This is an old revision of the document!
[gX:~] # cd /etc [gX:/etc] # cat inetd.conf ... telnet stream tcp nowait root /usr/libexec/telnetd telnetd shell stream tcp nowait root /usr/libexec/rshd rshd ... [gX:/etc] # /etc/rc.d/inetd rcvar [gX:/etc] # cat >> rc.conf inetd_enable="YES" [gX:/etc] # /etc/rc.d/inetd start Starting inetd. Протокол rsh [gX:~] # adduser Username: uY ... [gX:~] # telnet gY User (root): uX Password: $ cat .rhosts ... gX root ... $ exit Connection closed by foreign host. [gX:~] # rsh -l uX gY "uname -a"
[gX:~] # cat shell.sh #!/bin/sh echo -n "> " while read c do # $c && echo "OK" ${c%?} && echo "OK" echo -n "> " done [gX:/etc] # cat /etc/inetd.conf ... telnet stream tcp nowait root /root/shell.sh ...
[gX:/etc] # cat /etc/inetd.conf ... http stream tcp nowait root /root/webshell.sh webshell.sh ... [gX:~] # cat webshell.sh #!/bin/sh read s c=$(expr "$s" : ".*=\(.*\) " | sed "s/+/ /g") if [ "$c" = "" ] then echo '<html><h1>Command:</h1><form action=""><input type=text name=command></form></html>' exit 0 fi $c
[gX:/etc] # cat /etc/inetd.conf http stream tcp nowait root /root/httpd.sh httpd.sh [gX:~] # cat httpd.sh #!/bin/sh read s c=$(expr "$s" : "GET..\(.*\) ") if [ "$c" = "" ] then echo "<html> $s <h1>shell WebServer</h1></html>" exit 0 fi if [ -x "/root/$c" ] then /root/$c else cat /root/$c fi
[gX:~] # cd /etc [gX:/etc] # mkdir devd [gX:/etc] # cd devd [gX:/etc/devd] # cat my.conf attach 30 { device-name "umass0"; action "sleep 3; /sbin/mount -t msdos /dev/da0s1 /mnt/"; };