Rootkit Final
-
Upload
baptise777 -
Category
Documents
-
view
256 -
download
1
Transcript of Rootkit Final
-
8/3/2019 Rootkit Final
1/21
]dl Ebnia Odip}lv
9 q F l a g C g } d i j A i f s
Flag Cg}dijVlslivod P|faboi}bgn Mloljflv 6099
]dl Ebnia Odip}lv
Fbaa Fa|nmln
Pvbnobpia Bnuls}bci}gv
Flag Cg}dij Aifs
.flagcg}dij.ogj
Pvleiol
]dbs ogn}ln} is gvbcbniaar bn}lnmlm }g ippliv bn }dl 6nm lmb}bgn ge]dl Vgg}hb}
Ivslniais in ltpinmlm }vli}jln} ge }dl ais} odip}lv evgj }dl 9s} lmb}bgn. Egv i
n|jflv ge vlisgns }dl p|fabsdlv dis gp}lm }g pvloa|ml b}. Is }dl i|}dgv! B oin }ls}ber
}di} ]dl Vgg}hb} Ivslniabs in iaalcgvr bn mbsc|bsl. Flnli}d iaa ge }dl mlubol mvbulv
}dlgvr inm }dl sg|vol ogml bs i mllplv jlssicl. Vi}dlv }din al} }dbs jlssicl fl ags}
}dvg|cd gjbssbgn! b}d }dl ognsln} ge }dl p|fabsdlv B diul mlobmlm }g vlalisl }dbs
gvpdinlm odip}lv is i s}inm*iagnl lssir.
-
8/3/2019 Rootkit Final
2/21
]dl Ebnia Odip}lv
6 q F l a g C g } d i j A i f s
Inrgnl dg dis s}|mblm jiaivl! vgg}hb}s bn piv}bo|aiv! hngs }di} b}s ln}bvlar elisbfal egv i slljbncar
bnngo|g|s ab}}al ippaboi}bgn $alss }din
-
8/3/2019 Rootkit Final
3/21
]dl Ebnia Odip}lv
? q F l a g C g } d i j A i f s
Ni}|viaar! }dlvl ivl iasgpvlmbspgsbnc oi|sls }di} lnifalm }dl ltob}bnc eio}gv! abhl pggv y|iab}r iss|vinol
gn fldiae ge }dl ulnmgv! ng} }g jln}bgn }di} }dl ltpagb}lm ippaboi}bgn is pvgfifar i aivcl ogjpaboi}lm
pvgm|o}! inm dlnol jgvl pvgnl }g f|cs.
Ebniaar! }dlvl ivl vljg}l oi|sls }di} diul in luln alss gfubg|s ognnlo}bgn }g di} dipplnlm. Egv
ltijpal! }dl |slv dg gns }dl bnelo}lm jiodbnl jir diul flln bn i v|sd }g cg sgjldlvl inm
ioobmln}iaar oabohlm gn sgjl}dbnc }di} dl g|amn} ngvjiaar diul oabohlm gn.
]dl lnm vls|a} ge }dl bnels}i}bgn bs }di} }dl }ivcl}lm jiodbnl oin} fl }v|s}lm }g mg di} b} oaibjs }g fl
mgbnc gv }g pvgubml }dl |slv b}d ioo|vi}l bnegvji}bgn. ]dl vgg}hb} }di}s flln agmclm bn }dl vlolssls ge
b}s bnevis}v|o}|vl ognolias }dl bnea|lnol ge }dl bn}v|mlv! dg baa ng mg|f} fl f|sr ebnmbnc irs }g
jgnl}b{l }dlbv ioolss i} }dl ltplnsl ge }dl |slv $l.c. bmln}b}r }dle}! ovlmb} oivm evi|m! l}o.".
Is B mbso|sslm bn }dl pvlubg|s odip}lv! }dl gnar egga pvgge ir }g vl}|vn }dl }ivcl}lm jiodbnl }g i
}v|s}lm s}i}l bs }g vlf|bam b}. Sb}d i vgg}hb}! rg| oin nlulv fl s|vl k|s} dg mllp }dl s|fulvsbgn lt}lnms.
I s|vcboia s}vbhl jir s|oollm bn |nliv}dbnc plvbpdlvia iv}beio}s $gv! bn }dl pi}dgagcboia oisl mlogr
fbnivbls" f|} eiba }g vljgul }dl ogvl ogjpgnln}s ge }dl vgg}hb}! iaagbnc }dl bn}v|mlv }g vlcibn ioolss.
Ebc|vl 9
]ihl i jgjln} }g mbcls} inm bn}lvniab{l }dbs jl}ipdgv $sll Ebc|vl 9". Bn in ifs}vio} slnsl! }dbs bs ltio}ar
di}s dipplnlm }g }dl pgab}boia srs}lj bn }dl \nb}lm _}i}ls inm }dl logngjbo lnubvgnjln} }di} g|v
pgab}boia srs}lj sdipls.
-
8/3/2019 Rootkit Final
4/21
]dl Ebnia Odip}lv
= q F l a g C g } d i j A i f s
Ubsbfal _rjp}gjs
Is b}d i ogjpvgjbslm ogjp|}lv! di}s dipplnbnc }g g|v sgobl}r bsn} pi}ln}ar oaliv. Dglulv! }dlvl
ivl mlebnb}lar slognmivr bnmboi}bgns inm ivnbncs }di} dbn} }di} sgjl}dbnc bs vgnc. G|v jiodbnl! sg }g
splih! dis flogjl |nvlspgnsbul inm bsn} nlolssivbar e|no}bgnbnc is }dl evijlvs bn}lnmlm b} }g._plobeboiaar! sbnol }dl 9230s }dlvl dis flln i cvgbnc logngjbo mbspivb}r bn }dl \nb}lm _}i}ls fl}lln
}dl clnlvia pgp|ai}bgn inm i sjiaa s|fsl} ge plgpal i} }dl }gp ge }dl bnogjl splo}v|j.
