Rootkit Final

download Rootkit Final

of 21

Transcript of Rootkit Final

  • 8/3/2019 Rootkit Final

    1/21

    ]dl Ebnia Odip}lv

    9 q F l a g C g } d i j A i f s

    Flag Cg}dijVlslivod P|faboi}bgn Mloljflv 6099

    ]dl Ebnia Odip}lv

    Fbaa Fa|nmln

    Pvbnobpia Bnuls}bci}gv

    Flag Cg}dij Aifs

    .flagcg}dij.ogj

    Pvleiol

    ]dbs ogn}ln} is gvbcbniaar bn}lnmlm }g ippliv bn }dl 6nm lmb}bgn ge]dl Vgg}hb}

    Ivslniais in ltpinmlm }vli}jln} ge }dl ais} odip}lv evgj }dl 9s} lmb}bgn. Egv i

    n|jflv ge vlisgns }dl p|fabsdlv dis gp}lm }g pvloa|ml b}. Is }dl i|}dgv! B oin }ls}ber

    }di} ]dl Vgg}hb} Ivslniabs in iaalcgvr bn mbsc|bsl. Flnli}d iaa ge }dl mlubol mvbulv

    }dlgvr inm }dl sg|vol ogml bs i mllplv jlssicl. Vi}dlv }din al} }dbs jlssicl fl ags}

    }dvg|cd gjbssbgn! b}d }dl ognsln} ge }dl p|fabsdlv B diul mlobmlm }g vlalisl }dbs

    gvpdinlm odip}lv is i s}inm*iagnl lssir.

  • 8/3/2019 Rootkit Final

    2/21

    ]dl Ebnia Odip}lv

    6 q F l a g C g } d i j A i f s

    Inrgnl dg dis s}|mblm jiaivl! vgg}hb}s bn piv}bo|aiv! hngs }di} b}s ln}bvlar elisbfal egv i slljbncar

    bnngo|g|s ab}}al ippaboi}bgn $alss }din

  • 8/3/2019 Rootkit Final

    3/21

    ]dl Ebnia Odip}lv

    ? q F l a g C g } d i j A i f s

    Ni}|viaar! }dlvl ivl iasgpvlmbspgsbnc oi|sls }di} lnifalm }dl ltob}bnc eio}gv! abhl pggv y|iab}r iss|vinol

    gn fldiae ge }dl ulnmgv! ng} }g jln}bgn }di} }dl ltpagb}lm ippaboi}bgn is pvgfifar i aivcl ogjpaboi}lm

    pvgm|o}! inm dlnol jgvl pvgnl }g f|cs.

    Ebniaar! }dlvl ivl vljg}l oi|sls }di} diul in luln alss gfubg|s ognnlo}bgn }g di} dipplnlm. Egv

    ltijpal! }dl |slv dg gns }dl bnelo}lm jiodbnl jir diul flln bn i v|sd }g cg sgjldlvl inm

    ioobmln}iaar oabohlm gn sgjl}dbnc }di} dl g|amn} ngvjiaar diul oabohlm gn.

    ]dl lnm vls|a} ge }dl bnels}i}bgn bs }di} }dl }ivcl}lm jiodbnl oin} fl }v|s}lm }g mg di} b} oaibjs }g fl

    mgbnc gv }g pvgubml }dl |slv b}d ioo|vi}l bnegvji}bgn. ]dl vgg}hb} }di}s flln agmclm bn }dl vlolssls ge

    b}s bnevis}v|o}|vl ognolias }dl bnea|lnol ge }dl bn}v|mlv! dg baa ng mg|f} fl f|sr ebnmbnc irs }g

    jgnl}b{l }dlbv ioolss i} }dl ltplnsl ge }dl |slv $l.c. bmln}b}r }dle}! ovlmb} oivm evi|m! l}o.".

    Is B mbso|sslm bn }dl pvlubg|s odip}lv! }dl gnar egga pvgge ir }g vl}|vn }dl }ivcl}lm jiodbnl }g i

    }v|s}lm s}i}l bs }g vlf|bam b}. Sb}d i vgg}hb}! rg| oin nlulv fl s|vl k|s} dg mllp }dl s|fulvsbgn lt}lnms.

    I s|vcboia s}vbhl jir s|oollm bn |nliv}dbnc plvbpdlvia iv}beio}s $gv! bn }dl pi}dgagcboia oisl mlogr

    fbnivbls" f|} eiba }g vljgul }dl ogvl ogjpgnln}s ge }dl vgg}hb}! iaagbnc }dl bn}v|mlv }g vlcibn ioolss.

    Ebc|vl 9

    ]ihl i jgjln} }g mbcls} inm bn}lvniab{l }dbs jl}ipdgv $sll Ebc|vl 9". Bn in ifs}vio} slnsl! }dbs bs ltio}ar

    di}s dipplnlm }g }dl pgab}boia srs}lj bn }dl \nb}lm _}i}ls inm }dl logngjbo lnubvgnjln} }di} g|v

    pgab}boia srs}lj sdipls.

  • 8/3/2019 Rootkit Final

    4/21

    ]dl Ebnia Odip}lv

    = q F l a g C g } d i j A i f s

    Ubsbfal _rjp}gjs

    Is b}d i ogjpvgjbslm ogjp|}lv! di}s dipplnbnc }g g|v sgobl}r bsn} pi}ln}ar oaliv. Dglulv! }dlvl

    ivl mlebnb}lar slognmivr bnmboi}bgns inm ivnbncs }di} dbn} }di} sgjl}dbnc bs vgnc. G|v jiodbnl! sg }g

    splih! dis flogjl |nvlspgnsbul inm bsn} nlolssivbar e|no}bgnbnc is }dl evijlvs bn}lnmlm b} }g._plobeboiaar! sbnol }dl 9230s }dlvl dis flln i cvgbnc logngjbo mbspivb}r bn }dl \nb}lm _}i}ls fl}lln

    }dl clnlvia pgp|ai}bgn inm i sjiaa s|fsl} ge plgpal i} }dl }gp ge }dl bnogjl splo}v|j.

    ]dbs cvgbnc bnly|iab}r dis flln laa mgo|jln}lm.9 Evgj 923= }g 6004! }dl sdivl ge iaa livnlm bnogjl

    bn }dl \nb}lm _}i}ls $bnoa|mbnc oipb}ia cibns" ge }dl }gp 9 plvoln} ge g|v pgp|ai}bgn bnovlislm evgj

    ippvgtbji}lar 2 plvoln} }g sabcd}ar gulv 60 plvoln}. Egv }dl }gp }ln}d ge i plvoln} ge }dl pgp|ai}bgn!

    }dlsl ebc|vls diul cgnl evgj 6.3 }g 90.= plvoln} ge iaa livnlm bnogjl. ]dlbv sdivl ge }dl pbl jgvl }din

    }vbpalm.

    B}s bn}lvls}bnc }g ng}l }di} bn 9264! k|s} flegvl }dl Cvli} Mlpvlssbgn! }dl }gp livnlvs }di} jiml |p }dl}gp }ln}d ge i plvoln} ge }dl pgp|ai}bgn lvl jihbnc jgvl }din 99 plvoln} ge iaa livnlm bnogjl bn }dl

    \nb}lm _}i}ls. Rg| oin }ihl i aggh i} }dl vi n|jflvs! }dlrvl iuibaifal gnabnl .6

    Sdbal }dl lia}dr lvl iodblubnc bjpvlssbul cibns! }dbncs lvln} is vgsr egv jbmmal *oaiss Ijlvboins

    inm fa|l ogaaiv gvhlvs. Mi}i evgj }dl Ogncvlssbgnia F|mcl} Geebol bs pvgubmlm bn ]ifal 9.? Is rg| oin

    sll! }dl pggvls} ebe}d ge }dl pgp|ai}bgn ltplvblnolm in 99 plvoln} vbsl bn }dlbv iulvicl ie}lv*}it bnogjl

    evgj 9232 }g 6005. ]dl nlt} }g ebe}ds ltplvblnolm in bnovlisl ge 94 plvoln} inm 69 plvoln}!

    vlsplo}bular.

    ]dl }gp 9 plvoln} b}nlsslm i s}icclvbnc 6

  • 8/3/2019 Rootkit Final

    5/21

    ]dl Ebnia Odip}lv

    < q F l a g C g } d i j A i f s

    }gp. Be rg| aggh i} }dl vi n|jflvs bn ]ifal 9! b} baa flogjl gfubg|s }di} }dl uis} jikgvb}r ge gvhbnc

    plgpal diul flln }vlimbnc i}lv gv iodblubnc jgmls} cibns $i} fls}" dbal }dl plgpal i} }dl }gp ge }dl

    splo}v|j diul flln vihbnc b} bn.

    Og|pal }dbs s|s}ibnlm cvg}d ge logngjbo bnly|iab}r b}d ogns}in}ar sdvbnhbnc flnleb}s! abjb}lm sgobia

    jgfbab}r! inm |nljpagrjln} }di} dgulvs oagsl }g 90 plvoln}.= Evblnms! laogjl }g }dl Sbnnlv*]ihl*Iaa

    logngjr.

    ]dl \nmlvarbnc Pvgfalj

    Bn g|v sgobl}r! vlia pglv mgls ng} dippln }g abl bn }dl pgab}boia srs}lj!

    b} abls bn }dl pvbui}l logngjr.

    Ngij Odgjshr

    _g! di}s cgbnc gn7 Sdi} ioog|n}s egv }dl bnovlisbnc mbspivb}r7 Be rg| aggh }g Vlp|faboin bmlgagc|ls

    egv c|bminol! }dlraa pgbn} }g i uis} ognspbvior gn }dl ale}. Abhlbsl! be rg| y|lvr }dl Mljgovi}s ! }dlraa

    pgbn} }g i uis} ognspbvior gn }dl vbcd}. ]dl pvgfalj b}d }dbs }g*piv}r sodlji bs }di} b} eibas }g

    vlogcnb{l }di} l io}|iaar ltbs} bn i sbncal*piv}r srs}lj; }dl ogvpgvi}l piv}r. Gulv }dl pis} }dvll

    mloimls! f|sbnlss bn}lvls}s diul cvim|iaar ognsgabmi}lm }dlbv ogn}vga gulv }dl pgaborjihbnc lncbnl bn

    Sisdbnc}gn. Bn sdgv}! }dlrul vgg}lm MO.

    Cvin}lm }dlbv bnea|lnol bsn} }g}ia! f|} b}s ognsbmlvifal lng|cd }g mbo}i}l }dl v|als }di} gppgsbnc cvg|ps

    j|s} gfslvul inm }g evijl }dl }lvjs ge p|fabo mbsog|vsl. Bn }dbs jinnlv! }dlrul s|oollmlm bn |sbnc

    }dlbv ogn}vga }g sdipl }dl logngjr! vlsl} }it vi}ls! inm clnlviaar cl} mljgovior }g slvul }dlbv

    logngjbo cgias.

    Gnl jbcd} ivc|l; Dlr! di}s sg fim ifg|} ogvpgvi}bgns7 B jlin! i ogvpgvi}bgn bs vliaar k|s} i f|nod ge

    plgpal }di} gvh }gcl}dlv. _g di} flnleb}s i ogvpgvi}bgn iasg flnleb}s }dl ljpagrlls }di} ogns}b}|}l

    }di} ogvpgvi}bgn. Sdi}s vgnc b}d }di}7

    ]g vlspgnm }g }dbs ivc|jln} b}s nlolssivr }g |nmlvs}inm }dl }v|l ni}|vl ge i ogvpgvi}bgn in m }dl

    cvg}lsy|l mbspivb}r }di} dis lugaulm gulv }dl rlivs fl}lln ogvpgvi}l alimlvsdbp inm }dl iulvicl vinh*

    inm*ebal ljpagrll.

