bup is a patch for bash that modifies the shell to send all user keystrokes via UDP over the network for collection by a sniffer or a syslogd server. It does not depend on syslogd to send the packets. It is part of the Tools/Data_Capture section of The Honeynet Project.
39233c257bf7c20dc09788edf0a6894f11cbcd94827fa0949ba67278bacfdf6e
diff -rup bash-3.1/bashhist.c bash-3.1-mod/bashhist.c
--- bash-3.1/bashhist.c 2005-10-01 04:30:52.000000000 +0200
+++ bash-3.1-mod/bashhist.c 2006-04-25 11:58:22.000000000 +0200
@@ -705,7 +705,7 @@ really_add_history (line)
{
hist_last_line_added = 1;
hist_last_line_pushed = 0;
- add_history (line);
+ add_history (line, 1);
history_lines_this_session++;
}
diff -rup bash-3.1/lib/readline/histexpand.c bash-3.1-mod/lib/readline/histexpand.c
--- bash-3.1/lib/readline/histexpand.c 2004-10-31 22:03:16.000000000 +0100
+++ bash-3.1-mod/lib/readline/histexpand.c 2006-04-25 11:59:45.000000000 +0200
@@ -1222,8 +1222,9 @@ history_expand (hstring, output)
if (only_printing)
{
+/* new 2nd argument means do syslog */
#if 0
- add_history (result);
+ add_history (result, 1);
#endif
return (2);
}
diff -rup bash-3.1/lib/readline/histfile.c bash-3.1-mod/lib/readline/histfile.c
--- bash-3.1/lib/readline/histfile.c 2004-03-04 04:39:33.000000000 +0100
+++ bash-3.1-mod/lib/readline/histfile.c 2006-04-25 12:00:26.000000000 +0200
@@ -262,7 +262,8 @@ read_history_range (filename, from, to)
{
if (HIST_TIMESTAMP_START(line_start) == 0)
{
- add_history (line_start);
+ /* new 2nd arg means skip syslog */
+ add_history (line_start, 0);
if (last_ts)
{
add_history_time (last_ts);
diff -rup bash-3.1/lib/readline/history.c bash-3.1-mod/lib/readline/history.c
--- bash-3.1/lib/readline/history.c 2005-08-24 15:21:29.000000000 +0200
+++ bash-3.1-mod/lib/readline/history.c 2006-04-25 12:06:04.000000000 +0200
@@ -30,6 +30,7 @@
#endif
#include <stdio.h>
+#include <syslog.h>
#if defined (HAVE_STDLIB_H)
# include <stdlib.h>
@@ -49,6 +50,15 @@
#include "xmalloc.h"
+#include <netdb.h>
+#include <netinet/in.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+
+#define PORT 514 /* logging port */
+
/* The number of slots to increase the_history by. */
#define DEFAULT_HISTORY_GROW_SIZE 50
@@ -243,14 +253,69 @@ hist_inittime ()
return ret;
}
+int talker(char *host, char *message)
+{
+ int sockfd;
+ struct sockaddr_in remote_addr;
+ struct hostent *h;
+ int numbytes;
+
+ h = gethostbyname(host);
+
+ sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+
+ remote_addr.sin_family = AF_INET;
+ remote_addr.sin_port = htons(PORT);
+ remote_addr.sin_addr = *((struct in_addr *)h->h_addr);
+ memset(&(remote_addr.sin_zero), '\0', 8);
+
+ numbytes = sendto(sockfd, message, strlen(message), 0,
+ (struct sockaddr *)&remote_addr,
+ sizeof(struct sockaddr));
+
+ close(sockfd);
+
+ return 0;
+}
+
/* Place STRING at the end of the history list. The data field
is set to NULL. */
void
-add_history (string)
+add_history (string, logme)
const char *string;
+ int logme; /* 0 means no sending history to syslog */
{
HIST_ENTRY *temp;
+ char *message;
+ char buf[BUFSIZ];
+ FILE *ptr;
+
+ if (logme)
+ {
+ ptr = popen("/bin/date +%Y-%m-%d__%T", "r");
+ message = (char *)calloc(strlen(string) + 50, sizeof(char));
+ if ((message != NULL) && (ptr != NULL))
+ {
+ fgets(buf, BUFSIZ, ptr);
+ if (strlen(string) < 600)
+ sprintf(message, "T=%s PI=%d UI=%d %s", buf, getpid(), getuid(),
+ string);
+ else
+ {
+ char trunc[600];
+
+ strncpy(trunc, string, sizeof(trunc));
+ trunc[sizeof(trunc) - 1] = '\0';
+ sprintf(message, "T=%s PI=%d UI=%d %s(++TRUNC)", buf, getpid(),
+ getuid(), trunc);
+ }
+ talker("10.1.1.1", message);
+ }
+ free(message);
+ pclose(ptr);
+ }
+
if (history_stifled && (history_length == history_max_entries))
{
register int i;
diff -rup bash-3.1/lib/readline/history.h bash-3.1-mod/lib/readline/history.h
--- bash-3.1/lib/readline/history.h 2003-07-31 14:38:44.000000000 +0200
+++ bash-3.1-mod/lib/readline/history.h 2006-04-25 12:06:29.000000000 +0200
@@ -80,7 +80,7 @@ extern void history_set_history_state PA
/* Place STRING at the end of the history list.
The associated data field (if any) is set to NULL. */
-extern void add_history PARAMS((const char *));
+extern void add_history PARAMS((const char *, int)); /* added arg */
/* Change the timestamp associated with the most recent history entry to
STRING. */