[Script][Videp] evilDEB.sh (v0.1)

[g0tmi1k]

Links
Watch video on-line: http://g0tmi1k.blip.tv/file/3946972Download video: http://www.mediafire.com/?3528ebkqs469g4v
Download (evilDEB.sh): http://www.mediafire.com/?7aoorgly77teuzo


What is this?
This video demonstrates how easy and dangerous it is to inject a backdoor (a metasploit payload) into a .deb file (Debian software package).


How does this work?

• Either, download or copy the .deb file to /tmp
• Extract all the files from the .deb
• Extract any information about the .deb
• Create a payload (via metasploit)
• Inject payload into the deb file
• Repackage the .deb
• Start a web server (Not needed...just "helps")
• Prepare metasploit

• When the deb is run, it requires root access, which the payload takes advantage of. (=

What do I need?

• evilDEB.sh ---The script (see above)
• Metasploit --- On Backtrack 4 final
• A deb file--- Optional!

How to use it?

• bash evilDEB.sh --- No command lines - automatically downloads "xbomb" and uses that
• -i [interface] --- Changes interface (defaults is eth0 - check with ifconfig)
• -d [deb] --- Uses a different deb file. *Has to be the whole path *
• -h --- Help

Commands:

bash evilDEB.sh
hostname
hostname
whoami
ifconfig
cat /etc/passwd
exit
bash evilDEB.sh -h
bash evilDEB.sh -d /root/gedit_2.30.3-0ubuntu0.1_i386.deb
--------------------------------------
ifconfig
kate evilDEB.sh

Notes:

• If your interface isn't eth0, you'll need to either edit the file or use "-i [interface]". Check with "ifconfig"
• This may not work with every .deb file out there!
• This is a rushed script

Song: LMC V U2 - Take Me to the Clouds Above
Video length: 3:19
Capture length: 4:18

Blog Post: http://g0tmi1k.blogspot.com/2010/07/script-video-evildebshv01.html
Forum Post: http://www.backtrack-linux.org/forums/backtrack-videos/31062-%5Bscript%5D%5Bvidep%5D-evildeb-sh-v0-1-a.html#post170151

[m0j4h3d]

10x for the thread nice one .. but i have problem and some questions, it might be silly .. but take a look
first
if i have to create a payload using metasploit,,then where do i have to put it,,or the script creates it auto . if that i need my ip ,, i've putted it in the script so where the payload goes ? any explanations !

on the other hand take a look for what is happining

root@bt:~# bash evilDEB-v0.1.sh -i wlan0[*] g0tmilk's evilDEB v0.1
[>] Checking environment...
[>] Downloading .DEB...
[>] Extracting .DEB...
[>] Creating payload...
[>] Injecting payload...
[>] Creating .DEB file...
[>] Running web server... (http://92.62.166.218:8000)
[>] Running metasploit...
Serving HTTP on 0.0.0.0 port 8000 ...[*] Please wait while we load the module tree...
/opt/metasploit3/msf3/lib/msf/core/data_store.rb:93:in `each': The argument could not be parsed correctly. (Rex::ArgumentParseError)
        from /opt/metasploit3/msf3/lib/msf/core/data_store.rb:93:in `import_options_from_s'
        from /opt/metasploit3/msf3/msfcli:140:in `<main>'

[>] Cleaning up...
evilDEB-v0.1.sh: line 16: 10751 Terminated              python -m SimpleHTTPServer
[>] Done! (= Have you... g0tmi1k?

seems it facing error

hope replay ,, @ end ,, thanks

[g0tmi1k]

10x for the thread nice one .. but i have problem and some questions, it might be silly .. but take a look
first
if i have to create a payload using metasploit,,then where do i have to put it,,or the script creates it auto . if that i need my ip ,, i've putted it in the script so where the payload goes ? any explanations !

on the other hand take a look for what is happining

root@bt:~# bash evilDEB-v0.1.sh -i wlan0[*] g0tmilk's evilDEB v0.1
[>] Checking environment...
[>] Downloading .DEB...
[>] Extracting .DEB...
[>] Creating payload...
[>] Injecting payload...
[>] Creating .DEB file...
[>] Running web server... (http://92.62.166.218:8000)
[>] Running metasploit...
Serving HTTP on 0.0.0.0 port 8000 ...[*] Please wait while we load the module tree...
/opt/metasploit3/msf3/lib/msf/core/data_store.rb:93:in `each': The argument could not be parsed correctly. (Rex::ArgumentParseError)
        from /opt/metasploit3/msf3/lib/msf/core/data_store.rb:93:in `import_options_from_s'
        from /opt/metasploit3/msf3/msfcli:140:in `<main>'

[>] Cleaning up...
evilDEB-v0.1.sh: line 16: 10751 Terminated              python -m SimpleHTTPServer
[>] Done! (= Have you... g0tmi1k?

seems it facing error

hope replay ,, @ end ,, thanks

This SHOULD automate everything, so you don't need to create the payload (therefore no need able worrying where the exploit/payload goes!).
The same goes with your IP, it SHOULD automatically find it. It reads the value (either from the script, or the command line) to trys to find your IP address on that interface.

As I said in the post, this script was rushed.
There isnt too much "checking/debugging" stuff going on...
Im not 100% sure why your getting that error.
What DEB file are you trying to inject into?
Does metasploit create payloads okay?
Im going to look into this - but Ive got a lot of other things to be doing before I can

[m0j4h3d]

thanks for your replay g0tmi1k,,,, i modified the ip in the code in the script .. i have static ip externally and i fw what i need from the router ,,, any way thanks
-----------
go FW until u finish it ,,also am gonna search for a solution ,,, cu

[g0tmi1k]

*Think I understand now*
Your welcome?

[kernel831]

Mediafire links don't currently seem to be working, could just be high traffic but figured i'd let you know in case it isn't.

[g0tmi1k]

Mediafire links don't currently seem to be working, could just be high traffic but figured i'd let you know in case it isn't.

Thanks for reporting.
Ive just tested all the links - they seem to be working now.
I will be soon mirroring all the scripts on googlecode and you can download the videos from blip.tv as well.