]dbs cvgbnc bnly|iab}r dis flln laa mgo|jln}lm.9 Evgj 923= }g 6004! }dl sdivl ge iaa livnlm bnogjl
bn }dl \nb}lm _}i}ls $bnoa|mbnc oipb}ia cibns" ge }dl }gp 9 plvoln} ge g|v pgp|ai}bgn bnovlislm evgj
ippvgtbji}lar 2 plvoln} }g sabcd}ar gulv 60 plvoln}. Egv }dl }gp }ln}d ge i plvoln} ge }dl pgp|ai}bgn!
}dlsl ebc|vls diul cgnl evgj 6.3 }g 90.= plvoln} ge iaa livnlm bnogjl. ]dlbv sdivl ge }dl pbl jgvl }din
}vbpalm.
B}s bn}lvls}bnc }g ng}l }di} bn 9264! k|s} flegvl }dl Cvli} Mlpvlssbgn! }dl }gp livnlvs }di} jiml |p }dl}gp }ln}d ge i plvoln} ge }dl pgp|ai}bgn lvl jihbnc jgvl }din 99 plvoln} ge iaa livnlm bnogjl bn }dl
\nb}lm _}i}ls. Rg| oin }ihl i aggh i} }dl vi n|jflvs! }dlrvl iuibaifal gnabnl .6
Sdbal }dl lia}dr lvl iodblubnc bjpvlssbul cibns! }dbncs lvln} is vgsr egv jbmmal *oaiss Ijlvboins
inm fa|l ogaaiv gvhlvs. Mi}i evgj }dl Ogncvlssbgnia F|mcl} Geebol bs pvgubmlm bn ]ifal 9.? Is rg| oin
sll! }dl pggvls} ebe}d ge }dl pgp|ai}bgn ltplvblnolm in 99 plvoln} vbsl bn }dlbv iulvicl ie}lv*}it bnogjl
evgj 9232 }g 6005. ]dl nlt} }g ebe}ds ltplvblnolm in bnovlisl ge 94 plvoln} inm 69 plvoln}!
vlsplo}bular.
]dl }gp 9 plvoln} b}nlsslm i s}icclvbnc 6
-
8/3/2019 Rootkit Final
5/21
]dl Ebnia Odip}lv
< q F l a g C g } d i j A i f s
}gp. Be rg| aggh i} }dl vi n|jflvs bn ]ifal 9! b} baa flogjl gfubg|s }di} }dl uis} jikgvb}r ge gvhbnc
plgpal diul flln }vlimbnc i}lv gv iodblubnc jgmls} cibns $i} fls}" dbal }dl plgpal i} }dl }gp ge }dl
splo}v|j diul flln vihbnc b} bn.
Og|pal }dbs s|s}ibnlm cvg}d ge logngjbo bnly|iab}r b}d ogns}in}ar sdvbnhbnc flnleb}s! abjb}lm sgobia
jgfbab}r! inm |nljpagrjln} }di} dgulvs oagsl }g 90 plvoln}.= Evblnms! laogjl }g }dl Sbnnlv*]ihl*Iaa
logngjr.
]dl \nmlvarbnc Pvgfalj
Bn g|v sgobl}r! vlia pglv mgls ng} dippln }g abl bn }dl pgab}boia srs}lj!
b} abls bn }dl pvbui}l logngjr.
Ngij Odgjshr
_g! di}s cgbnc gn7 Sdi} ioog|n}s egv }dl bnovlisbnc mbspivb}r7 Be rg| aggh }g Vlp|faboin bmlgagc|ls
egv c|bminol! }dlraa pgbn} }g i uis} ognspbvior gn }dl ale}. Abhlbsl! be rg| y|lvr }dl Mljgovi}s ! }dlraa
pgbn} }g i uis} ognspbvior gn }dl vbcd}. ]dl pvgfalj b}d }dbs }g*piv}r sodlji bs }di} b} eibas }g
vlogcnb{l }di} l io}|iaar ltbs} bn i sbncal*piv}r srs}lj; }dl ogvpgvi}l piv}r. Gulv }dl pis} }dvll
mloimls! f|sbnlss bn}lvls}s diul cvim|iaar ognsgabmi}lm }dlbv ogn}vga gulv }dl pgaborjihbnc lncbnl bn
Sisdbnc}gn. Bn sdgv}! }dlrul vgg}lm MO.
Cvin}lm }dlbv bnea|lnol bsn} }g}ia! f|} b}s ognsbmlvifal lng|cd }g mbo}i}l }dl v|als }di} gppgsbnc cvg|ps
j|s} gfslvul inm }g evijl }dl }lvjs ge p|fabo mbsog|vsl. Bn }dbs jinnlv! }dlrul s|oollmlm bn |sbnc
}dlbv ogn}vga }g sdipl }dl logngjr! vlsl} }it vi}ls! inm clnlviaar cl} mljgovior }g slvul }dlbv
logngjbo cgias.
Gnl jbcd} ivc|l; Dlr! di}s sg fim ifg|} ogvpgvi}bgns7 B jlin! i ogvpgvi}bgn bs vliaar k|s} i f|nod ge
plgpal }di} gvh }gcl}dlv. _g di} flnleb}s i ogvpgvi}bgn iasg flnleb}s }dl ljpagrlls }di} ogns}b}|}l
}di} ogvpgvi}bgn. Sdi}s vgnc b}d }di}7
]g vlspgnm }g }dbs ivc|jln} b}s nlolssivr }g |nmlvs}inm }dl }v|l ni}|vl ge i ogvpgvi}bgn in m }dl
cvg}lsy|l mbspivb}r }di} dis lugaulm gulv }dl rlivs fl}lln ogvpgvi}l alimlvsdbp inm }dl iulvicl vinh*
inm*ebal ljpagrll.
