[Question] Is it possible or has it been done, can a Honeypot be created with bash aliases that would use a very common command someone would run if they were in your system but it aliases to some

chingadera@lemmy.world · 8 months

Sort of command that would pull a download that is self executed to the host machine?

That’s worded a bit fucky, if I need to elaborate, please chime in.

chingadera@lemmy.world · 8 months

Is there anything that is specific to ssh that would allow for this? Like a command that would allow something to execute back to the other machine similar to downloading? I’m not well versed just kind of a napkin idea I thought of.

sprite0@sh.itjust.works · 8 months

you can’t know what system architecture is on the ssh client side. It could be a mac, a windows or linux box, android or ios, beos, amigaos, etc.

So even if you could get ssh to pass malicious code how would you know what code to pass?

What you’re asking for is nigh impossible i think.

chingadera@lemmy.world · 8 months

And when you say “can’t know” do you mean it would be impossible to tell strictly through SSH?

sprite0@sh.itjust.works · 8 months

the ssh protocol doesn’t provide any mechanism for your server to identity the client host architecture, nor does it provide any mechanism i’m aware of to send any payloads back to the host client for arbitrary execution.

The thing is ssh is a protocol and it’s implementation is not going to be identical across clients.

So if you found a bug in an ssh client that allowed for this your hypothetical attack vector would only work on intruders using that broken client. ssh is one of the most scrutinized protocols there are and you should be a hero if you found this bug. what you’re asking for, if it were as easy as you might hope, well ssh wouldn’t be the ubiquitous security connection protocol if it were simple like that right?