pamspy - Credentials Dumper for Linux using eBPF

pamspy leverage eBPF technologies to achieve an equivalent work of 3snake. https://github.com/citronneur/pamspy It will track a particular userland function inside the PAM (Pluggable Authentication Modules) library, used by many critical applications to handle authentication like: sudo sshd passwd gnome x11 and many other ... How to launch? pamspy is built as a static binary without any dependencies, and available on the release page. Usage: pamspy [OPTION...] pamspy Uses eBPF to dump secrets use by PAM (Authentication) module By hooking the pam_get_authtok function in libpam.so USAGE: ./pamspy -p $(/usr/sbin/ldconfig -p | grep libpam.so | cut -d ' ' -f4) -d /var/log/trace.0 -d, --daemon=PATH TO OUTPUT CREDENTIALS Start pamspy in daemon mode and output in the file passed as argument -p, --path=PATH Path to the libpam.so file -r, --print-headers Print headers of the program -v, --verbose Verbose mode -?, --help Give this help list --usage Give a short usage message -V, --version....