Ramen worm . More details on it. ( found a password and e-mails crypted inside it)

[Mihai Moldovanu <mihaim () PROFM RO>]

I completed reverse engineering the ramen worm. There are 3 crypted text messages in the worm :
2 are email addresses :
Decrypted: "gb31337 () hotmail com" ,  in executable ->  "fa20226?gnsl`hk-bnl"
Decrypted: "gb31337 () yahoo com" ,   in executable ->  "fa20226?x`gnn-bnl"
and a crypted password :
Decrypted "bl3h"  ,   in executable -> "ak2g"
This texts can be found in almost all ELF worm executables.
Crypting algorithm is verry easy.

For each characted in crypted text add 1 and you will obtain the plain text
i used the following C code to decrypt :

for (i= 0 ;i<strlen(text) ;i++) a[i] = a[i] +1;

The asp executable ( the one wich get's installed in /sbin/asp and serve requests on 27374 )  has a strange getline 
function coded wich
seems to be specialy crafted to allow remote upload / execution of code . Unfortunately I can't prove that function 
have a buffer
overflow in it .




--
Lead programmer,
Mihai Moldovanu (mihaim () profm ro)
WEB:    http://tfm.profm.ro/
        http://www.slashdot.ro/