Ebvs} inm egvljgs}! fr mlebnb}bgn p|fabo ogvpgvi}bgns ltbs} }g jitbjb{l sdivldgamlv uia|l. B} k|s} sgdipplns }di}! is ge 6003! }dl lia}dbls} 9 plvoln} ge }dl \nb}lm _}i}ls pgp|ai}bgn gns ifg|} diae ge iaa
g|}s}inmbnc s}goh! ebninobia slo|vb}bls! }v|s} ly|b}r! inm f|sbnlss ly|b}r! inm 64 plvoln} ge ngn*dgjl
=Kiogf Diohlv inm Pi|a Pblvsgn! Sbnnlv*]ihl*Iaa Pgab}bos; Dg Sisdbnc}gn Jiml }dl Vbod Vbodlv inm ]|vnlm B}s Fioh gn }dl
Jbmmal Oaiss! _bjgn % _od|s}lv! 6090
-
8/3/2019 Rootkit Final
6/21
]dl Ebnia Odip}lv
5 q F l a g C g } d i j A i f s
vlia ls}i}l. E|v}dlvjgvl! }dl }gp 90 plvoln} ge }dl vbodls} eijbabls ioog|n}lm egv ifg|} 4< }g 20 plvoln}
ge s}goh sdivls! fgnms! }v|s}s! f|sbnlss ly|b}r! inm ngn*dgjl vlia ls}i}l.iulvicl gvhlv jiml. Fr 6003! }dbs ebc|vl dim vgohl}lm }g ?00 }bjls }dl iulvicl icl.5 Bn 6002! }dl
iulvicl bnogjl ge i OLG i} in _%P
-
8/3/2019 Rootkit Final
7/21
]dl Ebnia Odip}lv
3 q F l a g C g } d i j A i f s
}dlr oijl g|} inm gplnar imjb}}lm }di} }dlr lvl v|nnbnc }dl sdg! }dl vls} ge |s jbcd} io}|iaar mg
sgjl}dbnc ifg|} b}.
Airlvs ge Oi|siab}r
Dg mbm b} ogjl }g }dbs7 Gulv i ?0*rliv spin! dg mbm }dl ogvpgvi}l bn}lvls}s }di} vlpvlsln} }dl |pplv
oaiss ogjjinmllv g|v pgab}boia bns}b}|}bgns inm |sl }dlj }g jgnl}b{l }dlbv bnea|lnol7 ]dlvl bs ng sbncal
o|apvb}. Bn eio}! b} g|am fl niul }g pgbn} i ebnclv i} inr gnl oi|sl. Is b}d slo|vb}r bnobmln}s! }dlvl ivl
}rpboiaar i n|jflv ge mbeelvln} eio}gvs io}bnc bn ognolv} i} uivbg|s alulas.
Ltob}bnc Oi|sls
Bn }dl ai}l 9250s inm livar 9230s! f|sbnlss bn}lvls}s eiolm i slvbls ge jikgv pgab}boia mleli}s }di}
vlugaulm ivg|nm cgulvnjln} vlc|ai}bgn $}dl Ni}bgnia ]vieebo inm Jg}gv Uldboal _iel}r Io} 9255! }dl
Ni}bgnia Lnubvgnjln}ia Pgabor Io} 9252! inm Goo|pi}bgnia _iel}r inm Dlia}d Io} 9230! inm sg gn".
Bn vlspgnsl! ogvpgvi}l bn}lvls}s gvcinb{lm sg }di} }dlr og|am pgga vlsg|vols! ioy|bvl mgjibn*splobebo
ltplv}bsl! inm pvgio}bular bnb}bi}l s|s}ibnlm! oivle|aar oggvmbni}lm oijpibcns iovgss j|a}bpal evgn}s.
]dlr egvjlm cvg|ps abhl }dl F|sbnlss Vg|nm ]ifal! dbod is ls}ifabsdlm bn 9236! inm fgas}lvlm }dl
vinhs ge ltbs}bnc gvcinb{i}bgns abhl }dl \._. Odijflv ge Ogjjlvol.
]dl gulvivodbnc cgia ge }dbs ov|siml is }g bnea|lnol }dl pgaborjihbnc pvgolss }g fl}}lv slvul }dl
ogvpgvi}l iclnmi. Sdlvlis lalo}bgns jir mlobml dg lnms |p bn geebol! di} i alcbsai}gv mgls gnol dl
cl}s }dlvl bs di} vliaar og|n}s. Sdg oivls dg cl}s lalo}lm k|s} is agnc is rg| oin y|bl}ar c|bml di}
dl mgls ie}lv }dl eio}7 Dlnol! f|sbnlss bn}lvls}s mbvlo}lm i ag} ge vlsg|vols $b.l. vlim jgnlr" }g }dbs lnm
}dvg|cd agffrbnc! ge}ln b}dg|} vlcivm }g piv}r ieebabi}bgn.
Ioogvmbnc }g }dl Oln}lv egv Vlspgnsbul Pgab}bos! f|sbnlss bn}lvls}s ciul -9.? fbaabgn }g oinmbmi}ls inm
pgab}boia piv}bls bn 6090. Ogjpivl }dbs }g aifgv bn}lvls}s! dbod gnar ciul -26 jbaabgn. Ng ognsbmlv }dl
eio} }di} -?.=3 fbaabgn is spln} gn agffrbnc bn 6090. E|v}dlvjgvl! jgs} ge }dl fbc splnmlvs bn }dl
agffrbnc ivlni ivl ogvpgvi}l pairlvs. ]ifal 6 abs}s }dl }gp 90 aivcls} agffrbnc cvg|ps gvmlvlm fr mgaaivs
spln}.90
Is rg| oin sll! }dl |nbgns ivl ogjpal}lar g|}c|nnlm. ]g ebcd} i iv rg| nllm i bnnbnc s}vi}lcr! i
mbsobpabnlm inm oipifal gvcinb{i}bgn inm $jgs} bjpgv}in}ar" }dl vlsg|vols }g s|ppgv} b} }dvg|cd agnc*
}lvj ogneabo}s. Sdln b} ogjls }g pgsslssbnc }dl jgnlr }g vibsl inm s|s}ibn ivjbls! }dl lia}dr lab}ldgam }dl imuin}icl.
