Back Sploitus

installer exploit

Sploitus • September 14, 2026

Share: View original

* Docker Containers: ![Release Test: Docker Containers](

* Homebrew: ![Release Test: Homebrew](

* Install.sh: ![Release Test: install.sh](

* Install.ps1: ![Release Test: install.ps1](

* macOS Pkg: ![Release Test: macOS Package](

* Arch Linux: ![Release Test: Arch Linux](

The easiest way to install `mql` & `cnspec` is to use the install scripts.

bash -c "$(curl -sSL

Set-ExecutionPolicy Unrestricted -Scope Process -Force;

[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072;

iex ((New-Object System.Net.WebClient).DownloadString('

# query system information with incident and inventory query pack

# scan the platform for security vulnerabilities

mql & cnspec support local and remote targets, including servers (Linux, Windows, macOS), Cloud (AWS, Azure, Google, VMware), Kubernetes (EKS, GKE, AKS, self-managed), containers, container registries, SaaS products (Google Workspace, M365, GitHub, GitLab), and more.

# scan a docker image from a remote registry

# scan a docker container (get ids from docker ps)

cnspec scan docker container 00fa961d6b6a

The arguments support the following values:

`arch`| `amd64`, `arm64`, `armv7`, `armv6`, `386`, `ppc64le`

`filetype`| `tar.gz`, `deb`, `rpm`, `zip`, `pkg`, `msi`

`method`| `download`, `filename`, `version`, `sha256`

# Get the filename for the latest cnspec package

# Get the version for the latest cnspec package

# Get the sha256 for the latest cnspec client

# Download a specific version of cnspec client

# Get the sha256 for a specific version of cnspec Client

## Kubernetes Manifests to install the operator

kubectl apply -f

### Kubernetes manifest to configure the MondooAuditConfig

kubectl apply -f

To browse all releases, please visit

* install.sh \- `mql` & `cnspec` Bash Installer

* download.sh \- `mql` & `cnspec` Bash Binary Downloader

* install.ps1 \- `mql` & `cnspec` PowerShell Installer

* download.ps1 \- `mql` & `cnspec` PowerShell Binary Downloader

The `install.sh` script is POSIX `sh` compatible. All tests are driven via `make` from the repo root.

# POSIX compliance: shellcheck -s sh, dash -n, shebang check

These mount your local `install.sh` into containers and run it under the distro's `/bin/sh`:

# Test on RHEL/CentOS/Fedora distros (yum)

# Test via existing multi-stage Dockerfiles (all distros)

# Run everything: lint + all Docker tests

**Upgrade tests** (cnquery -> mql migration):

Mondoo signs Microsoft Windows executables, PowerShell scripts, Linux packages and code signs Apple macOS executables. The public code signing certificate and public GPG key ist store in the Installer Repo.

* Public certificate for code signing `public-code-signing.cer`

* Public GPG key for package signing `public-package-signing.gpg`

**Note:** The cmdlet `Get-AuthenticodeSignature` is currently not available in PowerShell Core, so you will need a Windows installation to run it.

Since the `11.66.1` release, we have adopted Azure Trusted Signing, which provides short-lived code signing certificates that rotate approximately every 72 hours. This means the certificate thumbprint will differ between releases and cannot be used as a reliable method of validation.

To verify the integrity of the `mql` or `cnspec` executable, please use Microsoft's `Get-AuthenticodeSignature` PowerShell command and verify the **signature status** is `Valid`. Additionally the **Signer (Subject)** is: `CN=Mondoo, Inc.` and the **Issuer** is: `CN=Microsoft ID Verified CS EOC CA 01, O=Microsoft Corporation, C=US`

$file = ".\mondoo_11.66.1_windows_amd64.msi"

(Get-AuthenticodeSignature -FilePath $file).SignerCertificate | Format-List

Subject : CN="Mondoo, Inc.", O="Mondoo, Inc.", L=Cary, S=North Carolina, C=US

Issuer : CN=Microsoft ID Verified CS EOC CA 01, O=Microsoft Corporation, C=US

Thumbprint : 6134EB03311452EFFFA36EFC767F4BEBE29A4107

Extensions : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid,

System.Security.Cryptography.Oid, System.Security.Cryptography.Oid...}

To verify the integrity of the Mondoo PowerShell `install.ps1` script, please use Microsoft's `Get-AuthenticodeSignature` PowerShell and verify the **signature status** is `Valid`.

SignerCertificate Status

----------------- ------

6134EB03311452EFFFA36EFC767F4BEBE29A4107 Valid

Prior to version `11.66.1`, we used DigiCert to sign our Microsoft releases. These were signed with a certificate issued by `CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1, O="DigiCert, Inc.", C=US` and had a static thumbprint of `EE97D1E3C6CD96E06C47B0233DD7C6CE2684FA50`.

