Uroburos script
Aller à la navigation
Aller à la recherche
| Fiche express | |
|---|---|
| Cible analysée | Rootkit Uroburos (Turla / Snake / Sednit) |
| Nature du script | PoC de détection réseau (défensif) |
| Auteur | ExaTrack (PoC public) |
| Crypto | Threefish (constante 0x1BD11BDAA9FC1A22)
|
| Voir aussi | Rootkit |
Uroburos (aussi connu sous les noms Turla, Snake) est un rootkit avancé attribué à un acteur étatique, capable d'opérer en mode noyau et de communiquer avec son C2 via des canaux dissimulés (dont du HTTP).
Cette page reproduit le script de preuve de concept (PoC) de détection publié par ExaTrack. Il s'agit d'un outil défensif : il forge une requête de contrôle (encodée et signée par la routine crypto propre au rootkit, une variante de Threefish) et l'envoie à un hôte/port donné ; si la réponse présente la structure et le checksum attendus, l'hôte est signalé comme compromis. Le script ne dépose aucune charge malveillante — il sonde et interprète une réponse.
Note : aucune adresse de C2 réelle n'est codée en dur ; l'IP et le port cibles sont passés en arguments de ligne de commande. Le tag (ABCD) et la chaîne de test (ExaTrack) sont ceux de la démonstration originale.
Références
- https://exatrack.com/public/Uroburos_FR.pdf
- https://artemonsecurity.com/uroburos.pdf
- Source du PoC : https://exatrack.com/public/uroburos_poc.py
Script de détection (PoC ExaTrack)
import sys
import struct
def hexprint(string, base = 0, word_size = 1, no_print = False):
result = ""
if len(string) == 0:
return
string = str(string)
ascii = list("."*256)
for i in range(1,0x7f):
ascii[i] = chr(i)
ascii[0x0] = "."
ascii[0x7] = "."
ascii[0x8] = "."
ascii[0x9] = "."
ascii[0xa] = "."
ascii[0x1b] = "."
ascii[0xd] = "."
ascii[0xff] = "\xfe"
ascii = "".join(ascii)
offset = 0
while (offset+0x10) <= len(string):
line = string[offset:(offset+0x10)]
linebuf = " %016X " % (offset+base)
if word_size == 1:
for i in range(0,16):
if i == 8:
linebuf += " "
linebuf += "%02X " % ord(line[i])
linebuf += " "
for i in range(0,16):
linebuf += ascii[ord(line[i])]
if no_print == True:
result += linebuf+"\n"
else:
print linebuf
elif word_size == 4:
for i in [0,4,8,0xc]:
if i == 8:
linebuf += " "
linebuf += "%08X " % struct.unpack('I', line[i:i+4])[0]
linebuf += " "
for i in range(0,16):
linebuf += ascii[ord(line[i])]
if no_print == True:
result += linebuf+"\n"
else:
print linebuf
elif word_size == 8:
for i in [0,8]:
if i == 8:
linebuf += " "
linebuf += "%016X " % struct.unpack('Q', line[i:i+8])[0]
linebuf += " "
for i in range(0,16):
linebuf += ascii[ord(line[i])]
if no_print == True:
result += linebuf+"\n"
else:
