пятница, 18 июля 2014 г.

PAM_steal plugin released

Typically pentest’s attack can be presented by the following schema:
perimeter -> command execution -> privileges escalation -> ...
The next step for pentesters is to gain privileges at other machines.
For example, it can be done by stealing credentials (one of many methods).
Passwords at local machine will be hashed and it's not so good to crack it due to the time.

SSH MITM (tool: http://www.signedness.org/tools/mitm-ssh.tgz) is a good one. It should be noticed though that passwords can be shared between many services and thus is also necessary.

PAM (Pluggable Authentification Module) provide dynamic authorization for applications and services in a Linux system. Our password logger plugin for PAM can be found here: https://github.com/ONsec-Lab/scripts/tree/master/pam_steal

This is a good point after rooting machines during penetration tests.

Install process:
./make.sh
vim /etc/pam.d/common-auth
add "auth required pam_steal.so" into it
Then check /tmp/.steal.log - all FTP/SSH and other PAM-based daemon's passwords will be there!

50 комментариев:

  1. Thanks for sharing, nice post!

    Chia sẻ các mẹ cháo cá trê cho bé ăn dặm cực ngon bổ dưỡng hay chia sẻ bí quyết cách đánh thức trẻ sơ sinh dậy để bú tại nhà hiệu quả hay đẹn ở trẻ sơ sinh là gì có nguy hiểm không và chữa như thế nào hay nấu cháo trứng gà với rau gì thì ngon cho bé ăn dặm hay trẻ sơ sinh hắt xì hơi nhiều thì phải làm sao hay sự phát triển như thế nào bé 1 tuổi biết làm những gì tiem phòng chích ngừa cho bé thì sao chích ngừa viêm não nhật bản có sốt không hay trẻ sốt bao nhiêu độ dán miếng hạ sốt và miếng dán hạ sốt dán trong bao lâu các món ăn dặm cho bé với cách nấu cháo hạt sen cho bé ăn dặm hay thắc mắc nhiều mẹ quan tâm nạo va hết bao nhiêu tiền, nạo va là gì ở đâu thì tốt, cháo cá hồi bổ dưỡng cho bé thì cháo cá hồi nấu với rau gì việc trẻ bơm mật ong vào hậu môn có tốt không hay bơm mật ong vào hậu môn trẻ sơ sinh tiêm phòng cho trẻ bao nhiêu tiền hay tiêm phòng sởi quai bị rubella hết bao nhiêu tiền ở đâu thì tốt, với cách chữa sôi bụng ở trẻ sơ sinh cháo sò huyết bổ dưỡng cho bé thì cháo sò huyết nấu với rau gì thì ngon hấp dẫn cho con hay trẻ đi ngoài nhiều lần thì bé đi ngoài nhiều lần trong ngày có sao không có ảnh hưởng đến sức khỏe của bé không.

    ОтветитьУдалить
    Ответы
    1. . A vehicle title bank won't squander your chance; as long as you get all the capability data, once your auto is evaluated, you will know immediately regardless of whether your application has been affirmed.

      شهرام صولتی

      منصور

      داریوش

      Удалить
    2. Great Article android based projects

      Java Training in Chennai Project Center in Chennai Java Training in Chennai projects for cse The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training Project Centers in Chennai

      Удалить
  2. . A vehicle title bank won't squander your chance; as long as you get all the capability data, once your auto is evaluated, you will know immediately regardless of whether your application has been affirmed.
    Auto Title Loans Chicago
    Cash Advance Chula-vista
    Payday Loans Corona

    ОтветитьУдалить
  3. That's the quite different which you provide now. looking for the best online store in Newzealand. We will provide you treasurebox store items which you will be provide easily on a single click.

    ОтветитьУдалить
  4. https://www.cratoswin.com/

    Canlı bahis sitesi

    Vip casino sitesi Cratosslot

    Egt slot oyunları

    Online canlı bahis sitesi Cratossporting

    Online casino Cratosslot

    En iyi oyunlar 

    Tüm radyo frekansları için

    ОтветитьУдалить
  5. Thank you for sharing the information with us. QBO is a Quickbooks File that is generated when you download an online bank statement from your financial institution.

    ОтветитьУдалить
  6. Independent Escorts in Dubai is the right decision. the top Dubai Escorts at your one Click. Log on to us for entertainment.

    ОтветитьУдалить
  7. The Schengen Region could be a gather of 26 European nations that have nullified visa and movement controls at their common borders and have a uniform visa approach. It capacities nearly as a single nation for universal travel purposes, which, whereas still permitting part nations to include extraordinary arrangements of their possess with respect to residency and neighborhood visa sorts, ensures that a few visa sorts are all inclusive, which an person with a residency in one Schengen nation does not require a visa to visit or travel another Schengen country http://www.immigration-residency.eu/

    ОтветитьУдалить
  8. I wanted to thank you for this excellent read!! I definitely loved every little bit of it. I’ve got you bookmarked to look at new stuff you post…
    Moviesda

    ОтветитьУдалить
  9. Independent Escorts in Dubai is the right decision. the top Dubai Escorts at your one Click. Log on to us for entertainment

    ОтветитьУдалить
  10. Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work. Thank You.!!!

