Cybersecurity Q&A
Browse concise answers derived from our published, source-linked cybersecurity coverage.
How are Linux user passwords stored and what is the format in the /etc/shadow file?
Linux user passwords are encrypted and stored in the `/etc/shadow` file, which is only readable by root. Each hash follows the format `$id$salt$encrypted`, where `id` indicates the algorithm (1=MD5, 5=SHA-256, 6=SHA-512), `salt` is a random value, and `encrypted` is the salted hash. The `/etc/passwd` file stores other user info but uses an `x` to indicate the password is in shadow. For a detailed breakdown of all fields, see the [Linux Password Hashes article](/news/linux-password-hashes-technical-overview-of-encryption-methods-and-cracking-techniques).
What are the advantages of this new technique over previous offline extraction methods?
The main advantage is that it does not require the user's plaintext password, only the lsass process dump and the `Login Data` file. This makes the technique more practical even when only NTLM hashes are available (e.g., from [SAM database extraction](/news/penetration-techniques-obtaining-local-user-hashes-via-sam-database)). Additionally, it works offline without executing mimikatz on the target system and does not require privilege downgrading from SYSTEM to the user context.
How does the article correct the previous misconception about locating the Master Key file for Chrome's database?
Earlier it was believed impossible to locate the correct Master Key file for decrypting Chrome's `Login Data`. This article demonstrates that the `guidMasterKey` can be obtained by running `dpapi::blob /in:test.txt` against the extracted ciphertext, which reveals the file path at `%APPDATA%\Microsoft\Protect\%SID%\{guid}`. Alternatively, reading the first 16 bytes of the `Preferred` file also identifies the correct key.
What are the steps to perform offline extraction of Chrome saved passwords using the Master Key approach?
First, obtain the `Login Data` SQLite database from `%LocalAppData%\Google\Chrome\User Data\Default\`. Second, acquire the lsass process memory dump (e.g., using procdump). Finally, use mimikatz locally to load the dump, extract the Master Key with `sekurlsa::dpapi`, and then decrypt the DPAPI blob with `dpapi::blob /in:test.txt` to retrieve the plaintext passwords. No plaintext password from the target user is required.
How can an attacker obtain the Master Key without needing the user's login password?
The attacker can dump the lsass process memory using tools like procdump or directly extract the Master Key online with mimikatz (via `sekurlsa::dpapi`). Once the Master Key is obtained, it can be used offline to decrypt the DPAPI blob containing the saved passwords. This method bypasses the need to crack the user's password or decrypt the Master Key file directly.
What is the main challenge addressed in this article regarding offline extraction of Chrome saved passwords?
The previous method for offline extraction of Chrome saved passwords required the user's plaintext password, which is often unavailable in modern Windows systems that only expose the NTLM hash. This article introduces a new technique using the [Master Key](/news/penetration-techniques-offline-extraction-of-saved-passwords-in-chrome-browser-using-masterkey) extracted from the lsass process, eliminating the need for the plaintext password entirely.
How can defenders detect 'notty' SSH connections and other stealthy SSH activity?
Defenders can detect notty connections by reviewing `/var/log/auth.log` for authentication records and using `netstat -vatn` to check TCP connections. Failed login attempts are still logged in `/var/log/btmp` (accessible via `lastb`). Additionally, enhancing the SSH daemon configuration (following guides like the one from putorius.net) and monitoring for unusual connection patterns helps. For Windows-specific log evasion, refer to [Penetration Techniques - Stealth Execution of Windows Remote Assistance](/news/penetration-techniques-stealth-execution-of-windows-remote-assistance).
How can I bypass SSH logging mechanisms entirely during a penetration test?
You can bypass most SSH logs by using a 'notty' connection (no pseudo-terminal) via protocols like sftp, scp, or rsync, or by implementing an SSH client that does not allocate a TTY. The article's Python and C# programs demonstrate this technique. A notty connection avoids logging to `/var/log/lastlog`, `/var/log/wtmp`, `/var/run/utmp`, and `~/.bash_history`, making it harder for administrators to detect your session via commands like `last` or `w`. This method is detailed in [Penetration Basics - Bypassing SSH Logs](/news/penetration-basics-bypassing-ssh-logs).
What are the key SSH log files on Linux and how can I delete or modify them to cover my tracks?
Key SSH log files include `/var/log/auth.log` (successful authentications), `/var/log/btmp` (failed attempts), `/var/log/wtmp` (login history), `/var/run/utmp` (current sessions), and `~/.bash_history` (command history). You can use `sed` to replace IPs or delete specific lines, or tools like `logtamper` to modify or clear logs for specific users. For example, `sed -i '/pattern/d' /var/log/auth.log` removes matching lines. For more advanced log manipulation, see [Penetration Techniques - Deletion and Bypass of Windows Logs](/news/penetration-techniques-deletion-and-bypass-of-windows-logs) which covers similar techniques on Windows.
How can I implement an SSH password authentication program in Python for penetration testing?
You can use the third-party library paramiko to create an SSH password authentication program. The [Penetration Basics - Bypassing SSH Logs](/news/penetration-basics-bypassing-ssh-logs) article provides sample code that supports both password and certificate file login. This approach enables automated SSH login attempts during penetration testing, but remember that such tools should only be used on systems you own or have explicit permission to test.
