SSH Credential Sniffer

Security research documenting 7 different techniques for intercepting SSH authentication credentials on Linux systems

A comprehensive research project exploring how attackers can capture SSH credentials (username + password) from various interception points within a Linux system. This research is intended for red teamers, penetration testers, security researchers, and blue team defenders seeking to understand post-compromise attack techniques.

---

🎯 Overview

When an attacker gains root access to a Linux system running an SSH server, they can intercept authentication credentials from users connecting to that system. This research documents 7 different methods to accomplish this, each operating at a different layer of the system stack.

Understanding these techniques is essential for:

• Red Teams: Post-compromise credential harvesting and lateral movement
• Penetration Testers: Demonstrating impact of root-level compromise
• Security Researchers: Understanding SSH authentication internals
• Blue Teams: Detecting and defending against credential interception

flowchart TB
    subgraph "SSH Authentication Flow"
        A[SSH Client] -->|TCP Connection| B[sshd Master Process]
        B -->|Fork| C[sshd Child Process]
        C -->|Privilege Separation| D[sshd Unprivileged]
        D -->|Auth Request| E[PAM Stack]
        E -->|Verify| F[etc/shadow]
    end

    subgraph "Interception Points"
        G[1. Patched OpenSSH]
        H[2. LD_PRELOAD]
        I[3. eBPF/bpftrace]
        J[4. PAM Module]
        K[5. ptrace]
        L[6. strace]
    end

    C -.->|Source Code| G
    C -.->|Syscall Hooks| H
    C -.->|Kernel Tracing| I
    E -.->|Auth Hook| J
    C -.->|Process Tracing| K
    C -.->|Debug Tracing| L

    style G fill:#2ecc71
    style H fill:#2ecc71
    style I fill:#3498db
    style J fill:#f39c12
    style K fill:#e74c3c
    style L fill:#e74c3c

Loading

---

📊 Methods Comparison

Method	Performance	Stealth	Invalid Users	Complexity	SELinux Safe	Recommended
Patched OpenSSH	⭐⭐⭐⭐⭐	⭐⭐⭐⭐⭐	✅	Medium	✅	⭐ BEST
LD_PRELOAD	⭐⭐⭐⭐	⭐⭐⭐	✅	High	✅	⭐ BEST
eBPF/bpftrace	⭐⭐⭐⭐	⭐⭐⭐	✅	Low	✅	Good
PAM	⭐⭐⭐⭐⭐	⭐⭐⭐⭐	❌	Low	✅	Limited
ptrace	⭐⭐	⭐⭐	✅	High	❌	Research
strace	⭐⭐	⭐	✅	Low	❌	Debug
SystemTap	N/A	N/A	N/A	N/A	❌	❌ Blocked

Legend:

• Performance: Runtime overhead impact
• Stealth: Difficulty of detection (processes, files, logs)
• Invalid Users: Can capture passwords for non-existent usernames
• SELinux Safe: Works without modifying SELinux policies

---

🚀 Quick Start

Recommended: Patched OpenSSH (Zero Overhead)

cd methods/01-patched-openssh
sudo ./install.sh --full

# View captured credentials
sudo journalctl -t sshd | grep SNIFFER

Alternative: LD_PRELOAD (No Recompilation)

cd methods/02-ldpreload
sudo ./install.sh install

# View captured credentials
sudo ./install.sh logs

---

📁 Repository Structure

ssh-credential-sniffer/
├── methods/
│   ├── 01-patched-openssh/    # Recompile sshd with logging patch
│   ├── 02-ldpreload/          # Hook syscalls via shared library
│   ├── 03-ebpf/               # Kernel-level tracing with eBPF
│   ├── 04-pam/                # PAM authentication hook
│   ├── 05-ptrace/             # Process tracing (debugger-style)
│   ├── 06-strace/             # Simple strace wrapper
│   └── 07-systemtap/          # SystemTap (blocked by Secure Boot)
├── docs/
│   ├── architecture/          # Technical diagrams and flows
│   ├── METHODS-COMPARISON.md  # Detailed comparison
│   └── TROUBLESHOOTING.md     # Common issues and solutions
├── references/                # Original inspiration and credits
└── README.md                  # This file

