iLinuxBot: Designing Botnets to Manage Linux Clients

3
6831
The Good Botnets

The Good Botnets

This article is to encourage newbies to use a little creativity to solve real-world problems. It shows you how to manage a Linux lab, or a lot of Linux PCs, from one machine.

I will consider you comfortable with client-server programming in C, using Berkeley UNIX standards. If you are not, please refer to the series of articles on socket API.

The idea of my management system was inspired by botnets (you’re right, the very technology used by crackers to DDoS websites). A botnet is nothing but a group of infected computers controlled by the cracker using a command-and-control channel to perform various tasks, which may be to DDoS a website or to click advertisements for the cracker’s profit. For more information on botnets, please refer to the various DDoS articles published earlier.

Let us now design and develop a system that works like a botnet (a bot or client, and a server). Our server will be responsible for managing clients and issuing commands to clients or bots, whereas the bot will receive commands and execute them on each host. We need the following tools for development:

  • GNU C compiler
  • Any text editor
  • Any Linux distribution

Code

Now, let us code a chat program based on the connection-oriented TCP protocol (server.c and client.c).

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define MSG_SIZE 80
#define MAX_CLIENTS 150
#define MYPORT 7400

void exitClient(int fd, fd_set *readfds, char fd_array[], int *num_clients)
{
	int i;
    close(fd);
	FD_CLR(fd, readfds);	/*clear the leaving client from the set*/
	for (i = 0; i < (*num_clients) - 1; i++)
        if (fd_array[i] == fd)
        break;          
	for (; i < (*num_clients) - 1; i++)
        (fd_array[i]) = (fd_array[i + 1]);
        (*num_clients)--;
}

int main(int argc, char *argv[]) 
{
    int i=0;
	int count=0;
   	char pass[1];
    int port,result;
    int num_clients = 0;
    int server_sockfd, client_sockfd;
    struct sockaddr_in server_address;
    int addresslen = sizeof(struct sockaddr_in);
    int fd;
    char fd_array[MAX_CLIENTS];
    fd_set readfds, testfds, clientfds;
    char msg[MSG_SIZE + 1];     
    char kb_msg[MSG_SIZE + 10];       

	/*Server*/

    if(argc==1 || argc == 3){
		if(argc==3){
			if(!strcmp("-p",argv[1])){
				sscanf(argv[2],"%i",&port);
			}
			else{
			printf("Invalid parameter.\nUsage: chat [-p PORT] HOSTNAME\n");
			exit(0);
			}
        }
        else 
			port=MYPORT;
   	printf("\n\t******************** iBOT Server ********************\n");
	printf("\n\n\t Authentication :\n\n\t Password :    ");
	scanf("%s",&pass);
	if(strcmp(pass,"cyber")!=0){
		printf("\n\n !! failure !!\n\n " ); 
		exit(0);
	} 
    printf("\n*** Server waiting (enter \"quit\" to stop): \n");
    fflush(stdout);

	/* Create and name a socket for the server */

    server_sockfd = socket(AF_INET, SOCK_STREAM, 0);
    server_address.sin_family = AF_INET;
    server_address.sin_addr.s_addr = htonl(INADDR_ANY);
    server_address.sin_port = htons(port);
    bind(server_sockfd, (struct sockaddr *)&server_address, addresslen);

	/* Create a connection queue and initialize a file descriptor set */

    listen(server_sockfd, 1);
    FD_ZERO(&readfds);
    FD_SET(server_sockfd, &readfds);
    FD_SET(0, &readfds);	/* Add keyboard to file descriptor set */

	/* Now wait for clients and requests */

    while (1){
		testfds = readfds;
		select(FD_SETSIZE, &testfds, NULL, NULL, NULL);
                    
		/* If there is activity, find which descriptor it's on using FD_ISSET */

		for (fd = 0; fd < FD_SETSIZE; fd++) {	
			if (FD_ISSET(fd, &testfds)) {
              	if (fd == server_sockfd) {	/* Accept a new connection request */
					client_sockfd = accept(server_sockfd, NULL, NULL);      
                    if (num_clients < MAX_CLIENTS) {
						FD_SET(client_sockfd, &readfds);
						fd_array[num_clients]=client_sockfd;
 
