fix: guard could be evaded by putting 'snare' in a process argv - #17
Merged
Conversation
The guard skipped any process whose command line contained the substring
'snare' anywhere:
case "$cmd" in *snare*|*/.snare/*) continue;; esac
That is the whole command line, not the executable. So a payload became
invisible to the guard simply by naming itself accordingly:
node /tmp/snare-helper.js
snare is public and its source is readable, so this was trivially
discoverable by anyone targeting users of the tool.
Confirmed by A/B against a live process whose argv contained both the word
'snare' and a known IOC:
pre-fix result: clean decoy: alive
post-fix result: DETECTED decoy: KILLED
The skip is now matched against the real install path ($SNARE_ROOT/bin/snare)
rather than the bare word.
Also from the same audit pass (shellcheck, 10 warnings -> 0):
- doctor counted persistence entries with 'ls | grep', which miscounts a
filename containing a newline. That check exists to inspect persistence
directories, which is exactly where a deliberately awkward filename
belongs. Now uses find.
- several 'local x=$(...)' declarations masked the command's exit status;
declared and assigned separately.
- dropped three genuinely unused variables.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by a shellcheck audit pass (SC2221/SC2222 flagged the redundant pattern, which led to the real problem).
The hole
The guard skipped any process whose command line contained
snareanywhere:So a payload hid from the guard by naming itself
node /tmp/snare-helper.js. snare is public, so this was trivially discoverable by anyone targeting its users.Confirmed by A/B against a live process
argv containing both
snareand a known IOC:main)clean— missedDETECTEDSkip is now matched on
$SNARE_ROOT/bin/snare, not the bare word.Also in this pass — shellcheck 10 warnings → 0
doctorcounted persistence entries withls | grep, which miscounts filenames containing newlines — in the one place a deliberately awkward filename belongslocal x=$(...)masked exit status