Re: Always practice safe software: a lesson from UnrealIRCd

[Vlatko Kosturjak <kost () linux hr>]

On 06/14/2010 06:37 AM, Ron wrote:
> On Sun, 13 Jun 2010 16:32:24 -0500 Ron <ron () skullsecurity net> wrote:
> > Attaching the first version that uses timing, I'd like to get
> > comments on it -- I've only tried it against local targets, but it
> > should work better against remote ones unless the lag goes really,
> > really high. 
> >
> > I'm working on "infecting" my windows system now, then I'll release a
> > version that can detect infected Windows + Linux systems. 
> I totally failed to get a Trojanned version of UnrealIRCd running on Windows, and I don't know if any of the Windows 
> binaries were even affected, but the attached version should run on both Windows and Linux. It uses delays to check 
> whether or not the command runs, since we have no access to the output. It uses ping -n on Linux and ping -c on 
> Windows. 
>
> I opted for delaying 8 seconds by default -- Trojanned servers will respond after 8 seconds, and non-Trojanned 
> servers will respond instantly. It's long enough to avoid false positives for slow connections (no response should 
> ever take 8 seconds), but short enough that the user doesn't have to wait a long time. 
>
> Let me know if you have any comments. 

Great. I see you have even implemented 127.0.0.1 already! I have tested
it additionaly against standard ircd and hybrid and it's OK. Only
problem I have spotted is fast reconnects. It's the problem of the
original(kill it) and this timing implementation. i.e. if you run script
with something like this:
./nmap -sV -d2 -p6667,6697,8067 --script=irc-unrealircd-backdoor.nse
localhost

You'll get false-negative: it should be vulnerable, but server refused
connections because of fast reconnects due to HANGONRETRYDELAY
#define in unrealircd. That's because -sV already connects to the
service). Here's the debug output:

Initiating NSE at 07:59
NSE: NSE Script Threads (3) running:
NSE: Starting 'irc-unrealircd-backdoor' (thread: 0x8db2418) against
127.0.0.1:66
67.
NSE: Starting 'irc-unrealircd-backdoor' (thread: 0x8dadf30) against
127.0.0.1:80
67.
NSE: Starting 'irc-unrealircd-backdoor' (thread: 0x8da9a40) against
127.0.0.1:66
97.
NSE: irc-unrealircd-backdoor: Sending command: AB||SOMETHINGUNIQUE||ping
-c 9 12
7.0.0.1||ping -n 9 127.0.0.1
NSE: irc-unrealircd-backdoor: Sending command: AB||SOMETHINGUNIQUE||ping
-c 9 12
7.0.0.1||ping -n 9 127.0.0.1
NSE: irc-unrealircd-backdoor: Sending command: AB||SOMETHINGUNIQUE||ping
-c 9 12
7.0.0.1||ping -n 9 127.0.0.1
NSE: irc-unrealircd-backdoor: Receive failed: ERROR
NSE: Finished 'irc-unrealircd-backdoor' (thread: 0x8da9a40) against
127.0.0.1:66
97.
NSE: irc-unrealircd-backdoor: Receive failed: ERROR
NSE: Finished 'irc-unrealircd-backdoor' (thread: 0x8dadf30) against
127.0.0.1:80
67.
NSE: irc-unrealircd-backdoor: Receive failed: ERROR
NSE: Finished 'irc-unrealircd-backdoor' (thread: 0x8db2418) against
127.0.0.1:66
67.
Completed NSE at 07:59, 0.00s elapsed
NSE: Script Scanning completed.

As I'm not aware of any clever scheduling in NSE (i.e. to tell script to
reconnect after x seconds to same service and let other scripts execute
in the meantime), I come up with KISS (keep simple and stupid) solution
in beginning of the script:
        -- get rid of fast reconnecting annoyance
        stdnse.sleep(100)

This helps with this and original script.
I have also fixed @output part. New script is in attachment.

Let me know the comments,

Kost

Attachment: irc-unrealircd-backdoor.nse
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/