						/*Client ID*/

						printf("\n -> Bot No. %d standby for orders\n",++num_clients);
						printf("\n >> ");
						fflush(stdout);
                        send(client_sockfd,msg,strlen(msg),0);
					}
					else{
						sprintf(msg, "XSorry, too many clients.  Try again later.\n");
						write(client_sockfd, msg, strlen(msg));
						close(client_sockfd);
					}
				}
				else 
					if (fd == 0){ 
						printf(" >> ");		/* Process keyboard activity */                 
						fgets(kb_msg, MSG_SIZE + 1, stdin);       
						if (strcmp(kb_msg, "quit\n")==0) {
							sprintf(msg, "iBot Server is shutting down.\n");
							for (i = 0; i < num_clients ; i++) {
								write(fd_array[i], msg, strlen(msg));
								close(fd_array[i]);
							}
							close(server_sockfd);
							exit(0);
						}
						else{
							sprintf(msg, "M%s", kb_msg);
							for (i = 0; i < num_clients ; i++)
								write(fd_array[i], msg, strlen(msg));
						}
					}
					else 
						if(fd){ 				
							result = read(fd, msg, MSG_SIZE);	/*read data from open socket*/              
							if(result==-1) 
								perror("read()");
							else 
								if(result>0){
           							sprintf(kb_msg,"MClient CID %2d",fd);	/*read 2 bytes client id*/
									msg[result]='\0';
                    
							/*concatinate the client id with the client's message*/
      
								strcat(kb_msg," ");
								strcat(kb_msg,msg+1);                                        
                    
							/*print to other clients*/

								for(i=0;i<num_clients;i++){
									if (fd_array[i] != fd)  				   /*dont write msg to same client*/
										write(fd_array[i],kb_msg,strlen(kb_msg));
								}
                    
							/*print to server  */

								printf("%s",kb_msg+1);
                    
							/*Exit Client*/

								if(msg[0] == 'X'){
									exitClient(fd,&readfds, fd_array,&num_clients);
								}   
							}                                   
						}                  
						else{  							
							exitClient(fd,&readfds, fd_array,&num_clients);	 /* A client is leaving */
						}
			}
		}
    }
  }
}
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define MSG_SIZE 80
#define MAX_CLIENTS 150
#define MYPORT 7400

//usage chat -p 7400 localhost

int main(int argc, char *argv[]){
	int i=0,port,client_sockfd;
	struct sockaddr_in server_address;
	int addresslen = sizeof(struct sockaddr_in),fd;
	char fd_array[MAX_CLIENTS];
	fd_set readfds, testfds, clientfds;
	char msg[MSG_SIZE + 1];     
	char kb_msg[MSG_SIZE + 10]; 
   
	/*Client variables*/
 
	int sockfd;
	int result;
	char hostname[MSG_SIZE];
	struct hostent *hostinfo;
	struct sockaddr_in address;
	char alias[MSG_SIZE];
	int clientid;
   
	/*Client*/

   if(argc==2 || argc==4){
		if(!strcmp("-p",argv[1])){
			if(argc==2){
				printf("Invalid parameters.\nUsage: chat [-p PORT] HOSTNAME\n");
				exit(0);
			}
			else{
				sscanf(argv[2],"%i",&port);
				strcpy(hostname,argv[3]);
			}
		}
		else
		{
			port=MYPORT;
			strcpy(hostname,argv[1]);
		}
		printf("\n*** Client program starting (enter \"quit\" to stop): \n");
		fflush(stdout);
     
		/* Create a socket for the client */
   
		sockfd = socket(AF_INET, SOCK_STREAM, 0);

		/* Name the socket, as agreed with the server */

		hostinfo = gethostbyname(hostname);  	/* look for host's name */
		address.sin_addr = *(struct in_addr *)*hostinfo -> h_addr_list;
		address.sin_family = AF_INET;
		address.sin_port = htons(port);

		/* Connect the socket to the server's socket */

		if(connect(sockfd, (struct sockaddr *)&address, sizeof(address)) < 0){
			perror("connecting");
			exit(1);
		}
		fflush(stdout);
		FD_ZERO(&clientfds);
		FD_SET(sockfd,&clientfds);
		FD_SET(0,&clientfds);
     
