The ELF Virus Writing HOWTO: sparc-debian2.2-linux
Prev |  | Next

# 7. Scanners

| Enough research will tend to support your theory.
| Murphy's Law of Research

This is the platform dependent part of Scanners (i). It contains three things:

- Verifying peculiarities of system files.

- Choosing appropriate targets to demonstrate infection methods.

- Testing scanners on all infected executables.

All together this results in a kind of time warp. The infection methods detected here are described later on.

## 7.1. Finding executables

First a sample from `file` to show how the `sed` part is supposed to work.

Source: pre/sparc-debian2.2-linux/scanner/file.sh

    #!/bin/bash
    /usr/bin/file /bin/bash | /usr/bin/fmt

Output: out/sparc-debian2.2-linux/scanner/file

    /bin/bash: ELF 32-bit MSB executable, SPARC, version 1, dynamically linked
    (uses shared libs), stripped

And now the output of `find_exec.sh` for both the big and the small set of target executables. Linux distributions and Solaris have very few statically linked programs. On FreeBSD the number is much higher.

Output: out/sparc-debian2.2-linux/scanner/big.wc

    [] /bin /sbin /usr/bin /usr/sbin /usr/lib
          2 out/sparc-debian2.2-linux/scanner/big.static
        628 out/sparc-debian2.2-linux/scanner/big.dynamic
        630 total

Output: out/sparc-debian2.2-linux/scanner/small.wc

    [_infected] tmp/sparc-debian2.2-linux
          0 out/sparc-debian2.2-linux/scanner/small.static
          5 out/sparc-debian2.2-linux/scanner/small.dynamic
          5 total

## 7.2. Scan entry point

See Sections for the illustrative description of a dumped ELF header.

Output: out/sparc-debian2.2-linux/scanner/entry_point/big.static

    files=0002; detected=0000

Output: out/sparc-debian2.2-linux/scanner/entry_point/big.dynamic

    files=0628; detected=0000

Well, on a clean system there are absolutely no deviations. Now we let the script loose on all infected executables produced from the sources of this document. Only a few are detected (note the directory name `e1i1`). Which means there is cure against this vulnerability (see The entry point). In the following output `ep` means "entry point" and `sot` is "start of .text".

Output: out/sparc-debian2.2-linux/scanner/entry_point/small.dynamic

    segment_padding/e1i1/tcsh_infected           ep=0x57500    sot=0x11d9c
    segment_padding/e1i1/perl_infected           ep=0x9fcd0    sot=0x1eed0
    segment_padding/e1i1/mt_infected             ep=0x14390    sot=0x10d78
    segment_padding/e1i1/bash_infected           ep=0x85770    sot=0x1f598
    segment_padding/e1i1/strip_bash_infected     ep=0x85770    sot=0x1f598
    files=0005; detected=0005

## 7.3. Scan segments

Note that only the last few lines of output are shown.

Output: out/sparc-debian2.2-linux/scanner/segment/big.static

    CHECK: /usr/bin/ldd
    CHECK: src/scanner/segment/action.inc#17
    CHECK: (delta) > (0x10000)
    CHECK: 65536 > 65536; 0x10000 > 0x10000
    files=2; ok=2; det_page=0; det_align=1; min=0x10000; max=0x0000

Output: out/sparc-debian2.2-linux/scanner/segment/big.dynamic

    CHECK: 65536 > 65536; 0x10000 > 0x10000
    CHECK: /usr/lib/emacs/20.7/sparc-debian-linux-gnu/hexl
    CHECK: src/scanner/segment/action.inc#17
    CHECK: (delta) > (0x10000)
    CHECK: 65536 > 65536; 0x10000 > 0x10000
    CHECK: /usr/lib/postgresql/bin/postgres
    CHECK: src/scanner/segment/action.inc#17
    CHECK: (delta) > (0x10000)
    CHECK: 65536 > 65536; 0x10000 > 0x10000
    files=628; ok=628; det_page=0; det_align=59; min=0x10000; max=0x10005

On this installation at least 628 + 2 files are possible targets for Segment padding infection. So on to all infected executables created from the sources of this document. Again only the last few lines of output is shown. It's enough to see that all infected files are detected.

Output: out/sparc-debian2.2-linux/scanner/segment/small.dynamic

    CHECK: 61441 > 65536; 0xf001 > 0x10000
    CHECK: tmp/sparc-debian2.2-linux/segment_padding/e1i1/bash_infected
    CHECK: src/scanner/segment/action.inc#17
    CHECK: (delta) > (0x10000)
    CHECK: 61445 > 65536; 0xf005 > 0x10000
    CHECK: tmp/sparc-debian2.2-linux/segment_padding/e1i1/strip_bash_infected
    CHECK: src/scanner/segment/action.inc#17
    CHECK: (delta) > (0x10000)
    CHECK: 61445 > 65536; 0xf005 > 0x10000
    files=5; ok=5; det_page=0; det_align=5; min=0xf001; max=0xf005

## 7.4. A shell for segment padding

I want to demonstrate infection methods on a shell. The usual suspect is `/bin/sh`. But on some systems that particular executable is not vulnerable to Segment padding infection.

Source: pre/sparc-debian2.2-linux/scanner/find-shell.sh

    #!/bin/bash
    /bin/sed -ne 's/ \.\.\. .* Ok$//p' \
    	out/sparc-debian2.2-linux/scanner/segment/big.dynamic.full \
    	out/sparc-debian2.2-linux/scanner/segment/big.static.full \
    | /bin/grep -f ./src/scanner/find-shell.lst
    /bin/echo status=$?

Source: src/scanner/find-shell.lst

    bin/ash\>
    bin/bash\>
    bin/bsh\>
    bin/csh\>
    bin/ksh\>
    bin/sash\>
    bin/sh\>
    bin/tcsh\>

Output: out/sparc-debian2.2-linux/scanner/find-shell

    /bin/bash
    /usr/bin/tcsh
    status=0

## 7.5. Scan file size

Output: out/sparc-debian2.2-linux/scanner/filesize/big.dynamic

    files=628; ok=628; detected=0

Output: out/sparc-debian2.2-linux/scanner/filesize/big.static

    files=2; ok=2; detected=0

Output: out/sparc-debian2.2-linux/scanner/filesize/small.dynamic

    files=5; ok=5; detected=0

Prev | Home | Next
Sections |  | Segment padding infection