2000-1247
# Disable AJP in Tomcat server.xml
sed -i 's/<Connector port="8009".*\/>/<!-- AJP disabled -->/' /etc/tomcat*/server.xml
# Or set requiredSecret and bind to localhost:
# <Connector protocol="AJP/1.3" port="8009" address="127.0.0.1" requiredSecret="SECRET" />
systemctl restart tomcat*
ufw deny 8009/tcp


# ══ Tomcat HTTP on 192.168.64.2:8180 ══
# Risk: Apache Tomcat 5.5 with default credentials (tomcat/tomcat). Manager webapp allows WAR file upload = RCE.
# Fix:  Change Tomcat credentials, restrict manager app to localhost, upgrade Tomcat.
# Change Tomcat credentials in tomcat-users.xml
# Edit /etc/tomcat*/tomcat-users.xml and set strong password
# Restrict manager to localhost in context.xml:
# <Valve className='org.apache.catalina.valves.RemoteAddrValve' allow='127\.\d+\.\d+\.\d+'/>
apt-get upgrade tomcat* -y
systemctl restart tomcat*


echo "[+] Remediation complete. Reboot recommended."