To verify the integrity of the `mql` or `cnspec` executable, please use Apple's codesign utility and compare the TeamIdentifier field, which should match the one below.

codesign --verify -d --verbose=2 /usr/local/bin/cnspec

CodeDirectory v=20500 size=2124850 flags=0x10000(runtime) hashes=66396+2 location=embedded

Authority=Developer ID Application: Mondoo, Inc. (W2KUBWKG84)

Authority=Developer ID Certification Authority

The current PGP public key from Mondoo has ID `00E1C42B` / fingerprint `4CE909E26AE7439C39CE7647AC69C65100E1C42B` and is:

mQINBGAF59cBEAC2qCHNY7b8vqKNfGkmgUiOQM7Ags2qL7Z6wlZR+6PjfHjCO7c/

zJgCOSbY1O/XcwnsntQUBlAjZ7yzIBvvvGjmL+3vW1flKl4ZlgLnufHB9oUXtkVd

AMSnVD/LztLKgDMad4KqNwGHuXOa3Ewl5Fv7ZQBHo0hLjslr/mbjG3CtJovXCuS1

HHklLwTap5C/SHx6DIQvJ5DV7GyhCJkRvVxs495XPEIjgv5nyftWhkDqVQxdHoSZ

RoYvoKytG5isDTlv3qbUgPFN6VYvMMEbGegwQpYvdwq6WHNFgri/Abq+yWKZ+Ysn

t8mXEVZR7onfH8jnI2X2XYrIw/c7GHcmkROU+sDvjKnEY/QfcnZUYQnsYmSW34l5

rOVoqQNEutlu41r3KZ1Z7fA8aRYo++D6IusmgIZYA0MtverWPc/S+ZkirQ/SCmNm

9CHV2iLHBJ2kYZ/sYYXCigOGAoJZ1QsTiXpKOB6X/IoDh5zw2yZQm+9GSQ1OGFlr

AWz9tPv98UpSNqGxJAoigS3aMYUobgskXL+dnCkAgb9kLIuDvp3e5EWJr3qmowC7

JMfphTtjrIVu8IgnpjwULlW1WIh3IUp4YfTN51D3NeeAIXuJYhHA5QSjkK9k+Rst

ElLYDWlvF4vZUgvF1a0DGCc5QcRousnavh4ReivLZZVdhxghFdRmO2NgMwARAQAB

tB9Nb25kb28gSW5jIDxzZWN1cml0eUBtb25kb28uaW8+iQJUBBMBCgA+AhsDBQsJ

CAcDBRUKCQgLBRYCAwEAAh4BAheAFiEETOkJ4mrnQ5w5znZHrGnGUQDhxCsFAmPH

LZ8FCQlk4EgACgkQrGnGUQDhxCsvFw//TH3r5Qd8eR5YVsbfAHjbiTkOGhtt4V2k

s0Gt4s6tuLxQlO2SfqtQBuEH3gf8P2Nz6i0WkXb6bdtJFgJ/QVW7FIUtInqR6KLw

CP06J5ZawUepPusjFt6ARzmy99MwWjCv+rgXk6olrOWrpyauDgCFfGRVNBhhRGwX

RNnzpDwnEQegU5bd5GuLJKvGE4eW349a495Sdfg5V22kngsbM10CoTVAIExLnP6a

GZMqWic7q577UGsxml48xw8wluRJp4Xwa2uAjNZzdFkPmhGeHzsF66Rw7pvaqayP

2t4zpAj3KfjWZcYkTnQdkEcLy01rzZZXvUdtv8dwIKLztEyGcP7uTY0O5Bv0aSES

I9KLMLo0fmMr4pBtpgtpLZPkQp6nfupIZF954+d/IkufjEFSLKJmRVyMph6bNWRU

dBmDfmnoG5aaMVREkXA1oOHVULnjWyCZqfWQj2iWx5/JhBHQwUJQXEu6GnYUI+SJ

H8axM8GpfA2Gaj88G82Vxl0QObMJ5rnaYLWvaoUpRjD+LTVybCzGHVZSQOfy7ukc

windeWQtvqcAIgnRMiWMZ0r88ZyM7Hw59kd4shPenBqLLPMyfrhsBj85n4N2epzE

oFhAnK5Jdr7d195l3onVIEylXGfBiY9cdV7YynJbmaFmnKZivE0c06Lfv3Ck+Luj

Yzytm9bkDrW0IE1vbmRvbyBJbmMgPHNlY3VyaXR5QG1vbmRvby5jb20+iQJUBBMB

CgA+FiEETOkJ4mrnQ5w5znZHrGnGUQDhxCsFAmPHLtACGwMFCQlk4EgFCwkIBwIG

