4 ms·
That was a delightful read. Wasn't entirely sure how they knew where to look for the Passport credentials though, unless they'd gleaned that information earlie
by djhworld 10y ago
That was a delightful read.
Wasn't entirely sure how they knew where to look for the Passport credentials though, unless they'd gleaned that information earlier. From the article the author makes it sound like they had a limited window to mount the disk, pull off what they wanted and shut everything down, did they already know where to look?
- jessaustin 10y agoHow does Passport find its credentials? IDK, but I'd guess there is a series something like: exec flag, envvar, config file in user's home directory, config file in default /etc location. Attackers would just use the same logic. That wouldn't get them the first thing in the list, but that's probably not how it was set up anyway. If one were worried about time, one could patch Passport to print the results after it had done the work itself.
- bradleybuda 10y agoThanks, and great question. During our exploration of the first box we popped, we noticed that most of the services on the host had their code and configuration in /usr/inversoft (or /usr/local/inversoft, I can't remember which exactly). So when we got our shell on the app server, that was the first place we looked, and luckily it didn't take long to find a config file containing Passport credentials.