search

carloslack / KoviD

Linux kernel rootkit
Other
247 stars 51 forks source link

No password required for association, lack of security #93

Open doge-dog opened 4 months ago

doge-dog commented 4 months ago

Command： ./bdclient.sh openssl 192.168.11.128 7777

You can consider adding the secret parameter, and the connection can only be made if the match is successful.

carloslack commented 4 months ago

Thanks for the suggestion @doge-dog , I will check this possibility

carloslack commented 4 months ago

but first, notice that the connection happens after a certain sequence of port-knocking packets are received by KoviD, only then the connection is accepted, but yes, it is not a password.

doge-dog commented 3 months ago

everyone can connect and get other people's shells by traversing global ip addresses.

carloslack commented 3 months ago

yes , you are right, I will try to come up with something to overcome that, in the meantime I am keeping his issue open of course so we can continue from here, thanks @doge-dog