How can defenders detect and prevent malicious Transport Agent backdoors on Exchange?
Defenders should regularly list all installed transport agents using `Get-TransportAgent` in Exchange PowerShell and verify their legitimacy, especially after any service restart. Monitoring for unexpected DLLs in the Exchange Public folder and reviewing event logs for suspicious agent loading can also help. Since attackers may combine this with other persistence methods, such as via TelemetryController, it is crucial to adopt a layered defense as discussed in [Analysis of Backdoor Implementation Using TelemetryController](/news/analysis-of-backdoor-implementation-using-telemetrycontroller).
What malicious actions can a Transport Agent backdoor perform on email traffic?
A malicious Transport Agent can monitor every email by logging sender, date, and content; modify email subjects, sender addresses, and display names; delete or block emails entirely; and even extract attachments or search for keywords like 'password' to exfiltrate sensitive data. The agent can also be designed to launch external programs, turning the Exchange server into a command-and-control node. Similar backdoor techniques exploit junction folders or library files, as described in [Penetration Techniques - Backdoor Exploitation of Junction Folders and Library Files](/news/penetration-techniques-backdoor-exploitation-of-junction-folders-and-library-files).
How does an attacker install a malicious Transport Agent on an Exchange server?
An attacker compiles a C# class library that references `Microsoft.Exchange.Data.Transport.dll`, implementing a transport agent factory and agent class. The DLL is copied to the server, then installed via Exchange PowerShell commands: `Install-TransportAgent`, `Enable-TransportAgent`, and a restart of the MSExchangeTransport service. This installation method is also used in related Exchange attacks, such as [Penetration Techniques - From Exchange File Read/Write Permissions to Command Execution](/news/penetration-techniques-from-exchange-file-read-write-permissions-to-command-execution).
What is a Transport Agent in Microsoft Exchange and how can it be exploited as a backdoor?
A Transport Agent is a .NET plugin for Exchange that extends transport behaviors, such as reading, modifying, or deleting emails as they pass through the server. Attackers can deploy a malicious Transport Agent—similar to the LightNeuron malware—to create a persistent backdoor that intercepts and manipulates all email traffic. This technique is part of a broader set of Exchange-focused penetration methods, as detailed in [Penetration Techniques - Using Transport Agent as an Exchange Backdoor](/news/penetration-techniques-using-transport-agent-as-an-exchange-backdoor).
Can PowerForensics recover files that were deleted using SDelete?
No, because SDelete overwrites the file's data clusters before deletion, so even if the MFT entry is intact, the recovered content will be overwritten garbage, not the original data. The article [Penetration Techniques - File Recovery and Deletion in Windows Systems](/news/penetration-techniques-file-recovery-and-deletion-in-windows-systems) explicitly tests and confirms this limitation.
How do I delete a file that is locked by another process?
You must release the file handle held by the locking process. This involves enumerating all system handles using `NtQuerySystemInformation`, filtering for file handles (ObjectTypeNumber 0x1e), and using `DuplicateHandle` with the `DUPLICATE_CLOSE_SOURCE` option to close the handle. The article [Penetration Techniques - File Recovery and Deletion in Windows Systems](/news/penetration-techniques-file-recovery-and-deletion-in-windows-systems) provides open-source code and explains the required debug privilege elevation.
How can I securely delete a file to prevent recovery on Windows?
Secure deletion requires overwriting the file's data before removal, making recovery impossible. Tools like Sysinternals SDelete (`sdelete64.exe C:\test.txt`) perform this overwrite. Alternatively, you can write a C++ program that fills the file with zeros or random data before calling `DeleteFile`, as shown in the article [Penetration Techniques - File Recovery and Deletion in Windows Systems](/news/penetration-techniques-file-recovery-and-deletion-in-windows-systems). This ensures even if the MFT entry is restored, the content is meaningless.
What is PowerForensics and how can it be used to recover deleted files?
PowerForensics is a PowerShell module for forensic analysis, including file recovery. You can import it and run `Get-ForensicFileRecord | Where {$_.Deleted -eq $true} | Select FullName` to list recoverable files, then use the `CopyFile` method on a specific record to restore it. This tool is demonstrated in [Penetration Techniques - File Recovery and Deletion in Windows Systems](/news/penetration-techniques-file-recovery-and-deletion-in-windows-systems).
How do file deletion and recovery work on NTFS Windows systems?
File deletion in NTFS only modifies the Master File Table (MFT) entry, marking the file as deleted without erasing the actual data clusters. Recovery is possible by restoring the MFT record, as long as the file's data hasn't been overwritten. This principle is detailed in the article [Penetration Techniques - File Recovery and Deletion in Windows Systems](/news/penetration-techniques-file-recovery-and-deletion-in-windows-systems). Tools like WinHex can visualize the MFT changes before and after deletion.
Why can't you directly copy SysEvent.Evt from `%systemroot%\system32\config` and open it in Event Viewer?
When the EVT file is in use by the system, the file header is not synchronously updated with current log changes, causing the copied file to appear corrupt. The article demonstrates that repairing the file header—by correcting the end-of-file offset and other fields—allows the file to open normally. This is why the preferred method is to save the log via 'Save Log File As...' in Event Viewer, which produces a properly formatted file.