lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <Pine.LNX.4.58.0403061929190.26821@rosetta.temerity.net> From: m.mohr at laposte.net (m.mohr@...oste.net) Subject: mydoom.c information I recently read somewhere that mydoom.c included the source code for the a variant. Being the curious type, I wanted to see it. During my research, I came across a post from a professor in the same situation as I was, bascially looking for sync-src-1.00.tbz. That message was posted to this list, and so after successfully obtaining this source I thought I might share my trek. This is how I came to be in possession of it: The mydoom virus listens on tcp port 3127. It will accept and execuate a binary streamed to it if the binary is prefixed with bytes 85 13 3c 9e a2. doomjuice spreads by 'updating' hosts already infected with previous versions of mydoom. If you want to obtain a copy, you probably need to catch a copy in the wild. To do so, you can set up a listener like this: nc -l -p 3127 > doomjuice.dump Remember that the netcat dump contains control codes for mydoom, so the dumps will be 5 bytes larger than the sizes listed below. Remove these bytes or take them into account. There are a few variants out with these filesizes: 36,864 doomjuice.a (contains mydoom.a source code) 5,120 doomjuice.b doomjuice / mydoom is packed with UPX, so download a copy of UPX and decompress the file before starting work on it. The uncompressed version of doomjuice.a is 43,008 bytes. The mydoom.a source code starts at byte 1232 (0x04d0) and is 28,569 bytes long. It's name is sync-src-1.00.tbz. The archive can be extracted thus: dd if=doomjuice.a of=sync-src-1.00.tbz bs=1 skip=1232 count=28569 With the huge proliferation of infected hosts out there, it shouldn't be too long before your IP is contacted. You will probably want to write a loop to restart netcat because it exits after a successful transfer.
Powered by blists - more mailing lists