pamspy - Credentials Dumper for Linux using eBPF

pamspy leverage eBPF technologies to achieve an equivalent work of 3snake.

It will track a particular userland function inside the PAM (Pluggable Authentication Modules) library, used by many critical applications to handle authentication like:

  • sudo
  • sshd
  • passwd
  • gnome
  • x11
  • and many other ...

How to launch?

pamspy is built as a static binary without any dependencies, and available on the release page.

Usage: pamspy [OPTION...]

Uses eBPF to dump secrets use by PAM (Authentication) module
By hooking the pam_get_authtok function in

USAGE: ./pamspy -p $(/usr/sbin/ldconfig -p | grep | cut -d ' ' -f4) -d /var/log/trace.0

                             Start pamspy in daemon mode and output in the file
                             passed as argument
  -p, --path=PATH            Path to the file
  -r, --print-headers        Print headers of the program
  -v, --verbose              Verbose mode
  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

Mandatory or optional arguments to long options are also mandatory or optional
for any corresponding short options.

Report bugs to .

As pamspy rely on libpam, we have to set the path where libpam is installed on your distribution. To find where libpam is installed you can run the following command :

> /usr/sbin/ldconfig -p | grep | cut -d ' ' -f4

Once you get the path you can launch pamspy :

> ./pamspy -p /lib/x86_64-linux-gnu/

An easy way to launch pamspy is to use the following command :

> ./pamspy -p $(/usr/sbin/ldconfig -p | grep | cut -d ' ' -f4)

pamspy can also be started as a daemon by providing an output file where credentials will be written:

./pamspy -p $(/usr/sbin/ldconfig -p | grep | cut -d ' ' -f4) -d /tmp/credentials

How to build?

To build the static binary, we need a third-party program. For eBPF we need clang to compile the C code into eBPF CO-RE code. We also rely on bpftool creating a skeleton from ebpf program to include it in our userland program. Then we need also libelf to find the correct symbol in libpam.

sudo apt install make clang-11 gcc libelf-dev bpftool

Then just build!

git clone --recursive
cd pamspy/src

How does It work?

pamspy will load a userland return probe eBPF program to hook the pam_get_authtok function from PAM stands for "Pluggable Authentication Modules", and has a flexible design to manage a different kinds of authentication on Linux.

Each time an authentication process tries to check a new user, It will call pam_get_authtok, and will be here to dump the content of the critical secrets!

Easy! Enjoy!

Credits and references

Thanks to @blendin for 3snake tool !!!

August 8, 2022
Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Inline Feedbacks
View all comments
© HAKIN9 MEDIA SP. Z O.O. SP. K. 2013
Join our newsletter and receive for FREE, our premium edition “Brute Force and Supply Chain Attacks”