print linebuf
offset += 0x10
if (len(string) % 0x10) > 0:
linebuf = " %016X " % (offset+base)
if word_size == 1:
for i in range((len(string)-(len(string) % 0x10)),(len(string))):
if i == 8:
linebuf += " "
linebuf += "%02X " % ord(string[i])
linebuf += " "*(0x10-(len(string) % 0x10))
linebuf += " "
if (len(string)%0x10) < 8:
linebuf += " "
for i in range((len(string)-(len(string) % 0x10)),(len(string))):
linebuf += ascii[ord(string[i])]
if no_print == True:
result += linebuf+"\n"
else:
print linebuf
elif word_size == 4:
linebuf = " %08X " % (offset+base)
if (len(string) % 0x10) == 8:
linebuf += "%08X " % struct.unpack('I', string[len(string)-4:])[0]
linebuf += " "*(0x11-(len(string) % 0x10))
linebuf += " "
for i in range((len(string)-(len(string) % 0x10)),(len(string))):
linebuf += ascii[ord(string[i])]
if no_print == True:
result += linebuf+"\n"
else:
print linebuf
elif word_size == 8:
linebuf = " %016X " % (offset+base)
if (len(string) % 0x10) == 8:
linebuf += "%016X " % struct.unpack('Q', string[len(string)-8:])[0]
linebuf += " "*(0x11-(len(string) % 0x10))
linebuf += " "
for i in range((len(string)-(len(string) % 0x10)),(len(string))):
linebuf += ascii[ord(string[i])]
if no_print == True:
result += linebuf+"\n"
else:
print linebuf
return result.decode("cp1252")
def __ROL8__(num, index):
return align_64((num<<index)|(num>>(64-index)))
def __ROR8__(num, index):
return align_64((num>>index)|((num&((2**index)-1))<<(64-index)))
def align_64(num):
return (num&0xffffffffffffffff)
def crypto_it(a1, a2, a3, a4):
v331 = a4
v330 = a3
v329 = a2
v328 = a1
v4 = struct.unpack("Q",a1[24:24+8])[0]
v5 = struct.unpack("Q",a1[16:16+8])[0]
result = a2
v322 = struct.unpack("Q",a1[24:24+8])[0]
v7 = a1
v321 = 0
while ( v321 == 0 ):
v8 = struct.unpack("Q",v7[0x38:0x38+8])[0]
v9 = struct.unpack("Q",v7[48:48+8])[0]
v10 = struct.unpack("Q",v7[32:32+8])[0]
v323 = align_64(a4 + v5)
v11 = align_64(a4 + v5)
v12 = struct.unpack("Q",v7[40:40+8])[0]
v13 = align_64((a4 + v5) ^ v4)
v14 = align_64(v10 ^ v12 ^ v9 ^ v8 ^ 0x1BD11BDAA9FC1A22)
Dst = struct.unpack("Q",result[0:8])[0]
v325 = struct.unpack("Q",result[8:0x10])[0]
v326 = struct.unpack("Q",result[0x10:0x18])[0]
v327 = struct.unpack("Q",result[0x18:0x20])[0]
v329 = v329[32:]
v15 = align_64(v325)
v16 = align_64(v326)
v17 = align_64(v11 + v325 + v12)
v18 = align_64(v327)
v19 = align_64(v10 + v17 + Dst)
v17 = __ROL8__(v17, 14)
v20 = align_64(v19 ^ v17)
v21 = align_64(v322 + v9 + v327 + v8 + v326)
v22 = __ROL8__(v327 + v8, 16)
v23 = align_64(v21 ^ v22)
v24 = align_64(v20 + v21)
v25 = align_64(v23 + v19)
v23 = __ROR8__(v23, 12)
v26 = align_64(v25 ^ v23)
v20 = __ROR8__(v20, 7)