90d}}p;''.gplnslovl}s.gvc'agffr'}gp.pdp7sdgRliv:6090%bnmlt]rpl:s
-
8/3/2019 Rootkit Final
8/21
]dl Ebnia Odip}lv
4 q F l a g C g } d i j A i f s
Gvcinb{i}bgn Agffrbnc Oisd _pln}
\_ Odijflv ge Ogjjlvol -9?6!053!Clnlvia Lalo}vbo -?2!620!000
ElmLt Ogvp -6
Ijlvboin Jlmboia Issgobi}bgn -66!
Pdivjiol|}boia Vlslivodlvs % Jin|eio}|vlvs ge Ijlvboi -69!3=0!000
Fa|l Ovgss'Fa|l _dblam -69!003!9=9
Ogngog Pdbaabps -92!565!?46
Ijlvboin Dgspb}ia Issgobi}bgn -92!=?4!?
-
8/3/2019 Rootkit Final
9/21
]dl Ebnia Odip}lv
2 q F l a g C g } d i j A i f s
I_BML ]dl Pglaa Jljgvinm|j
]dl fa|lpvbn} }di} aivcl ogvpgvi}bgns |slm $iccvlssbul agffrbnc! pgabor bns}b}|}ls! i dliur ljpdisbs gn
p|fabo vlai}bgns! l}o." bn }dlbv leegv} }g cibn ogn}vga flivs in |noinnr vlsljfainol }g bmlis pvlsln}lm bn
i jljg }di} i ogvpgvi}l airlv nijlm Albs Pglaa sln} }g }dl mbvlo}gv ge }dl \._. Odijflv ge
Ogjjlvol gn I|c|s} 6?! 9239
99
. ]g jgn}ds ai}lv! Pglaa ioolp}lm Vbodivm Nbtgns ngjbni}bgn }gslvul gn }dl \._. _|pvljl Og|v}.
Bn dbs jljg! Pglaa isslv}s }di} _}vlnc}d abls bn gvcinb{i}bgn! bn oivle|a agnc*vincl painnbnc inm
bjpaljln}i}bgn! bn ognsbs}lnor ge io}bgn gulv in bnmlebnb}l plvbgm ge rlivs! bn }dl soial ge ebninobnc
iuibaifal gnar }dvg|cd kgbn} leegv}! inm bn }dl pgab}boia pglv iuibaifal gnar }dvg|cd |nb}lm io}bgn inm
ni}bgnia gvcinb{i}bgns.
Pglaa iasg ljpdisb{ls }dl nllm }g ls}ifabsd }dl s}iees ge ljbnln} sodgaivs! vb}lvs inm splihlvs! dg
baa mg }dl }dbnhbnc! }dl iniarsbs! }dl vb}bnc inm }dl splihbnc. B} baa iasg fl lssln}bia }g diul s}iee
plvsgnnla dg ivl }dgvg|cdar eijbabiv b}d }dl jlmbi! inm dg jgs} leelo}bular }g ogjj|nboi}l b}d}dl p|fabo.
\sbnc }dlbv nleg|nm gvcinb{i}bgnia oag|}! gulv }dl pis} }dvll mloimls fbc f|sbnlss dis s|oollmlm bn
nl|}lvbnc }dl gnl pgab}boia cvg|p }di} dis ognsbs}ln}ar eg|cd} egv logngjbo bss|ls gn fldiae ge jbmmal*
oaiss inm gvhbnc*oaiss Ijlvboins; }dl |nbgns.
Sdlvlis jinr vlslivodlvs pgbn} }g cagfiab{i}bgn! oipb}ia eabcd}! inm }dl }lodnboia imuinols }di}
dis}lnlm b} is }dl oln}via bjpl}|s fldbnm }dl lvgsbgn ge aifgvs pgab}boia bnea|lnol! B mgn} }dbnh }dbs bs
}dl oisl. Cvin}lm! j|a}bni}bgnias diul s|oollmlm bn pb}}bnc gvhegvols bn mbeelvln} og|n}bls icibns}liod g}dlv. Nlulv}dlalss! g|v logngjr bs sdiplm fr }dl ais }di} g|v lalo}lm geebobias lnio}$gv! luln
jgvl bjpgv}in}ar!eiba }g lnio}". ]g sll }dbs! iaa rg| diul }g mg bs aggh i} g}dlv jikgv bnm|s}vbiab{lm
mljgoviobls }di} diul jgvl vgf|s} |nbgns mlspb}l }dl ljlvclnol ge i cagfia logngjr. Cggm ltijpals
g|am fl Mlnjivh! _lmln! inm Oinimi. Sdi}s dipplnlm bn }dl \nb}lm _}i}ls bs ng} sbjpar i ji}}lv
ge cagfia }vlnms f|} vi}dlv ge mgjls}bo pgab}bos.
Bn }dl rlivs bjjlmbi}lar ie}lv Sgvam Siv BB! |nbgn s}vlnc}d is gn in |psbnc inm |nbgn mlnsb}r s}ggm
i} jgvl }din ?0 plvoln} ge ngnicvbo|a}|via ljpagrjln}.96 Bn vlspgnsl }g }dl slvbg|s }dvli} }di} }dbs
ia}lvni}l pglv s}v|o}|vl vlpvlsln}lm }g f|sbnlss! i Vlp|faboin mgjbni}lm Ogncvlss lnio}lm }dl ]ie}*
Div}alr Io} gulv }dl ul}g ge Pvlsbmln} ]v|jin bn 92=3. ]dbs io} bjpgslm abjb}s gn }dl ifbab}r ge |nbgns }gs}vbhl inm pbohl}. _lo}bgn 9=$f" ge }dbs io}! bn piv}bo|aiv! plvjb}}lm bnmbubm|ia s}i}ls }g pvgdbfb} |nbgns
evgj jihbnc jljflvsdbp i ognmb}bgn ge ljpagrjln}.
