# Linux clear-text credential harvesting techniques (process memory, PAM backdoors, bash history, ptrace tooling)

> DFIR.ch (Stephan Berger) documents how threat actors collect clear-text passwords on compromised Linux systems via shell history, /proc and process memory, ptrace-based interception (3snake), PAM manipulation, and backdoored edge-device login portals, then use them for lateral movement and cloud pivoting. This is technique-level detection-engineering material, not a single confirmed campaign.

- **Published:** 2026-10-24T08:40:01Z
- **Last reviewed:** 2026-10-24T08:40:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4359
- **ID:** TL-2026-4359
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The DFIR.ch article 'Fantastic clear-text passwords and where to collect them (Part 1 - Linux)' (published 2026-06-22) argues that compromised Linux servers are usually pivots rather than final objectives: harvested clear-text secrets are reused for lateral movement, network pivoting and access to cloud tenants such as Azure.

Collection techniques covered: (1) Shell history review (~/.bash_history, /root/.bash_history) - the author cites a real case where a Siemens SCS Groupware keystore password sat in root's history in a keytool -importkeystore command referencing groupware.jks, alongside OpenScape XML config exposing an Azure tenant ID and client ID. (2) Process memory and environment review - /proc/<pid>/environ and truffleproc (github.com/controlplaneio/truffleproc), which attaches with GDB, dumps process memory and scans it for credential patterns. (3) pspy (github.com/DominicBreuker/pspy), which watches process command lines via inotify without root and exposes credentials passed as arguments by cron jobs and automation. (4) ptrace-based interception with 3snake (github.com/blendin/3snake), which intercepts read/write syscalls of sshd, sudo, su, ssh client, passwd and OpenLDAP and listens for process events via netlink; Positive Technologies reported the Hellhounds group using 3snake in Operation Lahat. (5) PAM abuse - native pam_tty_audit.so logging of keystrokes to audit.log, and custom PAM backdoors, often under 100 lines, that write passwords to hidden files while accepting a hardcoded credential. (6) Edge-device portal backdoors - a modified Citrix NetScaler ADC/Gateway login page posts credentials via JavaScript fetch to https://jscloud.live/items/accounts; the article references Volexity's January 2024 Ivanti Connect Secure exploitation research (CVE-2023-46805, CVE-2024-21887, UTA0178), where a modified login script exfiltrated credentials.

Defensive guidance in the source: set kernel.yama.ptrace_scope (1 restricted, 2 admin-only, 3 disabled until reboot) in /etc/sysctl.d/10-ptrace.conf; alert on PTRACE_ATTACH against sshd, sudo, su and passwd unless whitelisted; flag unrecognized binaries spawning children that attach to authentication daemons; use file integrity monitoring on /etc/pam.d/ and PAM .so files; enforce SSH key authentication and disable PasswordAuthentication in sshd_config; set HISTCONTROL=ignorespace; use a secrets manager such as HashiCorp Vault and Entra Conditional Access for workload identities.

No CVE, CVSS or per-incident exploitation confirmation is attributed to the article itself; severity is an analyst estimate.

## MITRE ATT&CK

- T1552.003 Shell History
- T1552.001 Credentials In Files
- T1003.007 Proc Filesystem
- T1056.001 Keylogging
- T1056.003 Web Portal Capture
- T1556.003 Pluggable Authentication Modules
- T1556.003 Pluggable Authentication Modules
- T1556.003 Pluggable Authentication Modules
- T1055.008 Ptrace System Calls
- T1055.008 Ptrace System Calls
- T1057 Process Discovery
- T1021.004 SSH
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1190 Exploit Public-Facing Application

## Sources

- [Fantastic clear-text passwords and where to collect them (Part 1 - Linux)](https://dfir.ch/posts/fantastic_passwords_linux/)
- [Volexity: Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN](https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/)
- [Positive Technologies: Hellhounds - Operation Lahat, Part 2](https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/hellhounds-operation-lahat-part-2/)
- [truffleproc (controlplaneio)](https://github.com/controlplaneio/truffleproc)
- [pspy (DominicBreuker)](https://github.com/DominicBreuker/pspy)
- [3snake (blendin)](https://github.com/blendin/3snake)
- [Red Hat: Configuring PAM for Auditing (pam_tty_audit)](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing)
- [Nextron Systems: Stealth in 100 Lines - Analyzing PAM Backdoors in Linux](https://www.nextron-systems.com/2025/05/30/stealth-in-100-lines-analyzing-pam-backdoors-in-linux/)
- [AhnLab ASEC: PAM backdoor analysis](https://asec.ahnlab.com/en/89557/)
- [Group-IB: PAM harvesting insight](https://www.group-ib.com/blog/pam-harvesting-insight/)
- [Embrace The Red: Post-exploit PAM SSH password grabbing](https://embracethered.com/blog/posts/2022/post-exploit-pam-ssh-password-grabbing/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4359