v27 = align_64(v24 ^ v20)
v28 = align_64(v26 + v24)
v29 = align_64(v27 + v25)
v27 = __ROL8__(v27, 23)
v30 = align_64(v29 ^ v27)
v26 = __ROR8__(v26, 24)
v31 = align_64(v28 ^ v26)
v32 = align_64(v30 + v28)
v33 = align_64(v31 + v29)
v30 = __ROR8__(v30, 27)
v34 = align_64(v322 + v9 + (v32 ^ v30))
v31 = __ROL8__(v31, 5)
v35 = align_64((v33 ^ v31) + v14 + 1)
v36 = align_64(v34 + v12 + v33)
v34 = __ROL8__(v34, 25)
v37 = align_64(v36 ^ v34)
v38 = align_64(v8 + v35 + v13 + v32)
v35 = __ROR8__(v35, 31)
v39 = align_64(v38 ^ v35)
v40 = align_64(v37 + v38)
v41 = align_64(v39 + v36)
v39 = __ROR8__(v39, 18)
v42 = align_64(v41 ^ v39)
v37 = __ROL8__(v37, 12)
v43 = align_64(v40 ^ v37)
v44 = align_64(v42 + v40)
v45 = align_64(v43 + v41)
v43 = __ROR8__(v43, 6)
v46 = align_64(v45 ^ v43)
v42 = __ROL8__(v42, 22)
v47 = align_64(v44 ^ v42)
v48 = align_64(v46 + v44)
v49 = align_64(v47 + v45)
v46 = __ROL8__(v46, 32)
v50 = align_64(v8 + v13 + (v48 ^ v46))
v47 = __ROL8__(v47, 32)
v51 = align_64(v49 ^ v47)
v52 = align_64(v50 + v9 + v49)
v50 = __ROL8__(v50, 14)
v53 = align_64(v51 + v10 + 2)
v54 = align_64(v52 ^ v50)
v55 = align_64(v323 + v53 + v14 + v48)
v53 = __ROL8__(v53, 16)
v56 = align_64(v55 ^ v53)
v57 = align_64(v54 + v55)
v58 = align_64(v56 + v52)
v56 = __ROR8__(v56, 12)
v59 = align_64(v58 ^ v56)
v54 = __ROR8__(v54, 7)
v60 = align_64(v57 ^ v54)
v61 = align_64(v59 + v57)
v62 = align_64(v60 + v58)
v60 = __ROL8__(v60, 23)
v63 = align_64(v62 ^ v60)
v59 = __ROR8__(v59, 24)
v64 = align_64(v61 ^ v59)
v65 = align_64(v63 + v61)
v66 = align_64(v64 + v62)
v63 = __ROR8__(v63, 27)
v67 = align_64(v323 + v14 + (v65 ^ v63))
v64 = __ROL8__(v64, 5)
v68 = align_64((v66 ^ v64) + v12 + 3)
v69 = align_64(v67 + v8 + v66)
v67 = __ROL8__(v67, 25)
v70 = align_64(v69 ^ v67)
v71 = align_64(v322 + v68 + v10 + v65)
v68 = __ROR8__(v68, 31)
v72 = align_64(v71 ^ v68)
v73 = align_64(v70 + v71)
v74 = align_64(v72 + v69)
v72 = __ROR8__(v72, 18)
v75 = align_64(v74 ^ v72)
v70 = __ROL8__(v70, 12)
v76 = align_64(v73 ^ v70)
v77 = align_64(v75 + v73)
v78 = align_64(v76 + v74)
v76 = __ROR8__(v76, 6)
v79 = align_64(v78 ^ v76)
v75 = __ROL8__(v75, 22)
v80 = align_64(v77 ^ v75)
v81 = align_64(v79 + v77)
v82 = align_64(v80 + v78)
v79 = __ROL8__(v79, 32)
v83 = align_64(v322 + v10 + (v81 ^ v79))
v80 = __ROL8__(v80, 32)
v84 = align_64(v82 ^ v80)
v85 = align_64(v83 + v14 + v82)
v86 = align_64(v84 + v9 + 4)
v83 = __ROL8__(v83, 14)
v87 = align_64(v85 ^ v83)
v88 = align_64(v12 + v86 + v13 + v81)
v86 = __ROL8__(v86, 16)
v89 = align_64(v88 ^ v86)
v90 = align_64(v87 + v88)
v91 = align_64(v89 + v85)
v89 = __ROR8__(v89, 12)
v92 = align_64(v91 ^ v89)
v87 = __ROR8__(v87, 7)
