[{"data":1,"prerenderedAt":347},["ShallowReactive",2],{"project-31988820":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":42,"post_text":45,"what":46,"said":93,"maker_in_thread":174,"shape":183,"grid":188,"attempts":310,"same_week":311,"maker_shows":44,"maker_hidden":340,"reader_version":341,"card":342},"31988820","pamspy","Credentials dumper for Linux using eBPF","title","Show HN: Credentials dumper for Linux using eBPF","https:\u002F\u002Fgithub.com\u002Fcitronneur\u002Fpamspy","github.com","citronneur",1657032295,2022,235,50,212,2570,9,"notable","security_privacy","credential dumping tool","cli",[24,25,26,27,28],"ebpf","libpam","credential dumper","linux","pentesting","curious",0,{"positive":32,"neutral":33,"mixed":34,"critical":32},4,11,1,20,{"docs":37,"execution":39,"privacy":40,"idea":41},{"positive":34,"critical":38},2,{"positive":34,"critical":34},{"positive":30,"critical":34},{"positive":34,"critical":30},[43,30,30,30,43,30,34,44,30,34,30,30,30,30,34,44,44,30,44,44,44,44,44,44,43,30,43,44,44,44,30,34,30,30,30,30,30,30,30,30],5,3,null,{"problem":47,"audience":63,"pricing":45,"motivation":70,"time_to_build":45,"stack":77,"openness":92,"stage":92,"team_size":92},{"value":48,"source":49,"evidence":50},"Captures passwords used for local authentication on Linux by hooking libpam","commenter",[51,55,59],{"id":52,"by":53,"text":54},"31991297","frellus","My ignorance, I had no idea eBPF tracing would make grabbing people's passwords so easy .. that's quite scary to me. I thought it was mostly good for telemetry and deep kernel…",{"id":56,"by":57,"text":58},"31991619","freedomben","Whoa, awesome work OP this is super neat! Not only is it an actually useful tool for pen testers, and a remarkable PoC for abusing eBPF, but it's a sweet and simple example for…",{"id":60,"by":61,"text":62},"31989487","semiquaver","When the author says it “has no dependencies” they are referring to build time dependencies (i.e. development headers) and runtime library dependencies (dynamic libraries that…",{"value":64,"source":49,"evidence":65},"penetration testers and security researchers",[66,67],{"id":56,"by":57,"text":58},{"id":68,"by":57,"text":69},"31991522","This is not an exploit in itself, but could be very useful for pivoting and privilege escalation (across the network). You have to have already achieved root on the target…",{"value":71,"source":72,"evidence":73},"Lateral movement use case for attackers and PoC for abusing eBPF","maker",[74],{"id":75,"by":11,"text":76},"31992489","Lateral movement for example",[78,88],{"value":79,"source":80,"evidence":81},"eBPF","inferred",[82,84],{"id":83},"post",{"id":85,"by":86,"text":87},"31989573","mdaverde","Great clean example of using libbpf. Latest of libbpf (which seems like you vendored) comes with ability to calculate symbol offset for you. Thoughts on using that instead of…",{"value":89,"source":49,"evidence":90},"libbpf",[91],{"id":85,"by":86,"text":87},"unknown",{"praise":94,"objections":107,"requests":129,"questions":134,"alternatives":160},[95,100],{"value":96,"source":49,"evidence":97},"Clean, simple example of writing an eBPF program",[98,99],{"id":85,"by":86,"text":87},{"id":56,"by":57,"text":58},{"value":101,"source":49,"evidence":102},"Animated GIF in readme makes it clear how it works",[103],{"id":104,"by":105,"text":106},"31989471","thedougd","I love the animated GIF you included in the readme that shows two sessions at once. It made it perfectly clear in moments what it does, and how easy it is to use.",[108,119],{"value":109,"source":49,"evidence":110},"Readme is confusing about dependencies",[111,115],{"id":112,"by":113,"text":114},"31989327","sorcix","> built as a static binary without any dependencies > As pamspy rely on libpam, we have to set the path where libpam is installed on your distribution. Confusing text in the…",{"id":116,"by":117,"text":118},"31990210","nicce","It is still quite confusing. > built as a static binary without any dependencies Static binaries are explicitly used for removing the need for specific dynamic runtime…",{"value":120,"source":49,"evidence":121},"Uretprobe argument reading is unreliable",[122,126],{"id":123,"by":124,"text":125},"31995776","evgpbfhnr","Am I the only one for whom it doesn't work? the reason being that using PARMx registers on uretprobe has no guarantee that the registers still hold the argument values, as these…",{"id":127,"by":124,"text":128},"32050098","Thanks! This happens to work for me, but the root of the problem is the same: there's no guarantee that the handle will still be in that register when the function returns; my…",[130],{"value":131,"source":49,"evidence":132},"Use libbpf's symbol offset calculation instead of custom logic",[133],{"id":85,"by":86,"text":87},[135,149],{"value":136,"source":49,"evidence":137},"Does it need root privileges?",[138,142,145],{"id":139,"by":140,"text":141},"31989564","pdonis","So is this an exploit? Or are root privileges on the local machine needed to run it?",{"id":143,"by":86,"text":144},"31989600","Root is