Offensive BPF: Using bpftrace to sniff PAM logon passwords

This post is part of a series about Offensive BPF . Click the “ebpf” tag to see all related posts.

It has been a while that we posted something in the “Offensive BPF” series. But recently there have been a couple of new cool ebpf based tools, such as TripleCross , boopkit and pamspy .

So, I thought it be quite fitting to do another post in the Offensive BPF series to keep raising awareness.

Let’s sniff PAM again - pamsnoop.bt

A few weeks back we discussed a backdoor PAM module to grab authtok tokens (e. g. SSH passwords) when someone logs on to a machine. In this post we will build an eBPF program using bpftrace to do the same. Kudos for the idea using eBPF go to citronneur .