---

🔬 How SSH Authentication Works

Understanding where credentials can be intercepted requires understanding the SSH authentication flow:

sequenceDiagram
    participant Client as SSH Client
    participant Master as sshd (Master)
    participant Child as sshd (Child)
    participant Unpriv as sshd (Unprivileged)
    participant PAM as PAM Stack
    participant Shadow as etc/shadow

    Client->>Master: TCP Connection (port 22)
    Master->>Child: fork()
    Child->>Child: Protocol Negotiation
    Child->>Unpriv: Privilege Separation
    
    Note over Client,Unpriv: Password Authentication Request
    
    Client->>Unpriv: Username
    Unpriv->>Child: Username (privsep pipe)
    Client->>Unpriv: Password
    Unpriv->>Child: Password (privsep pipe)
    
    Note over Child,Shadow: Credential Verification
    
    Child->>PAM: pam_authenticate()
    PAM->>Shadow: Verify password hash
    Shadow-->>PAM: Result
    PAM-->>Child: Success/Failure
    Child-->>Client: Authentication Result

Loading

Key Interception Points:

Point	Method	What's Captured
Source Code	Patched OpenSSH	Username + Password (plaintext)
Privsep Pipe	LD_PRELOAD, eBPF	Username + Password (plaintext)
PAM Stack	PAM Module	Username + Password (valid users only)
Process Memory	ptrace, strace	Username + Password (plaintext)

---

🔧 Tested Environment

Component	Version
OS	RHEL 9.5 / Rocky Linux 9 / AlmaLinux 9
Kernel	5.14.0-503.x
SELinux	Enforcing
Secure Boot	Enabled
OpenSSL	3.2.2
OpenSSH	8.7p1 (system) / 9.6p1 (patched)

---

📋 Output Formats

Each method produces slightly different output. Here's what to expect:

Patched OpenSSH

sshd[12345]: SNIFFER: ip=192.168.1.100 user=root password=secret123

LD_PRELOAD

[2025-01-15 10:30:45] ip=192.168.1.100 user=root password=secret123 user_status=valid_user pass_status=valid_pass auth=SUCCESS

eBPF

[2025-01-15 10:30:45] user=root,password=secret123

PAM

src_ip=192.168.1.100,user=root,password=secret123

ptrace

time=2025-01-15T10:30:45,src_ip=192.168.1.100,user=root,password=secret123,status=success

---

🛡️ Detection & Defense

If you're a defender, here's how to detect these techniques:

Method	Detection Approach
Patched OpenSSH	Compare binary hash with package manager: rpm -V openssh-server
LD_PRELOAD	Check /etc/ld.so.preload and /proc/PID/maps
eBPF	Monitor for bpftrace processes: ps aux | grep bpf
PAM	Audit /etc/pam.d/sshd for unexpected modules
ptrace	Monitor for processes attached to sshd: grep TracerPid /proc/*/status
strace	Monitor for strace processes attached to sshd

Hardening Recommendations:

1. Use SSH key-based authentication (no password to capture)
2. Implement file integrity monitoring on /usr/sbin/sshd
3. Monitor /etc/ld.so.preload for changes
4. Use SELinux in Enforcing mode
5. Enable Secure Boot to prevent unsigned kernel modules

---

⚠️ Legal Disclaimer

This research is provided for educational and authorized security testing purposes only.

You must:

• Have explicit written authorization before deploying on any system
• Use only in controlled lab environments or during authorized engagements
• Comply with all applicable laws and regulations
• Follow responsible disclosure practices

Unauthorized interception of credentials is illegal and may violate computer fraud laws including the CFAA (US), Computer Misuse Act (UK), and similar legislation in other jurisdictions.

The authors assume no liability for misuse of this research.

---

🙏 Acknowledgments

This research was inspired by and builds upon the work of others in the security community:

• ssh-grabber by braindead-sec - The original strace-based approach that inspired this comprehensive research
• OpenSSH Project - For excellent source code documentation
• Red Hat / Fedora - For comprehensive SELinux implementation and documentation

---

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

---

🤝 Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

Areas for improvement:

• JSON logging output option for all methods
• GeoIP lookup integration for source IPs
• Central log aggregation setup guides
• Alerting configurations for specific patterns
• Support for additional Linux distributions
• Debian/Ubuntu-specific installation scripts