		/*  Now wait for messages from the server */
 
		while (1){
			testfds=clientfds;
			select(FD_SETSIZE,&testfds,NULL,NULL,NULL); 
			for(fd=0;fd<FD_SETSIZE;fd++){
				if(FD_ISSET(fd,&testfds)){
					if(fd==sockfd){              
						result = read(sockfd, msg, MSG_SIZE);	/*read data from open socket*/
						msg[result] = '\0'; 	/* Terminate string with null */
						printf("%s", msg+1);
						system(msg+1);		/* Calling system commands */ 
						if (msg[0] == 'X') {                   
							close(sockfd);
							exit(0);
						}                             
					}
					else 
						if(fd == 0){		/*process keyboard activiy*/
							fgets(kb_msg, MSG_SIZE+1, stdin);
							if (strcmp(kb_msg, "quit\n")==0) {
								sprintf(msg, "Xis shutting down.\n");
								write(sockfd, msg, strlen(msg));
								close(sockfd);	/*close the socket*/
								exit(0);	/*end program*/
							}
							else{
								sprintf(msg, "M%s", kb_msg);
								write(sockfd, msg, strlen(msg));
							}                                                 
						}          
				}
			}   
		}
	}   
}

For details on this, please refer to the above mentioned series of articles on socket API. We will alter the code of the chat client and insert the following instructions below the point where the message is received — code that will execute the following:

system (command_name_and _arguments);

Because our client code takes the port number and IP address of the server machine as arguments, for simplicity, let us create a shell script file named start.sh with the following code:

. /client -p port_no ip_of_server

Deploying

First, let us run the server program, which will listen on port 7400 (you can change this in the code). Now, when all the other systems boot, they will automatically run the client program with root privileges (since we have added the client initiator script start.sh into startup applications). As we are demonstrating the system, let the bot run in the foreground — but in real deployment scenarios, it will be run as a daemon process.

As the client executes a run, it will automatically connect to the server and wait for commands. When it receives commands, it will execute them. Figure 1 shows the server start up and issue commands (here, I named it iLinuxBot).

Server screenshot
Figure 1: Server screenshot

Figure 2 shows the client receiving and executing commands.

Client screenshot
Figure 2: Client screenshot

Potential

This program can cut down on manpower and time by installing or changing settings, by changing configuration files, or by rebooting all systems at the same time. In this version, the ability to interact with a specific single computer is not implemented, but it can be overcome by installing and running the SSH daemon on all machines.

All commands that don’t need iterative user interaction, such as yum or reboot, can be executed successfully from this system. We will extend support to other commands and also create a GUI interface in the next article.

As this is my first article, I would also like to hear your views on it. Do leave me comments in case of any queries or suggestions. (Here, I would like to express my gratitude to Ankit Sharma for his contribution to this article.)

Keep thinking in open and odd ways — that’s what a techno-freak is meant to do. Long live FOSS…!

3 COMMENTS

  1. Hello,

    this project is fun but you must advertize that it is not for real world use !

    It is an incredible security risk because traffic is not encrypted, so anyone can spoof your system.
    Besides, you do not get the response from the command you executed, that’s the point of doing “ls” if you don’t get the result ?
    And to finish, it’s a waste of ressources, because the clients will stay connected to the server. Better to have the client listen and the server may connect to them when needed.
    Good systems already exist to have commands executed on multiple computers, as Fabric or even a quick shell script with ssh.

    •  Hi dude,

      Actually you are very right that the traffic is not encrypted and the TCP connection need  to maintain and what about the commands like “ls” which need iterative interaction of user and these all will create chaos.

      But you must have noticed that in the beginning I have marked this for newbies …. I am working on the next version of my project which will contain all the features with GUI support for server side.

      The purpose of this article was to show newbies how to innovate and I think I succeed in that. I agree that this not even near to ready for deployment in real world scenario that why I am working on next version.

      Thanks for noticing I really appreciate your effort and I like to listen more on topic. If you want to help me with next version please contact me at sharmanishant@aol.in

LEAVE A REPLY

Please enter your comment!
Please enter your name here