Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Client Auth Options #255

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Client Auth Options #255

wants to merge 1 commit into from

Conversation

Ronni3X
Copy link

@Ronni3X Ronni3X commented Mar 21, 2021

I added more options for how the authorization information is provided through the client (the --auth option). You can provide the username and password through stdin by putting the string "stdin" in place of the username:password. It will prompt you for the username and the password, with the typed password not being echoed. To implement this I had to include the term library from the golang repo. This was useful for me in a lab environment, like Hack the box and OSCP, so that other users couldn't see the username and password in the process list output (ps) and then create connections back through my machine. I added the file and environment variable options for the same reason as the stdin option, but also for the lack of a full tty shell. After providing the input file or environment variable you can then remove the login information. The file and environment variable option also allow you to background the process when ran. To provide the file you include a greater than symbol followed by the file name (i.e. ">auth_file"). If the file is in the same path you can use only the name, otherwise you need to provide the relative or absolute path with the filename. To provide the environment variable you include an equal symbol followed by the environment variable name (i.e. "=auth"). I changed the help information and README to reflect these additions. I'm new to golang so the code might not be as efficient as it could be.

…nt variable). Also, added the option information to the help info and readme
@haegar
Copy link

haegar commented May 13, 2021

Moin,

Can't comment on the go code, but I like the principle of not having the authentication info visible in the process list.

Just some small comment:

"To provide the file you include a greater than symbol followed by the file name (i.e. ">auth_file")"
Here I think using the less than symbol "<" would make more sense - as this option here means "read from", not "write to", we should use the same as the shell and not the opposite.
Then if you make an error in your shell quoting you get maybe an error, but did not overwrite your auth data with the chisel output.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants