This is an old revision of the document!
[gX:~] # cd /etc [gX:/etc] # cat inetd.conf ... telnet stream tcp nowait root /usr/libexec/telnetd telnetd shell stream tcp nowait root /usr/libexec/rshd rshd ... [gX:/etc] # /etc/rc.d/inetd rcvar [gX:/etc] # cat >> rc.conf inetd_enable="YES" [gX:/etc] # /etc/rc.d/inetd start Starting inetd. Протокол rsh [gX:~] # adduser Username: uY ... [gX:~] # telnet gY User (root): uX Password: $ cat .rhosts ... gX root ... $ exit Connection closed by foreign host. [gX:~] # rsh -l uX gY "uname -a"
[gX:~] # cat shell.sh
#!/bin/sh
echo -n "> "
while read c
do
# $c && echo "OK"
${c%?} && echo "OK"
echo -n "> "
done
[gX:/etc] # cat /etc/inetd.conf
...
telnet stream tcp nowait root /root/shell.sh
...
[gX:/etc] # cat /etc/inetd.conf ... http stream tcp nowait root /root/webshell.sh webshell.sh ... [gX:~] # cat webshell.sh #!/bin/sh read s c=$(expr "$s" : ".*=\(.*\) " | sed "s/+/ /g") if [ "$c" = "" ] then echo '<html><h1>Command:</h1><form action=""><input type=text name=command></form></html>' exit 0 fi $c
[gX:/etc] # cat /etc/inetd.conf
http stream tcp nowait root /root/httpd.sh httpd.sh
[gX:~] # cat httpd.sh
#!/bin/sh
read s
c=$(expr "$s" : "GET..\(.*\) ")
if [ "$c" = "" ]
then
echo "<html> $s <h1>shell WebServer</h1></html>"
exit 0
fi
if [ -x "/root/$c" ]
then
/root/$c
else
cat /root/$c
fi
[gX:~] # cd /etc
[gX:/etc] # mkdir devd
[gX:/etc] # cd devd
[gX:/etc/devd] # cat my.conf
attach 30 {
device-name "umass0";
action "sleep 3; /sbin/mount -t msdos /dev/da0s1 /mnt/";
};