    Ebvs} inm egvljgs}! fr mlebnb}bgn p|fabo ogvpgvi}bgns ltbs} }g jitbjb{l sdivldgamlv uia|l. B} k|s} sgdipplns }di}! is ge 6003! }dl lia}dbls} 9 plvoln} ge }dl \nb}lm _}i}ls pgp|ai}bgn gns ifg|} diae ge iaa

    g|}s}inmbnc s}goh! ebninobia slo|vb}bls! }v|s} ly|b}r! inm f|sbnlss ly|b}r! inm 64 plvoln} ge ngn*dgjl

    =Kiogf Diohlv inm Pi|a Pblvsgn! Sbnnlv*]ihl*Iaa Pgab}bos; Dg Sisdbnc}gn Jiml }dl Vbod Vbodlv inm ]|vnlm B}s Fioh gn }dl

    Jbmmal Oaiss! _bjgn % _od|s}lv! 6090

  • 8/3/2019 Rootkit Final

    6/21

    ]dl Ebnia Odip}lv

    5 q F l a g C g } d i j A i f s

    vlia ls}i}l. E|v}dlvjgvl! }dl }gp 90 plvoln} ge }dl vbodls} eijbabls ioog|n}lm egv ifg|} 4< }g 20 plvoln}

    ge s}goh sdivls! fgnms! }v|s}s! f|sbnlss ly|b}r! inm ngn*dgjl vlia ls}i}l.iulvicl gvhlv jiml. Fr 6003! }dbs ebc|vl dim vgohl}lm }g ?00 }bjls }dl iulvicl icl.5 Bn 6002! }dl

    iulvicl bnogjl ge i OLG i} in _%P

  • 8/3/2019 Rootkit Final

    7/21

    ]dl Ebnia Odip}lv

    3 q F l a g C g } d i j A i f s

    }dlr oijl g|} inm gplnar imjb}}lm }di} }dlr lvl v|nnbnc }dl sdg! }dl vls} ge |s jbcd} io}|iaar mg

    sgjl}dbnc ifg|} b}.

    Airlvs ge Oi|siab}r

    Dg mbm b} ogjl }g }dbs7 Gulv i ?0*rliv spin! dg mbm }dl ogvpgvi}l bn}lvls}s }di} vlpvlsln} }dl |pplv

    oaiss ogjjinmllv g|v pgab}boia bns}b}|}bgns inm |sl }dlj }g jgnl}b{l }dlbv bnea|lnol7 ]dlvl bs ng sbncal

    o|apvb}. Bn eio}! b} g|am fl niul }g pgbn} i ebnclv i} inr gnl oi|sl. Is b}d slo|vb}r bnobmln}s! }dlvl ivl

    }rpboiaar i n|jflv ge mbeelvln} eio}gvs io}bnc bn ognolv} i} uivbg|s alulas.

    Ltob}bnc Oi|sls

    Bn }dl ai}l 9250s inm livar 9230s! f|sbnlss bn}lvls}s eiolm i slvbls ge jikgv pgab}boia mleli}s }di}

    vlugaulm ivg|nm cgulvnjln} vlc|ai}bgn $}dl Ni}bgnia ]vieebo inm Jg}gv Uldboal _iel}r Io} 9255! }dl

    Ni}bgnia Lnubvgnjln}ia Pgabor Io} 9252! inm Goo|pi}bgnia _iel}r inm Dlia}d Io} 9230! inm sg gn".

    Bn vlspgnsl! ogvpgvi}l bn}lvls}s gvcinb{lm sg }di} }dlr og|am pgga vlsg|vols! ioy|bvl mgjibn*splobebo

    ltplv}bsl! inm pvgio}bular bnb}bi}l s|s}ibnlm! oivle|aar oggvmbni}lm oijpibcns iovgss j|a}bpal evgn}s.

    ]dlr egvjlm cvg|ps abhl }dl F|sbnlss Vg|nm ]ifal! dbod is ls}ifabsdlm bn 9236! inm fgas}lvlm }dl

    vinhs ge ltbs}bnc gvcinb{i}bgns abhl }dl \._. Odijflv ge Ogjjlvol.

    ]dl gulvivodbnc cgia ge }dbs ov|siml is }g bnea|lnol }dl pgaborjihbnc pvgolss }g fl}}lv slvul }dl

    ogvpgvi}l iclnmi. Sdlvlis lalo}bgns jir mlobml dg lnms |p bn geebol! di} i alcbsai}gv mgls gnol dl

    cl}s }dlvl bs di} vliaar og|n}s. Sdg oivls dg cl}s lalo}lm k|s} is agnc is rg| oin y|bl}ar c|bml di}

    dl mgls ie}lv }dl eio}7 Dlnol! f|sbnlss bn}lvls}s mbvlo}lm i ag} ge vlsg|vols $b.l. vlim jgnlr" }g }dbs lnm

    }dvg|cd agffrbnc! ge}ln b}dg|} vlcivm }g piv}r ieebabi}bgn.

    Ioogvmbnc }g }dl Oln}lv egv Vlspgnsbul Pgab}bos! f|sbnlss bn}lvls}s ciul -9.? fbaabgn }g oinmbmi}ls inm

    pgab}boia piv}bls bn 6090. Ogjpivl }dbs }g aifgv bn}lvls}s! dbod gnar ciul -26 jbaabgn. Ng ognsbmlv }dl

    eio} }di} -?.=3 fbaabgn is spln} gn agffrbnc bn 6090. E|v}dlvjgvl! jgs} ge }dl fbc splnmlvs bn }dl

    agffrbnc ivlni ivl ogvpgvi}l pairlvs. ]ifal 6 abs}s }dl }gp 90 aivcls} agffrbnc cvg|ps gvmlvlm fr mgaaivs

    spln}.90

    Is rg| oin sll! }dl |nbgns ivl ogjpal}lar g|}c|nnlm. ]g ebcd} i iv rg| nllm i bnnbnc s}vi}lcr! i

    mbsobpabnlm inm oipifal gvcinb{i}bgn inm $jgs} bjpgv}in}ar" }dl vlsg|vols }g s|ppgv} b} }dvg|cd agnc*

    }lvj ogneabo}s. Sdln b} ogjls }g pgsslssbnc }dl jgnlr }g vibsl inm s|s}ibn ivjbls! }dl lia}dr lab}ldgam }dl imuin}icl.