v93 = align_64(v90 ^ v87)
v94 = align_64(v92 + v90)
v95 = align_64(v93 + v91)
v93 = __ROL8__(v93, 23)
v96 = align_64(v95 ^ v93)
v92 = __ROR8__(v92, 24)
v97 = align_64(v94 ^ v92)
v98 = align_64(v96 + v94)
v99 = align_64(v97 + v95)
v96 = __ROR8__(v96, 27)
v100 = align_64(v12 + v13 + (v98 ^ v96))
v97 = __ROL8__(v97, 5)
v101 = align_64(v99 ^ v97)
v102 = align_64(v100 + v10 + v99)
v100 = __ROL8__(v100, 25)
v103 = align_64(v101 + v8 + 5)
v104 = align_64(v102 ^ v100)
v105 = align_64(v323 + v103 + v9 + v98)
v103 = __ROR8__(v103, 31)
v106 = align_64(v105 ^ v103)
v107 = align_64(v104 + v105)
v108 = align_64(v106 + v102)
v106 = __ROR8__(v106, 18)
v109 = align_64(v108 ^ v106)
v104 = __ROL8__(v104, 12)
v110 = align_64(v107 ^ v104)
v111 = align_64(v109 + v107)
v112 = align_64(v110 + v108)
v110 = __ROR8__(v110, 6)
v113 = align_64(v112 ^ v110)
v109 = __ROL8__(v109, 22)
v114 = align_64(v111 ^ v109)
v115 = align_64(v113 + v111)
v116 = align_64(v114 + v112)
v113 = __ROL8__(v113, 32)
v117 = align_64(v323 + v9 + (v115 ^ v113))
v114 = __ROL8__(v114, 32)
v118 = align_64(v116 ^ v114)
v119 = align_64(v117 + v12 + v116)
v117 = __ROL8__(v117, 14)
v120 = align_64(v118 + v14 + 6)
v121 = align_64(v119 ^ v117)
v122 = align_64(v322 + v120 + v8 + v115)
v120 = __ROL8__(v120, 16)
v123 = align_64(v122 ^ v120)
v124 = align_64(v121 + v122)
v125 = align_64(v123 + v119)
v123 = __ROR8__(v123, 12)
v126 = align_64(v125 ^ v123)
v121 = __ROR8__(v121, 7)
v127 = align_64(v124 ^ v121)
v128 = align_64(v126 + v124)
v129 = align_64(v127 + v125)
v127 = __ROL8__(v127, 23)
v130 = align_64(v129 ^ v127)
v126 = __ROR8__(v126, 24)
v131 = align_64(v128 ^ v126)
v132 = align_64(v130 + v128)
v133 = align_64(v131 + v129)
v130 = __ROR8__(v130, 27)
v134 = align_64(v322 + v8 + (v132 ^ v130))
v131 = __ROL8__(v131, 5)
v135 = align_64(v133 ^ v131)
v136 = align_64(v134 + v9 + v133)
v134 = __ROL8__(v134, 25)
v137 = align_64(v135 + v10 + 7)
v138 = align_64(v136 ^ v134)
v139 = align_64(v14 + v137 + v13 + v132)
v137 = __ROR8__(v137, 31)
v140 = align_64(v139 ^ v137)
v141 = align_64(v138 + v139)
v142 = align_64(v140 + v136)
v140 = __ROR8__(v140, 18)
v143 = align_64(v142 ^ v140)
v138 = __ROL8__(v138, 12)
v144 = align_64(v141 ^ v138)
v145 = align_64(v143 + v141)
v146 = align_64(v144 + v142)
v144 = __ROR8__(v144, 6)
v147 = align_64(v146 ^ v144)
v143 = __ROL8__(v143, 22)
v148 = align_64(v145 ^ v143)
v149 = align_64(v147 + v145)
v150 = align_64(v148 + v146)
v147 = __ROL8__(v147, 32)
v151 = align_64(v14 + v13 + (v149 ^ v147))
v148 = __ROL8__(v148, 32)
v152 = align_64((v150 ^ v148) + v12 + 8)
v153 = align_64(v151 + v8 + v150)
v151 = __ROL8__(v151, 14)
