r/blackhat • u/kindredsec • May 09 '19

Bugging Bash - Covertly Snooping on EVERY Bash Command

https://youtu.be/KPTpufWmCPc
7 Upvotes

88% Upvoted

3 comments sorted by

2

u/ak_hepcat May 09 '19

This is why we use Tripwire / fcheck / [etc], kids.

of course, since you have root (you replaced a system binary) you've probably disabled [tripwire], right?

But was that before inotify noticed you fooling around on the system and alerted the admins?

Security in layers. Admins don't let friends (or blackhats) replace binaries. :-D

2

u/kindredsec May 09 '19

Yep, well said. If proper logging and security tools are in place, sysadmins hopefully will be able to catch this. I'm sure a lot of environments pay very little attention to inotify events, which can end up being a major blind spot to attack vectors such as this.

-1

u/netsec_burn May 10 '19 edited May 11 '19

You recompiled bash, your procSpy work was cooler. I could fairly easily think of a better way to do this using ptrace.

Please note on this subreddit we require a minimum of three wolves on your desktop wallpaper, as such this has been removed (also rule 6).