3snake: Tool for extracting information from newly spawned processes

• 3snake – dump sshd and sudo credential related strings

Targeting rooted servers, reads memory from sshd and sudo system calls that handle password-based authentication. Doesn’t write any memory to the traced processes. Spawns a new process for every sshd and sudo command that is run.

Listens for the proc event using netlink sockets to get candidate processes to trace. When it receives an sshd or sudoprocess ptrace is attached and traces read and write system calls, extracting strings related to password-based authentication.

Don’t really like the solution of backdooring openssh or installing a kernel module on target servers so I made this.

Build

git clone https://github.com/blendin/3snake.git

make

./3snake -h

./3snake

Usage

Run in current terminal ./3snake

Run in current terminal and dump output to file ./3snake -o "output_file.txt"

Daemonize and dump output to file ./3snake -d -o "output_file.txt"

Source: https://github.com/blendin/