iLinuxBot: Designing Botnets to Manage Linux Clients

This article is to encourage newbies to use a little creativity to solve real-world problems. It shows you how to manage a Linux lab, or a lot of Linux PCs, from one machine.

I will consider you comfortable with client-server programming in C, using Berkeley UNIX standards. If you are not, please refer to the series of articles on socket API.

The idea of my management system was inspired by botnets (you’re right, the very technology used by crackers to DDoS websites). A botnet is nothing but a group of infected computers controlled by the cracker using a command-and-control channel to perform various tasks, which may be to DDoS a website or to click advertisements for the cracker’s profit. For more information on botnets, please refer to the various DDoS articles published earlier.

Let us now design and develop a system that works like a botnet (a bot or client, and a server). Our server will be responsible for managing clients and issuing commands to clients or bots, whereas the bot will receive commands and execute them on each host. We need the following tools for development:

• GNU C compiler
• Any text editor
• Any Linux distribution

Code

Now, let us code a chat program based on the connection-oriented TCP protocol (server.c and client.c).

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define MSG_SIZE 80
#define MAX_CLIENTS 150
#define MYPORT 7400

void exitClient(int fd, fd_set *readfds, char fd_array[], int *num_clients)
{
	int i;
    close(fd);
	FD_CLR(fd, readfds);	/*clear the leaving client from the set*/
	for (i = 0; i < (*num_clients) - 1; i++)
        if (fd_array[i] == fd)
        break;          
	for (; i < (*num_clients) - 1; i++)
        (fd_array[i]) = (fd_array[i + 1]);
        (*num_clients)--;
}

int main(int argc, char *argv[]) 
{
    int i=0;
	int count=0;
   	char pass[1];
    int port,result;
    int num_clients = 0;
    int server_sockfd, client_sockfd;
    struct sockaddr_in server_address;
    int addresslen = sizeof(struct sockaddr_in);
    int fd;
    char fd_array[MAX_CLIENTS];
    fd_set readfds, testfds, clientfds;
    char msg[MSG_SIZE + 1];     
    char kb_msg[MSG_SIZE + 10];       

	/*Server*/

    if(argc==1 || argc == 3){
		if(argc==3){
			if(!strcmp("-p",argv[1])){
				sscanf(argv[2],"%i",&port);
			}
			else{
			printf("Invalid parameter.\nUsage: chat [-p PORT] HOSTNAME\n");
			exit(0);
			}
        }
        else 
			port=MYPORT;
   	printf("\n\t******************** iBOT Server ********************\n");
	printf("\n\n\t Authentication :\n\n\t Password :    ");
	scanf("%s",&pass);
	if(strcmp(pass,"cyber")!=0){
		printf("\n\n !! failure !!\n\n " ); 
		exit(0);
	} 
    printf("\n*** Server waiting (enter \"quit\" to stop): \n");
    fflush(stdout);

	/* Create and name a socket for the server */

    server_sockfd = socket(AF_INET, SOCK_STREAM, 0);
    server_address.sin_family = AF_INET;
    server_address.sin_addr.s_addr = htonl(INADDR_ANY);
    server_address.sin_port = htons(port);
    bind(server_sockfd, (struct sockaddr *)&server_address, addresslen);

	/* Create a connection queue and initialize a file descriptor set */

    listen(server_sockfd, 1);
    FD_ZERO(&readfds);
    FD_SET(server_sockfd, &readfds);
    FD_SET(0, &readfds);	/* Add keyboard to file descriptor set */

	/* Now wait for clients and requests */

    while (1){
		testfds = readfds;
		select(FD_SETSIZE, &testfds, NULL, NULL, NULL);
                    
		/* If there is activity, find which descriptor it's on using FD_ISSET */

		for (fd = 0; fd < FD_SETSIZE; fd++) {	
			if (FD_ISSET(fd, &testfds)) {
              	if (fd == server_sockfd) {	/* Accept a new connection request */
					client_sockfd = accept(server_sockfd, NULL, NULL);      
                    if (num_clients < MAX_CLIENTS) {
						FD_SET(client_sockfd, &readfds);
						fd_array[num_clients]=client_sockfd;
 
						/*Client ID*/

						printf("\n -> Bot No. %d standby for orders\n",++num_clients);
						printf("\n >> ");
						fflush(stdout);
                        send(client_sockfd,msg,strlen(msg),0);
					}
					else{
						sprintf(msg, "XSorry, too many clients.  Try again later.\n");
						write(client_sockfd, msg, strlen(msg));
						close(client_sockfd);
					}
				}
				else 
					if (fd == 0){ 
						printf(" >> ");		/* Process keyboard activity */                 
						fgets(kb_msg, MSG_SIZE + 1, stdin);       
						if (strcmp(kb_msg, "quit\n")==0) {
							sprintf(msg, "iBot Server is shutting down.\n");
							for (i = 0; i < num_clients ; i++) {
								write(fd_array[i], msg, strlen(msg));
								close(fd_array[i]);
							}
							close(server_sockfd);
							exit(0);
						}
						else{
							sprintf(msg, "M%s", kb_msg);
							for (i = 0; i < num_clients ; i++)
								write(fd_array[i], msg, strlen(msg));
						}
					}
					else 
						if(fd){ 				
							result = read(fd, msg, MSG_SIZE);	/*read data from open socket*/              
							if(result==-1) 
								perror("read()");
							else 
								if(result>0){
           							sprintf(kb_msg,"MClient CID %2d",fd);	/*read 2 bytes client id*/
									msg[result]='\0';
                    
