evolve or die

bash-perassi.patch

bash-perassi.patch
Posted May 25, 2004
Authored by Carlo Perassi | Site honeynet.org

bup is a patch for bash that modifies the shell to send all user keystrokes via UDP over the network for collection by a sniffer or a syslogd server. It does not depend on syslogd to send the packets. It is part of the Tools/Data_Capture section of The Honeynet Project.

tags | shell, udp, patch, bash
systems | unix
MD5 | b07577f07aa49fc5a61988221cb2f836

bash-perassi.patch

Change Mirror Download
diff -Nru bash-2.05b/bashhist.c bash-2.05b_mod/bashhist.c
--- bash-2.05b/bashhist.c 2002-03-12 16:29:56.000000000 +0100
+++ bash-2.05b_mod/bashhist.c 2004-02-17 16:18:29.000000000 +0100
@@ -654,7 +654,7 @@
char *line;
{
hist_last_line_added = 1;
- add_history (line);
+ add_history (line, 1);
history_lines_this_session++;
}

diff -Nru bash-2.05b/lib/readline/histexpand.c bash-2.05b_mod/lib/readline/histexpand.c
--- bash-2.05b/lib/readline/histexpand.c 2002-04-16 17:47:59.000000000 +0200
+++ bash-2.05b_mod/lib/readline/histexpand.c 2004-02-17 16:45:33.000000000 +0100
@@ -1160,7 +1160,7 @@

if (only_printing)
{
- add_history (result);
+ add_history (result, 1); /* Ant: new 2nd argument means do syslog */
return (2);
}

diff -Nru bash-2.05b/lib/readline/histfile.c bash-2.05b_mod/lib/readline/histfile.c
--- bash-2.05b/lib/readline/histfile.c 2002-03-26 15:00:26.000000000 +0100
+++ bash-2.05b_mod/lib/readline/histfile.c 2004-02-17 16:46:23.000000000 +0100
@@ -231,7 +231,8 @@
*line_end = '\0';

if (*line_start)
- add_history (line_start);
+ /* Ant: new 2nd arg means skip syslog */
+ add_history (line_start, 0);

current_line++;

diff -Nru bash-2.05b/lib/readline/history.c bash-2.05b_mod/lib/readline/history.c
--- bash-2.05b/lib/readline/history.c 2002-03-12 17:27:34.000000000 +0100
+++ bash-2.05b_mod/lib/readline/history.c 2004-02-17 16:47:04.000000000 +0100
@@ -30,6 +30,7 @@
#endif

#include <stdio.h>
+#include <syslog.h>

#if defined (HAVE_STDLIB_H)
# include <stdlib.h>
@@ -47,6 +48,15 @@
#include "history.h"
#include "histlib.h"

+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netdb.h>
+
+#define PORT 514 /* logging port */
+
#include "xmalloc.h"

/* The number of slots to increase the_history by. */
@@ -209,11 +219,41 @@
/* Place STRING at the end of the history list. The data field
is set to NULL. */
void
-add_history (string)
+add_history (string, logme)
const char *string;
+ int logme; /* 0 means no sending history to syslog */
{
HIST_ENTRY *temp;

+ char *message;
+ char buf[BUFSIZ];
+ FILE *ptr;
+
+ if (logme)
+ {
+ ptr = popen("/bin/date +%Y-%m-%d__%T", "r");
+ message = (char *)calloc(strlen(string) + 50, sizeof(char));
+ if ((message != NULL) && (ptr != NULL))
+ {
+ fgets(buf, BUFSIZ, ptr);
+ if (strlen(string) < 600)
+ sprintf(message, "T=%s PI=%d UI=%d %s", buf, getpid(), getuid(),
+ string);
+ else
+ {
+ char trunc[600];
+
+ strncpy(trunc, string, sizeof(trunc));
+ trunc[sizeof(trunc) - 1] = '\0';
+ sprintf(message, "T=%s PI=%d UI=%d %s(++TRUNC)", buf, getpid(),
+ getuid(), trunc);
+ }
+ talker("10.1.1.1", message);
+ }
+ free(message);
+ pclose(ptr);
+ }
+
if (history_stifled && (history_length == history_max_entries))
{
register int i;
@@ -379,3 +419,30 @@

history_offset = history_length = 0;
}
+
+/* logger routine, updated by me */
+int talker(char *host, char *message)
+{
+ int sockfd;
+ struct sockaddr_in remote_addr;
+ struct hostent *h;
+ int numbytes;
+
+ h = gethostbyname(host);
+
+ sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+
+ remote_addr.sin_family = AF_INET;
+ remote_addr.sin_port = htons(PORT);
+ remote_addr.sin_addr = *((struct in_addr *)h->h_addr);
+ memset(&(remote_addr.sin_zero), '\0', 8);
+
+ numbytes = sendto(sockfd, message, strlen(message), 0,
+ (struct sockaddr *)&remote_addr,
+ sizeof(struct sockaddr));
+
+ close(sockfd);
+
+ return 0;
+}
+
diff -Nru bash-2.05b/lib/readline/history.h bash-2.05b_mod/lib/readline/history.h
--- bash-2.05b/lib/readline/history.h 2001-08-22 15:37:23.000000000 +0200
+++ bash-2.05b_mod/lib/readline/history.h 2004-02-17 16:16:41.000000000 +0100
@@ -74,7 +74,7 @@

/* Place STRING at the end of the history list.
The associated data field (if any) is set to NULL. */
-extern void add_history PARAMS((const char *));
+extern void add_history PARAMS((const char *, int)); /* Ant added arg */

/* A reasonably useless function, only here for completeness. WHICH
is the magic number that tells us which element to delete. The

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2012

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    37 Files
  • 2
    May 2nd
    53 Files
  • 3
    May 3rd
    33 Files
  • 4
    May 4th
    4 Files
  • 5
    May 5th
    10 Files
  • 6
    May 6th
    17 Files
  • 7
    May 7th
    19 Files
  • 8
    May 8th
    36 Files
  • 9
    May 9th
    34 Files
  • 10
    May 10th
    35 Files
  • 11
    May 11th
    20 Files
  • 12
    May 12th
    18 Files
  • 13
    May 13th
    11 Files
  • 14
    May 14th
    27 Files
  • 15
    May 15th
    58 Files
  • 16
    May 16th
    54 Files
  • 17
    May 17th
    25 Files
  • 18
    May 18th
    53 Files
  • 19
    May 19th
    9 Files
  • 20
    May 20th
    15 Files
  • 21
    May 21st
    25 Files
  • 22
    May 22nd
    32 Files
  • 23
    May 23rd
    35 Files
  • 24
    May 24th
    26 Files
  • 25
    May 25th
    25 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2012 Packet Storm. All rights reserved.

close