sbdump.pl

一款经典的lkm后门

#!/usr/bin/perl
#
#--------------------------------------------------------------------
#----- $Header: /home/cvsroot/sebek/dump/sbdump.pl,v 1.4 2002/09/08 22:48:57 cvs Exp $
#--------------------------------------------------------------------
#
# Copyright (C) 2001/2002 The Honeynet Project.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
# 3. All advertising materials mentioning features or use of this software
#    must display the following acknowledgement:
#      This product includes software developed by The Honeynet Project.
# 4. The name "The Honeynet Project" may not be used to endorse or promote
#    products derived from this software without specific prior written
#    permission.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#



#----- Log processor for sebek -------------------------------------------------


use strict;
use 5.004;
use Getopt::Std;
use Time::gmtime;
use FileHandle;

#-------------------------------------------------------------------------------
#----- sub timefmt: formats the time stamp all pretty like
#-------------------------------------------------------------------------------
sub timefmt{
  my $tm;
  $tm = gmtime(shift);
  return sprintf("%02d:%02d:%02d-%04d/%02d/%02d",
	  $tm->hour,$tm->min,$tm->sec,$tm->year+1900,$tm->mon+1,$tm->mday);
}

#-------------------------------------------------------------------------------
#---- Get the data collected by sebek in char by char mode, this corresponds
#---- to interactive terminals usually
#-------------------------------------------------------------------------------
sub char{
  my $file = shift;
  my $next_rec = 0;
  my $x = 0;
  my $head_sz = 64;
  my $time;

  my $tmp_ts;
  my $tmp_data;

  my %data;  #----- multidimensional hash uid->pid->the log

  my ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest,$head,$data);

  open(DATA,$file) or die("cant open $file");

  while(read(DATA,$head,$head_sz,0) > 0){

    #----- split out the fields in the head
    ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest) = split(':',$head,9);

    #----- set pointer to beginning of current data
    $next_rec += length($pid)   + 1;
    $next_rec += length($uid)   + 1;
    $next_rec += length($comm)  + 1;
    $next_rec += length($stamp) + 1;
    $next_rec += length($fd)    + 1;
    $next_rec += length($tty)   + 1;
    $next_rec += length($type)  + 1;
    $next_rec += length($len)   + 1;

    #----- read data if type C
    if($type eq "c" && $tty){
      seek(DATA,$next_rec,0);
      read(DATA,$data,$len,0);
      $time = timefmt($stamp);

      chop($data);

      #--- print(" -->$data<--\n");
      #----- if the rec not defined record the ts
      if(!defined($data{$uid}{"$pid:$comm"})){
	$data{$uid}{"$pid:$comm"}{"ts"} = $time;
      }

      #------ add the data
      $data{$uid}{"$pid:$comm"}{"data"} .= $data;

      #----- if the char is a new line then print + purge
      if($data eq "\r"){
	$tmp_ts   = $data{$uid}{"$pid:$comm"}{"ts"};
        $tmp_data = $data{$uid}{"$pid:$comm"}{"data"};
        print("$tmp_ts [$uid:$comm:$pid:$tty:$fd]");
	print("$tmp_data\n");

	undef($data{$uid}{"$pid:$comm"});
      }

    }

    #------ set pointer to beginning of next record
    $next_rec += $len;
    seek(DATA,$next_rec,0);
    $head = "";
  }

}
#-------------------------------------------------------------------------------
#---- From remote: remote -> local
#-------------------------------------------------------------------------------

sub scp0{
  my $file = shift;
  my $next_rec = 0;
  my $x = 0;
  my $head_sz = 64;
  my $time;

  my $tmp;
  my $buff;

  my $ready;

  my $ftime;
  my $fname;
  my $fsize;
  my $fmod;

  my %fh;

  my %data;  #----- multidimensional hash uid->pid->the log

  my ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest,$head,$data);

  open(DATA,$file) or die("cant open $file");

  while(read(DATA,$head,$head_sz,0) > 0){

    #----- split out the fields in the head
    ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest) = split(':',$head,9);

    #----- set pointer to beginning of current data
    $next_rec += length($pid)   + 1;
    $next_rec += length($uid)   + 1;
    $next_rec += length($comm)  + 1;
    $next_rec += length($stamp) + 1;
    $next_rec += length($fd)    + 1;
    $next_rec += length($tty)   + 1;
    $next_rec += length($type)  + 1;
    $next_rec += length($len)   + 1;

    #----- read data if its scp header data
    if($type eq "c" && $comm eq "scp"  && !$tty && ($fd == 0 || $fd == 4)){
      seek(DATA,$next_rec,0);
      read(DATA,$buff,$len,0);
      $time = timefmt($stamp);

      chop($buff);

      #------ add the data
      $data{$pid}{"data"}   .= $buff;

      if($buff eq "\n"){
	($fmod,$fsize,$fname) = split(" ",$data{$pid}{"data"});
	$data{$pid}{"fname"} = $fname;
        $tmp = timefmt($stamp);
	print("$tmp SCP (remote)->local $fname $fsize bytes\n");
	$fh{$pid} = FileHandle->new();
	open($fh{$pid},">$fname") || die "unable to open $fname\n";
      }
    }

    #----- read data if its scp copied data
    if(defined($data{$pid}) && $type eq "b" && $comm eq "scp" && !$tty && $fd == 0){
      seek(DATA,$next_rec,0);
      read(DATA,$buff,$len,0);
      syswrite($fh{$pid},$buff,$len,0);
    }


    #------ set pointer to beginning of next record
    $next_rec += $len;
    seek(DATA,$next_rec,0);
    $head = "";
  }


}

#-------------------------------------------------------------------------------
#---- From remote: remote <- local
#-------------------------------------------------------------------------------
sub scp1{
  my $file = shift;
  my $next_rec = 0;
  my $x = 0;
  my $head_sz = 64;
  my $time;

  my $tmp;

  my $ready;

  my $ftime;
  my $fname;
  my $fsize;
  my $fmod;


  my %fh;

  my %data;  #----- multidimensional hash uid->pid->the log

  my ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest,$head,$buff);

  open(DATA,$file) or die("cant open $file");

  while(read(DATA,$head,$head_sz,0) > 0){

    #----- split out the fields in the head
    ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest) = split(':',$head,9);

    #----- set pointer to beginning of current data
    $next_rec += length($pid)   + 1;
    $next_rec += length($uid)   + 1;
    $next_rec += length($comm)  + 1;
    $next_rec += length($stamp) + 1;
    $next_rec += length($fd)    + 1;
    $next_rec += length($tty)   + 1;
    $next_rec += length($type)  + 1;
    $next_rec += length($len)   + 1;

    #----- read data if its scp copied data
    if($type eq "b" && (($comm eq "sshd" && $fd == 5) || ($comm eq "scp" && $fd == 3))){
      seek(DATA,$next_rec,0);
      read(DATA,$buff,$len,0);

      if(!$ready && $comm eq "sshd" && $buff =~/^C\d+\s\d+\s.+/){
	($fmod,$fsize,$fname) = split(" ",$buff);
	$data{$pid}{"fname"} = $fname;
        $tmp = timefmt($stamp);
	print("$tmp SCP local->(remote) $fname $fsize bytes\n");
	$ready++;
      }else{
	if($ready && $comm eq "scp"){
	  if(!$fh{$pid}){
	    $fh{$pid} = FileHandle->new();
	    #----- crappy pid hack again
	    $tmp =$data{$pid-1}{"fname"}; 
	    open($fh{$pid},">$tmp") || die " unable to open $tmp\n";
	  }
	  syswrite($fh{$pid},$buff,$len,0);
	}
      }
    }


