Im a dev and i have been learning cybersec and acting as appsec eng
During the ctfs, boxes and etc the KRB_AP_ERR_SKEW found me a lot, the usual "correction" for it is to change the entire system clock or use some one liners that always get bugged or dont work in every environment, so i decided to create the skewrun to solve it and to also practice the knowledge ive been getting, also decided to do it with rust to be able to create libs/crates others could use in theirs projects and help the community.
So Skewrun is a wrapper that reads the DC time (CLDAP → SMB → NTP) with protocol fallback in case of errors and calculates the offset in the microsecond then injects it in the process being wrapped by LD_PRELOAD resulting in the tool/script being synced with the DC without the need to change the system clock and without root.
As i said, its lib-first, with the crate ad-time dealing with the time extraction and etc and the skewrun being the cli to orchestrate it
Ive also written some ADRs with the decisions and choices made, research done, one of the nicest is the ADR-0002 that talks about the till from AS-REQ that is a Windows hardcoded constant, in the first iterations i was using now+10h what even broke in one test because the local clock was too far behind, the lib is also proptested and fuzzed in the CI
But yeah, it still have some limitations, whereas the ad-time is OS agnostic the skewrun only runs in linux because it need the libfaketime and it doesnt work with static bins (like Go) but the cli will detect and warn about it if you try
Now for the fun part, how to test it xD, you can simply run "cargo install skewrun", for me is the easiest path but you can also use the static pre-compiled musl bin available in the github release or build from source. and if you just wanna see it running first, theres a ~35s asciinema here: https://asciinema.org/a/1261342 (also a gif in the readme)
So, what do you think? the ad-time as a crate makes sense to be used outside skewrun? and has anybody dealt with this kind of problem without LD_PRELOAD, any ideas of how to make it deal with satic bins and/or be trully OS agnostic?
jvbotelho•4h ago
During the ctfs, boxes and etc the KRB_AP_ERR_SKEW found me a lot, the usual "correction" for it is to change the entire system clock or use some one liners that always get bugged or dont work in every environment, so i decided to create the skewrun to solve it and to also practice the knowledge ive been getting, also decided to do it with rust to be able to create libs/crates others could use in theirs projects and help the community.
So Skewrun is a wrapper that reads the DC time (CLDAP → SMB → NTP) with protocol fallback in case of errors and calculates the offset in the microsecond then injects it in the process being wrapped by LD_PRELOAD resulting in the tool/script being synced with the DC without the need to change the system clock and without root.
As i said, its lib-first, with the crate ad-time dealing with the time extraction and etc and the skewrun being the cli to orchestrate it
Ive also written some ADRs with the decisions and choices made, research done, one of the nicest is the ADR-0002 that talks about the till from AS-REQ that is a Windows hardcoded constant, in the first iterations i was using now+10h what even broke in one test because the local clock was too far behind, the lib is also proptested and fuzzed in the CI
But yeah, it still have some limitations, whereas the ad-time is OS agnostic the skewrun only runs in linux because it need the libfaketime and it doesnt work with static bins (like Go) but the cli will detect and warn about it if you try
Now for the fun part, how to test it xD, you can simply run "cargo install skewrun", for me is the easiest path but you can also use the static pre-compiled musl bin available in the github release or build from source. and if you just wanna see it running first, theres a ~35s asciinema here: https://asciinema.org/a/1261342 (also a gif in the readme)
So, what do you think? the ad-time as a crate makes sense to be used outside skewrun? and has anybody dealt with this kind of problem without LD_PRELOAD, any ideas of how to make it deal with satic bins and/or be trully OS agnostic?