Cleartext credential capture (pcap group)

Many protocols travel unencrypted: FTP, HTTP, Telnet, SMTP, POP3... If we can sniff the traffic of a service that authenticates in cleartext, we capture username and password directly. On a compromised host, the key is having permission to put an interface into capture mode.

The usual route is membership of the pcap group (or holding CAP_NET_RAW), which lets you run tcpdump without being root. Combined with an internal process that makes cleartext requests (pspy gives it away: a cron calling an FTP client, for instance), you capture that loopback traffic and extract the credentials:

id                                   # ...groups=...,pcap
tcpdump -i lo -w capture.cap -v      # capture on the loopback interface

The capture is moved to the attacker box and filtered by protocol with tshark (or Wireshark), looking for the authentication commands:

tshark -r capture.cap -Y "ftp" 2>/dev/null
# ... FTP Request: USER hades
# ... FTP Request: PASS <password>

The reason to capture on lo is that the internal process usually connects to 127.0.0.1; that traffic never leaves through the external NIC, only through loopback.

Other ways to squeeze the capture:

python3 Pcredz -f capture.cap            # extracts credentials from many protocols
net-creds.py -p capture.cap
tshark -r capture.cap -Y 'http.authorization' -T fields -e http.authorization
tshark -r capture.cap -Y 'telnet or pop or imap' 2>/dev/null

Requirements. A service authenticating in cleartext, traffic that actually crosses an interface we can capture, and capture permission (pcap group / CAP_NET_RAW). The credentials obtained are then tried via reuse on SSH, su, etc.

How to detect it. The signature is a non-root process opening a capture socket (AF_PACKET/raw): auditd over the socket syscall, or the execution of tcpdump/tshark by a pcap-group user (execve), something almost no legitimate flow does. Writing a .cap/.pcap file in a home (FIM) and putting an interface into promiscuous mode (kernel message entered promiscuous mode) reinforce the hint. At rest, a regular user in the pcap group or holding CAP_NET_RAW is the exposure to audit.

Defence. Encrypt every service (FTPS/SFTP, HTTPS, SMTPS), do not put regular users in the pcap group, and stop automated processes from sending cleartext credentials even over localhost.