FQoJCAsCBBYCAwECHgECF4AACgkQrGnGUQDhxCvYihAAhkrBNbEUIB0kDIUx/Tyg

S5DsTA9tvx0mlJwYXqnUQXqybfsE9S3HHml7rXRQgSmNbwM149uR41i6BB/VdkN7

hL5a4Hwmuw2q4qBkdwFq459fcDn/KaZRkjD+QsJcs0FvR/E5GyEz3bC4jvWErtpy

wMS0wF34IoR6vqTUgBV8IFaXrMOUjoAbtUTfhUOEnLn0PPVRvs+TZ3D98e1PpinI

ng+TQY9LKXIHzC7oyxoQc5YpIPAZycwwpvlFFqE9xp0/HfcZkW0OZ5A6/KCSEyRC

5u4N4N9vZhe4WeZqEf3KXo01OYNKoOJUa57vMiv4UyNPI53V2P64mcrXqKhAiP2z

BKIAM8OMIeIWRD5a0EMoGNazMGkQ2RD9YALCqbkAsNBQ/ZN6dsl8fVw1LQLAnGLv

/7il90YxIZYzw1sLYG7uATtHXf/jSjGaWS+1nW/faBOTcKj3zaY5/F3REZHhmQDG

6O6ae1HtcgKclJ7N/TXVPS6qcsNDVv2xctW0HpH0RNSt5Xc2VVvkzbZ1JHT/lRRq

iRivUN+HoDwwda5e7pjgThDUVzUwzD6NTXf8Hfp7risZUGwI+ALbPc8zQxu2HlYF

6C4MxGS/hGJTgw01oTcKZma/ZuRW8FtybYVtheEI0S4qaIOg/0leTZV76ugEA+WY

ugfAyAbwEXF540MRjWoxI3q5Ag0EYAXn1wEQAMAiLOUBM5FgrU32MS7MCDpbyoiW

PmPPHE2onMEXzpX5YH1a5JedUwYdAkc1x4WtUmSM3PnrfUA2gD4JX/ZrnyjK2kC7

wmIM61oOARBL/Mmyk7zb5+t/4TlVB0Q1AI9ylPrZPfxYEJ+VaUKJB+pixqilbc6S

muDW3Q7Q9fdF3/Yan3nbewpt11zV3zPZaZfeFfCByOIwmpU9NJXULqV+oW99u0Cj

8N532gMTIEO24oPBm+e71sy9Kv0OwXrlrJwUHhZJ7WciOI1XthxDgoqfxzW4EP6k

jrIkQ4LltnMHtpeKv6yohlLOZiWNmzPWAWnMbpXJCmUpgeTKaxxjXUehsstFbMGE

YsGFM49Z3092AXuGrYnoqpZNv9its7+Ly15wXpdXPPEIjqW9KTJqk+OoO7YopGE2

XRKIDAZc1Qtxzi9gAcwkOvIyhziZvzgyjbi/dtQa/vFWPSih6F3P9TPey82/eSBf

RUwdM+UKP3CD3dNLWHRigtMT/p1dlIRFXRlxYzAjZ4EwRg62eGScttP6PbPO+3IT

VOCpMXAmnguHDrpvuyuLmAwLpW2Q18EVtjV+UuLSbnF4nieUsT5iIWmy7JhRsLEu

1Yerws4bTyoAqNqDaZ1IottzkOHJpvNu5ntiJx8T/M8yuthFFy9jhbTDeiSTV+iE

SDVAtVVqhYT6nyDlABEBAAGJAjwEGAEKACYCGwwWIQRM6QniaudDnDnOdkesacZR

AOHEKwUCY8ctlQUJCWTgPgAKCRCsacZRAOHEK9CsD/wMUmo4pCP8F5EtKe3QNvAu

6wjEpQNXDRCGft18k2eeuyk3v+vJ4jqGLcw5wlvilTzGBu9xZQTkUr3tZX+ZhZkb

e86yXd71qywHcCeIm0pAb2kGMq889r2sZwhR9TjLolFPAtOr3qfbEqK3rQTqZS/4

m1Z2bQ028Vhzwe2L8WrjQDZ3WFAIKp6Yb8pEDWcMDhvgoMGzDQNJwC6t4e2QVZHj

h/v6H/E1E0jEsiHZcSPRM/eE36QayIgXa13VamUZuFx7sb1s8Ik1/c5gseZMkxRR

MOgZYidWpV/FdUJ02lKwT0BZsbLSnzY38+Vpz4FyDBp7UEOlg6uJVkh2FCfP4Wlm

wgpi9CDQNvDEYWPOPDJcKpLqLxHk7mJIYsnDOsfMB+jfG9okEkGoA2My6/eGykhx

SOqD3Y95L3RXRL2PY7sRvcs2ygtRma6u+aU7KxOqsOfwhkyrefo2d74cMaOuPyKK

ix7+7QWLFx8HzREN24tx8eJuuB2Z4lAe7SxVOkY/Lo3pibXET8Cjzw/e+ut6b3Iu

wYfYiuZWjMEIvRNQ+EP5S5rKW+uCPTAYuKeTinNIHm4idD7cdFZJUz+jKAeShOsb

ROXmwrH9exRkCM3RblVq6XRk/GnXburwB2rtPIF8OOnQiGptLUtCnbApp5crYC/u

Key ID `00E1C42B` / fingerprint `4CE909E26AE7439C39CE7647AC69C65100E1C42B`: