The ELF Virus Writing HOWTO: i386-redhat8.0-linux
PrevNext

1. Variables and packages

 

Once it hits the fan, the only rational choice is to sweep it up, package it, and sell it as fertilizer.

 anonymous

This document tries to cover multiple platforms through conditional compilation. There is a configure.pl that determines the host type and sets up a config.sh containing environment variable definitions. There also are equivalent config.csh, config.h, config.mak, config.sed, and config.xml. The Makefile then uses individual sub-directories for each platform. The name of these directories (and some other platform specific values) is retrieved through environment variables. The directory structure is not without meaning.

1.1. Variables prefixed with TEVWH_

The files in src/ are obfuscated with obscene amounts of variable references like ${TEVWH_ELF_BASE} or even ${TEVWH_PATH_LS}. I admit that using variables instead of plain program names makes shell scripts harder to read. But this is necessary to maintain a minimum level of reproducibility on SunOS. Anyway, directory pre/ makes that 8048000 and /bin/ls. You will encounter this syntax nightmare only in a few places. An almost complete list of used variables is given below.

Table 1. Variables prefixed with TEVWH_

Variable nameValue on this platform
ASM_FLAVORset disassembly-flavor intel
CFLAGS-Wall -O1 -I . -I out/i386-redhat8.0-linux -D NDEBUG
OS_NAMERed Hat Linux release 8.0 (Psyche)
OUT_XMLout/i386-redhat8.0-linux/xml
Variable nameValue on this platformVariable nameValue on this platform
AFLAGS-I . -D _ASMARCHi386
ASMi386_Linux_intelASM_COMMENT;
ASM_OBJDUMP-MintelASM_RETURN(ret|hlt)
ASM_STYLEintelBYTE_ORDERL
ELF_ADDRElf32_AddrELF_ADDR_SIZE32
ELF_ALIGN1000ELF_BASE8048000
ELF_EHDRElf32_EhdrELF_MAGIC8048001
ELF_OFFElf32_OffELF_PAGE_SIZE1000
ELF_PHDRElf32_PhdrELF_SHDRElf32_Shdr
HOSTTYPELinux/i386OS_CODEi386-redhat8.0-linux
OS_PKG_SYSrpmOS_VENDORredhat
OS_VERSION8.0OUTout/i386-redhat8.0-linux
PREpre/i386-redhat8.0-linuxPROC_EXE/proc/self/exe
PROC_MEM/proc/self/memTMPtmp/i386-redhat8.0-linux
UNAMELinux  

Note that hexadecimal shell variables actually miss the leading 0x to simplify calculations with bc. These values are also available to C code through corresponding #define statements after #include <config.h>. Values are not quoted, but hexadecimal values are correctly prefixed by 0x.

1.2. Variables prefixed with TEVWH_PATH_

Table 2. Variables prefixed with TEVWH_PATH_

Variable nameValue on this platformVariable nameValue on this platform
BASH/bin/bashBC/usr/bin/bc
CAT/bin/catCC/usr/bin/gcc
CHMOD/bin/chmodCSH/bin/tcsh
CUT/bin/cutDD/bin/dd
DISTID/etc/redhat-releaseDU/usr/bin/du
ECHO/bin/echoEXPAND/usr/bin/expand
FILE/usr/bin/fileFIND/usr/bin/find
FMT/usr/bin/fmtGDB/usr/bin/gdb
GREP/bin/grepHEXDUMP/usr/bin/hexdump
KILL/usr/bin/killLD/usr/bin/ld
LDD/usr/bin/lddLS/bin/ls
MAKE/usr/bin/makeMAN/usr/bin/man
NASM/usr/bin/nasmNDISASM/usr/bin/ndisasm
NICE/bin/niceNM/usr/bin/nm
OBJDUMP/usr/bin/objdumpOD/usr/bin/od
PERL/usr/bin/perlREADELF/usr/bin/readelf
RPM/bin/rpmSED/bin/sed
SH/bin/bashSORT/bin/sort
STRACE/usr/bin/straceSTRINGS/usr/bin/strings
STRIP/usr/bin/stripTAIL/usr/bin/tail
TEE/usr/bin/teeTR/usr/bin/tr
UNIQ/usr/bin/uniqWC/usr/bin/wc
XARGS/usr/bin/xargsXXD/usr/bin/xxd

1.3. The name of the X

Command: src/packages/uname.sh 
#!/bin/sh
uname -mprs
echo "[${HOSTTYPE}]"
echo "[${VENDOR}]"
echo "[${OSTYPE}]"
echo "[${MACHTYPE}]"
echo "[${LANG}]"

The value of LANG is not directly related. But some tools create strange output for en_US.UTF-8.

