通常我们在得到一个主机的控制权后，总是考虑下次如何轻易的能再次进来，而不需要每次都重复复杂的漏洞利用，也有可能系统管理员发现了漏洞及时的补上了呢。 Usually we get a host of control, always consider how easily the next time came once again, without the need for repeated each time the complex exploits, system administrators may also find a loophole in a timely manner on the complement of it. 那么我们需要安装backdoor（后门），这样只要管理员没有发现被入侵或没有发现我们的后门，下次就可以非常轻松的进来了。 Then we need to install the backdoor (back door), so long as the administrator is not found or not found to be invading our back door, the next you can very easily come up. 在这我们介绍一些常用的后门。 In this we introduce some of the commonly used back door.
Rhosts + + 后门 Rhosts + + back door
在unix系统里，一些Rsh、Rlogin通过基于rhosts文件的简单认证。 On unix systems, a number of Rsh, Rlogin rhosts file based simple authentication. 在某个帐户的home下的rhosts文件里加上一行++，那么任何人任何机器都可以不需要密码登陆这个帐户了。 Home in an account under the rhosts file with a line + +, then any person any machine without a password can log the account.
校验和与时间戳后门 Checksum and timestamp back door
严格的讲，这只是一个隐藏后门的方法。 Strictly speaking, this is just a hidden back door approach. 我们通常用自己写的木马来代替系统原来的一些可执行文件来达到后门的效果。 We usually write their own horse to replace some of the original executable file systems to achieve the effect of the back door. 许多管理员通过时间戳和校验和来检查是否存在这样的木马。 Many administrators by timestamp and checksum to check the existence of such a Trojan. 我们可以通过一些小技巧来很容易的欺骗，一个简单的程序通过修改系统时钟就能使文件的时间戳和原始一样，至于校验和是用CRC，更加容易伪造了。 We can pass some easy tips to deceive, a simple procedure by modifying the system clock can make the original file's timestamp and the same, as is the checksum CRC, more easily forged. 所以系统管理员还是定期用MD5 校验和来检查文件吧。 Therefore, the system administrator or regularly used to check the MD5 checksum and file it. 起码不可能伪造MD5的校验和。 At least not fake MD5 checksum.
Login 后门 Login backdoor
这个是最常用的后门了，我们可以用login.c的源代码改一改，编译一下，替代原来的login，功能就是先检查我设定的密码，如果对的话，不去比较系统密码，直接进入，而对于其他用户来说和原来的login用起来感觉是一样的。 This is the most common back door, we can use the source code login.c altered, compiled about to replace the original login, set my function is to check the password, if so, do not compare the system password, direct enter, and for other users login with it and the original feeling is the same. 而且在程序上可以不必记录utmp和wtmp，那么你用后门密码进去的时候就是隐形的了。 And the program can not record the utmp and wtmp, then you go in with a backdoor password is invisible when the. 为了防止strings命令显示出login的文本内容，从而暴露backdoor的后门密码。 In order to prevent the strings command displays the contents of a text login, thus exposing the backdoor backdoor password. 那么在改login.c的时候就得加密或隐藏口令了。 Then when you have to change login.c password encryption or hide a. 但管理员还是可以用MD5校验和来发现这类后门。 However, administrators can still use the MD5 checksum to detect such a back door.
Telnetd 后门 Telnetd back door
当inetd守护程序发现有telnet连接，就交给in.telnetd处理，进入login程序。 When the inetd daemon found to have a telnet connection, on to the in.telnetd process, enter the login program. 在in.telnetd处理时通常检测一些其他信息，例如终端类型是Xterm还是vt100等，我们可以修改in.telnetd在这加一个类型hole,当我们选择hole时，系统将自动给个shell，而不需要认证。 Usually detected in the in.telnetd process some additional information, such as terminal type is vt100 Xterm or other, we can add a modified in.telnetd in this type of hole, hole when we choose, the system will automatically send a shell, without the need certification.
Services 后门每个服务都可以被利用来当作后门，象什么finger,rsh,rexec,rlogin,ftp,inetd...。 Services back door each service can be used to as a back door, like what the finger, rsh, rexec, rlogin, ftp, inetd .... 这和那些开放某个端口提供shell的后门程序没什么差别，只是隐蔽一点罢了。 This is a port that provides the shell opening backdoors no difference, but subtle bit of everything. 当然你可以修改inetd.conf加一些伪装成某个服务的程序，名字可以是uutcp...等具有伪装性的。 Of course, you can modify the inetd.conf add some disguised as a service program, the name can be uutcp ... and so on with camouflage in nature.
Crontab 后门 Crontab back door
Crontab使unix系统在特定的时间内执行指定的程序。 Crontab the unix system in a specific period of time the specified procedures. 我们可以让系统在每天的特定时间运行我们的指定开放port的shell程序。 We can let the system run at a specific time every day we open the specified port of the shell program. 当然系统管理员也会检查/usr/spool/cron/crontabs/下的文件来看有没有安排后门的存在。 Of course, the system administrator will check the / usr / spool / cron / crontabs / file under the back door of view there is no arrangement exists. 所以通过修改那些正常的cron程序，可以达到隐蔽的目的。 Therefore, by modifying the normal cron process that can achieve the purpose of concealment.
Library 后门几乎所有的unix系统使用共享库文件，共享一些常用的调用。 Library back door almost all unix systems use shared libraries, shared some common calls.
