Credentials Dumper for Linux using eBPF
pamspy leverage eBPF technologies to achieve an equivalent work of 3snake.
It will track a particular userland function inside the PAM (Pluggable Authentication Modules) library, used by many critical applications to handle authentication like:
pamspy is built as a static binary without any dependencies, and available on the release page.
…As pamspy rely on libpam, we have to set the path where libpam is installed on your distribution. To find where libpam is installed you can run the following command :
> /usr/sbin/ldconfig -p | grep libpam.so | cut -d ' ' -f4
/lib/x86_64-linux-gnu/libpam.so.0Once you get the path you can launch pamspy :
> ./pamspy -p /lib/x86_64-linux-gnu/libpam.so.0An easy way to launch pamspy is to use the following command :
> ./pamspy -p $(/usr/sbin/ldconfig -p | grep libpam.so | cut -d ' ' -f4)pamspy can also be started as a daemon by providing an output file where credentials will be written:
./pamspy -p $(/usr/sbin/ldconfig -p | grep libpam.so | cut -d ' ' -f4) -d /tmp/credentialsTo build the static binary, we need third-party program. For eBPF we need clang to compile the C code into eBPF CO-RE code.
We also rely on bpftool to create a skeleton from ebpf program to include it in our userland program. Then we need also libelf to find the correct symbol in libpam.
sudo apt install make clang-11 gcc libelf-dev bpftoolThen just build!
git clone https://github.com/citronneur/pamspy --recursive
cd pamspy/src
makepamspy will load a userland return probe eBPF program to hook the pam_get_authtok function from libpam.so.
PAM stands for "Pluggable Authentication Modules", and have a flexible design to manage a different kind of authentication on Linux.
Each time an authentication process tries to check a new user, It will call pam_get_authtok, and will be here to dump the content of the critical secrets!
Easy! Enjoy!
Thanks to @blendin for 3snake tool !!!
No open issues yet, or sync has not completed.