Post Exploitation: Sniffing Logon Passwords with PAM

Pluggable Authentication Modules (PAM) on Unix based systems are useful to change logon behavior and enforce authentication via various means.
In “Red Team Strategies” the chapter “Protecting the Pentester” walks the reader through the configuration of a PAM module to get notified in real-time via a pop-up when someone logs on to the machine (e.g. system compromise).
But there are also bad things that can be done with PAM (especially post-exploitation) and this is what this post is about.

exploitation logon pam passwords sniffing