Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM)

Adversaries may modify components of the PAM system to create backdoors. PAM components, such as <code>pam_unix.so</code>, can be patched to accept arbitrary adversary supplied values as legitimate credentials.(Citation: PAM Backdoor)

Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.(Citation: PAM Creds)(Citation: Apple PAM)
Pluggable Authentication Modules
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1556/003  external_id: T1556.003     source_name: Apple PAM  description: Apple. (2011, May 11). PAM - Pluggable Authentication Modules. Retrieved June 25, 2020.  url: https://opensource.apple.com/source/dovecot/dovecot-239/dovecot/doc/wiki/PasswordDatabase.PAM.txt     source_name: Man Pam_Unix  description: die.net. (n.d.). pam_unix(8) - Linux man page. Retrieved June 25, 2020.  url: https://linux.die.net/man/8/pam_unix     source_name: Red Hat PAM  description: Red Hat. (n.d.). CHAPTER 2. USING PLUGGABLE AUTHENTICATION MODULES (PAM). Retrieved June 25, 2020.  url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/managing_smart_cards/pluggable_authentication_modules     source_name: PAM Backdoor  description: zephrax. (2018, August 3). linux-pam-backdoor. Retrieved June 25, 2020.  url: https://github.com/zephrax/linux-pam-backdoor     source_name: PAM Creds  description: Fernández, J. M. (2018, June 27). Exfiltrating credentials via PAM backdoors & DNS requests. Retrieved June 26, 2020.  url: https://x-c3ll.github.io/posts/PAM-backdoor-DNS/     