    90d}}p;''.gplnslovl}s.gvc'agffr'}gp.pdp7sdgRliv:6090%bnmlt]rpl:s

  • 8/3/2019 Rootkit Final

    8/21

    ]dl Ebnia Odip}lv

    4 q F l a g C g } d i j A i f s

    Gvcinb{i}bgn Agffrbnc Oisd _pln}

    \_ Odijflv ge Ogjjlvol -9?6!053!Clnlvia Lalo}vbo -?2!620!000

    ElmLt Ogvp -6

    Ijlvboin Jlmboia Issgobi}bgn -66!

    Pdivjiol|}boia Vlslivodlvs % Jin|eio}|vlvs ge Ijlvboi -69!3=0!000

    Fa|l Ovgss'Fa|l _dblam -69!003!9=9

    Ogngog Pdbaabps -92!565!?46

    Ijlvboin Dgspb}ia Issgobi}bgn -92!=?4!?

  • 8/3/2019 Rootkit Final

    9/21

    ]dl Ebnia Odip}lv

    2 q F l a g C g } d i j A i f s

    I_BML ]dl Pglaa Jljgvinm|j

    ]dl fa|lpvbn} }di} aivcl ogvpgvi}bgns |slm $iccvlssbul agffrbnc! pgabor bns}b}|}ls! i dliur ljpdisbs gn

    p|fabo vlai}bgns! l}o." bn }dlbv leegv} }g cibn ogn}vga flivs in |noinnr vlsljfainol }g bmlis pvlsln}lm bn

    i jljg }di} i ogvpgvi}l airlv nijlm Albs Pglaa sln} }g }dl mbvlo}gv ge }dl \._. Odijflv ge

    Ogjjlvol gn I|c|s} 6?! 9239

    99

    . ]g jgn}ds ai}lv! Pglaa ioolp}lm Vbodivm Nbtgns ngjbni}bgn }gslvul gn }dl \._. _|pvljl Og|v}.

    Bn dbs jljg! Pglaa isslv}s }di} _}vlnc}d abls bn gvcinb{i}bgn! bn oivle|a agnc*vincl painnbnc inm

    bjpaljln}i}bgn! bn ognsbs}lnor ge io}bgn gulv in bnmlebnb}l plvbgm ge rlivs! bn }dl soial ge ebninobnc

    iuibaifal gnar }dvg|cd kgbn} leegv}! inm bn }dl pgab}boia pglv iuibaifal gnar }dvg|cd |nb}lm io}bgn inm

    ni}bgnia gvcinb{i}bgns.

    Pglaa iasg ljpdisb{ls }dl nllm }g ls}ifabsd }dl s}iees ge ljbnln} sodgaivs! vb}lvs inm splihlvs! dg

    baa mg }dl }dbnhbnc! }dl iniarsbs! }dl vb}bnc inm }dl splihbnc. B} baa iasg fl lssln}bia }g diul s}iee

    plvsgnnla dg ivl }dgvg|cdar eijbabiv b}d }dl jlmbi! inm dg jgs} leelo}bular }g ogjj|nboi}l b}d}dl p|fabo.

    \sbnc }dlbv nleg|nm gvcinb{i}bgnia oag|}! gulv }dl pis} }dvll mloimls fbc f|sbnlss dis s|oollmlm bn

    nl|}lvbnc }dl gnl pgab}boia cvg|p }di} dis ognsbs}ln}ar eg|cd} egv logngjbo bss|ls gn fldiae ge jbmmal*

    oaiss inm gvhbnc*oaiss Ijlvboins; }dl |nbgns.

    Sdlvlis jinr vlslivodlvs pgbn} }g cagfiab{i}bgn! oipb}ia eabcd}! inm }dl }lodnboia imuinols }di}

    dis}lnlm b} is }dl oln}via bjpl}|s fldbnm }dl lvgsbgn ge aifgvs pgab}boia bnea|lnol! B mgn} }dbnh }dbs bs

    }dl oisl. Cvin}lm! j|a}bni}bgnias diul s|oollmlm bn pb}}bnc gvhegvols bn mbeelvln} og|n}bls icibns}liod g}dlv. Nlulv}dlalss! g|v logngjr bs sdiplm fr }dl ais }di} g|v lalo}lm geebobias lnio}$gv! luln

    jgvl bjpgv}in}ar!eiba }g lnio}". ]g sll }dbs! iaa rg| diul }g mg bs aggh i} g}dlv jikgv bnm|s}vbiab{lm

    mljgoviobls }di} diul jgvl vgf|s} |nbgns mlspb}l }dl ljlvclnol ge i cagfia logngjr. Cggm ltijpals

    g|am fl Mlnjivh! _lmln! inm Oinimi. Sdi}s dipplnlm bn }dl \nb}lm _}i}ls bs ng} sbjpar i ji}}lv

    ge cagfia }vlnms f|} vi}dlv ge mgjls}bo pgab}bos.

    Bn }dl rlivs bjjlmbi}lar ie}lv Sgvam Siv BB! |nbgn s}vlnc}d is gn in |psbnc inm |nbgn mlnsb}r s}ggm

    i} jgvl }din ?0 plvoln} ge ngnicvbo|a}|via ljpagrjln}.96 Bn vlspgnsl }g }dl slvbg|s }dvli} }di} }dbs

    ia}lvni}l pglv s}v|o}|vl vlpvlsln}lm }g f|sbnlss! i Vlp|faboin mgjbni}lm Ogncvlss lnio}lm }dl ]ie}*

    Div}alr Io} gulv }dl ul}g ge Pvlsbmln} ]v|jin bn 92=3. ]dbs io} bjpgslm abjb}s gn }dl ifbab}r ge |nbgns }gs}vbhl inm pbohl}. _lo}bgn 9=$f" ge }dbs io}! bn piv}bo|aiv! plvjb}}lm bnmbubm|ia s}i}ls }g pvgdbfb} |nbgns

    evgj jihbnc jljflvsdbp i ognmb}bgn ge ljpagrjln}.

