4 ms·

sudo is great for phishing. If I want to take over a system, I just need the users password. Given that sudo is almost never set up correctly and is unrestric

sudo is great for phishing. If I want to take over a system, I just need the users password. Given that sudo is almost never set up correctly and is unrestricted to anyone allowed to use it, I just send a script that requires sudo, capture the password, then relay the password in a DNS request back to myself. All in good red teaming fun, of course.

thricegr8 6y ago
Can you expand a bit on the type of scripts/scenario you'd use for something like this? I presume the email + script would need to be something legitimate enough looking as to not raise any red flags during a glance over, with built in assurances you aren't causing any real harm against the target, and then properly configuring the script (or downstream actions) to then get exfil'd. Very interesting nonetheless.
- heavenlyblue 6y ago
  I don’t really understand what that gives the attacker. Login to the developer’s machine as in? What if they disabled SSH password auth? I mean, if you already made them run a random script why would you even care about their password?
  - fulafel 6y ago
    To be able to easily get root through sudo later when running the malware payload (reverse shell eg) in the background?
    - heavenlyblue 6y ago
      You already have sudo, you can install any malware immediately (with a rootkit on top and any kernel extensions to hide yourself)
      - fulafel 6y ago
        Maybe you don't want to leave any log traces, kernel mods etc behind yet before getting instructions from your c&c or waiting until a set time when some other coordinated action (or a weekend) happens.
Jnr 6y ago
So, you send someone a script... And they just run it? If they do, then it doesn't matter if it uses/fakes sudo, or not. They have some bigger problems.
- nelgaard 6y ago
  But that is one reason I do use sudo. I have some extra user accounts that I can sudo into to run scripts, plugins etc from e.g., github that I trust somewhat but not 100 percent. In case they do start mining bitcoins or sending spam mail I will find out and stop it.
- dTal 6y ago
  If that's your threat model (untrusted script = owned) then don't even bother creating a user account. Just run as root.
rmrfstar 6y ago
Why a dns request?

thricegr8 6y ago

Can you expand a bit on the type of scripts/scenario you'd use for something like this? I presume the email + script would need to be something legitimate enough looking as to not raise any red flags during a glance over, with built in assurances you aren't causing any real harm against the target, and then properly configuring the script (or downstream actions) to then get exfil'd. Very interesting nonetheless.

heavenlyblue 6y ago
I don’t really understand what that gives the attacker. Login to the developer’s machine as in? What if they disabled SSH password auth? I mean, if you already made them run a random script why would you even care about their password?
- fulafel 6y ago
  To be able to easily get root through sudo later when running the malware payload (reverse shell eg) in the background?
  - heavenlyblue 6y ago
    You already have sudo, you can install any malware immediately (with a rootkit on top and any kernel extensions to hide yourself)
    - fulafel 6y ago
      Maybe you don't want to leave any log traces, kernel mods etc behind yet before getting instructions from your c&c or waiting until a set time when some other coordinated action (or a weekend) happens.

Jnr 6y ago

So, you send someone a script... And they just run it? If they do, then it doesn't matter if it uses/fakes sudo, or not. They have some bigger problems.

nelgaard 6y ago
But that is one reason I do use sudo. I have some extra user accounts that I can sudo into to run scripts, plugins etc from e.g., github that I trust somewhat but not 100 percent. In case they do start mining bitcoins or sending spam mail I will find out and stop it.
dTal 6y ago
If that's your threat model (untrusted script = owned) then don't even bother creating a user account. Just run as root.

rmrfstar 6y ago

Why a dns request?