Xzbot: Notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

• xzbot

  2 3,435 2.8 Go

  notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

Instead of needing the honeypot openssh.patch at compile-time https://github.com/amlweems/xzbot/blob/main/openssh.patch

How did the exploit do this at runtime?

I know the chain was:

opensshd -> systemd for notifications -> xz included as transient dependency

How did liblzma.so.5.6.1 hook all the way back to openssh_RSA_verify when it was loaded into memory?

• signature-base

  12 2,333 9.1 YARA

  YARA signature and IOC database for my scanners and tools

> It doesn't matter.

To understand the exact behavior and extend of the backdoor, this does matter. An end to end proof of how it works is exactly what was needed.

> A way to check if servers are vulnerable is probably by querying the package manager

Yes, this has been know since the initial report + later discovering what exact strings are present for the payload.

https://github.com/Neo23x0/signature-base/blob/master/yara/b...

> Not very sophisticated, but it'll work.

Unfortunately, we live in a world with closed-servers and appliances - being able as a customer or pen tester rule out certain class of security issues without having the source/insights available is usually desirable.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• pam_2fa

  1 33 - C

  2nd factor authentication using PAM

  

• knockknock

  3 504 0.0 Python

  A simple, secure, and stealthy port knocking implementation that does not use libpcap or bind to a socket interface.

It's old and there are probably friendlier options out there now, but

https://github.com/moxie0/knockknock/blob/master/INSTALL

• hn-search

  1,620 524 2.9 TypeScript

  Hacker News Search

  

https://hn.algolia.com/?query=port%20knocking%20obscurity&ty...

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

Suggest a related project