v154 = align_64(v153 ^ v151)
v155 = align_64(v323 + v152 + v10 + v149)
v152 = __ROL8__(v152, 16)
v156 = align_64(v155 ^ v152)
v157 = align_64(v154 + v155)
v158 = align_64(v156 + v153)
v156 = __ROR8__(v156, 12)
v159 = align_64(v158 ^ v156)
v154 = __ROR8__(v154, 7)
v160 = align_64(v157 ^ v154)
v161 = align_64(v159 + v157)
v162 = align_64(v160 + v158)
v160 = __ROL8__(v160, 23)
v163 = align_64(v162 ^ v160)
v159 = __ROR8__(v159, 24)
v164 = align_64(v161 ^ v159)
v165 = align_64(v163 + v161)
v166 = align_64(v164 + v162)
v163 = __ROR8__(v163, 27)
v167 = align_64(v323 + v10 + (v165 ^ v163))
v164 = __ROL8__(v164, 5)
v168 = align_64(v166 ^ v164)
v169 = align_64(v167 + v14 + v166)
v167 = __ROL8__(v167, 25)
v170 = align_64(v168 + v9 + 9)
v171 = align_64(v169 ^ v167)
v172 = align_64(v322 + v170 + v12 + v165)
v170 = __ROR8__(v170, 31)
v173 = align_64(v172 ^ v170)
v174 = align_64(v171 + v172)
v175 = align_64(v173 + v169)
v173 = __ROR8__(v173, 18)
v176 = align_64(v175 ^ v173)
v171 = __ROL8__(v171, 12)
v177 = align_64(v174 ^ v171)
v178 = align_64(v176 + v174)
v179 = align_64(v177 + v175)
v177 = __ROR8__(v177, 6)
v180 = align_64(v179 ^ v177)
v176 = __ROL8__(v176, 22)
v181 = align_64(v178 ^ v176)
v182 = align_64(v180 + v178)
v183 = align_64(v181 + v179)
v180 = __ROL8__(v180, 32)
v184 = align_64(v322 + v12 + (v182 ^ v180))
v181 = __ROL8__(v181, 32)
v185 = align_64(v183 ^ v181)
v186 = align_64(v184 + v10 + v183)
v184 = __ROL8__(v184, 14)
v187 = align_64(v185 + v8 + 10)
v188 = align_64(v186 ^ v184)
v189 = align_64(v9 + v187 + v13 + v182)
v187 = __ROL8__(v187, 16)
v190 = align_64(v189 ^ v187)
v191 = align_64(v188 + v189)
v192 = align_64(v190 + v186)
v190 = __ROR8__(v190, 12)
v193 = align_64(v192 ^ v190)
v188 = __ROR8__(v188, 7)
v194 = align_64(v191 ^ v188)
v195 = align_64(v193 + v191)
v196 = align_64(v194 + v192)
v194 = __ROL8__(v194, 23)
v197 = align_64(v196 ^ v194)
v193 = __ROR8__(v193, 24)
v198 = align_64(v195 ^ v193)
v199 = align_64(v197 + v195)
v200 = align_64(v198 + v196)
v197 = __ROR8__(v197, 27)
v201 = align_64(v9 + v13 + (v199 ^ v197))
v198 = __ROL8__(v198, 5)
v202 = align_64(v200 ^ v198)
v203 = align_64(v201 + v12 + v200)
v201 = __ROL8__(v201, 25)
v204 = align_64(v202 + v14 + 11)
v205 = align_64(v203 ^ v201)
v206 = align_64(v323 + v204 + v8 + v199)
v204 = __ROR8__(v204, 31)
v207 = align_64(v206 ^ v204)
v208 = align_64(v205 + v206)
v209 = align_64(v207 + v203)
v207 = __ROR8__(v207, 18)
v210 = align_64(v209 ^ v207)
v205 = __ROL8__(v205, 12)
v211 = align_64(v208 ^ v205)
v212 = align_64(v210 + v208)
v213 = align_64(v211 + v209)
v211 = __ROR8__(v211, 6)
v214 = align_64(v213 ^ v211)
v210 = __ROL8__(v210, 22)