Output: out/i386-redhat8.0-linux/packages/uname 
Linux 2.4.19 i586 i586
[i386-linux]
[intel]
[linux]
[i386]
[en_US]

While most Linux distributions ship with slightly modified kernels, no vendor has ever dared to mess with the values returned by uname(2). Instead the tradition of distribution dependent text files in directory /etc was established.

Command: pre/i386-redhat8.0-linux/packages/distid.sh 
#!/bin/bash
# We need this script to copy the id-file into directory out/.
# I use many machines to test examples, but only one to render the document.

/bin/cat /etc/redhat-release

Output: out/i386-redhat8.0-linux/packages/distid 
Red Hat Linux release 8.0 (Psyche)

1.4. The owner of files

One of the lesser known features of package management is self-reflection. How do we determine the package owning a file if we have the canonical path name?

Red Hat Linux release 8.0 (Psyche) uses rpm for package management. It maintains an extensive database in /var/lib/rpm/ in binary form. Query operations are quite fast, but disk space usage is rather high.

Source: pre/i386-redhat8.0-linux/packages/rpm/du.sh 
#!/bin/bash
/usr/bin/file /var/lib/rpm/*
/usr/bin/du -s /var/lib/rpm

Output: out/i386-redhat8.0-linux/packages/du 
/var/lib/rpm/Basenames:      Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Conflictname:   Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/__db.001:       data
/var/lib/rpm/__db.002:       X11 SNF font data, LSB first
/var/lib/rpm/__db.003:       X11 SNF font data, LSB first
/var/lib/rpm/Dirnames:       Berkeley DB (Btree, version 8, native byte-order)
/var/lib/rpm/Filemd5s:       Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Group:          Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Installtid:     Berkeley DB (Btree, version 8, native byte-order)
/var/lib/rpm/Name:           Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Packages:       Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Providename:    Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Provideversion: Berkeley DB (Btree, version 8, native byte-order)
/var/lib/rpm/Pubkeys:        Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Requirename:    Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Requireversion: Berkeley DB (Btree, version 8, native byte-order)
/var/lib/rpm/Sha1header:     Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Sigmd5:         Berkeley DB (Hash, version 7, native byte-order)
/var/lib/rpm/Triggername:    Berkeley DB (Hash, version 7, native byte-order)
26244	/var/lib/rpm

The query is straightforward:

Source: pre/i386-redhat8.0-linux/packages/rpm/simple.sh 
#!/bin/bash
/bin/rpm -qf $( which perl )

Output: out/i386-redhat8.0-linux/packages/simple 
perl-5.8.0-55

Output format is customizable. A list of available tag names is output by rpm --querytags.

Source: pre/i386-redhat8.0-linux/packages/rpm/custom.sh 
#!/bin/bash
/bin/rpm -q -f $( which perl ) \
--qf 'name=%{name}\nversion=%{version}\nrelease=%{release}\n'

Output: out/i386-redhat8.0-linux/packages/rpm/custom 
name=perl
version=5.8.0
release=55

1.5. The source of man-pages

Option -a of man returns all matching entries, not just the lowest section. This behavior is identical between platforms.

Command: pre/i386-redhat8.0-linux/packages/man-all/Linux.sh 
#!/bin/bash
/usr/bin/man -a -w kill

Output: out/i386-redhat8.0-linux/packages/man-all 
/usr/share/man/man1/kill.1.gz
/usr/share/man/man2/kill.2.gz

Requesting a specific section requires option -s section on SunOS, while Linux and FreeBSD prefer a plain section.

Command: pre/i386-redhat8.0-linux/packages/man-section/Linux.sh 
#!/bin/bash
/usr/bin/man -w 2 kill

Output: out/i386-redhat8.0-linux/packages/man-section 
/usr/share/man/man2/kill.2.gz

1.6. Verifying installed packages

This chapter is not about checking the integrity of package files. See Intrusion detection systems (i) for a general introduction.

rpm(1) lets you verify everything or complete packages. A package can be specified indirectly through a file owned by it, though.

Command: pre/i386-redhat8.0-linux/packages/rpm/verify.sh 
#!/bin/bash
/bin/rpm -qf /etc/profile
/bin/rpm --verify bash
/bin/echo status=$?
/bin/rpm --verify -f /etc/profile
/bin/echo status=$?

Output: out/i386-redhat8.0-linux/packages/verify 
setup-2.5.20-1
status=0
S.5....T c /etc/csh.cshrc
missing  c /etc/csh.login
S.5....T c /etc/printcap
..?..... c /etc/securetty
status=1

A quick fix to lower the noise is to ignore all files flagged as " c ". Take the following as inspiration for a cron-based script.

Command: pre/i386-redhat8.0-linux/packages/rpm/verify-all.sh 
#!/bin/bash
/bin/nice -n 19 /bin/rpm --verify --all \
| /bin/grep -v '........ c'

With option -p package_file you can verify against the checksums included in a package file, e.g. on the installation CD.

PrevHomeNext
The ELF Virus Writing HOWTO The magic of the Elf