Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Credentials dumper for Linux using eBPF

github.com

Post reply on HN
Print view View original

31–40 of 51 posts

Re: Show HN: Credentials dumper for Linux using eBPF

#31

Post by freedomben »

pdonis wrote: post #13

So is this an exploit? Or are root privileges on the local machine needed to run it?

This is not an exploit in itself, but could be very useful for pivoting and privilege escalation (across the network). You have to have already achieved root on the target machine, but once you have obtained that you want to start pivoting to other machines which may not have vulnerabilities you can exploit.

The first thing I usually do is dump the /etc/shadow file and start up hashcat on it. However this is a very slow and often unsuccessful approach. With a tool like this, I would still dump the /etc/shadow file but I would also fire this thing up so I can obtain passwords as people log in.

The reason this is useful is because most people reuse passwords across other systems. If I can get the password they use for this system, chances are I just gained access to other systems. The mitigation/defense against this is to always use unique passwords. I'm already root on this box so getting your password benefits me nothing if it's a unique password that you haven't used elsewhere.

Re: Show HN: Credentials dumper for Linux using eBPF

#32

Post by nicce »

freedomben wrote: post #28
nicce wrote: post #21

Earlier quoted context omitted.

It is still quite confusing. > built as a static binary without any dependencies Static binaries are explicitly used for removing the need for specific dynamic runtime dependencies. It does not refer to build dependencies, which are not interesting here. Based on the terms, I would except that libpam is included for the final binary.

If libpam was compiled in, then this tool would do nothing. libpam is not a library for this tool, it's a target , like an input file. libpam is a library for the kernel of the target system. this tool hooks into it to do its work.

Exactly, it is the target. The later phrase pointed out in the original comment it to be some sort of dependency for runtime use, making the confusion. While it is not related to runtime code functionality at all.

Re: Show HN: Credentials dumper for Linux using eBPF

#35

Post by NavinF »

mdaverde wrote: post #30
NavinF wrote: post #29

Earlier quoted context omitted.

Why? eBPF is usually compiled at runtime (so there’s no binary to sign) and running it inside your kernel requires root.

Running eBPF programs doesn't necessarily require compilation at runtime nor root privileges. Look into bpftool's skeleton generation as well as CAP_BPF. With that being said, because eBPF programs can be compiled at runtime, it makes signing eBPF programs trickier. The kernel team doesn't want efforts such as bpftrace to be stifled. It seems like the conversation on signing eBPF programs is still ongoing with an eye…

Hmm I see. I’m still not sure what’s the use case and threat model.

Is this all for Secure Boot just like signed kernel modules?

Re: Show HN: Credentials dumper for Linux using eBPF

#36

Post by citronneur »

shaicoleman wrote: post #34

Related: TripleCross - A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities. https://github.com/h3xduck/TripleCross

You have also https://github.com/pathtofile/bad-bpf or https://github.com/Gui774ume/ebpfkit which are good references also

Re: Show HN: Credentials dumper for Linux using eBPF

#38

Post by frellus »

AntiRush wrote: post #27
frellus wrote: post #26

My ignorance, I had no idea eBPF tracing would make grabbing people's passwords so easy .. that's quite scary to me. I thought it was mostly good for telemetry and deep kernel metrics, but this seems like a serious security flaw to me. Anyone know of any tools to check for abuse?

Unless you enable unprivileged eBPF, root is required to load a module. If a user has root there are plenty of ways to get passwords.

Understood, and agreed once you have root access you can get passwords but I've not seen many that are this easy, and I'm now thinking there's something I need to understand about how to detect if certain traces are happening so I can detect a potential breach.

Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing?

Re: Show HN: Credentials dumper for Linux using eBPF

#39

Post by MPSimmons »

frellus wrote: post #38
AntiRush wrote: post #27

Earlier quoted context omitted.

Unless you enable unprivileged eBPF, root is required to load a module. If a user has root there are plenty of ways to get passwords.

Understood, and agreed once you have root access you can get passwords but I've not seen many that are this easy , and I'm now thinking there's something I need to understand about how to detect if certain traces are happening so I can detect a potential breach. Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing?

> Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing?

This is a good path to go down anyway, despite the fact that Kerberos, for instance, is totally susceptible to 'pass the hash'[1] type attacks. Concentrate on things like Yubikey-based authentication. You can do SAML/OIDC2/mTLS and SSH with Yubikeys.

Eliminate passwords.

[1] - https://www.beyondtrust.com/resources/glossary/pass-the-hash...

Post reply on HN