Closed RCarras closed 2 months ago
Hello @scudette should I do anything more to approve the module? Sorry for any inconvenience.
Couple of comments:
But mainly the issue is with the shell script - this type of analysis is easy to do with VQL so what does the shell script add? It also looks to be quite vulnerable (bash scripts are difficult to write securely) so I am not sure we really want to go that way?
Hi @scudette, firstly, thanks for your support and contribution to improve the artifact. Replying to your suggestions and questions:
I didnt take a closer look at the shell script to be honest but some things immediately stood out to me.
It is also very hard for me to actually see what the script is doing without reading it very closely. A better comments or description would help. What constitutes a detection? Is 5 failed logins within 1 hour a detection? Is it doing more than that? Is it similar logic to https://docs.velociraptor.app/artifact_references/pages/windows.events.failedlogbeforesuccess/ ?
It is usually very difficult to write secure shell scripts so I am always a bit reluctant to include those. You are right that some other artifacts include shell scripts too (like for example UAC is also a shell script). It is a bit about risk mitigation.
We have on our road map an attempt to split the exchange into different categories of artifacts - particularly to put artifacts that use external tools and scripts in their own category because they do pose higher risk i think.
Hello @scudette, thanks again for all your feedback and great ideas to improve the shell script. I've just update the shell script (repository) and VQL artifact locked hash.
Updates:
I'd also want to add that the script has 3 flows to detect different type of brute forces:
Kind regards, RCarras
Just FYI , point 3 does not fix the issue - which
still searches the path for the command which is still vulnerable to path injection. Scripts need to specify the absolute path to all sub commands.
Just FYI , point 3 does not fix the issue -
which
still searches the path for the command which is still vulnerable to path injection. Scripts need to specify the absolute path to all sub commands.
@scudette Solved. If it's necessary anything more to merge artifact with the exchange let me now. Thanks!!
This module search for brute force attacks, basing its analysis on BTMP and WTMP logs.
Requirements: It's necessary to use velociraptor client with high privileges because of utmpdump command use.