文章作者：Toby Miller[SANS]
Purpose
The purpose of this paper is to inform the IDS community of signatures related to the t0rn rootkit. This paper will not serve as a how-to guide to the t0rn rootkit; rather, it is designed to identify binaries and ports that t0rn uses. This paper will also provide md5sums of binaries and analysis on how to detect t0rn.
T0rn Rootkit
The t0rn rootkit is designed for speed. By that I mean t0rn was designed to install quickly on Linux machines. T0rn can do this because it takes very little skill to install and run t0rn. All of the binaries that the attacker would need comes pre-compiled and the installation process is as simple as ./t0rn. T0rn comes standard (sounds like a car package : ) with a log cleaner called t0rnsb, a sniffer named t0rns and a log parser called t0rnp.
Red Hat 6.1 Details
T0rn has many details that need to be discussed and analyzed in order to detect it in the wild. The computer that was used in this analysis is a RH 6.1 box with no applied patches, the inetd.conf file had been secured, the password has 6 characters and was connected to an internal network. In order to analyze t0rn I had to complete some pre-installation t0rn data collection that included documenting the sizes and creation dates of both the RH binaries and the pre-compiled t0rn binaries.
First, we want to take a look at the Red Hat 6.1 binaries (before t0rn is installed) their date, size and timestamps. Figure 1 is a list of RH 6.1 binaries and their characteristics.
File(s) Size Timestamp
/usr/bin/du 21716 September 24 1999
/usr/bin/find 56564 August 27 1999
/sbin/ifconfig 35964 August 29 1999
/usr/sbin/in.fingerd 7748 July 28 1999
/bin/login 20132 September 9 1999
/bin/ls 49844 September 24 1999
/bin/netstat 58648 August 29 1999
/bin/ps 61244 September 26 1999
/usr/bin/sz 61232 March 21 2000
/usr/bin/top 35636 October 26 1999
Figure 1. RH 6.1 Binaries and properties
Why is this information important? Well, as you will see in a minute the file size is a key indicator in detecting t0rn. Another piece of data that I collected was the md5sums of the RH 6.1 binaries. I figured the creator of this rootkit might be able to mask the file size and creation timestamp(s) that are included in this rootkit with the good ones in the operating systems. But there would be little chance he/she could recreate the md5sums. Figure 2 is the md5sums of the RH 6.1 binaries that would eventually be replaced (by t0rn).
568623d6e28888799fb62dc57e8af66e == /usr/bin/du
e7d046008bc8e252b07a775876814ad2 == /usr/bin/find
3ee9c2373742ae5b7ea9fa9846c61668 == /sbin/ifconfig
3beb34844da605ad27ba8cf4daa5e3e5 == /bin/login
c91ecc0dc1e914eb69466b8c9799fe8c == /bin/ls
b8954aa3c6b142e5533ea4af9389eb29 == /bin/netstat
e70ff99a50ea5c73d5409eb3d300d644 == /bin/ps
cb11ba05f3c2e78d240bed98354295c5 == /usr/bin/sz
e59c618c53fea0fa6962f665b55b1504 == /usr/bin/top
Figure 2. RH 6.1 md5sums(before t0rn)
I also copied most of the RH 6.1 binaries to a different directory so that I could use them after the Trojan binaries were loaded.
T0rn Details
Now that we have analyzed the Red Hat binaries, lets look at the t0rn binaries before installation. After unpacking t0rn I made a list (Figure 3) of the t0rn binaries and their properties (did not get the year but that.s not important).
File Size Timestamp
Du 22460 August 22 2000
Find 57452 August 22 2000
Ifconfig 32728 August 22 2000
In.fingerd 6408 August 22 2000
Login 3964 August 22 2000
Ls 39484 August 22 2000
Netstat 53364 August 22 2000
Pg 4568 September 13 2000
Ps 31336 August 22 2000
Pstree 13184 August 22 2000
Sz 1382 July 25 2000
T0rn 7877 September 13 2000
Top 266140 July 17 2000
Figure 3. t0rn binaries and properties (before installation).
After I documented the t0rn file sizes and properties I also ran a md5sum on the t0rn binaries and came up with figure 4. These checksums can be critical in determining if t0rn has been installed on your Linux box.
C42ac93969af2cb36bac9d52cd224cc6 == /home/tk/du
3caecec277d533c1d9adb466cd5e6598 == /home/tk/find
05f2e91720bb5ca7740d9f0450eab5ae == /home/tk/ifconfig
3e817f86442711f31e97bc4f3582f9ba == /home/tk/login
5de875f7950f33dc586889f5c8315dc8 == /home/tk/ls
572f2d1aecd2fdd18fc7471c7a92901b == /home/tk/netstat
4e45ce616cf302faae24436a70c065ee == /home/tk/psf
2e3b130a937af92ff507315406589b1 == /home/tk/sz
197f0ab0c49d2b377c6e411748ce9299 == /home/tk/top
Figure 4. t0rn md5sums.