v215 = align_64(v212 ^ v210)
v216 = align_64(v214 + v212)
v217 = align_64(v215 + v213)
v214 = __ROL8__(v214, 32)
v218 = align_64(v323 + v8 + (v216 ^ v214))
v215 = __ROL8__(v215, 32)
v219 = align_64(v217 ^ v215)
v220 = align_64(v218 + v9 + v217)
v218 = __ROL8__(v218, 14)
v221 = align_64(v219 + v10 + 12)
v222 = align_64(v220 ^ v218)
v223 = align_64(v322 + v221 + v14 + v216)
v221 = __ROL8__(v221, 16)
v224 = align_64(v223 ^ v221)
v225 = align_64(v222 + v223)
v226 = align_64(v224 + v220)
v224 = __ROR8__(v224, 12)
v227 = align_64(v226 ^ v224)
v222 = __ROR8__(v222, 7)
v228 = align_64(v225 ^ v222)
v229 = align_64(v227 + v225)
v230 = align_64(v228 + v226)
v228 = __ROL8__(v228, 23)
v231 = align_64(v230 ^ v228)
v227 = __ROR8__(v227, 24)
v232 = align_64(v229 ^ v227)
v233 = align_64(v231 + v229)
v234 = align_64(v232 + v230)
v231 = __ROR8__(v231, 27)
v235 = align_64(v322 + v14 + (v233 ^ v231))
v232 = __ROL8__(v232, 5)
v236 = align_64((v234 ^ v232) + v12 + 13)
v237 = align_64(v235 + v8 + v234)
v235 = __ROL8__(v235, 25)
v238 = align_64(v237 ^ v235)
v239 = align_64(v10 + v236 + v13 + v233)
v236 = __ROR8__(v236, 31)
v240 = align_64(v239 ^ v236)
v241 = align_64(v238 + v239)
v242 = align_64(v240 + v237)
v240 = __ROR8__(v240, 18)
v243 = align_64(v242 ^ v240)
v238 = __ROL8__(v238, 12)
v244 = align_64(v241 ^ v238)
v245 = align_64(v243 + v241)
v246 = align_64(v244 + v242)
v244 = __ROR8__(v244, 6)
v247 = align_64(v246 ^ v244)
v243 = __ROL8__(v243, 22)
v248 = align_64(v245 ^ v243)
v249 = align_64(v247 + v245)
v250 = align_64(v248 + v246)
v247 = __ROL8__(v247, 32)
v251 = align_64(v10 + v13 + (v249 ^ v247))
v248 = __ROL8__(v248, 32)
v252 = align_64(v250 ^ v248)
v253 = align_64(v251 + v14 + v250)
v251 = __ROL8__(v251, 14)
v254 = align_64(v252 + v9 + 14)
v255 = align_64(v253 ^ v251)
v256 = align_64(v323 + v254 + v12 + v249)
v254 = __ROL8__(v254, 16)
v257 = align_64(v256 ^ v254)
v258 = align_64(v255 + v256)
v259 = align_64(v257 + v253)
v257 = __ROR8__(v257, 12)
v260 = align_64(v259 ^ v257)
v255 = __ROR8__(v255, 7)
v261 = align_64(v258 ^ v255)
v262 = align_64(v260 + v258)
v263 = align_64(v261 + v259)
v261 = __ROL8__(v261, 23)
v264 = align_64(v263 ^ v261)
v260 = __ROR8__(v260, 24)
v265 = align_64(v262 ^ v260)
v266 = align_64(v264 + v262)
v267 = align_64(v265 + v263)
v264 = __ROR8__(v264, 27)
v268 = align_64(v323 + v12 + (v266 ^ v264))
v265 = __ROL8__(v265, 5)
v269 = align_64(v267 ^ v265)
v270 = align_64(v268 + v10 + v267)
v268 = __ROL8__(v268, 25)
v271 = align_64(v269 + v8 + 15)
v272 = align_64(v270 ^ v268)
v273 = align_64(v322 + v271 + v9 + v266)
v271 = __ROR8__(v271, 31)
v274 = align_64(v273 ^ v271)
v275 = align_64(v272 + v273)