    #------ set pointer to beginning of next record
    $next_rec += $len;
    seek(DATA,$next_rec,0);
    $head = "";
  }
}


#-------------------------------------------------------------------------------
#---- From localhost: local -> remote
#---- to interactive terminals usually
#-------------------------------------------------------------------------------
sub scp2{
  my $file = shift;
  my $next_rec = 0;
  my $x = 0;
  my $head_sz = 64;
  my $time;

  my $tmp;

  my $ready;

  my $ftime;
  my $fname;
  my $fsize;
  my $fmod;


  my %fh;

  my %data;  #----- multidimensional hash uid->pid->the log

  my ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest,$head,$buff);

  open(DATA,$file) or die("cant open $file");

  while(read(DATA,$head,$head_sz,0) > 0){

    #----- split out the fields in the head
    ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest) = split(':',$head,9);

    #----- set pointer to beginning of current data
    $next_rec += length($pid)   + 1;
    $next_rec += length($uid)   + 1;
    $next_rec += length($comm)  + 1;
    $next_rec += length($stamp) + 1;
    $next_rec += length($fd)    + 1;
    $next_rec += length($tty)   + 1;
    $next_rec += length($type)  + 1;
    $next_rec += length($len)   + 1;

    #----- read data if its scp header data
    if($type eq "c" && $tty && ($fd == 0 || $fd == 4) && $comm eq "ssh"){
      seek(DATA,$next_rec,0);
      read(DATA,$buff,$len,0);

      chop($buff);

      if(!defined($data{$pid})){
	$data{$pid}{"pw"} =  "";
      }

      #------ record the password
      $buff =~ s/\n/  /g;
      $data{$pid}{"pw"}   .= $buff;
    }

    #----- read data if its scp copied data
    if(defined($data{$pid}) && $type eq "b" && $comm eq "ssh" && $tty && $fd == 4){
      seek(DATA,$next_rec,0);
      read(DATA,$buff,$len,0);

      if(!$ready){
	($fmod,$fsize,$fname) = split(" ",$buff);
	$data{$pid}{"fname"} = $fname;
        $tmp = timefmt($stamp);
	print("$tmp SCP (local)->remote $fname $fsize bytes\n");
	$buff = $data{$pid}{"pw"};
        print("$tmp SCP: passwd $buff\n\n");
	$ready++;
      }else{
	if(!$fh{$pid}){
	$fh{$pid} = FileHandle->new();
	$tmp =$data{$pid}{"fname"}; 
	open($fh{$pid},">$tmp") || die "unable to open $fname\n";
      }
	syswrite($fh{$pid},$buff,$len,0);
      }
    }


    #------ set pointer to beginning of next record
    $next_rec += $len;
    seek(DATA,$next_rec,0);
    $head = "";
  }
}


#-------------------------------------------------------------------------------
#---- From localhost: local <- remote
#---- to interactive terminals usually
#-------------------------------------------------------------------------------
sub scp3{
  my $file = shift;
  my $next_rec = 0;
  my $x = 0;
  my $head_sz = 64;
  my $time;

  my $tmp;

  my $ready;

  my $ftime;
  my $fname;
  my $fsize;
  my $fmod;


  my %fh;

  my %data;  #----- multidimensional hash uid->pid->the log

  my ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest,$head,$buff);

  open(DATA,$file) or die("cant open $file");

  while(read(DATA,$head,$head_sz,0) > 0){

    #----- split out the fields in the head
    ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest) = split(':',$head,9);

    #----- set pointer to beginning of current data
    $next_rec += length($pid)   + 1;
    $next_rec += length($uid)   + 1;
    $next_rec += length($comm)  + 1;
    $next_rec += length($stamp) + 1;
    $next_rec += length($fd)    + 1;
    $next_rec += length($tty)   + 1;
    $next_rec += length($type)  + 1;
    $next_rec += length($len)   + 1;


