Fantastic clear-text passwords and where to collect them (Part 1 - Linux)

What it is

Part 1 of a DFIR series by dfir.ch on harvesting clear-text credentials from compromised Linux hosts. It documents three concrete techniques — Bash history leakage, process memory extraction, and command-line snooping — grounded in a real incident where a Siemens OpenScape groupware server became a pivot into a customer's Azure tenant.

How it works

The incident chain: root's .bash_history contained a keytool invocation passing a Java Keystore password via -storepass in clear text. A backup keystore sat at /root/keystore.jks. The attacker extracted the private key and certificate, then read the Tenant ID and app Client ID from the OpenScape XML config (exchange.auth.oauth.tenantId / clientId). With cert + tenant + client ID, they ran the OAuth client-credentials flow with certificate-based auth against login.microsoftonline.com and read corporate mail via Microsoft Graph.

Beyond history: truffleproc attaches to a live process via GDB (ptrace), core-dumps it, extracts strings, and pattern-matches for secrets — requires root and GDB installed. pspy snoops on process command lines via the inotify API without root, catching secrets passed as cron/automation flags while commands run.

Preconditions / Affected

• Bash history / memory dumping: attacker already has root (or the process owner) on the host.
• pspy: works without root — it reads process events, not memory.
• The cloud pivot required the specific Siemens OpenScape Exchange Online integration exposing OAuth credentials on disk.

What to do

• Never pass passwords as CLI arguments; use interactive prompts or a secrets manager (Vault).
• Environment variables beat CLI args (not written to history), but root or the process owner can still read /proc/<pid>/environ while the process runs.
• Set HISTCONTROL=ignorespace so a leading space keeps a secret-bearing command out of history.
• Restrict ptrace system-wide in /etc/sysctl.d/10-ptrace.conf: `` kernel.yama.ptrace_scope = 1 ` Values: 1 (restricted), 2 (admin-only), 3` (disabled until reboot). This blocks truffleproc/GDB memory dumping.
• Apply Microsoft Entra Conditional Access for Workload Identities to service principals, restricting certificate-based auth to trusted locations.

Caveats

HISTCONTROL=ignorespace is a discipline control, not enforcement — it only helps if the operator remembers the leading space. ptrace_scope restricts memory dumping but does nothing for secrets already in bash history or config files. The post is Part 1 (Linux) and the command-line snooping section is cut off in the fetched text.