一个su后门程序.docVIP

　　一个su后门程序～教育资源库 　　本代码为假冒的su,用于捕获以root身份登陆的非授权用户。两刃剑。 /* * From:　　CERT Tools * To:　　　cert-toolscert.org * Subject: Quiet list * Date:　　.I.T. / room 38-388 / Cambridge, MA　02139 / USA * ** PGP Key available on request ** * */ 　　/* * Dummy su program. Intended to help an intruder (many cheat sheets) to trip alarms * so the rightful sysadmin folks can charge to the rescue. * * Author: Shaplied, use at your oode 770 (group ode 4510 *　 c) Nos su program. (mode 4511) (usually /bin or /usr/bin). *　　　This program needs to be setuid root to be beleived, but as *　　　you can see, it does NOT run as root, it runs as daemon as *　　　soon as its run. *　 d) Finally, make sure to add yourself to odify /etc/crontab to *　 advise any system shell Ｓcripts ost ANY UNIX system. As alent. */ 　　#include #include 　　char uname[10], tname[20]; extern char *getlogin(), *ttyname(); 　　main (argc, argv) char **argv; { char *key, *t; 　　/* 　 * If an intruder is to buy this, ust LOOK like a 　 * real copy of /bin/su 　 */ 　　if (geteuid ()) { 　 fprintf (stderr, su: not properly installed\n); 　 exit (1); } else { 　 /* 　 * Bee daemon, Right ae / location 　 */ 　　if ((t = getlogin ()) == NULL) 　 strcpy (uname, unknoe, t); 12下一页 友情提醒：，特别！if ((t = ttyname(2)) == NULL) 　 strcpy (tname, unknoe, t); 　　/* 　 * Open log, and gripe! 　 */ 　　#ifdef LOG_AUTH openlog (su, LOG_PID, LOG_AUTH); #else openlog (su, LOG_PID); #endif syslog (LOG_NOTICE, SU attempt failed by %s on %s\n, uname, tname); 　 syslog (LOG_NOTICE, User tried to bee %s using su\n, (argc gt; 1 ? argv[1] : root)); 　　/* 　 * Query for a passail here, to add to the feel of delay... 　 */ 　　sendmail (argc, argv); (void)crypt (key, XX);/* Look and feel tactic */ 　　/* 　 * Of course, ail() * Blast off an email message about this attempt. Quick and sail (argc, argv) char **argv; { FILE *pbuf; long Clock; 　　if (access (/usr/bin/mail, 0)) 　 return (0); 　　if ((pbuf = popen (/usr/bin/mail root, e (Clock); 　　fprintf (pbuf, \nSECURITY