v276 = align_64(v274 + v270)
v274 = __ROR8__(v274, 18)
v277 = align_64(v276 ^ v274)
v272 = __ROL8__(v272, 12)
v278 = align_64(v275 ^ v272)
v279 = align_64(v277 + v275)
v280 = align_64(v278 + v276)
v278 = __ROR8__(v278, 6)
v281 = align_64(v280 ^ v278)
v277 = __ROL8__(v277, 22)
v282 = align_64(v279 ^ v277)
v283 = align_64(v281 + v279)
v284 = align_64(v282 + v280)
v281 = __ROL8__(v281, 32)
v285 = align_64(v322 + v9 + (v283 ^ v281))
v282 = __ROL8__(v282, 32)
v286 = align_64(v284 ^ v282)
v287 = align_64(v285 + v12 + v284)
v285 = __ROL8__(v285, 14)
v288 = align_64(v286 + v14 + 16)
v289 = align_64(v287 ^ v285)
v290 = align_64(v8 + v288 + v13 + v283)
v288 = __ROL8__(v288, 16)
v291 = align_64(v290 ^ v288)
v292 = align_64(v289 + v290)
v293 = align_64(v291 + v287)
v291 = __ROR8__(v291, 12)
v294 = align_64(v293 ^ v291)
v289 = __ROR8__(v289, 7)
v295 = align_64(v292 ^ v289)
v296 = align_64(v294 + v292)
v297 = align_64(v295 + v293)
v295 = __ROL8__(v295, 23)
v298 = align_64(v297 ^ v295)
v294 = __ROR8__(v294, 24)
v299 = align_64(v296 ^ v294)
v300 = align_64(v298 + v296)
v301 = align_64(v299 + v297)
v298 = __ROR8__(v298, 27)
v302 = align_64(v13 + (v300 ^ v298))
v5 = align_64(v323)
v303 = align_64(v8 + v302)
v299 = __ROL8__(v299, 5)
v304 = align_64(v301 ^ v299)
v305 = align_64(v303 + v9 + v301)
v303 = __ROL8__(v303, 25)
v306 = align_64(v304 + v10 + 17)
v307 = align_64(v305 ^ v303)
v308 = align_64(v323 + v306 + v14 + v300)
v306 = __ROR8__(v306, 31)
v309 = align_64(v308 ^ v306)
v7 = v328
v310 = align_64(v307 + v308)
v311 = align_64(v309 + v305)
v309 = __ROR8__(v309, 18)
v312 = align_64(v311 ^ v309)
v307 = __ROL8__(v307, 12)
v313 = align_64(v310 ^ v307)
v314 = align_64(v312 + v310)
v315 = align_64(v313 + v311)
v313 = __ROR8__(v313, 6)
v316 = align_64(v315 ^ v313)
v312 = __ROL8__(v312, 22)
v317 = align_64(v314 ^ v312)
v318 = align_64(v316 + v314)
v319 = align_64(v317 + v315)
v316 = __ROL8__(v316, 32)
v328[32:32+8] = struct.pack("Q",align_64(Dst ^ (v8 + v319)))
v320 = align_64(v16 ^ (v322 + v318 + v10))
a4 = align_64(v331)
v328[48:48+8] = struct.pack("Q",align_64(v320))
v317 = __ROL8__(v317, 32)
v328[40:40+8] = struct.pack("Q",align_64((v323 + v14 + (v318 ^ v316)) ^ v15))
v328[56:56+8] = struct.pack("Q",align_64(v18 ^ ((v319 ^ v317) + v12 + 18)))
v4 = align_64(v322 & 0xBFFFFFFFFFFFFFFF)
v330 -= 1
if v330 < 1:
v321 = 1
result = v329
v322 &= 0xBFFFFFFFFFFFFFFF
v328[0x10:0x10+8] = struct.pack("Q",align_64(v323))
v328[0x18:0x18+8] = struct.pack("Q",align_64(v4))
return result
def get_crypto_sum(datas):
rcx = "\x20\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"
rcx += "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\xc4"
