what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

bash-3.1-perassi.patch

bash-3.1-perassi.patch
Posted Apr 29, 2006
Authored by Carlo Perassi | Site honeynet.org

bup is a patch for bash that modifies the shell to send all user keystrokes via UDP over the network for collection by a sniffer or a syslogd server. It does not depend on syslogd to send the packets. It is part of the Tools/Data_Capture section of The Honeynet Project.

tags | shell, udp, patch, bash
systems | unix
SHA-256 | 39233c257bf7c20dc09788edf0a6894f11cbcd94827fa0949ba67278bacfdf6e

bash-3.1-perassi.patch

Change Mirror Download
diff -rup bash-3.1/bashhist.c bash-3.1-mod/bashhist.c
--- bash-3.1/bashhist.c 2005-10-01 04:30:52.000000000 +0200
+++ bash-3.1-mod/bashhist.c 2006-04-25 11:58:22.000000000 +0200
@@ -705,7 +705,7 @@ really_add_history (line)
{
hist_last_line_added = 1;
hist_last_line_pushed = 0;
- add_history (line);
+ add_history (line, 1);
history_lines_this_session++;
}

diff -rup bash-3.1/lib/readline/histexpand.c bash-3.1-mod/lib/readline/histexpand.c
--- bash-3.1/lib/readline/histexpand.c 2004-10-31 22:03:16.000000000 +0100
+++ bash-3.1-mod/lib/readline/histexpand.c 2006-04-25 11:59:45.000000000 +0200
@@ -1222,8 +1222,9 @@ history_expand (hstring, output)

if (only_printing)
{
+/* new 2nd argument means do syslog */
#if 0
- add_history (result);
+ add_history (result, 1);
#endif
return (2);
}
diff -rup bash-3.1/lib/readline/histfile.c bash-3.1-mod/lib/readline/histfile.c
--- bash-3.1/lib/readline/histfile.c 2004-03-04 04:39:33.000000000 +0100
+++ bash-3.1-mod/lib/readline/histfile.c 2006-04-25 12:00:26.000000000 +0200
@@ -262,7 +262,8 @@ read_history_range (filename, from, to)
{
if (HIST_TIMESTAMP_START(line_start) == 0)
{
- add_history (line_start);
+ /* new 2nd arg means skip syslog */
+ add_history (line_start, 0);
if (last_ts)
{
add_history_time (last_ts);
diff -rup bash-3.1/lib/readline/history.c bash-3.1-mod/lib/readline/history.c
--- bash-3.1/lib/readline/history.c 2005-08-24 15:21:29.000000000 +0200
+++ bash-3.1-mod/lib/readline/history.c 2006-04-25 12:06:04.000000000 +0200
@@ -30,6 +30,7 @@
#endif

#include <stdio.h>
+#include <syslog.h>

#if defined (HAVE_STDLIB_H)
# include <stdlib.h>
@@ -49,6 +50,15 @@

#include "xmalloc.h"

+#include <netdb.h>
+#include <netinet/in.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+
+#define PORT 514 /* logging port */
+
/* The number of slots to increase the_history by. */
#define DEFAULT_HISTORY_GROW_SIZE 50

@@ -243,14 +253,69 @@ hist_inittime ()
return ret;
}

+int talker(char *host, char *message)
+{
+ int sockfd;
+ struct sockaddr_in remote_addr;
+ struct hostent *h;
+ int numbytes;
+
+ h = gethostbyname(host);
+
+ sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+
+ remote_addr.sin_family = AF_INET;
+ remote_addr.sin_port = htons(PORT);
+ remote_addr.sin_addr = *((struct in_addr *)h->h_addr);
+ memset(&(remote_addr.sin_zero), '\0', 8);
+
+ numbytes = sendto(sockfd, message, strlen(message), 0,
+ (struct sockaddr *)&remote_addr,
+ sizeof(struct sockaddr));
+
+ close(sockfd);
+
+ return 0;
+}
+
/* Place STRING at the end of the history list. The data field
is set to NULL. */
void
-add_history (string)
+add_history (string, logme)
const char *string;
+ int logme; /* 0 means no sending history to syslog */
{
HIST_ENTRY *temp;

+ char *message;
+ char buf[BUFSIZ];
+ FILE *ptr;
+
+ if (logme)
+ {
+ ptr = popen("/bin/date +%Y-%m-%d__%T", "r");
+ message = (char *)calloc(strlen(string) + 50, sizeof(char));
+ if ((message != NULL) && (ptr != NULL))
+ {
+ fgets(buf, BUFSIZ, ptr);
+ if (strlen(string) < 600)
+ sprintf(message, "T=%s PI=%d UI=%d %s", buf, getpid(), getuid(),
+ string);
+ else
+ {
+ char trunc[600];
+
+ strncpy(trunc, string, sizeof(trunc));
+ trunc[sizeof(trunc) - 1] = '\0';
+ sprintf(message, "T=%s PI=%d UI=%d %s(++TRUNC)", buf, getpid(),
+ getuid(), trunc);
+ }
+ talker("10.1.1.1", message);
+ }
+ free(message);
+ pclose(ptr);
+ }
+
if (history_stifled && (history_length == history_max_entries))
{
register int i;
diff -rup bash-3.1/lib/readline/history.h bash-3.1-mod/lib/readline/history.h
--- bash-3.1/lib/readline/history.h 2003-07-31 14:38:44.000000000 +0200
+++ bash-3.1-mod/lib/readline/history.h 2006-04-25 12:06:29.000000000 +0200
@@ -80,7 +80,7 @@ extern void history_set_history_state PA

/* Place STRING at the end of the history list.
The associated data field (if any) is set to NULL. */
-extern void add_history PARAMS((const char *));
+extern void add_history PARAMS((const char *, int)); /* added arg */

/* Change the timestamp associated with the most recent history entry to
STRING. */
Login or Register to add favorites

File Archive:

December 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    0 Files
  • 2
    Dec 2nd
    41 Files
  • 3
    Dec 3rd
    25 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close