Le dimensioni dei file coinvolti sono piuttosto notevoli
.IptabLes 1103207 bytes
.IptabLex 722392 bytes
con il comando file si vede che il file non e' stato strippato
IptabLes: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, from '@%ebx', not stripped
IptabLex: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, from '@%ebx', not stripped
inoltre entrambi sono linkati staticamente (il che giustifica le dimensioni in quanto si portano dietro tutte le librerie di cui hanno bisogno)
mediante il comando strings si vede che il programma non e' criptato
-----------------------------
rm -f %s
/proc/self/exe
GETFILE_%08X
http://www.yahoo.com.http://www.baidu.com.http://www.china.com.http://www.ifeng.com
abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
/proc
/proc/%s/exe
/delxxaazz
/rc.d/r
/etc%sc%d.d/S55IptabLes
/delallmykkk
/delallmykkk>/dev/null
cp %s %s>/dev/null
/etc/rc.d/init.d/IptabLes
/etc/rc.d/IptabLes
/boot/IptabLes
%d.%d.%d
/boot/.IptabLes
/usr/.IptabLes
xxxx
#!/bin/sh
exit 0
#!/bin/sh
if [ -z $1 ] ; then
ps -f -C .IptabLes |grep .IptabLes | awk '{print $3}' | xargs $0 2
ps -f -C .IptabLes |grep .IptabLes | awk '{print $3}' | xargs $0 2
ps -f -C .IptabLes |grep .IptabLes | awk '{print $2}' | xargs $0 2
ps -f -C .IptabLes |grep .IptabLes | awk '{print $2}' | xargs $0 2
ps -axu | grep .IptabLes | awk '{print $2}' |xargs kill -9
ps -axu | grep .IptabLes | awk '{print $2}' |xargs kill -9
ps -C .IptabLes | xargs kill -9
ps -C .IptabLes | grep .IptabLes |xargs kill -9
rm -f /boot/.stabip
rm -f /boot/.IptabLes
rm -f /etc/rc.d/init.d/IptabLes
rm -f /boot/IptabLes
rm -f /tmp/IptabLes
rm -f /usr/IptabLes
rm -f /usr/.IptabLes
rm -f /boot/.IptabLes
rm -f /.IptabLes
rm -f /boot/IptabLes
rm -f /IptabLes
rm -f /etc/rc.d/rc4.d/*IptabLes
rm -f /etc/rc.d/rc1.d/*IptabLes
rm -f /etc/rc.d/rc2.d/*IptabLes
rm -f /etc/rc.d/rc3.d/*IptabLes
rm -f /etc/rc.d/rc0.d/*IptabLes
rm -f /etc/rc.d/rc5.d/*IptabLes
rm -f /etc/rc.d/rc6.d/*IptabLes
rm -f /etc/init.d/IptabLes
rm -f /etc/rc4.d/*IptabLes
rm -f /etc/rc1.d/*IptabLes
rm -f /etc/rc2.d/*IptabLes
rm -f /etc/rc3.d/*IptabLes
rm -f /etc/rc0.d/*IptabLes
rm -f /etc/rc5.d/*IptabLes
rm -f /etc/rc6.d/*IptabLes
rm -rf "$0"
else
if [ -z $2 ] ; then
exit
else
if [ 1 -ne $2 ] ; then
kill -9 $2
exit
#!/bin/bash
sleep 3
kill %d
sleep 1
rm -f %s
rm -rf "$0"
sh /delxxaazz
/proc/net/dev
face
rrrrrrss
FATAL: exception not rethrown
/proc/sys/kernel/version
/proc/sys/kernel/osrelease
FATAL: kernel too old
FATAL: cannot determine kernel version
/dev/full
set_thread_area failed when setting up thread-local storage
UUUU
?3333
/bin/sh
exit 0
LIBC_FATAL_STDERR_
/dev/tty
-----------------------------
si legge anche chiaramente dove vengono messi i file ed alcuni comandi di shell
Francamente non ho esperienza in Assembler ma mediante il decompilatore RecStudio e' possibile leggere in chiaro il nome delle funzioni tra cui si vede chiaramente SynFlood e DNSFlood che corrisponde a quanto fa effettivamente il programma