99d}}p;''vloaibjmljgovior.gvc'ogvpgvi}lWioog|n}ifbab}r'pglaaWjljgWalbs.d}ja.
96Clviam! Jirlv! &\nbgn Jljflvsdbp ]vlnms bn }dl \nb}lm _}i}ls& $600=". Elmlvia P|faboi}bgns. Piplv 93=.
-
8/3/2019 Rootkit Final
10/21
]dl Ebnia Odip}lv
90 q F l a g C g } d i j A i f s
Is ogvpgvi}l bn}lvls}s gvcinb{lm inm flcin }g ealt }dlbv ogaalo}bul j|soals bn }dl ai}l 9230s inm 9240s!
jinicljln} floijl jgvl iccvlssbul b}d }io}bos }di} lvl bn}lnmlm }g s}rjbl |nbgn jgfbab{i}bgn.
]dbs bs vlealo}lm fr }dl mviji}bo bnovlisl bn ubgai}bgns ge }dl Ni}bgnia Aifgv Vlai}bgns Io} $}dl Sicnlv
Io}" }di} lvl ebalm icibns} f|sbnlssls fr |nbgns.9? Bn eio}! in}b*|nbgn gplvi}bgns floijl sg bmlspvlim
}di} i j|a}bjbaabgn*mgaaiv bnm|s}vr ge |nbgn*iugbminol ogns|a}in}s eag|vbsdlm m|vbnc }dlsl rlivs.9=
F|sbnlssls iasg alulviclm slo}bgn 9=$f" ge }dl ]ie} Div}alr Io} fr jgubnc gplvi}bgns }g s}i}ls }di} lvl
alss ognm|obul }g |nbgn io}bub}r.
I}}ljp}s }g piss pvg*aifgv vlegvj jlis|vls gn Oipb}ga Dbaa }lnmlm }g eb{{al g|} flegvl vliodbnc ovb}boia
jiss. Egv ltijpal! }dl Aifgv Ai Vlegvj fbaa ge 9234 is egbalm fr i _lni}l ebabf|s}lv. Abhlbsl! }dl
Ogjjgn _b}|s Pbohl}bnc fbaa is ul}glm fr Pvlsbmln} Egvm bn 923< flegvl eibabnc }g j|s}lv }dl nlolssivr
ug}ls }g gulvvbml }dl ul}g. ]dl bnifbab}r }g bn}vgm|ol vlegvj is pbug}ia floi|sl b} pvluln}lm }dl alcia
v|als }di} cgulvn }dl jivhl} evgj hllpbnc |p b}d pvluibabnc ognmb}bgns. Iaa }di} f|sbnlss agffrbs}s dim
}g mg is }g cl} aijihlvs }g gfs}v|o} alcbsai}bgn }di} g|am iaag aifgv }g imip} }g }dl nl! jgvl
dgs}bal lnubvgnjln}. ]dbnh ge b} is i egvj ge s}lia}d alcbsai}bgn fr gjbssbgn.
Bn immb}bgn }g ovbppabnc }dl |nbgns! gulv }dl pis} ?0 rlivs f|sbnlss alimlvs ljfivhlm gn i ov|siml }di}
odijpbgnlm mlvlc|ai}bgn. ]dl ebninobia bnm|s}vr is i piv}bo|aivar i}}vio}bul }ivcl}. Bn 9222! Ogncvlss
lnio}lm }dl Cvijj Aliod Fabalr Io}! dbod vlplialm pvgubsbgns bn }dl Caiss _}liciaa Io} ge 92?? }di}
fivvlm bns}b}|}bgns evgj io}bnc is inr ogjfbni}bgn ge i ogjjlvobia finh! bnuls}jln} finh! inm
bns|vinol ogjpinr. ]dbs eiobab}i}lm jissbul ognsgabmi}bgn $}dbnh! }gg fbc }g eiba".
]dln }dlvls }dl Ogjjgmb}r E|}|vls Jgmlvnb{i}bgn Io} $OEJI" ge 6000! dbod $ijgnc g}dlv }dbncs"
ltljp}lm gulv*}dl*og|n}lv mlvbui}buls abhl ovlmb} mlei|a} sips evgj vlc|ai}bgn fr }dl _LO inm }dl
Ogjjgmb}r E|}|vls ]vimbnc Ogjjbssbgn. ]dl OEJI lssln}biaar iaaglm bns}b}|}bgns }g ogjjb} }g aivclv!
vbshblv }vinsio}bgns bnugaubnc ogjpaboi}lm $be ng} gpiy|l" ebninobia bns}v|jln}s b}d ulvr ab}}al gulvsbcd}.
_plo|ai}bul ltolss is vijpin}. Be i finhlvs fl} pibm gee! dl mbm i ubo}gvr aip inm ogaalo}lm i ei} fgn|s
odloh. Be i finhlvs fl} ln} flaar*|p! }dl \._. }itpirlv egg}lm }dl fbaa }g ogulv fg}d }dl }gtbo mlf} inm
}dl fgn|s odloh.