    99d}}p;''vloaibjmljgovior.gvc'ogvpgvi}lWioog|n}ifbab}r'pglaaWjljgWalbs.d}ja.

    96Clviam! Jirlv! &\nbgn Jljflvsdbp ]vlnms bn }dl \nb}lm _}i}ls& $600=". Elmlvia P|faboi}bgns. Piplv 93=.

  • 8/3/2019 Rootkit Final

    10/21

    ]dl Ebnia Odip}lv

    90 q F l a g C g } d i j A i f s

    Is ogvpgvi}l bn}lvls}s gvcinb{lm inm flcin }g ealt }dlbv ogaalo}bul j|soals bn }dl ai}l 9230s inm 9240s!

    jinicljln} floijl jgvl iccvlssbul b}d }io}bos }di} lvl bn}lnmlm }g s}rjbl |nbgn jgfbab{i}bgn.

    ]dbs bs vlealo}lm fr }dl mviji}bo bnovlisl bn ubgai}bgns ge }dl Ni}bgnia Aifgv Vlai}bgns Io} $}dl Sicnlv

    Io}" }di} lvl ebalm icibns} f|sbnlssls fr |nbgns.9? Bn eio}! in}b*|nbgn gplvi}bgns floijl sg bmlspvlim

    }di} i j|a}bjbaabgn*mgaaiv bnm|s}vr ge |nbgn*iugbminol ogns|a}in}s eag|vbsdlm m|vbnc }dlsl rlivs.9=

    F|sbnlssls iasg alulviclm slo}bgn 9=$f" ge }dl ]ie} Div}alr Io} fr jgubnc gplvi}bgns }g s}i}ls }di} lvl

    alss ognm|obul }g |nbgn io}bub}r.

    I}}ljp}s }g piss pvg*aifgv vlegvj jlis|vls gn Oipb}ga Dbaa }lnmlm }g eb{{al g|} flegvl vliodbnc ovb}boia

    jiss. Egv ltijpal! }dl Aifgv Ai Vlegvj fbaa ge 9234 is egbalm fr i _lni}l ebabf|s}lv. Abhlbsl! }dl

    Ogjjgn _b}|s Pbohl}bnc fbaa is ul}glm fr Pvlsbmln} Egvm bn 923< flegvl eibabnc }g j|s}lv }dl nlolssivr

    ug}ls }g gulvvbml }dl ul}g. ]dl bnifbab}r }g bn}vgm|ol vlegvj is pbug}ia floi|sl b} pvluln}lm }dl alcia

    v|als }di} cgulvn }dl jivhl} evgj hllpbnc |p b}d pvluibabnc ognmb}bgns. Iaa }di} f|sbnlss agffrbs}s dim

    }g mg is }g cl} aijihlvs }g gfs}v|o} alcbsai}bgn }di} g|am iaag aifgv }g imip} }g }dl nl! jgvl

    dgs}bal lnubvgnjln}. ]dbnh ge b} is i egvj ge s}lia}d alcbsai}bgn fr gjbssbgn.

    Bn immb}bgn }g ovbppabnc }dl |nbgns! gulv }dl pis} ?0 rlivs f|sbnlss alimlvs ljfivhlm gn i ov|siml }di}

    odijpbgnlm mlvlc|ai}bgn. ]dl ebninobia bnm|s}vr is i piv}bo|aivar i}}vio}bul }ivcl}. Bn 9222! Ogncvlss

    lnio}lm }dl Cvijj Aliod Fabalr Io}! dbod vlplialm pvgubsbgns bn }dl Caiss _}liciaa Io} ge 92?? }di}

    fivvlm bns}b}|}bgns evgj io}bnc is inr ogjfbni}bgn ge i ogjjlvobia finh! bnuls}jln} finh! inm

    bns|vinol ogjpinr. ]dbs eiobab}i}lm jissbul ognsgabmi}bgn $}dbnh! }gg fbc }g eiba".

    ]dln }dlvls }dl Ogjjgmb}r E|}|vls Jgmlvnb{i}bgn Io} $OEJI" ge 6000! dbod $ijgnc g}dlv }dbncs"

    ltljp}lm gulv*}dl*og|n}lv mlvbui}buls abhl ovlmb} mlei|a} sips evgj vlc|ai}bgn fr }dl _LO inm }dl

    Ogjjgmb}r E|}|vls ]vimbnc Ogjjbssbgn. ]dl OEJI lssln}biaar iaaglm bns}b}|}bgns }g ogjjb} }g aivclv!

    vbshblv }vinsio}bgns bnugaubnc ogjpaboi}lm $be ng} gpiy|l" ebninobia bns}v|jln}s b}d ulvr ab}}al gulvsbcd}.

    _plo|ai}bul ltolss is vijpin}. Be i finhlvs fl} pibm gee! dl mbm i ubo}gvr aip inm ogaalo}lm i ei} fgn|s

    odloh. Be i finhlvs fl} ln} flaar*|p! }dl \._. }itpirlv egg}lm }dl fbaa }g ogulv fg}d }dl }gtbo mlf} inm

    }dl fgn|s odloh.

