pamspy
Security and privacy
credential dumping tool
SHOW HN2022
How HN took it
4 positive, 11 neutral or asking, 1 mixed, 4 critical, out of 20 comments about the project. Thread score 0.00.
Docs: 1 for, 2 againstExecution: 1 for, 1 againstPrivacy: 0 for, 1 againstIdea: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clean, simple example of writing an eBPF program
From 2 comments
Great clean example of using libbpf. Latest of libbpf (which seems like you vendored) comes with ability to calculate symbol offset for you. Thoughts on using that instead of…
mdaverde on HNWhoa, awesome work OP this is super neat! Not only is it an actually useful tool for pen testers, and a remarkable PoC for abusing eBPF, but it's a sweet and simple example for…
freedomben on HN
Animated GIF in readme makes it clear how it works
From 1 comment
I love the animated GIF you included in the readme that shows two sessions at once. It made it perfectly clear in moments what it does, and how easy it is to use.
thedougd on HN
Objections
Readme is confusing about dependencies
From 2 comments
> built as a static binary without any dependencies > As pamspy rely on libpam, we have to set the path where libpam is installed on your distribution. Confusing text in the…
sorcix on HNIt is still quite confusing. > built as a static binary without any dependencies Static binaries are explicitly used for removing the need for specific dynamic runtime…
nicce on HN
Uretprobe argument reading is unreliable
From 2 comments
Am I the only one for whom it doesn't work? the reason being that using PARMx registers on uretprobe has no guarantee that the registers still hold the argument values, as these…
evgpbfhnr on HNThanks! This happens to work for me, but the root of the problem is the same: there's no guarantee that the handle will still be in that register when the function returns; my…
evgpbfhnr on HN
Requests
Use libbpf's symbol offset calculation instead of custom logic
From 1 comment
Great clean example of using libbpf. Latest of libbpf (which seems like you vendored) comes with ability to calculate symbol offset for you. Thoughts on using that instead of…
mdaverde on HN
Questions
Does it need root privileges?
From 3 comments
So is this an exploit? Or are root privileges on the local machine needed to run it?
pdonis on HNRoot is still needed, so not an exploit. Still a simple straightforward example on how to use eBPF/libbpf to grab returned data from a userspace function call
mdaverde on HNIt appears that you need root, at a minimum the demo gif uses sudo to run the program. At an absolute minimum you would need CAP_BPF[0] to execute the eBPF. [0]…
sdmike1 on HN
Could it grab ssh client passwords?
From 2 comments
Does it grab ssh passwords? (Not sshd password) when a user runs ssh from the target server itself to other servers
jaimehrubiks on HNDoubt it, but only for lack of trying. As the readme says this hooks into libpam, which wouldn't be used when ssh client makes an outgoing connection, unless the outgoing…
pritambaral on HN
Alternatives named
TripleCross eBPF rootkit
From 1 comment
Related: TripleCross - A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.…
shaicoleman on HN
bad-bpf and ebpfkit
From 1 comment
You have also https://github.com/pathtofile/bad-bpf or https://github.com/Gui774ume/ebpfkit which are good references also
citronneur on HN