Linux.BackDoor.AES.DDoS Attack And Defense Analysis

catalogue

1. 恶意程序概述
2. 模块分解
3. 通信协议
4. 木马清理
5. 中控源发现

 

1. 恶意程序概述

AES DDOS客户端恶意程序主要针对router devices(区别于其他针对x86、x64的恶意程序)，AES恶意程序客户端基于ARM architecture

Relevant Link:

https://otx.alienvault.com/pulse/55b290e5b45ff508d47ccc10/
http://blog.0day.jp/2015/07/linuxaesddosarm.html
https://otx.alienvault.com/pulse/55afa041b45ff56bb994e6ea/
http://blog.malwaremustdie.org/2014/09/reversing-arm-architecture-elf-elknot.html

2. 模块分解
3. 通信协议

1. 心跳包
2. 攻击指令包

def dataReceived(self, data):
        print "Server said:", data.encode('hex')
        dataLen = len(data)
        if data[0] == '\x06' and dataLen == 0x1a5:      # DDOS
            # AES Decrpt
            taskBody = self.AESEncDec(data[0x4:0x1A4], self.key)
            #extract ip list
            ipList = self.extractTasks(taskBody)
            attackType = taskBody[0x184]
            if attackType == '\x01':
                attackType = 'SYN'
            elif attackType == '\x02':
                attackType = 'UDP'
            elif attackType == '\x03':
                attackType = 'TCP'
            elif attackType == '\x04':
                attackType = 'DNS'
            elif attackType == '\x08':
                attackType = 'CC'
            elif attackType == '\x0c':
                attackType = 'CC SNAIL'
            else:
                attackType = 'Unknow'
            for ip in ipList:
                target_ip = socket.inet_ntoa(struct.pack('I',socket.htonl(ip[0]))[::-1])
                target_url = ""
                target_port = str(ip[1])
                target_attack_type = attackType
                #save attack info
                eventReporter.saveAttackEvent(server=self.server, cmd='DDOS', cmd_desc=target_attack_type, victim_ip=target_ip, victim_port=target_port,victim_url=target_url)

4. 木马清理

5. 中控源发现

0x1:  端口探活

masscan.exe -p80 0.0.0.0/4 -sS -Pn -n --randomize-hosts   
masscan.exe -p2869,2444,2413,2800,2420,6000,3502,6001,2837,3309,6003,3307,2407,3308,7709,2871,2801,8003,3504,2422,6004,2897,6002,80,2446,2854,2412,2427,7011 0.0.0.0/0 --exclude 255.255.255.255 --rate=100000

Relevant Link:

https://github.com/robertdavidgraham/masscan
http://tools.kali.org/information-gathering/masscan
https://github.com/robertdavidgraham/masscan/blob/master/doc/masscan.8.markdown
https://www.offensive-security.com/offsec/masscan-web-interface/
http://www.kitploit.com/2014/09/masscan-mass-ip-port-scanner-fastest.html

0x2: 握手验证中控源

login_data = '\x36\xa0\x26\xb8\x10\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa8\x41\x32\x46\x41\x33\x36\x41\xbe\xbe\xc6\xca\x07\x1f\x77\x06\x6c\x72\x1f\x74\x72\x1e\x51\x24\x2f\x24\x4b\x5c\x57\x31\x46\x30\x42\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30\x42\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30\x42\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x58\x70\x08\x74\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30\x42\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30\x42\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30\x42\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x77\x1a\x71\x71\x02\x7f\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30\x42\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30\x42\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30\x42\x42\x32\x46\x41\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x5f\x2c\x25\x44\x35\x31\x55\x5b\x23\x3b\x2d\x40\x54\x4e\x4b\x3e\x52\x25\x25\x54\x37\x38\x56\x42\x25\x29\x29\x58\x40\x5b\x44\x2f\x30\x11\x16\x73\x12\x08\x70\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30\x70\x6c\x02\x68\x71\x33\x36\x41\x41\x41\x39\x35\x34\x31\x46\x30'

 def dataReceived(self, data):
        dataLen = len(data)
        if dataLen >= 28:
            header = data[:28]
            # cc response the same as request
            if header[0:4] == self.login_data[0:4] and header[4:8] == self.login_data[4:8]:
                print "find C&C: ", self.transport.getPeer()
                ip = self.transport.getPeer().host
                port = self.transport.getPeer().port
                monitor.eventReporter.ccServerInfo(res_type = "XorDDoS", url ="", ip = ip, port = port, is_active = 1, is_monitor = 1, is_attack = 1)
        self.transport.abortConnection()

0x3: 二次握手验证

对于很多Web Server来说，默认都会内置echo response the same request，即如果Client发送的数据包不是一个标准的HTTP请求包，Web Server会直接原封不动返回请求包。这会对我们的木马login握手验证产生误报，因此这里需要增加一个二次握手验证，即

1. login request-resonse验证
2. 心跳包验证

 

Copyright (c) 2016 LittleHann All rights reserved