    ]dl mlvlc|ai}bgn iul is i d|cl pirmir egv Siaa _}vll}. M|vbnc }dl plvbgm 6000 * 6004! }dl }gp ebul

    ltlo|}buls i} Fliv _}livns inm Aldjin Fvg}dlvs vihlm bn -6.= fbaabgn evgj ly|b}r sials inm oisd

    fgn|sls.9< Inm }dlsl lvl finhs }di} ln} |nmlv) Evgj }dl jbm*9220s gnivm! vlslivod plvegvjlm fr

    pvgelssgvs evgj Nl Rgvh \nbulvsb}r inm }dl \nbulvsb}r ge Ubvcbnbi ognoa|mlm }di} |p }g diae ge }dl icl

    mbeelvln}bia }di} ltbs}s fl}lln }dl ebninobia slo}gv inm g}dlv slo}gvs oin fl i}}vbf|}lm }g cgulvnjln}

    mlvlc|ai}bgn.95 ]dlsl bneai}lm siaivbls! bn }|vn! jihl b} mbeebo|a} egv vlc|ai}gvs }g mlulagp }dl }ialn}

    9?Vgflv} Eainicin! Dis Jinicljln} _}vincalm \._. \nbgns7Kg|vnia ge Aifgv Vlslivod 65! ng. 9! Mloljflv! 600

  • 8/3/2019 Rootkit Final

    11/21

    ]dl Ebnia Odip}lv

    99 q F l a g C g } d i j A i f s

    nlolssivr }g hllp |p b}d }dl evln{blm piol ge }dl ebninobia bnm|s}vr inm cvisp b} laa lng|cd }g ltlv}

    ogn}vga. Bn i slnsl! mlvlc|ai}bgn ioog|n}s bn piv} egv vlc|ai}gvr eiba|vl. ]dl jgvl v|als rg| }ihl iir!

    }dl divmlv b} bs }g jgnb}gv }dl vls|a}bnc jivhl}.

    Lt}viuicin} ogjplnsi}bgn bsn} abjb}lm }g ogvpgvi}l geebolvs bn }dl ebninobia slo}gv. Is jln}bgnlm livabl v

    bn }dl odip}lv! ltlo|}bul pir iovgss }dl \nb}lm _}i}ls bs ng d|nmvlms ge }bjls cvli}lv }din }di} ge }dl

    iulvicl gvhlv. ]dbs s}ljs aivclar evgj i eailm ogvpgvi}l cgulvninol srs}lj }di} iaags ltlo|}buls }g

    bnea|lnol }dl fgivm jljflvs }di} sl} }dlbv pir! bn immb}bgn }g s}lia}dr ogjplnsi}bgn pvio}bols

    $mlelvvlm ogjplnsi}bgn! fiohmi}bnc gp}bgn uia|ls! l}o." }di} ivl bn}lnmlm }g jihl b} mbeebo|a} egv

    bnuls}gvs }g mbsolvn }dlj is s|od. Ia}dg|cd }dl _ivfinls Gtalr Io} ge 6006 is i s}lp bn }dl vbcd}

    mbvlo}bgn! ogvpgvi}l agffrbnc cvg|ps lvl ifal }g |nmlvjbnl }dl sgv} ge vlegvjs }di} g|am diul alm }g

    luln cvli}lv fgivm bnmlplnmlnol.93

    Ebniaar! }dl lab}l dis flln eibvar s|oolsse|a i} ognsbs}ln}ar aglvbnc b}s }it vi}ls gulv }dl pis} ?0 rlivs. Bn

    9250! }dl }gp }ln}d ge i plvoln} ge }dl bnogjl splo}v|j ltplvblnolm in iulvicl }it vi}l ge gulv 30

    plvoln}. Fr 600

    pairlm i vgal bn }dbs s}limr mgnivm }vlnm. Ioogvmbnc }g i s}|mr fr }dl Ogncvlssbgnia F|mcl} Geebol!

    dg|sldgams livnbnc jgvl }din -9 jbaabgn i rliv b}nlsslm }dlbv elmlvia }it vi}ls eiaa jgvl sdivpar }din

    inr cvg|p bn }dl og|n}vr is i mbvlo} vls|a} ge Pvlsbmln} F|sds }it o|}s .92

    Sdln }dl }bjl oijl egv Pvlsbmln} Gfiji }g ognsbmlv }dlsl }it o|}s! Vlp|faboin slni}gvs }dvli}lnlm }g

    ebabf|s}lv |n}ba }dl ji}}lv is egvjiaar immvlsslm. ]dg|cd Gfiji mlebin}ar vlelvvlm }g }dlsl

    Vlp|faboins is dgs}icl*}ihlvs! ie}lv j|od cv|jfabnc bn 6090! dl |a}bji}lar ippvgulm i fbaa }di}

    lt}lnmlm }dl }it o|}s |n}ba 6096. Al} }di} fl i alssgn }g rg|! mliv vlimlv; \n}ba }dl logngjboiaar

    pvbubalclm ivl dippr! ng gnl lasl cl}s }g fl dippr.

    Pvlmbspgsbnc Oi|sls

    Slul slln dg }dl ogvpgvi}l bn}lvls}s s}iv}lm jissbnc }dlbv ivjbls bn }dl 9230s }g agffr lalo}lm

    geebobias inm sir }dlbv ug}bnc fldiubgv. ]dl lnm vls|a} is }di} fbc f|sbnlss s|oollmlm bn cl}}bnc

    mljgovior }g slvul oipb}iabsj. ]dlr ovbppalm aifgv! mlvlc|ai}lm }dl ebninobia jivhl}s! gfs}v|o}lm

    i}}ljp}s }g vlbcn bn ltlo|}bul ogjplnsi}bgn! inm ciul }dljslauls nbol }it o|}s. Bn }dl jlin}bjl!

    lulvrgnl lasl }vlims i}lv.

    Sdi} |nmlvarbnc isplo}s ge Ijlvboin mljgovior lnifalm }dbs }g dippln7

    93A|obin Flfod|h inm Klssl Evblm! Pir b}dg|} Plvegvjinol; ]dl \ne|aebaalm

    Pvgjbsl ge Ltlo|}bul Ogjplnsi}bgn! Divuivm \nbulvsb}r Pvlss! Nguljflv! 600=.94

    ]dgjis Pbhl}}r inm Ljjin|la _il{! &Dg Pvgcvlssbul bs }dl \._. Elmlvia ]it

    _rs}lj7 I Dbs}gvboia inm Bn}lvni}bgnia Plvsplo}bul!&Kg|vnia ge Logngjbo Plvsplo}buls! Uga|jl 69! N|jflv 9!

    Sbn}lv 6003.92

    Lmj|nm Inmvls! ]it O|}s Geelv Jgs} egv Ulvr Vbod! _}|mr _irs!Nl Rgvh ]bjls! Kin|ivr 4! 6003.

