Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

OS Credential Dumping: Proc Filesystem

Other sub-techniques of OS Credential Dumping (8)

ID	Name
.001	LSASS Memory
.002	Security Account Manager
.003	NTDS
.004	LSA Secrets
.005	Cached Domain Credentials
.006	DCSync
.007	Proc Filesystem
.008	/etc/passwd and /etc/shadow

Adversaries may gather credentials from information stored in the Proc filesystem or /proc. The Proc filesystem on Linux contains a great deal of information regarding the state of the running operating system. Processes running with root privileges can use this facility to scrape live memory of other running programs. If any of these programs store passwords in clear text or password hashes in memory, these values can then be harvested for either usage or brute force attacks, respectively. This functionality has been implemented in the MimiPenguin(Citation: MimiPenguin GitHub May 2017), an open source tool inspired by Mimikatz. The tool dumps process memory, then harvests passwords and hashes by looking for text strings and regex patterns for how given applications such as Gnome Keyring, sshd, and Apache use memory to store such authentication artifacts.

ID: T1003.007

Sub-technique of: T1003

Tactic(s): Credential Access

Platforms: Linux

Permissions Required: root

Data Sources: Command: Command Execution, File: File Access

Version: 1.0

Created: 11 Feb 2020

Last Modified: 19 Mar 2020

Name	Description
Procedure Examples
LaZagne	LaZagne can obtain credential information running Linux processes.(Citation: GitHub LaZagne Dec 2018)
MimiPenguin	MimiPenguin can dump process memory and extract clear-text credentials.(Citation: MimiPenguin GitHub May 2017)

Mitigation	Description
Mitigations
Password Policies	Set and enforce secure password policies for accounts.
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.

Detection

To obtain the passwords and hashes stored in memory, processes must open a maps file in the /proc filesystem for the process being analyzed. This file is stored under the path /proc/\*/maps, where the \* directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.