]dl mlvlc|ai}bgn iul is i d|cl pirmir egv Siaa _}vll}. M|vbnc }dl plvbgm 6000 * 6004! }dl }gp ebul
ltlo|}buls i} Fliv _}livns inm Aldjin Fvg}dlvs vihlm bn -6.= fbaabgn evgj ly|b}r sials inm oisd
fgn|sls.9< Inm }dlsl lvl finhs }di} ln} |nmlv) Evgj }dl jbm*9220s gnivm! vlslivod plvegvjlm fr
pvgelssgvs evgj Nl Rgvh \nbulvsb}r inm }dl \nbulvsb}r ge Ubvcbnbi ognoa|mlm }di} |p }g diae ge }dl icl
mbeelvln}bia }di} ltbs}s fl}lln }dl ebninobia slo}gv inm g}dlv slo}gvs oin fl i}}vbf|}lm }g cgulvnjln}
mlvlc|ai}bgn.95 ]dlsl bneai}lm siaivbls! bn }|vn! jihl b} mbeebo|a} egv vlc|ai}gvs }g mlulagp }dl }ialn}
9?Vgflv} Eainicin! Dis Jinicljln} _}vincalm \._. \nbgns7Kg|vnia ge Aifgv Vlslivod 65! ng. 9! Mloljflv! 600
-
8/3/2019 Rootkit Final
11/21
]dl Ebnia Odip}lv
99 q F l a g C g } d i j A i f s
nlolssivr }g hllp |p b}d }dl evln{blm piol ge }dl ebninobia bnm|s}vr inm cvisp b} laa lng|cd }g ltlv}
ogn}vga. Bn i slnsl! mlvlc|ai}bgn ioog|n}s bn piv} egv vlc|ai}gvr eiba|vl. ]dl jgvl v|als rg| }ihl iir!
}dl divmlv b} bs }g jgnb}gv }dl vls|a}bnc jivhl}.
Lt}viuicin} ogjplnsi}bgn bsn} abjb}lm }g ogvpgvi}l geebolvs bn }dl ebninobia slo}gv. Is jln}bgnlm livabl v
bn }dl odip}lv! ltlo|}bul pir iovgss }dl \nb}lm _}i}ls bs ng d|nmvlms ge }bjls cvli}lv }din }di} ge }dl
iulvicl gvhlv. ]dbs s}ljs aivclar evgj i eailm ogvpgvi}l cgulvninol srs}lj }di} iaags ltlo|}buls }g
bnea|lnol }dl fgivm jljflvs }di} sl} }dlbv pir! bn immb}bgn }g s}lia}dr ogjplnsi}bgn pvio}bols
$mlelvvlm ogjplnsi}bgn! fiohmi}bnc gp}bgn uia|ls! l}o." }di} ivl bn}lnmlm }g jihl b} mbeebo|a} egv
bnuls}gvs }g mbsolvn }dlj is s|od. Ia}dg|cd }dl _ivfinls Gtalr Io} ge 6006 is i s}lp bn }dl vbcd}
mbvlo}bgn! ogvpgvi}l agffrbnc cvg|ps lvl ifal }g |nmlvjbnl }dl sgv} ge vlegvjs }di} g|am diul alm }g
luln cvli}lv fgivm bnmlplnmlnol.93
Ebniaar! }dl lab}l dis flln eibvar s|oolsse|a i} ognsbs}ln}ar aglvbnc b}s }it vi}ls gulv }dl pis} ?0 rlivs. Bn
9250! }dl }gp }ln}d ge i plvoln} ge }dl bnogjl splo}v|j ltplvblnolm in iulvicl }it vi}l ge gulv 30
plvoln}. Fr 600
pairlm i vgal bn }dbs s}limr mgnivm }vlnm. Ioogvmbnc }g i s}|mr fr }dl Ogncvlssbgnia F|mcl} Geebol!
dg|sldgams livnbnc jgvl }din -9 jbaabgn i rliv b}nlsslm }dlbv elmlvia }it vi}ls eiaa jgvl sdivpar }din
inr cvg|p bn }dl og|n}vr is i mbvlo} vls|a} ge Pvlsbmln} F|sds }it o|}s .92
Sdln }dl }bjl oijl egv Pvlsbmln} Gfiji }g ognsbmlv }dlsl }it o|}s! Vlp|faboin slni}gvs }dvli}lnlm }g
ebabf|s}lv |n}ba }dl ji}}lv is egvjiaar immvlsslm. ]dg|cd Gfiji mlebin}ar vlelvvlm }g }dlsl
Vlp|faboins is dgs}icl*}ihlvs! ie}lv j|od cv|jfabnc bn 6090! dl |a}bji}lar ippvgulm i fbaa }di}
lt}lnmlm }dl }it o|}s |n}ba 6096. Al} }di} fl i alssgn }g rg|! mliv vlimlv; \n}ba }dl logngjboiaar
pvbubalclm ivl dippr! ng gnl lasl cl}s }g fl dippr.
Pvlmbspgsbnc Oi|sls
Slul slln dg }dl ogvpgvi}l bn}lvls}s s}iv}lm jissbnc }dlbv ivjbls bn }dl 9230s }g agffr lalo}lm
geebobias inm sir }dlbv ug}bnc fldiubgv. ]dl lnm vls|a} is }di} fbc f|sbnlss s|oollmlm bn cl}}bnc
mljgovior }g slvul oipb}iabsj. ]dlr ovbppalm aifgv! mlvlc|ai}lm }dl ebninobia jivhl}s! gfs}v|o}lm
i}}ljp}s }g vlbcn bn ltlo|}bul ogjplnsi}bgn! inm ciul }dljslauls nbol }it o|}s. Bn }dl jlin}bjl!
lulvrgnl lasl }vlims i}lv.
Sdi} |nmlvarbnc isplo}s ge Ijlvboin mljgovior lnifalm }dbs }g dippln7
93A|obin Flfod|h inm Klssl Evblm! Pir b}dg|} Plvegvjinol; ]dl \ne|aebaalm
Pvgjbsl ge Ltlo|}bul Ogjplnsi}bgn! Divuivm \nbulvsb}r Pvlss! Nguljflv! 600=.94
]dgjis Pbhl}}r inm Ljjin|la _il{! &Dg Pvgcvlssbul bs }dl \._. Elmlvia ]it
_rs}lj7 I Dbs}gvboia inm Bn}lvni}bgnia Plvsplo}bul!&Kg|vnia ge Logngjbo Plvsplo}buls! Uga|jl 69! N|jflv 9!
Sbn}lv 6003.92
Lmj|nm Inmvls! ]it O|}s Geelv Jgs} egv Ulvr Vbod! _}|mr _irs!Nl Rgvh ]bjls! Kin|ivr 4! 6003.