  • 8/3/2019 Rootkit Final

    12/21

    ]dl Ebnia Odip}lv

    96 q F l a g C g } d i j A i f s

    Gnl eli}|vl ge g|v srs}lj bs }di} b} bs bnoabnlm }givm cvbmagoh. Be gnl pgab}boia cvg|p bsdls }g gfs}v|o}

    }dl pissicl ge alcbsai}bgn! b}s ng} }di} mbeebo|a}. Is l si b}d }dl Aifgv Ai Vlegvj fbaa ge 9234! }dl

    ebabf|s}lv bs in leelo}bul lipgn. Ing}dlv ogjjgn }io}bo bs egv i vlpvlsln}i}bul dg dis flln og*gp}lm

    fr agffrbs}s }g oaibj sgjl}dbnc abhl dbal B s|ppgv} }dbs jlis|vl bn spbvb}! }dlvl ivl olv}ibn pvgubsbgns

    }di} B ebnm gfklo}bgnifal.

    Is }dl f|sbnlss lnubvgnjln} odincls! alcbsai}bgn ge}ln nllms imk|s}jln} }g hllp |p b}d pvluibabnc

    jivhl} ognmb}bgns. Eiba|vl }g mg sg vls|a}s bn di} Sia}lv Abppjin oiaalm mvbe}. Egv ltijpal! bn }dl

    9230s inm 9240s! ogvpgvi}bgns gplnar inm vlc|aivar lnciclm bn fldiubgv }di} ubgai}lm ltbs}bnc aifgv

    ais $ebvbnc gvhlvs dg }dlr s|splo}lm lvl }vrbnc }g gvcinb{l". ]dlr hnl! dglulv! }di} pirbnc i

    ebnl egv fvlihbnc }dl ai g|am fl odliplv }din iaagbnc gvhlvs }g |nbgnb{l gulv }dl agnc v|n. Fr

    dbnmlvbnc gv y|bl}ar s}iaabnc }dl lnio}jln} ge fbaas }di} g|am vljlmbi}l pvgfaljs abhl }dbs! alcbsai}gvs

    og|am ipplisl ogvpgvi}l agffrbs}s inm s|ppgv} in}b*|nbgn io}bub}r b}dg|} gulv}ar ipplivbnc }g. Ie}lv iaa!

    jgs} pgab}boia iniars}s ego|s pvbjivbar gn in lalo}lm geebobias ug}bnc vlogvm. Sdi} }dbs jbnmsl} eibas }g

    iohngalmcl bs }di} bnio}bgn b}slae oin fl ubllm is i egvj ge s}lia}d alcbsai}bgn.

    ]dln }dlvls iasg }dl ji}}lv ge ug}lv mbslncicljln}. Bn }dl 6090 jbm}lvj lalo}bgns! gnar =0.3 plvoln}

    ge }dgsl labcbfal }g ug}l mbm sg $ippvgtbji}lar 42 jbaabgn plgpal".60 Ogjpivl }dbs }g }dl 999 jbaabgn

    plgpal dg i}odlm }dl _|plv Fga bn 6099. Sdbal B g|am fl} }di} jgs} jbmmal*oaiss plgpal pvgfifar

    |nmlvs}inm }g sgjl mlcvll }di} }dlrvl flbnc cbuln }dl sdgv} lnm ge }dl s}boh! }dlsl sijl plgpal eiba }g

    ogjjb} }dljslauls }g bns}b}|}bnc jlinbnce|a odincl. ]dlrm vi}dlv splnm }dlbv spivl }bjl b}d }dlbv

    eijbabls! egaag }dlbv eiugvb}l ]U mvijis! i}od spgv}s! gv di}lulv. Bn g}dlv gvms! }dlr diuln}

    vliodlm }dl pgbn} dlvl }dlr ella ogjplaalm }g mg sgjl}dbnc. Mlspb}l flbnc gn }dl agsbnc lnm ge i oaiss

    iv! gvmbnivr plgpal ivl s}baa slljbncar ogn}ln} lng|cd b}d fvlim inm obvo|sls.

    ]dbs flcs }dl y|ls}bgn; dr ivln} l g|}viclm lng|cd }g }ihl io}bgn7 Gnl vlisgn bs }di} }dl jikgv

    jlmbi g|}al}s $}dl iclnmi*sl}}bnc laljln}s ge }dl pvlss" jgs}ar imdlvl }g }dl Pvgpicinmi Jgmla

    splaalm g|} fr Ngij Odgjshr inm Lmivm Dlvjin bn }dlbv fggh Jin|eio}|vbnc Ognsln}. ]dl

    Pvgpicinmi Jgmla pvlmbo}s! y|b}l ioo|vi}lar! }di} }dl fbc nls g|}al}s evijl bss|ls bn s|od i ir is }g

    bno|aoi}l inm mlelnm }dl iclnmi ge }dl pvbubalclm cvg|ps }di} mgjbni}l }dl pvbui}l logngjr.

    ]dbs bs ng ioobmln} is }dl jikgv g|}al}s! abhl }dl Siaa _}vll} Kg|vnia$}dl fbccls} mibar nlspiplv

    ioogvmbnc }g }dl I|mb} F|vli| ge Obvo|ai}bgn"! ivl piv} ge aivcl p|faboar }vimlm ogvpgvi}bgns. Flbnc

    p|faboar }vimlm! }dl iclnmi*sl}}lvs ivl fldgamln }g }dl mlsbvls ge Siaa _}vll}! dlvl bnuls}gvs jlis|vl

    }dlbv uia|l is i e|no}bgn ge }dl pvgeb} }di} }dlr clnlvi}l.

    F|sbnlss alimlvs ivl laa iivl ge }dbs mrnijbo. Bn dbs 9239 jljgvinm|j }g }dl mbvlo}gv ge }dl \._.

    Odijflv ge Ogjjlvol! Albs Pglaa gfslvulm Jgs} ge }dl jlmbi! bnoa|mbnc }dl ni}bgnia ]U srs}ljs!

    ivl gnlm inm }dlgvl}boiaar ogn}vgaalm fr ogvpgvi}bgns dbod mlplnm |pgn pvgeb}s! inm }dl ln}lvpvbsl

    srs}lj }g s|vubul.