rcx += "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"
rcx += "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"
rdx = "SHA3"+"\x01\x00\x00\x00"+"\x20\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"
rcx = bytearray(rcx)
rdx = bytearray(rdx)
crypto_it(rcx,rdx,1,0x20)
rcx[0:0x10] = "\x20\x00\x00\x00"+"\x00\x00\x00\x00"+chr(len(datas))+"\x00\x00\x00"+"\x00\x00\x00\x00"
rcx[0x10:0x20] = "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\xf0"
rdx = datas
rdx += "\x00"*(0x20-len(datas))
rdx = bytearray(rdx)
crypto_it(rcx,rdx,1,len(datas))
rcx[0:0x10] = "\x20\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"
rcx[0x10:0x20] = "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\xff"
rdx = "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"
rdx = bytearray(rdx)
crypto_it(rcx,rdx,1,8)
return ''.join(a for a in reversed(str(rcx[0x20:0x24])))
def b64(datas):
import base64
return base64.b64encode(datas)
def send_packet(host, port, header):
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# s.settimeout(2)
try:
s.connect((host, port))
s.send(header)
data = s.recv(1024)
s.close()
except exception as e:
print e
s.close()
return None
return data
def send_command_http(tag, command, code, host, port):
key = "\x96u\x9e\xa0"
sum1 = get_crypto_sum(key+(''.join(reversed(struct.pack("I", code))))+tag)
header = "GET / HTTP/1.1\r\n"
header += "SomeHeader: "
sum2 = get_crypto_sum(sum1+tag)
final_command = command[:7]
checksum = 0
for ccar in final_command:
checksum += ord(ccar)
checksum = checksum & 0xff
final_command = final_command+chr(checksum)+command[8:]
header += sum1+tag+sum2+b64(final_command)+"\r\n"
header += "Connect: blabla\r\n"
header += "Connection: close\r\n\r\n"
return send_packet(host, port, header)
def interpret_command(datas):
command = datas[:7]
checksum = 0
for ccar in command:
checksum += ord(ccar)
checksum = checksum & 0xff
if ord(datas[7]) != checksum or datas[4:6] != 'ra':
print "Packet checksum is wrong :-("
return
print " [*] checksum OK - Host is compromised"
if len(sys.argv) < 3:
print "Usage: %s IP PORT" % (sys.argv[0])
sys.exit(0)
datas = send_command_http("ABCD", "ExaTrack", 0, sys.argv[1], int(sys.argv[2]))
if datas == None or len(datas) < 1:
print "No response from server"
rcv_datas = datas.split("Connection: close\r\n\r\n")
if len(rcv_datas) > 1 and len(rcv_datas[1]) >= 8:
rcv_datas = rcv_datas[1]
print "datas :"
hexprint(rcv_datas)
interpret_command(rcv_datas)
else:
hexprint(datas)
print "Not an Uroburos reply."
Voir aussi
- Rootkit — principe général et liste de rootkits connus
- RootkitRevealer — détection côté Windows