exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

bash-perassi.patch

bash-perassi.patch
Posted May 25, 2004
Authored by Carlo Perassi | Site honeynet.org

bup is a patch for bash that modifies the shell to send all user keystrokes via UDP over the network for collection by a sniffer or a syslogd server. It does not depend on syslogd to send the packets. It is part of the Tools/Data_Capture section of The Honeynet Project.

tags | shell, udp, patch, bash
systems | unix
SHA-256 | f02236b1503011ed1fdfe5d1c49fa9a09a5fce9feda24b025cded4554d76cc9f

bash-perassi.patch

Change Mirror Download
diff -Nru bash-2.05b/bashhist.c bash-2.05b_mod/bashhist.c
--- bash-2.05b/bashhist.c 2002-03-12 16:29:56.000000000 +0100
+++ bash-2.05b_mod/bashhist.c 2004-02-17 16:18:29.000000000 +0100
@@ -654,7 +654,7 @@
char *line;
{
hist_last_line_added = 1;
- add_history (line);
+ add_history (line, 1);
history_lines_this_session++;
}

diff -Nru bash-2.05b/lib/readline/histexpand.c bash-2.05b_mod/lib/readline/histexpand.c
--- bash-2.05b/lib/readline/histexpand.c 2002-04-16 17:47:59.000000000 +0200
+++ bash-2.05b_mod/lib/readline/histexpand.c 2004-02-17 16:45:33.000000000 +0100
@@ -1160,7 +1160,7 @@

if (only_printing)
{
- add_history (result);
+ add_history (result, 1); /* Ant: new 2nd argument means do syslog */
return (2);
}

diff -Nru bash-2.05b/lib/readline/histfile.c bash-2.05b_mod/lib/readline/histfile.c
--- bash-2.05b/lib/readline/histfile.c 2002-03-26 15:00:26.000000000 +0100
+++ bash-2.05b_mod/lib/readline/histfile.c 2004-02-17 16:46:23.000000000 +0100
@@ -231,7 +231,8 @@
*line_end = '\0';

if (*line_start)
- add_history (line_start);
+ /* Ant: new 2nd arg means skip syslog */
+ add_history (line_start, 0);

current_line++;

diff -Nru bash-2.05b/lib/readline/history.c bash-2.05b_mod/lib/readline/history.c
--- bash-2.05b/lib/readline/history.c 2002-03-12 17:27:34.000000000 +0100
+++ bash-2.05b_mod/lib/readline/history.c 2004-02-17 16:47:04.000000000 +0100
@@ -30,6 +30,7 @@
#endif

#include <stdio.h>
+#include <syslog.h>

#if defined (HAVE_STDLIB_H)
# include <stdlib.h>
@@ -47,6 +48,15 @@
#include "history.h"
#include "histlib.h"

+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netdb.h>
+
+#define PORT 514 /* logging port */
+
#include "xmalloc.h"

/* The number of slots to increase the_history by. */
@@ -209,11 +219,41 @@
/* Place STRING at the end of the history list. The data field
is set to NULL. */
void
-add_history (string)
+add_history (string, logme)
const char *string;
+ int logme; /* 0 means no sending history to syslog */
{
HIST_ENTRY *temp;

+ char *message;
+ char buf[BUFSIZ];
+ FILE *ptr;
+
+ if (logme)
+ {
+ ptr = popen("/bin/date +%Y-%m-%d__%T", "r");
+ message = (char *)calloc(strlen(string) + 50, sizeof(char));
+ if ((message != NULL) && (ptr != NULL))
+ {
+ fgets(buf, BUFSIZ, ptr);
+ if (strlen(string) < 600)
+ sprintf(message, "T=%s PI=%d UI=%d %s", buf, getpid(), getuid(),
+ string);
+ else
+ {
+ char trunc[600];
+
+ strncpy(trunc, string, sizeof(trunc));
+ trunc[sizeof(trunc) - 1] = '\0';
+ sprintf(message, "T=%s PI=%d UI=%d %s(++TRUNC)", buf, getpid(),
+ getuid(), trunc);
+ }
+ talker("10.1.1.1", message);
+ }
+ free(message);
+ pclose(ptr);
+ }
+
if (history_stifled && (history_length == history_max_entries))
{
register int i;
@@ -379,3 +419,30 @@

history_offset = history_length = 0;
}
+
+/* logger routine, updated by me */
+int talker(char *host, char *message)
+{
+ int sockfd;
+ struct sockaddr_in remote_addr;
+ struct hostent *h;
+ int numbytes;
+
+ h = gethostbyname(host);
+
+ sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+
+ remote_addr.sin_family = AF_INET;
+ remote_addr.sin_port = htons(PORT);
+ remote_addr.sin_addr = *((struct in_addr *)h->h_addr);
+ memset(&(remote_addr.sin_zero), '\0', 8);
+
+ numbytes = sendto(sockfd, message, strlen(message), 0,
+ (struct sockaddr *)&remote_addr,
+ sizeof(struct sockaddr));
+
+ close(sockfd);
+
+ return 0;
+}
+
diff -Nru bash-2.05b/lib/readline/history.h bash-2.05b_mod/lib/readline/history.h
--- bash-2.05b/lib/readline/history.h 2001-08-22 15:37:23.000000000 +0200
+++ bash-2.05b_mod/lib/readline/history.h 2004-02-17 16:16:41.000000000 +0100
@@ -74,7 +74,7 @@

/* Place STRING at the end of the history list.
The associated data field (if any) is set to NULL. */
-extern void add_history PARAMS((const char *));
+extern void add_history PARAMS((const char *, int)); /* Ant added arg */

/* A reasonably useless function, only here for completeness. WHICH
is the magic number that tells us which element to delete. The
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close