Detecting t0rn
When t0rn is installed there are a couple of things that happen. First,l it creates its own directory /usr/src/.puta. There you will find all the files (sniffer, log cleaner, etc.) needed to run t0rn.
Default t0rn is not really hard to detect. The first command I ran after installing the rootkit was ps .ef. The output of ps .ef was totally different then running the binary /bin/ps. The next step I took was to check the file(s) size and timestamp. T0rn is tricky in this department, the trojaned binaries keep the same exact timestamp as the good binaries. What stands out like an eye sore is the file size. An example of this is /bin/ps. Normally, if you were to run ls-la on /bin/ps (Red Hat 6.1) you would have the following output:
-r-xr-xr-x 1 root root 61244 Sept 26 1999
If t0rn is installed the user would see the following:
-r-xr-xr-x 1 root root 31336 Sept 26 1999
Notice the difference in the file size. Also, just as a side note that the file size is one byte off from being eleet. This holds true for all t0rn binaries. The one binary that I found the most interesting was netstat. Why? Well, t0rns version of netstate causes a segmentation fault.
T0rn can be detected by using lsof. (Yes. The guys who wrote this rootkit forgot to change an important tool.) Running lsof | grep LISTEN will show port 47017(bolded) is the listening state (Figure 5).
d 107 root 8u IPv4 110 TCP *:47017 (LISTEN)
inetd 370 root 5u IPv4 329 TCP *:ftp (LISTEN)
inetd 370 root 6u IPv4 330 TCP *:telnet (LISTEN)
inetd 370 root 7u IPv4 331 TCP *:shell (LISTEN)
inetd 370 root 9u IPv4 332 TCP *:finger (LISTEN)
inetd 370 root 10u IPv4 333 TCP *:linuxconf (LISTEN)
Figure 5. lsof | grep LISTEN output
This port is the default port used by t0rn. By using lsof | grep t0rn a person can look at anything being ran as t0rn. Figure 6 shows us the results of lsof .grep t0rn
t0rns 557 root cwd DIR 3,1 0 51920 /home/tmiller/tk (deleted)
t0rns 557 root rtd DIR 3,1 4096 2 /
t0rns 557 root txt REG 3,1 6948 51927 /usr/src/.puta/t0rns
t0rns 557 root mem REG 3,1 25034 19113 /lib/ld-linux.so.1.9.5
t0rns 557 root mem REG 3,1 699832 64363
/usr/i486-linux-libc5/lib/libc.so.5.3.12
t0rns 557 root 0u sock 0,0 489 can't identify protocol
t0rns 557 root 1w REG 3,1 0 51963 /home/tmiller/tk/system (deleted)
t0rns 632 root cwd DIR 3,1 4096 36547 /usr/src/.puta
t0rns 632 root rtd DIR 3,1 4096 2 /
t0rns 632 root txt REG 3,1 6948 51927 /usr/src/.puta/t0rns
t0rns 632 root mem REG 3,1 25034 19113 /lib/ld-linux.so.1.9.5
t0rns 632 root mem REG 3,1 699832 64363
/usr/i486-linux-libc5/lib/libc.so.5.3.12
t0rns 632 root 0u sock 0,0 533 can't identify protocol
t0rns 632 root 1w REG 3,1 0 34668 /usr/src/.puta/system
Figure 6. Output of lsof
Here we see a few key items. First, we see the file /usr/src/.puta/t0rns(sniffer) running (bolded). We also see /usr/srec/.puta, again this is the hidden directory for t0rn. These two files can be a key indicator for identifying t0rn.
Finally, I also found t0rn by running nmap and scanning for destination ports 45k .48k. The nmap output would look like this:
Starting nmap V. 2.54BETA7 (
www.insecure.org/nmap/ )
Interesting ports on (192.168.1.3):
(The 4000 ports scanned but not shown below are in state: closed)
Port State Service
47017/tcp open unknown
TCP Sequence Prediction: Class=random positive increments
Difficulty=3980866 (Good luck!)
Remote operating system guess: Linux 2.1.122 - 2.2.16
Nmap run completed -- 1 IP address (1 host up) scanned in 5 seconds
Recommendations
Detecting t0rn or any other rootkit requires planning when installing the operating systems. The best way to prevent these kinds of attacks is by using programs like Tripwire, maintaining good backups and keeping up with the latest patches. One other suggestion is to run md5sum on binaries such as /bin/ps, /bin/ls and many others and save the results to a floppy that will be stored in a secure place.
Conclusions
T0rn is a very sneaky toolkit and can be hard to detect if an administrator does not know what to look for. If a person follows the recommendations stated above he or she could save themselves a lot of heartache and time trying to look for programs like this.