							/*concatinate the client id with the client's message*/
      
								strcat(kb_msg," ");
								strcat(kb_msg,msg+1);                                        
                    
							/*print to other clients*/

								for(i=0;i<num_clients;i++){
									if (fd_array[i] != fd)  				   /*dont write msg to same client*/
										write(fd_array[i],kb_msg,strlen(kb_msg));
								}
                    
							/*print to server  */

								printf("%s",kb_msg+1);
                    
							/*Exit Client*/

								if(msg[0] == 'X'){
									exitClient(fd,&readfds, fd_array,&num_clients);
								}   
							}                                   
						}                  
						else{  							
							exitClient(fd,&readfds, fd_array,&num_clients);	 /* A client is leaving */
						}
			}
		}
    }
  }
}

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define MSG_SIZE 80
#define MAX_CLIENTS 150
#define MYPORT 7400

//usage chat -p 7400 localhost

int main(int argc, char *argv[]){
	int i=0,port,client_sockfd;
	struct sockaddr_in server_address;
	int addresslen = sizeof(struct sockaddr_in),fd;
	char fd_array[MAX_CLIENTS];
	fd_set readfds, testfds, clientfds;
	char msg[MSG_SIZE + 1];     
	char kb_msg[MSG_SIZE + 10]; 
   
	/*Client variables*/
 
	int sockfd;
	int result;
	char hostname[MSG_SIZE];
	struct hostent *hostinfo;
	struct sockaddr_in address;
	char alias[MSG_SIZE];
	int clientid;
   
	/*Client*/

   if(argc==2 || argc==4){
		if(!strcmp("-p",argv[1])){
			if(argc==2){
				printf("Invalid parameters.\nUsage: chat [-p PORT] HOSTNAME\n");
				exit(0);
			}
			else{
				sscanf(argv[2],"%i",&port);
				strcpy(hostname,argv[3]);
			}
		}
		else
		{
			port=MYPORT;
			strcpy(hostname,argv[1]);
		}
		printf("\n*** Client program starting (enter \"quit\" to stop): \n");
		fflush(stdout);
     
		/* Create a socket for the client */
   
		sockfd = socket(AF_INET, SOCK_STREAM, 0);

		/* Name the socket, as agreed with the server */

		hostinfo = gethostbyname(hostname);  	/* look for host's name */
		address.sin_addr = *(struct in_addr *)*hostinfo -> h_addr_list;
		address.sin_family = AF_INET;
		address.sin_port = htons(port);

		/* Connect the socket to the server's socket */

		if(connect(sockfd, (struct sockaddr *)&address, sizeof(address)) < 0){
			perror("connecting");
			exit(1);
		}
		fflush(stdout);
		FD_ZERO(&clientfds);
		FD_SET(sockfd,&clientfds);
		FD_SET(0,&clientfds);
     
		/*  Now wait for messages from the server */
 
		while (1){
			testfds=clientfds;
			select(FD_SETSIZE,&testfds,NULL,NULL,NULL); 
			for(fd=0;fd<FD_SETSIZE;fd++){
				if(FD_ISSET(fd,&testfds)){
					if(fd==sockfd){              
						result = read(sockfd, msg, MSG_SIZE);	/*read data from open socket*/
						msg[result] = '\0'; 	/* Terminate string with null */
						printf("%s", msg+1);
						system(msg+1);		/* Calling system commands */ 
						if (msg[0] == 'X') {                   
							close(sockfd);
							exit(0);
						}                             
					}
					else 
						if(fd == 0){		/*process keyboard activiy*/
							fgets(kb_msg, MSG_SIZE+1, stdin);
							if (strcmp(kb_msg, "quit\n")==0) {
								sprintf(msg, "Xis shutting down.\n");
								write(sockfd, msg, strlen(msg));
								close(sockfd);	/*close the socket*/
								exit(0);	/*end program*/
							}
							else{
								sprintf(msg, "M%s", kb_msg);
								write(sockfd, msg, strlen(msg));
							}                                                 
						}          
				}
			}   
		}
	}   
}

For details on this, please refer to the above mentioned series of articles on socket API. We will alter the code of the chat client and insert the following instructions below the point where the message is received — code that will execute the following:

system (command_name_and _arguments);

Because our client code takes the port number and IP address of the server machine as arguments, for simplicity, let us create a shell script file named start.sh with the following code:

. /client -p port_no ip_of_server

Deploying

First, let us run the server program, which will listen on port 7400 (you can change this in the code). Now, when all the other systems boot, they will automatically run the client program with root privileges (since we have added the client initiator script start.sh into startup applications). As we are demonstrating the system, let the bot run in the foreground — but in real deployment scenarios, it will be run as a daemon process.

As the client executes a run, it will automatically connect to the server and wait for commands. When it receives commands, it will execute them. Figure 1 shows the server start up and issue commands (here, I named it iLinuxBot).

Figure 2 shows the client receiving and executing commands.

Potential

This program can cut down on manpower and time by installing or changing settings, by changing configuration files, or by rebooting all systems at the same time. In this version, the ability to interact with a specific single computer is not implemented, but it can be overcome by installing and running the SSH daemon on all machines.

All commands that don’t need iterative user interaction, such as yum or reboot, can be executed successfully from this system. We will extend support to other commands and also create a GUI interface in the next article.

As this is my first article, I would also like to hear your views on it. Do leave me comments in case of any queries or suggestions. (Here, I would like to express my gratitude to Ankit Sharma for his contribution to this article.)

Keep thinking in open and odd ways — that’s what a techno-freak is meant to do. Long live FOSS…!