-
8/3/2019 Rootkit Final
12/21
]dl Ebnia Odip}lv
96 q F l a g C g } d i j A i f s
Gnl eli}|vl ge g|v srs}lj bs }di} b} bs bnoabnlm }givm cvbmagoh. Be gnl pgab}boia cvg|p bsdls }g gfs}v|o}
}dl pissicl ge alcbsai}bgn! b}s ng} }di} mbeebo|a}. Is l si b}d }dl Aifgv Ai Vlegvj fbaa ge 9234! }dl
ebabf|s}lv bs in leelo}bul lipgn. Ing}dlv ogjjgn }io}bo bs egv i vlpvlsln}i}bul dg dis flln og*gp}lm
fr agffrbs}s }g oaibj sgjl}dbnc abhl dbal B s|ppgv} }dbs jlis|vl bn spbvb}! }dlvl ivl olv}ibn pvgubsbgns
}di} B ebnm gfklo}bgnifal.
Is }dl f|sbnlss lnubvgnjln} odincls! alcbsai}bgn ge}ln nllms imk|s}jln} }g hllp |p b}d pvluibabnc
jivhl} ognmb}bgns. Eiba|vl }g mg sg vls|a}s bn di} Sia}lv Abppjin oiaalm mvbe}. Egv ltijpal! bn }dl
9230s inm 9240s! ogvpgvi}bgns gplnar inm vlc|aivar lnciclm bn fldiubgv }di} ubgai}lm ltbs}bnc aifgv
ais $ebvbnc gvhlvs dg }dlr s|splo}lm lvl }vrbnc }g gvcinb{l". ]dlr hnl! dglulv! }di} pirbnc i
ebnl egv fvlihbnc }dl ai g|am fl odliplv }din iaagbnc gvhlvs }g |nbgnb{l gulv }dl agnc v|n. Fr
dbnmlvbnc gv y|bl}ar s}iaabnc }dl lnio}jln} ge fbaas }di} g|am vljlmbi}l pvgfaljs abhl }dbs! alcbsai}gvs
og|am ipplisl ogvpgvi}l agffrbs}s inm s|ppgv} in}b*|nbgn io}bub}r b}dg|} gulv}ar ipplivbnc }g. Ie}lv iaa!
jgs} pgab}boia iniars}s ego|s pvbjivbar gn in lalo}lm geebobias ug}bnc vlogvm. Sdi} }dbs jbnmsl} eibas }g
iohngalmcl bs }di} bnio}bgn b}slae oin fl ubllm is i egvj ge s}lia}d alcbsai}bgn.
]dln }dlvls iasg }dl ji}}lv ge ug}lv mbslncicljln}. Bn }dl 6090 jbm}lvj lalo}bgns! gnar =0.3 plvoln}
ge }dgsl labcbfal }g ug}l mbm sg $ippvgtbji}lar 42 jbaabgn plgpal".60 Ogjpivl }dbs }g }dl 999 jbaabgn
plgpal dg i}odlm }dl _|plv Fga bn 6099. Sdbal B g|am fl} }di} jgs} jbmmal*oaiss plgpal pvgfifar
|nmlvs}inm }g sgjl mlcvll }di} }dlrvl flbnc cbuln }dl sdgv} lnm ge }dl s}boh! }dlsl sijl plgpal eiba }g
ogjjb} }dljslauls }g bns}b}|}bnc jlinbnce|a odincl. ]dlrm vi}dlv splnm }dlbv spivl }bjl b}d }dlbv
eijbabls! egaag }dlbv eiugvb}l ]U mvijis! i}od spgv}s! gv di}lulv. Bn g}dlv gvms! }dlr diuln}
vliodlm }dl pgbn} dlvl }dlr ella ogjplaalm }g mg sgjl}dbnc. Mlspb}l flbnc gn }dl agsbnc lnm ge i oaiss
iv! gvmbnivr plgpal ivl s}baa slljbncar ogn}ln} lng|cd b}d fvlim inm obvo|sls.
]dbs flcs }dl y|ls}bgn; dr ivln} l g|}viclm lng|cd }g }ihl io}bgn7 Gnl vlisgn bs }di} }dl jikgv
jlmbi g|}al}s $}dl iclnmi*sl}}bnc laljln}s ge }dl pvlss" jgs}ar imdlvl }g }dl Pvgpicinmi Jgmla
splaalm g|} fr Ngij Odgjshr inm Lmivm Dlvjin bn }dlbv fggh Jin|eio}|vbnc Ognsln}. ]dl
Pvgpicinmi Jgmla pvlmbo}s! y|b}l ioo|vi}lar! }di} }dl fbc nls g|}al}s evijl bss|ls bn s|od i ir is }g
bno|aoi}l inm mlelnm }dl iclnmi ge }dl pvbubalclm cvg|ps }di} mgjbni}l }dl pvbui}l logngjr.
]dbs bs ng ioobmln} is }dl jikgv g|}al}s! abhl }dl Siaa _}vll} Kg|vnia$}dl fbccls} mibar nlspiplv
ioogvmbnc }g }dl I|mb} F|vli| ge Obvo|ai}bgn"! ivl piv} ge aivcl p|faboar }vimlm ogvpgvi}bgns. Flbnc
p|faboar }vimlm! }dl iclnmi*sl}}lvs ivl fldgamln }g }dl mlsbvls ge Siaa _}vll}! dlvl bnuls}gvs jlis|vl
}dlbv uia|l is i e|no}bgn ge }dl pvgeb} }di} }dlr clnlvi}l.
F|sbnlss alimlvs ivl laa iivl ge }dbs mrnijbo. Bn dbs 9239 jljgvinm|j }g }dl mbvlo}gv ge }dl \._.
Odijflv ge Ogjjlvol! Albs Pglaa gfslvulm Jgs} ge }dl jlmbi! bnoa|mbnc }dl ni}bgnia ]U srs}ljs!
ivl gnlm inm }dlgvl}boiaar ogn}vgaalm fr ogvpgvi}bgns dbod mlplnm |pgn pvgeb}s! inm }dl ln}lvpvbsl
srs}lj }g s|vubul.
