I love the animated GIF you included in the readme that shows two sessions at once. It made it perfectly clear in moments what it does, and how easy it is to use.
Thanks!
Show HN: Credentials dumper for Linux using eBPF
11–20 of 51 posts
Re: Show HN: Credentials dumper for Linux using eBPF
#12Earlier quoted context omitted.
I read this as, due to pamspy setting an eBPF probe, pamspy needs to know where libpam.so lives. Not that the pamspy needs libpam to be built
Exactly, we have to found the address to hook on the system, so we need the path of the currently use of libpam by other process
Oh, makes sense, thanks!
Re: Show HN: Credentials dumper for Linux using eBPF
#13So is this an exploit? Or are root privileges on the local machine needed to run it?
Re: Show HN: Credentials dumper for Linux using eBPF
#14Great clean example of using libbpf.
Latest of libbpf (which seems like you vendored) comes with ability to calculate symbol offset for you. Thoughts on using that instead of your custom logic?
Re: Show HN: Credentials dumper for Linux using eBPF
#15So is this an exploit? Or are root privileges on the local machine needed to run it?
Root is still needed, so not an exploit. Still a simple straightforward example on how to use eBPF/libbpf to grab returned data from a userspace function call
Re: Show HN: Credentials dumper for Linux using eBPF
#16Great clean example of using libbpf. Latest of libbpf (which seems like you vendored) comes with ability to calculate symbol offset for you. Thoughts on using that instead of your custom logic?
Thanks I will check that!
Re: Show HN: Credentials dumper for Linux using eBPF
#17So is this an exploit? Or are root privileges on the local machine needed to run it?
It appears that you need root, at a minimum the demo gif uses sudo to run the program. At an absolute minimum you would need CAP_BPF[0] to execute the eBPF.
[0] https://man7.org/linux/man-pages/man7/capabilities.7.html#:~...
Re: Show HN: Credentials dumper for Linux using eBPF
#18Anyone know what the status is for enforcing signed eBPF programs?
Re: Show HN: Credentials dumper for Linux using eBPF
#19So is this an exploit? Or are root privileges on the local machine needed to run it?
Pretty much the same as loading an unsigned or untrusted kernel module, someone would have to get it loaded from a privileged account.
Re: Show HN: Credentials dumper for Linux using eBPF
#20Can't you achieve same thing with uprobe[1]?
[1]: https://brendangregg.com/blog/2015-06-28/linux-ftrace-uprobe...