T1556.003_pluggable-authentication-modules

T1556.003 Pluggable Authentication Modules

Sub-technique of: T1556

High-Level Description

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.

Adversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials.

Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.

Kill Chain Phase

• Credential Access (TA0006)
• Defense Evasion (TA0005)
• Persistence (TA0003)

Platforms: Linux, macOS

What to Check

• Identify if Pluggable Authentication Modules technique is applicable to target environment
• Check Linux systems for indicators of Pluggable Authentication Modules
• Check macOS systems for indicators of Pluggable Authentication Modules
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Malicious PAM rule

Inserts a rule into a PAM config and then tests it.

Upon successful execution, this test will insert a rule that allows every user to su to root without a password.

Supported Platforms: linux Elevation Required: Yes

sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}

Atomic Test 2: Malicious PAM rule (freebsd)

Inserts a rule into a PAM config and then tests it.

Upon successful execution, this test will insert a rule that allows every user to su to root without a password.

Supported Platforms: linux Elevation Required: Yes

sudo sed -i "" "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}

Atomic Test 3: Malicious PAM module

Creates a PAM module, inserts a rule to use it, and then tests it.

Upon successful execution, this test will create a PAM module that allows every user to su to root without a password.

Supported Platforms: linux Elevation Required: Yes

sudo sed -i "#{index}s,^,#{pam_rule}\n,g" #{path_to_pam_conf}

Dependencies:

• The PAM development library must be installed to build the PAM module
• The PAM module must exist on disk at specified location (#{path_to_pam_module})

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Pluggable Authentication Modules by examining the target platforms (Linux, macOS).

2. Assess Existing Defenses: Review whether mitigations for T1556.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1032 Multi-factor Authentication

Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information.

M1026 Privileged Account Management

Limit access to the root account and prevent users from modifying PAM components through proper privilege separation (ex SELinux, grsecurity, AppArmor, etc.) and limiting Privilege Escalation opportunities.

Detection

Detect Malicious Modification of Pluggable Authentication Modules (PAM)

Risk Assessment

CWE Categories

References

• Apple PAM
• Man Pam_Unix
• PAM Creds
• Red Hat PAM
• PAM Backdoor
• Atomic Red Team - T1556.003
• MITRE ATT&CK - T1556.003