CS338 Computer Security
Wednesday, 13 November 2024

+ CS Fall Comps Poster Session
- Tomorrow, 3:30-5:00
- Anderson atrium
- Fun! Interesting! Snacks!

+ What's up?

+ Final exam
- About 1/2 due the last day of classes (Nov 20)
- About 1/2 due the last day of finals (Nov 25)
- Will be posted no later than 9:00 tomorrow morning

+ Quick followup on pen-testing overview from Monday
- Finish the "sudo -l" privesc example
    - login as normal user
    - "sudo -l" says I have sudo privilege on the commands
        vi somefile and less somefile
    - check out gtfobins.github.io for clever ideas
    - woohoo, we're root!

- Overall structure
    - enumeration (find stuff out about the target)
    - foothold
    - privilege escalation (?)
    - lateral movement -- (go back to enumeration)
    - persistence

+ Authentication
- What is is?
    - Making sure somebody is who they say they are
- How is it different from authorization?
- What authentication mechanisms have we encountered this term?
    - passwords
    - Duo thing (MFA - multi-factor authentication)
    - passkey
    - certificates
- Any others you know about? (Not just in computers)
    - Show your ID
        - Fake IDs
    - Key for a door
        - cut a copy at the hardware store
        - lock pick
        - get a new key fob from your car dealer
    - Looking at somebody you know
        - Hide your face
- Mostly, we use proxies for ourselves during authentication

+ Lab
- Do it
- Debrief

+ Password hashing
- Does it just use a hash function like SHA-256? (Yes, but not "just".)
- Kali by default uses yescrypt
- Why?
    - it's slow
    - it uses a lot of memory
    - and that's what we want
        (imagine somebody stealing /etc/shadow; we want it to be
         hard for them to crack the passwords from the hashes)

+ Password storage in most Linuxes
- /etc/passwd (man 5 passwd)
- /etc/shadow (man shadow)

    $y$j9T$fSmonHRY6BGGcLLyPlpi3/$xwH0s6KveTGFO2qEa6YonOpwdvs./xUCqhv2AT1JqW/

    y says "use yescrypt" (new-ish password hashing alg., based on SHA-256)
    j9T - these are parameters for yescrypt
    fSmonHRY6BGGcLLyPlpi3/ - salt
    xwH0s6KveTGFO2qEa6YonOpwdvs./xUCqhv2AT1JqW/ - yescrypt(salt || password,j9T)   


+ What does a login (say, via ssh) look like?

+ How is authentication distinct from authorization?
- "Who are you?" vs. "what are you allowed to do?"


=======

- how to create a user
    sudo adduser username
- how to change a password
    sudo passwd username
- how to create a password hash
    select suitable hash (say, copy and mess with an existing salt from the shadow file)
    mkpasswd -S 'SALT-GOES-HERE' password
- salt format, what a mess!
- sequence of steps in a login
    u/p sent in the clear
    corresponding hash in /etc/passwd? hash w/ salt and compare
        if match, authenticated; skip the rest
    corresponding hash in /etc/shadow? hash w/ salt and compare
        if match, authenticated; else not

kali@kali:~/tmp$ sudo grep kali /etc/shadow
kali:$y$j9T$c4ctgJ3TPZVMz7jTOpngr.$eqdKry/.s7k3X84tN4kbqBdFMa0SilnoDEru/PHWvg2:20034:0:99999:7:::
kali@kali:~/tmp$ mkpasswd -S '$y$j9T$c4ctgJ3TPZVMz7jTOpngr.' kali
$y$j9T$c4ctgJ3TPZVMz7jTOpngr.$eqdKry/.s7k3X84tN4kbqBdFMa0SilnoDEru/PHWvg2

https://unix.stackexchange.com/questions/690679/what-does-j9t-mean-in-yescrypt-from-etc-shadow

kali@kali:~/cs338$ grep kali /etc/passwd
kali:x:1000:1000:kali,,,:/home/kali:/usr/bin/zsh

[man 5 passwd]
login name
optional "encrypted" password [goddammit]
numerical user ID
numerical group ID
user name or comment field
user home directory
optional user command interpreter

kali@kali:~/cs338$ sudo grep kali /etc/shadow
kali:$y$j9T$c4ctgJ3TPZVMz7jTOpngr.$eqdKry/.s7k3X84tN4kbqBdFMa0SilnoDEru/PHWvg2:20034:0:99999:7:::

[man shadow]
login name
"encrypted" password [UGH]
date of last password change [days since 00:00 UTC Jan 1, 1970]
minimum password age [in days]
maximum password age [in days]
password warning period [in days]
password inactivity period [in days]
account expiration date [days since 00:00 UTC Jan 1, 1970]
reserved