Xzbot: Notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

• xzbot

  2 3,456 5.2 Go

  notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

Instead of needing the honeypot openssh.patch at compile-time https://github.com/amlweems/xzbot/blob/main/openssh.patch

How did the exploit do this at runtime?

I know the chain was:

opensshd -> systemd for notifications -> xz included as transient dependency

How did liblzma.so.5.6.1 hook all the way back to openssh_RSA_verify when it was loaded into memory?

• signature-base

  12 2,341 9.1 YARA

  YARA signature and IOC database for my scanners and tools

> It doesn't matter.

To understand the exact behavior and extend of the backdoor, this does matter. An end to end proof of how it works is exactly what was needed.

> A way to check if servers are vulnerable is probably by querying the package manager

Yes, this has been know since the initial report + later discovering what exact strings are present for the payload.

https://github.com/Neo23x0/signature-base/blob/master/yara/b...

> Not very sophisticated, but it'll work.

Unfortunately, we live in a world with closed-servers and appliances - being able as a customer or pen tester rule out certain class of security issues without having the source/insights available is usually desirable.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• pam_2fa

  1 33 - C

  2nd factor authentication using PAM

  

• knockknock

  3 504 0.0 Python

  A simple, secure, and stealthy port knocking implementation that does not use libpcap or bind to a socket interface.

It's old and there are probably friendlier options out there now, but

https://github.com/moxie0/knockknock/blob/master/INSTALL

• hn-search

  1,643 525 2.9 TypeScript

  Hacker News Search

  

https://hn.algolia.com/?query=port%20knocking%20obscurity&ty...

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

Suggest a related project