    60Jbodila JoMgniam! &Ug}lv ]|vng|} bn }dl 6090 Jbm}lvj Lalo}bgn!& ]dl Egv|j! Uga|jl 4! Bss|l. =.

  • 8/3/2019 Rootkit Final

    13/21

    ]dl Ebnia Odip}lv

    9? q F l a g C g } d i j A i f s

    ]dl Siaa _}vll} Kg|vniaslaas vg|cdar 6 jbaabgn piplvs lulvr mir!69 inm imulv}bsljln} vluln|l bs

    s|fs}in}bia lng|cd }di} }dl ltlo|}buls dg ogn}vga }dl g|}al} diul ognsbmlvlm sbjpar cbubnc iir

    gnabnl ogn}ln} egv evll.66 Sdi} }dbs mljgns}vi}ls bs }di} jikgv nls sg|vols abhl }dl Siaa _}vll} Kg|vnia

    diul i pvgm|o} $}dlbv vlimlvs" }di} }dlr slaa }g }dl f|rlvs bn }dl jivhl} $}dl imulv}bslvs".

    Is b} }|vns g|}! }dl pvgeb} jivcbn bn }dbs jivhl} oin fl pvl}}r cggm. ]dbs bs floi|sl piplvs abhl }dl Siaa

    _}vll} Kg|vniajibn}ibn i odinnla }g i uia|ifal ogjjgmb}r; sgobl}rs dbcd alula mlobsbgn jihlvs. Bn g}dlv

    gvms! jinr ge }dl plgpal dg vlim }dl Siaa _}vll} Kg|vniaiasg vlpvlsln} Ijlvboispgab}boia oaiss.

    Ioogvmbnc }g IFO Nls! }dl iulvicl dg|sldgam bnogjl ge }dl Siaa _}vll} Kg|vnias s|fsovbflv bn 6003

    is ippvgtbji}lar -6?

    _g di}s cgbnc gn bs }di} rg| diul gnl aivcl ogvpgvi}bgn slaabnc b}s pvgm|o} }g g}dlv aivcl ogvpgvi}bgns!

    dlvl }dl pvgm|o} bs }dl lrls inm livs ge }dl v|abnc oaiss. B} gnar jihls slnsl }di} }dl bmlis p|} egv}d

    baa fl }dgsl }di} oi}lv }g }dl logngjbo mlsbvls inm pgab}boia bnoabni}bgns ge }dl piv}bls bnugaulm. Bn eio}!

    }dbs hbnm ge mbs}gv}bgn bs ltio}ar di} Ngij Odgjshr inm Lmivm Dlvjin mbsogulvlm dbal s}|mrbnc }dl

    ni}|vl ge }dl jiss jlmbi.

    ]ihl }dl drs}lvbi s|vvg|nmbnc SJMs inm }dl iaalclm ognnlo}bgn fl}lln _immij D|sslbn inm Ia

    Yilmi bn }dl mirs flegvl }dl \nb}lm _}i}ls bnuimlm Bviy. Iaa }dl fbc g|}al}s! s|od is }dl Nl Rgvh

    ]bjls! }dl Siaa _}vll} Kg|vnia! inm }dl Sisdbnc}gn Pgs}! ogjpabin}ar pairlm iagnc dln }dl F|sd

    Imjbnbs}vi}bgn pivimlm b}s evi|m|aln} lubmlnol bn evgn} ge }dl Ijlvboin p|fabo inm oiaalm b} |nmlnbifal

    pvgge.

    Sdr7 Dg mbm }dlr cl} iir b}d b}7 Ioogvmbnc }g Min Vi}dlv6=;

    Eliv bs bn lulvr nlsvggj bn }dl og|n}vr. Inm eliv ge di}7 Slaa! b}#s }dl eliv b}#s i ogjfbni}bgn ge; be

    rg| mgn#} cg iagnc }g cl} iagnc! rg|#vl cgbnc }g cl} }dl vlp|}i}bgn ge flbnc i }vg|faljihlv. ]dlvl#s iasg

    }dl eliv }di}! rg| hng! piv}bo|aivar bn nl}gvhs! }dlr#ul flogjl d|cl! bn}lvni}bgnia ogncagjlvi}ls.

    ]dlr diul fbc nllms! alcbsai}bul nllms! vlplv}gvr nllms bn Sisdbnc}gn. Ngfgmr dis }g slnm rg| i jljg

    }g }laa rg| }di} }di}#s }dl oisl.

    ]dl lnm vls|a} ge ug}lv ipi}dr bs }di} pgab}bobins vliab{l }dl alula ge obubo mbslncicljln} }di} ltbs}s inm

    }lnm }g cbul }dlbv i}}ln}bgn }g }dl cvg|ps }di} oin ltlv} }dl nlolssivr gvcinb{i}bgnia pvlss|vl }g vlivm

    $gv p|nbsd" }dlj egv s|ppgv}bnc i olv}ibn iclnmi. Cbuln }dl jgnlr*bn}lnsbul ni}|vl ge lalo}gvia pgab}bos!

    dlvl j|od ge di}s spln} cl}s mbvlo}lm }givm oijpibcn imulv}bsbnc!6< bnsgeiv is logngjbo bss|ls ivl

    ognolvnlm }dl s}inols }di} g|v lalo}lm geebobias iss|jl ivl aivclar ml}lvjbnlm fr ogvpgvi}l agffbls. Bn

    69d}}p;''ifois?.ioolssifo.ogj'lobvo'nls}b}alslivod|s.isp.

    66Oi}dlvbnl Dgaidin! ]dl Oisl egv Evllbnc }dl S_K Gnabnl! F|sbnlssSllh! I|c|s} 90! 6003.

    6?_og}} Jirlvgb}{! &Sdi} Mg }dl Vbod inm Pglve|a Vlim7&IFO Nls! K|ar 64! 6003.

    6=d}}p;''.pfs.gvc'jgrlvs'kg|vnia'f}'}vinsovbp}9.d}ja.

    6