通常我们在crypt.c和_crypt.c中安置后门程序。 Usually placed in crypt.c and _crypt.c in the backdoor. login.c使用crypt(),如果在里头安置后门的话，在调用 login.c using crypt (), if placed inside the back door, then calling
Crypt()时，可以跳过校验，直接给出shell.这样就是管理员用MD5检验login程序也不会发现我们的后门了。 Crypt (), you can skip the check directly given shell. This is a test with MD5 login program administrator will not find our back door of the. 如果管理员MD5检查所有的文件，难免会发现这些问题。 If the administrator MD5 check all the files, they will be found to these problems. 但我们还有一个方法，我们知道无论是什么程序，它都需要调用open()和其他的文件存取函数，如果我们能在这些上面做文章，那么当MD5执行时读取的是原来的文件，但执行的却是我们的后门程序，所以MD5看到的校验和是没有问题的。 But we still have a way, we know that no matter what program it needs to call open () and other file access functions, if we can make a fuss about these above, then when the MD5 implementation read the original document , but the execution is our backdoor, so that the MD5 checksum is no problem.
kernel 后门 kernel backdoor
可装载内核后门是最难发现而且难度最高的了。 Loadable kernel back door is the hardest and most difficult of discovery. 具体的描述可以参看w00w00著名的Linux Kernel Module (LKM) Hacking。 Detailed description can be found in w00w00 famous Linux Kernel Module (LKM) Hacking.
http://www.w00w00.org/files/articles/lkmhack.txt http://www.w00w00.org/files/articles/lkmhack.txt
File system 后门我们通常为了隐藏一些自己的后门程序、exploit程序、工具等文件，一般是采用.目录的隐藏方式。 File system for the back door we usually hide their backdoor, exploit procedures, tools and other documents, is generally used. Catalog hidden way. 但很容易被发现，所以修改一些象ls、du、fsck等程序达到隐藏的目的要更好一些。 However, it is easy to find, so as to modify some of the ls, du, fsck, etc. The purpose of the program to achieve better hidden.
如果更狠一点，就可以把文件放在磁盘的块标志成坏的，并且采用特殊的文件系统格式，只有特定的程序才能读出，这样也可以达到很好的隐藏效果。 If Genghen point, you can put files on the disk blocks marked as bad, and using a special file system format, only certain procedures before they can read, so you can achieve a good hiding effect.
Bootblock 后门在PC中病毒有一种类型叫引导型病毒，通过修改引导区程序来达到隐藏和执行的目的。 Bootblock backdoor on the PC in a type of virus called the boot sector virus, by modifying the boot process to achieve the purpose of hiding and implementation. 当然有许多杀毒程序也能查杀这些病毒。 Of course there are many anti-virus programs can also be killing the virus. 但在unix中，很少有管理员会使用软件来检查引导区，所以把后门放到引导区也是一个很有用的方法。 However, in unix, few administrators will use the software to check the boot sector, so the back door into the boot sector is a very useful method.
进程隐藏后门为了不让管理员用ps发现我们后门程序运行的进程一般有几种方法： Process with a hidden back door in order to prevent an administrator to run ps find our backdoor process generally have several ways:
1、通过修改argv[]来使程序看起来象另一个进程。 1, by modifying argv [] to make the program look like another process.
2、改名成和系统进程类似的名字。 2, changed its name into the system processes and similar names.
3、修改ps，使ps看不见。 3, modify ps, so that ps can not see.
4、利用amodload之类的程序，内核加入可装载模块来实现后门。 4, the use of amodload like the program, adding loadable kernel module to achieve the back door.
Rootkit Rootkit
由许多工具构成的后门工具集。 Many of the tools from the tool set consisting of the back door. 有一些这样的模块构成： There are a number of such modules:
修改系统日志utmp wtmp lastlog。 Modify the system log utmp wtmp lastlog.
sniffer,passcracker。 sniffer, passcracker.
欺骗时间戳和crc校验。 Timestamp and crc check fraud.
修改login Modify login
修改ifconfig 的PROMISC标志的输出。 Modify the output of the ifconfig PROMISC signs. 使检测不到分乱模式。 To detect sub-chaotic pattern.
修改ps使发现不了进程。 Ps to detect process changes.
隐藏使用的磁盘空间。 Hidden use of disk space.
隐藏所有的rootkit文件。 The rootkit hides all files.
TCP Shell 后门最常见的后门了，一个程序listen端口，连接后给出shell. TCP Shell backdoors of the most common back door, and a program listen port, the connection given shell.
容易被发现，netstat一看就知道了。 Easy to find, netstat to see that the.
UDP Shell 后门基于udp传输的后门，原理tcp shell后门差不多。 UDP Shell backdoor udp-based transport of the back door, back door similar principles tcp shell.
ICMP Shell 后门通过ICMP协议建立pipe来实现通讯的后门。 ICMP Shell ICMP protocol established by the back door to achieve the communication pipe backdoor. 在社区公告栏收集的旧帖子里就有一个很好的例子。 Community bulletin board in the yard there Report Top collected a good example.
ACK Shell后门通过TCP中ACK数据片来进行通讯的后门。 ACK Shell in the back door via TCP ACK data communication chip to the back door. 这个比较有意思，能避过许多防火墙，天网也不例外。 This comparison is interesting, can avoid many of the firewall, Skynet is no exception.
好了，就写这么多吧，关于每个后门的实现，以后再详细的找几个程序刨析了。 Well, you write so it, the realization of each door, later detailed analysis of the plane to find a few programs.
bigshrimp 2000-11-24 来自安盟 bigshrimp 2000-11-24 from UNITA
Tidak ada komentar:
Posting Komentar