Informer: Rizikovacu da ispadnem glup ali moram da pitam: sta su to narodne verzije?

mulaz: @bakara

Ako ti taj mikrotik koristi i kao DNS server, ako neko od usera ukuca neku nepostojecu adresu (recimo nepostojim.com), on (umesto greske) vraca neki kineski IP, na kome je neki kineski spam (i banneri,...).

bakara: To su krekovane verzije MT.

@newtesla
Daj objasni sta rade ove skripte, to je meni suvise napredno

newtesla: Slična komanda postoji i na vindozi, u pitanju je nslookup, ali ne znam sintaksu za nj.

mulaz:
Ako ti taj mikrotik koristi i kao DNS server, ako neko od usera ukuca neku nepostojecu adresu (recimo nepostojim.com), on (umesto greske) vraca neki kineski IP, na kome je neki kineski spam (i banneri,...).

Predrag Supurovic: Te zaobilaznice ce da rade samo ako se ispred malicioznog MT nalazi drugi, regularan, koji ce da blokira nepozeljne konekcije. Maliciozni MT ce uvek da zaobidje i firewal blokade.

A kao sto rece bmarkovic06, to je exploit koji se vidi a ko zna sta sve jos ima u njemu.

...znaš da ima, ili pitaš onako?

Predrag Supurovic:
Nek je vec malo razgledao tu hakovanu veryiju i prijavljeno je da je prilicno mutna: s vremena na vreme preuzima novi package sa nepoznatih izvora i instalira ih u MT. To prakticno znaci da moze da instalira sta god i da menja sopstveno opnasanje.

s vremena na vreme preuzima novi package sa nepoznatih izvora i instalira ih u MT

I gde je sad minus za ovakvu poruku, prepunu grešaka????

Hi all,

First post here.
Since I do decompiling as a hobby, I grabbed the "cracked" 5.18 ISO and did a quick analysis on what the crack changed.

Two files were added to the system package:
/etc/rc.d/run.d/S09plugin - this is an init script that runs on startup and starts the "clone" binary
/nova/bin/clone - this file is interesting for many reasons:
- there are multiple layers of obfuscation/encryption present in the file; I only managed to remove the first layer of obfuscation so far
- it is filled with many anti-debugging and anti-VM techniques (designed to make analysis harder)
- it seems to make hashes of the routing table, cpu/memory information and partition list; dunno what it does with the info
- seems to hijack /dev/tty, shows its own password prompt; dunno what it does with the password after that
- contains 6 binaries which are extracted and executed/loaded on startup

Binary 1: this one is a file/copy rename utility; no malicious code here
Binary 2: Like the "clone" app, this one is filled with anti-debug code; it extracts/loads the kernel modules.
Binary 3/4: These are the uniprocessor/SMP versions of the malware code. This one does multiple things:
- adds a kernel workqueue that periodically looks up the DNS address of "dns.vpn2vpn.info", "vvvvva.com" (?), "ssl.vpn2vpn.info"
- depending on the dns replies, downloads and inserts a new kernel module from the returned addresses; this can be used to execute arbitrary code on the router
- adds a hook to the netfilter firewall layer that modifies packets coming from port 53 (DNS)
Binary 5/6: These are the uniprocessor/SMP versions of the crack itself.
It hooks generic_ide_ioctl and ata_sas_scsi_ioctl and modifies the information returned about the MBR and the disks, so the kernel always sees the same driver serial number and accepts the same ROS software key.

I didn't check the other packages, so it is possible that those are infected in some way too.
Conclusion: DON'T USE !