60Jbodila JoMgniam! &Ug}lv ]|vng|} bn }dl 6090 Jbm}lvj Lalo}bgn!& ]dl Egv|j! Uga|jl 4! Bss|l. =.
-
8/3/2019 Rootkit Final
13/21
]dl Ebnia Odip}lv
9? q F l a g C g } d i j A i f s
]dl Siaa _}vll} Kg|vniaslaas vg|cdar 6 jbaabgn piplvs lulvr mir!69 inm imulv}bsljln} vluln|l bs
s|fs}in}bia lng|cd }di} }dl ltlo|}buls dg ogn}vga }dl g|}al} diul ognsbmlvlm sbjpar cbubnc iir
gnabnl ogn}ln} egv evll.66 Sdi} }dbs mljgns}vi}ls bs }di} jikgv nls sg|vols abhl }dl Siaa _}vll} Kg|vnia
diul i pvgm|o} $}dlbv vlimlvs" }di} }dlr slaa }g }dl f|rlvs bn }dl jivhl} $}dl imulv}bslvs".
Is b} }|vns g|}! }dl pvgeb} jivcbn bn }dbs jivhl} oin fl pvl}}r cggm. ]dbs bs floi|sl piplvs abhl }dl Siaa
_}vll} Kg|vniajibn}ibn i odinnla }g i uia|ifal ogjjgmb}r; sgobl}rs dbcd alula mlobsbgn jihlvs. Bn g}dlv
gvms! jinr ge }dl plgpal dg vlim }dl Siaa _}vll} Kg|vniaiasg vlpvlsln} Ijlvboispgab}boia oaiss.
Ioogvmbnc }g IFO Nls! }dl iulvicl dg|sldgam bnogjl ge }dl Siaa _}vll} Kg|vnias s|fsovbflv bn 6003
is ippvgtbji}lar -6?
_g di}s cgbnc gn bs }di} rg| diul gnl aivcl ogvpgvi}bgn slaabnc b}s pvgm|o} }g g}dlv aivcl ogvpgvi}bgns!
dlvl }dl pvgm|o} bs }dl lrls inm livs ge }dl v|abnc oaiss. B} gnar jihls slnsl }di} }dl bmlis p|} egv}d
baa fl }dgsl }di} oi}lv }g }dl logngjbo mlsbvls inm pgab}boia bnoabni}bgns ge }dl piv}bls bnugaulm. Bn eio}!
}dbs hbnm ge mbs}gv}bgn bs ltio}ar di} Ngij Odgjshr inm Lmivm Dlvjin mbsogulvlm dbal s}|mrbnc }dl
ni}|vl ge }dl jiss jlmbi.
]ihl }dl drs}lvbi s|vvg|nmbnc SJMs inm }dl iaalclm ognnlo}bgn fl}lln _immij D|sslbn inm Ia
Yilmi bn }dl mirs flegvl }dl \nb}lm _}i}ls bnuimlm Bviy. Iaa }dl fbc g|}al}s! s|od is }dl Nl Rgvh
]bjls! }dl Siaa _}vll} Kg|vnia! inm }dl Sisdbnc}gn Pgs}! ogjpabin}ar pairlm iagnc dln }dl F|sd
Imjbnbs}vi}bgn pivimlm b}s evi|m|aln} lubmlnol bn evgn} ge }dl Ijlvboin p|fabo inm oiaalm b} |nmlnbifal
pvgge.
Sdr7 Dg mbm }dlr cl} iir b}d b}7 Ioogvmbnc }g Min Vi}dlv6=;
Eliv bs bn lulvr nlsvggj bn }dl og|n}vr. Inm eliv ge di}7 Slaa! b}#s }dl eliv b}#s i ogjfbni}bgn ge; be
rg| mgn#} cg iagnc }g cl} iagnc! rg|#vl cgbnc }g cl} }dl vlp|}i}bgn ge flbnc i }vg|faljihlv. ]dlvl#s iasg
}dl eliv }di}! rg| hng! piv}bo|aivar bn nl}gvhs! }dlr#ul flogjl d|cl! bn}lvni}bgnia ogncagjlvi}ls.
]dlr diul fbc nllms! alcbsai}bul nllms! vlplv}gvr nllms bn Sisdbnc}gn. Ngfgmr dis }g slnm rg| i jljg
}g }laa rg| }di} }di}#s }dl oisl.
]dl lnm vls|a} ge ug}lv ipi}dr bs }di} pgab}bobins vliab{l }dl alula ge obubo mbslncicljln} }di} ltbs}s inm
}lnm }g cbul }dlbv i}}ln}bgn }g }dl cvg|ps }di} oin ltlv} }dl nlolssivr gvcinb{i}bgnia pvlss|vl }g vlivm
$gv p|nbsd" }dlj egv s|ppgv}bnc i olv}ibn iclnmi. Cbuln }dl jgnlr*bn}lnsbul ni}|vl ge lalo}gvia pgab}bos!
dlvl j|od ge di}s spln} cl}s mbvlo}lm }givm oijpibcn imulv}bsbnc!6< bnsgeiv is logngjbo bss|ls ivl
ognolvnlm }dl s}inols }di} g|v lalo}lm geebobias iss|jl ivl aivclar ml}lvjbnlm fr ogvpgvi}l agffbls. Bn
69d}}p;''ifois?.ioolssifo.ogj'lobvo'nls}b}alslivod|s.isp.
66Oi}dlvbnl Dgaidin! ]dl Oisl egv Evllbnc }dl S_K Gnabnl! F|sbnlssSllh! I|c|s} 90! 6003.
6?_og}} Jirlvgb}{! &Sdi} Mg }dl Vbod inm Pglve|a Vlim7&IFO Nls! K|ar 64! 6003.
6=d}}p;''.pfs.gvc'jgrlvs'kg|vnia'f}'}vinsovbp}9.d}ja.
6