    #----- read data if its scp header data
    if($type eq "c" && $tty && ($fd == 7 || $fd == 4) && ($comm eq "ssh" || $comm eq "scp")){
      seek(DATA,$next_rec,0);
      read(DATA,$buff,$len,0);

      chop($buff);

      #----- passwd
      if($fd == 4){
	$buff =~ s/\n/ /;
	$data{$pid }{"pw"} .= $buff;
      }

      #----- file info
      if($fd == 7){
	$data{$pid}{"file"} .= $buff;
	if($buff eq "\n"){
	 ($fmod,$fsize,$fname) = split(" ",$data{$pid}{"file"});
	  $tmp = timefmt($stamp);
	  print("$tmp SCP (local)<-remote $fname $fsize bytes\n");
	  $data{$pid}{"fname"} = $fname;
	  #----- pid increment is a crappy hack
	  $buff = $data{$pid +1}{"pw"};
	  print("$tmp SCP: passwd $buff\n\n");
	}
      }


    }

    #----- read data if its scp copied data
    if(defined($data{$pid}) && $type eq "b" && $comm eq "scp" && $tty && $fd == 7){
      seek(DATA,$next_rec,0);
      read(DATA,$buff,$len,0);

      ($fmod,$fsize,$fname) = split(" ",$data{$pid}{"file"});

      if(!$fh{$pid}){
	$fh{$pid} = FileHandle->new();
	$tmp = $data{$pid}{"fname"};
	open($fh{$pid},">$tmp") || die "unable to open $tmp\n";
      }
      syswrite($fh{$pid},$buff,$len,0);
      
    }


    #------ set pointer to beginning of next record
    $next_rec += $len;
    seek(DATA,$next_rec,0);
    $head = "";
  }
}




#-------------------------------------------------------------------------------
#----- This displays the bulk data recorded by sebek, this is raw an nasty stuff
#----- but it will yeild passwds that are entered, so it is usefull now and then
#-------------------------------------------------------------------------------
sub bulk{
  my $file = shift;
  my $next_rec = 0;
  my $x = 0;
  my $head_sz = 64;
  my $time;

  my ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest,$head,$data);

  open(DATA,$file) or die("cant open $file");

  while(read(DATA,$head,$head_sz,0) > 0){
    #----- split out the fields in the head
    ($stamp,$pid,$uid,$comm,$fd,$tty,$type,$len,$rest) = split(':',$head,9);

    #----- set pointer to beginning of current data
    $next_rec += length($pid)   + 1;
    $next_rec += length($uid)   + 1;
    $next_rec += length($comm)  + 1;
    $next_rec += length($stamp) + 1;
    $next_rec += length($tty) + 1;
    $next_rec += length($type) + 1;
    $next_rec += length($len) + 1;

    #print("[$stamp:$tty:$type:$len:] $next_rec\n");

    #----- read data if type C
    if($type eq "b"){
      seek(DATA,$next_rec,0);
      read(DATA,$data,$len,0);
      $time = timefmt($stamp);
      print("$time [$comm:$uid $pid:$fd:$tty]$data");
    }

    #------ set pointer to beginning of next record
    $next_rec += $len;
    seek(DATA,$next_rec,0);
    $head = "";
  }

}




sub usage{
  print "This is a program to parse sebek logfiles, it is handy\n";
  print "$0 [-c|-b|-s] filename\n";
  print "\t -c extracts data gathered character by character\n";
  print "\t -b extracts data gathered in bulk\n";
  print "\t -s extracts SCPed files recorded by sebek in the log\n";
  print "\n";
}



sub main {


  my %opt;

  #--- get the action ---
  getopts("c:b:s:",\%opt);

  if($opt{c}){
    char($opt{c});
    exit();
  }

  if($opt{b}){
    bulk($opt{b});
    exit;
  }

  if($opt{s}){
    scp0($opt{s});
    scp1($opt{s});
    scp2($opt{s});
    scp3($opt{s});
    exit();
  }

  usage();


}

main();