Hacker News Reader

Comment by LinuxBender | Hacker News Reader

sudo is great for phishing. If I want to take over a system, I just need the users password. Given that sudo is almost never set up correctly and is unrestricted to anyone allowed to use it, I just send a script that requires sudo, capture the password, then relay the password in a DNS request back to myself. All in good red teaming fun, of course.

View on HN

Can you expand a bit on the type of scripts/scenario you'd use for something like this? I presume the email + script would need to be something legitimate enough looking as to not raise any red flags during a glance over, with built in assurances you aren't causing any real harm against the target, and then properly configuring the script (or downstream actions) to then get exfil'd. Very interesting nonetheless.

I don’t really understand what that gives the attacker.

I mean, if you already made them run a random script why would you even care about their password?

To be able to easily get root through sudo later when running the malware payload (reverse shell eg) in the background?

You already have sudo, you can install any malware immediately (with a rootkit on top and any kernel extensions to hide yourself)

Maybe you don't want to leave any log traces, kernel mods etc behind yet before getting instructions from your c&c or waiting until a set time when some other coordinated action (or a weekend) happens.

So, you send someone a script... And they just run it?

If they do, then it doesn't matter if it uses/fakes sudo, or not. They have some bigger problems.

But that is one reason I do use sudo.

I have some extra user accounts that I can sudo into to run scripts, plugins etc from e.g., github that I trust somewhat but not 100 percent. In case they do start mining bitcoins or sending spam mail I will find out and stop it.

If that's your threat model (untrusted script = owned) then don't even bother creating a user account. Just run as root.

Why a dns request?

Reply on news.ycombinator.com