    ОтветитьУдалить
  11. There are some interesting points in time in this article but I don’t know if I see all of them center to heart. There is some validity but I will take hold opinion until I look into it further. Good article, thanks and we want more! Added to FeedBurner as well

    Click Here
    Visit Web
    Clyp.it

    ОтветитьУдалить
  12. Kesintisiz ve HD kalitede donmadan tv izlemek için ziyaret edin. canlı tv

    ОтветитьУдалить

  13. تنسيق الحدائق المنزلية من الامور الممتعة وهي غالبا تتطلب فقط تنظيم وترتيب الفضاء بحيث تستغل كل فراغ في الحديقة وتمزج بين الالوان للحصول على منظر جميل من النباتات
    شركة تنسيق حدائق بجدة
    نحتاج إلى إبقاء الخزان الجديد في نفس الحالة لفترة طويلة من خلال تعقيم المياه في الخزان أولاً ، حيث أن الخزان الجديد خالٍ تمامًا من الرواسب والفطريات. مع إدخال الماء ، لا يوجد مجال لدخول الفيروسات إلى الخزان ، لذلك يجب توخي الحذر للتأكد من أن الماء معقم وحرص على إبقاء الخزان لأطول فترة ممكنة.
    أفضل شركة تنظيف خزانات بالطائف لتنظيف جميع انواع الخزانات بمهارة
    شركة تنظيف خزانات بالطائف
    نظافة وجمال منزلك خير دليل على نظافة الجدران حيث ينكشف بسرعة أكبر قدر من الأوساخ والغبار والأوساخ ، كما نقوم بتنظيف الجدران بالطلاء والمواد الحافظة للجدران وتنظيفها بكفاءة عالية. تستخدمين أفضل وأقوى وأسلم المنظفات لصحتك ، والتي تحتوي أيضًا على عطر ذكي يعزز جمال المكان. يبدأ التنظيف بغسل جميع أنواع الجدران سواء كانت دهانات أو دريوال أو جميع أنواع ورق الحائط.
    شركة تنظيف منازل بالطائف

    ОтветитьУдалить
  14. This well-done content piece is in the form of a navigable catalog, which allows users to browse through different categories and make purchases. The live page itself can be found here: Complete Online Tata Spare Parts Catalog

    ОтветитьУдалить
  15. Selecting the correct Best Website Designing Company In Delhi is very critical: Understand How to choose. In today's world of tremendous competitors, any business or organization needs to have a web page of its own. The organization itself can do this web style, or they may seek the services of specific web style and growth organizations to do the job for them. Moreover, there are many such web styles and growth organizations out there in the market.

    ОтветитьУдалить
  16. Thanks for the blog loaded with so many information. Stopping by your blog helped me to get what I was looking for.
    섯다

    ОтветитьУдалить
  17. This is an excellent post I seen thanks to share it. It is really what I wanted to see hope in future you will continue for sharing such a excellent post.
    스포츠토토

    ОтветитьУдалить
  18. I do accept as true with all the concepts you’ve offered
    on your post. They are very convincing and can definitely work.
    Nonetheless, the posts are very quick for starters. May just you please lengthen them a bit from next time?
    성인웹툰

    ОтветитьУдалить
  19. I was reading some of your content on this website and I conceive this internet site is really informative ! Keep on putting up.
    토토사이트

    ОтветитьУдалить
  20. If your car uses more warm-up time, your engine is failing, and that marks the time to order your infallible Suzuki Engine Parts from BP Auto Spares India.

    Suzuki Electrical Parts: Your Suzuki car’s electrical system comprises of the alternator, battery, and the starter. Before you go on long-distance trips, check their health and get the right replacements.

    If your Suzuki car isn’t performing great as in its initial stages, attend to it immediately. Get replacement Suzuki Brake Parts for all your Suzuki brands and drive safely.

    Rejuvenate the look and feel of your Suzuki car with top-notch Suzuki Body Parts. Get custom parts to suit the requirements of individual Suzuki brands.

    ОтветитьУдалить
  21. If you are unable to halt your car without killing the engine, your Suzuki Clutch Parts have become damaged. Order your replacements now and save your Suzuki car.

    Suzuki Suspension Parts tend to wear out with time. But don't wait for complete damage. Restore ride quality and smoothen all ride bumps with our spare parts.

    Genuine and robust Suzuki Gear Parts for all Suzuki cars . Check out our vast list of Suzuki Spare Parts and aftermarket replacement parts here at BP Auto Spares India.

    Get the smooth driving feel of your Suzuki car as when it was new. Make every turn smooth with BP Auto Spares India tried and trusted Suzuki Steering Parts.

    Suzuki Propeller Shaft Parts: When your Suzuki car’s propeller shaft fails, it can detriment the propulsion function capacity. So, be on the alert for steel-to-steel contact, and get your spares always ready.

    Genuine and robust Suzuki Various Pipes and Hoses for all Suzuki cars . Check out our vast list of Suzuki Spare Parts and aftermarket replacement parts here at BP Auto Spares India.

    Genuine and robust Suzuki Other Parts for all Suzuki cars . Check out our vast list of Suzuki Spare Parts and aftermarket replacement parts here at BP Auto Spares India.

    ОтветитьУдалить
  22. This method permits new players to test the waters and see what they like before depositing. Since HoF presents solely free slot machines with bonus rounds, you'll not win or lose any actual money, but you WILL chill out, sit back, and have enjoyable. There are quantity of} methods find a way to|you probably can} earn free spins when playing in} slots online. Currently, HoF presents the choice for brand spanking new|for brand new} customers to decide on} between both one thousand coins of a hundred free spins as 카지노 사이트 their welcome gift. This gift presents loads of alternative to earn a ton of in-game foreign money, with out having to wager any away.

    ОтветитьУдалить