still needed, so not an exploit. Still a simple straightforward example on how to use eBPF\u002Flibbpf to grab returned data from a userspace function call",{"id":146,"by":147,"text":148},"31989710","sdmike1","It appears that you need root, at a minimum the demo gif uses sudo to run the program. At an absolute minimum you would need CAP_BPF[0] to execute the eBPF. [0]…",{"value":150,"source":49,"evidence":151},"Could it grab ssh client passwords?",[152,156],{"id":153,"by":154,"text":155},"31994409","jaimehrubiks","Does it grab ssh passwords? (Not sshd password) when a user runs ssh from the target server itself to other servers",{"id":157,"by":158,"text":159},"31998533","pritambaral","Doubt it, but only for lack of trying. As the readme says this hooks into libpam, which wouldn't be used when ssh client makes an outgoing connection, unless the outgoing…",[161,168],{"value":162,"source":49,"evidence":163},"TripleCross eBPF rootkit",[164],{"id":165,"by":166,"text":167},"31991960","shaicoleman","Related: TripleCross - A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.…",{"value":169,"source":72,"evidence":170},"bad-bpf and ebpfkit",[171],{"id":172,"by":11,"text":173},"31992480","You have also https:\u002F\u002Fgithub.com\u002Fpathtofile\u002Fbad-bpf or https:\u002F\u002Fgithub.com\u002FGui774ume\u002Febpfkit which are good references also",{"comments":18,"answered":43,"key":175},[176,179,180],{"id":177,"text":178},"31989489","Thanks!",{"id":172,"text":173},{"id":181,"text":182},"31989701","Thanks I will check that!",{"commenters":184,"max_depth":185,"maker_replies":18,"first_comment_mins":186,"lifespan_hours":187},30,6,31,213,[189,191,193,195,196,199,201,202,204,207,209,212,213,216,218,220,221,224,226,229,231,235,237,240,242,245,246,247,250,254,256,259,262,267,269,270,271,275,277,280,284,286,289,292,295,299,302,304,306,308],[104,30,43,190,105,30],"project\u002Fpositive\u002Fdocs",[177,30,30,192,11,34],"maker\u002Fneutral\u002Fnone",[165,34,30,194,166,30],"other\u002Fneutral\u002Fnone",[172,34,30,194,11,34],[197,34,30,194,198,30],"32009667","kerng",[85,38,43,200,86,30],"project\u002Fpositive\u002Fexecution",[181,38,30,192,11,34],[112,44,34,203,113,30],"project\u002Fcritical\u002Fdocs",[205,44,44,206,86,30],"31989383","project\u002Fneutral\u002Fdocs",[208,44,30,206,11,34],"31989400",[210,44,30,211,113,30],"31989549","commenter\u002Fneutral\u002Fdocs",[116,44,34,203,117,30],[214,44,30,211,215,30],"31990989","stevenhuang",[217,44,30,211,57,30],"31991417",[219,44,30,211,117,30],"31991525",[60,44,30,211,61,30],[222,44,30,211,223,30],"31994677","alias_neo",[123,32,34,225,124,30],"project\u002Fcritical\u002Fexecution",[227,32,30,228,11,34],"32001306","maker\u002Fneutral\u002Fexecution",[127,32,44,230,124,30],"project\u002Fmixed\u002Fexecution",[232,43,44,233,234,30],"31990105","project\u002Fneutral\u002Fexecution","jeff_vader",[236,43,30,228,11,34],"31990257",[238,185,44,192,239,30],"31989435","GRBLDeveloped",[241,185,30,192,11,34],"31989475",[139,243,44,244,140,30],7,"project\u002Fneutral\u002Fprivacy",[143,243,44,244,86,30],[146,243,44,244,147,30],[248,243,44,244,249,30],"31989935","qdog",[251,243,30,252,253,30],"31990405","other\u002Fneutral\u002Fprivacy","yebyen",[68,243,44,255,57,30],"project\u002Fneutral\u002Fidea",[56,257,43,258,57,30],8,"project\u002Fpositive\u002Fidea",[260,18,30,194,261,30],"31994090","Fnoord",[263,264,43,265,266,30],"31989222",10,"maker\u002Fpositive\u002Fnone","IncRnd",[268,264,30,192,11,34],"31989480",[153,33,44,255,154,30],[157,33,44,255,158,30],[272,273,44,255,274,30],"31990572",12,"amelius",[75,273,30,276,11,34],"maker\u002Fneutral\u002Fidea",[52,278,34,279,53,30],13,"project\u002Fcritical\u002Fprivacy",[281,278,30,282,283,30],"31991360","commenter\u002Fneutral\u002Fprivacy","AntiRush",[285,278,30,252,53,30],"31993328",[287,278,30,252,288,30],"31994084","MPSimmons",[290,278,30,252,291,30],"31994635","mindwok",[293,278,30,252,294,30],"31998445","withinboredom",[296,297,30,252,298,30],"31989867",14,"staticassertion",[300,297,30,282,301,30],"31991421","NavinF",[303,297,30,282,86,30],"31991491",[305,297,30,282,301,30],"31992222",[307,297,30,252,298,30],"32000818",[309,297,30,194,86,30],"32094810",[],[312,316,321,326,331,336],{"id":313,"name":314,"points":315,"category":20},"32002555","human eyes only",216,{"id":317,"name":318,"points":319,"category":320},"32005678","C3",182,"languages",{"id":322,"name":323,"points":324,"category":325},"31958823","Copper",146,"dev_tools",{"id":327,"name":328,"points":329,"category":330},"31932434","Featureform",136,"ai",{"id":332,"name":333,"points":334,"category":335},"32001817","SPS2022",132,"web_saas",{"id":337,"name":338,"points":339,"category":325},"31936356","UI Filler",129,false,"v2",{"id":343,"name":5,"line":6,"ai":340,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":30,"top":18,"kw":344,"maker":11,"domain":10,"tier":19,"attempts":30,"strip":345,"url":9,"mix":346,"praise":96,"objection":109,"sub":21},31988820,[24,25,26,27,28],"5000501301000013303333335053330100000000",[32,33,34,32],1793991048326]