timb-machine

Credential Access

T1556.003: Pluggable Authentication Modules

• https://www.intezer.com/blog/research/new-linux-threat-symbiote/ (timb-machine/linux-malware#452), citable: True (TACTICS OR TECHNIQUES WRONG)
• https://github.com/citronneur/pamspy (timb-machine/linux-malware#466), citable: False
• https://www.mandiant.com/resources/unc2891-overview (timb-machine/linux-malware#112), citable: True
• https://bazaar.abuse.ch/browse/tag/Symbiote/ (timb-machine/linux-malware#460), citable: False (TACTICS OR TECHNIQUES WRONG)

T1003: OS Credential Dumping

timb-machine

Never mind that what3words has real technical, logistical, practical limitations... Let's look at some of the dark, libellous, illegal and/or downright offensive combinations of /// addressess that their word lists can result in:

* https://what3words.com/mistakes.cost.lives
* https://what3words.com/troll.under.bridge
* https://what3words.com/burn.that.school
* https://what3words.com/lorry.catches.fire
* https://what3words.com/shank.that.police
* https://what3words.com/hang.puppy.quick
* https://what3words.com/master.whips.slave
* https://what3words.com/bullets.into.head

timb-machine

#!/bin/sh
find / \( \( -perm -u+s \) -o \( -perm -g+s \) \) -a -type f 2>/dev/null | while read SUIDFILE
do
        LSFILE=`ls -la "$SUIDFILE"`
        objdump -x "$SUIDFILE" 2>&1| egrep 'RPATH|RUNPATH' | while read name paths
        do
                if [ -n "$paths" ]; then
                         echo "$paths" | tr ":" "\n" | while read RPATHDIR
                         do
                                 if [ "`echo "$RPATHDIR" | cut -c 1`" != "/" ]

timb-machine

$ nc -v -l -p 5000 & ps -aef | grep nc; sudo gdb /bin/nc `pgrep nc`
timb      3976   952  0 00:22 pts/0    00:00:00 nc -v -l -p 5000
[1] 3976
listening on [any] 5000 ...
(gdb) info variable environ
All variables matching regular expression "environ":
(gdb) print execve("/bin/bash", 0x00007f717f158118, 0)
process 3976 is executing new program: /bin/bash
$ ps -aef | grep timb
timb      3976   952  0 00:22 pts/0    00:00:00 ?.#.?.

timb-machine

#include <sys/types.h>
#include <sys/ptrace.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <openssl/aes.h>

#define MAXIMUMWIDTH 80
#define MAXIMUMHEIGHT 20

timb-machine

$ cat racecar.sh 
#!/bin/sh

while :
do
echo "#!/bin/sh" > /Volumes/USB/a
chmod u+xs /Volumes/USB/a
ls -la /Volumes/USB/a | grep sr | grep -v 10
done

timb-machine

$ sudo yara -r yara/log4j.yara /usr/local
log4jjavaclass /usr/local/java/ghidra_9.1.2_PUBLIC/Ghidra/Framework/Generic/lib/log4j-api-2.8.2.jar
log4jjavasrc /usr/local/java/ghidra_9.1.2_PUBLIC/Ghidra/Framework/Generic/lib/log4j-api-2.8.2.jar
log4jjavaclass /usr/local/java/ghidra_9.1.2_PUBLIC/Ghidra/Framework/Generic/lib/log4j-core-2.8.2.jar
log4jjavasrc /usr/local/java/ghidra_9.1.2_PUBLIC/Ghidra/Framework/Generic/lib/log4j-core-2.8.2.jar

timb-machine

$ ./packet-monkey.sh --type all --pcapfilename packets-hostname-xxx.pcap
                  _        _                              _              
 _ __   __ _  ___| | _____| |_      _ __ ___   ___  _ __ | | _____ _   _ 
| '_ \ / _` |/ __| |/ / _ \ __|____| '_ ` _ \ / _ \| '_ \| |/ / _ \ | | |
| |_) | (_| | (__|   <  __/ ||_____| | | | | | (_) | | | |   <  __/ |_| |
| .__/ \__,_|\___|_|\_\___|\__|    |_| |_| |_|\___/|_| |_|_|\_\___|\__, |
|_|                                                                |___/ 

                                                      =[ @timb_machine ]=

timb-machine

rule pscan_or_luckscan {
  meta:
    author = "Tim Brown @timb_machine"
    description = "Hunts for references to pscan_or_luckscan"
  strings:
    $getopt = "%s <a-block> <port> [b-block] [c-block]"
    $vulnerable = "Lets try to root the %s"
  condition:
    $getopt or $vulnerable
}

timb-machine

# setup webex bot auth token env var - get auth here: https://developer.webex.com/my-apps/new/bot
export WEBEX_TOKEN="GET_TOKEN_ABOVE"

# get room id
WEBEX_ROOMID=$(curl --request GET --header "Authorization: Bearer $WEBEX_TOKEN" https://webexapis.com/v1/rooms |jq -r '.items[] | select(.title == "Room Name") | .id')

# post message
WEBEX_MSG="notification here"
curl --request POST --header "Authorization: Bearer $WEBEX_TOKEN" --form "roomId=$WEBEX_ROOMID" --form "text=$WEBEX_MSG" https://webexapis.com/v1/messages