Decoding VBScript Malware-infected HTML files

I have been running across malware like this lately.  It appears to be a local infection that appends some VBScript to HTML files on the webmaster's computer, spreading to the Internet when it's uploaded. Alternatively, it could be an infection on a Windows IIS server.

At any rate, WriteData is a hex string that goes on and on for a good couple of screen lengths, followed by some more VBScript to open a file handle, write binary data to it, then execute the dropped binary.

Since it appears this HTML file has been infected multiple times, I use uniq to get only one copy of the WriteData line. I split it with cut based on the double quotes to get only the hexadecimal part. I decided I'd try to use xxd to decode it. xxd can create or read hex dumps. I save xxd's output to svchost.exe (which is what the VBScript would have called it).

Finally, I use file to determine what kind of file svchost.exe is, presuming it'll be a Windows executable file.

No surprises there. I uploaded it to VirusTotal, and it looks like we have a ZBot (ZeuS) on our hands.

Sysadmin Sunday: parse strings with spaces using shell script

I run into this once in a while: I'm trying to perform some operation on a bunch of files or a big line of text, and a space in the filename or text file janks everything up. Take for example all these recordings from a podcast that got batch-named with spaces in them.

Chimera:Recordings axon$ ls

(110) - .mp3 (12) - .mp3 (18) - .mp3 (39) - .mp3 (79) - .mp3

(111) - .mp3 (15) - .mp3 (3) - .mp3 (70) - .mp3

I really don't want spaces in the names. No problem, just use ls -1 (the number one) to list the files on their own line, and use sed or something for renaming them and changing every space to a null character, right?

Chimera:Recordings axon$ for file in `ls -1`

> do mv "$file" `echo $file | sed s/" "//g`

> done

mv: rename (110) to (110): No such file or directory

mv: rename - to -: No such file or directory

mv: rename .mp3 to .mp3: No such file or directory

mv: rename (111) to (111): No such file or directory

mv: rename - to -: No such file or directory

mv: rename .mp3 to .mp3: No such file or directory

[truncated]

That did not go as planned...

There are a few interesting ways to solve this one. The actual reason for this problem is your shell's internal field separator. When iterating over some input (here, the results of "ls -1"), the shell interprets any kind of whitespace as a field separator, including spaces, tabs and newline characters.

Although there are some other clever ways to get around this limitation when dealing with filenames specifically, my favorite solution to this problem works on any whole line of input regardless its source, whether reading a text file and operating on it one line at a time or taking filenames as input from another command such as ls or find. You simply have to use something that can accept spaces and requires a newline character in order to set a variable. Of course, I'm talking about a rather unsavory (but totally viable) use of the read command, which most unixy shell-script writers are familiar with when they require user input. Check it:

Chimera:Recordings axon$ ls -1 | while read file

> do mv "$file" `echo $file | sed s/" "//g`

> done

Chimera:Recordings axon$ ls -1

(110)-.mp3

(111)-.mp3

(12)-.mp3

(15)-.mp3

(18)-.mp3

(3)-.mp3

(39)-.mp3

(70)-.mp3

(79)-.mp3

You can also remap the $IFS variable to contain a newline, but be sure to unset it afterwards (if using BASH, this will set it back to default), or your shell will act differently than you likely expect when you're done. Messing with the internal field separator can be useful for other things (such as parsing /etc/passwd or handling CSV files) but honestly I'd probably be more inclined to use awk for those. If we remap IFS to a newline, our original script that errored out above works just fine.

Chimera:Recordings axon$ IFS=`echo -en "\n\b"`

Chimera:Recordings axon$ for file in `ls -1`

> do mv "$file" `echo $file | sed s/" "//g`

> done

Chimera:Recordings axon$ ls -1

(110)-.mp3

(111)-.mp3

(12)-.mp3

(15)-.mp3

(18)-.mp3

(3)-.mp3

(39)-.mp3

(70)-.mp3

(79)-.mp3

Chimera:Recordings axon$ unset IFS

FART on Windows

No, I'm not asking you to unleash a batch of cheek-flapping flatulence upon Vista. Although I wouldn't mind if you did.

FART is an open-source Find And Replace Tool for the Windows command-line. It's much like a mash-up of grep and sed, and capable of easily converting text files from UNIX to Windows/DOS style newlines among other things.

Via HacksZine. Thanks, [Eric]