;merikenin.asm - Merikenin TCP/IP Stack Hardening and Basic Rootkit Checker version 1.0

;The programmer : ev1lut10n

;dedicated to Merikenin

;thanks to : X-hack,Danzel,Superman,Cakill, nofia fitri,Dedy, Chaer, Paulus gandung,Tian,Zendy,Hendra, Wenkhairu and all my bro and friends

;current big project : "Making a linux botnet and windows botnet that can work synergy (my own idea)"

;website : http://www.jasaplus.com

;gopher://sdf.org/1/users/wisdomc0

section .bss

pilih_on_heap resb 6

file: resd 1

section .data

t00lname db ".::Merikenin TCP/IP Stack Hardening and Basic Rootkit Checker::.",13,10

pjg_t00lname equ $-t00lname

c0d3r db "c0der : ev1lut10n",13,10

pjg_c0d3r equ $-c0d3r

g0tr00t db "we got root access",13,10

pjg_g0tr00t equ $-g0tr00t

n0tr00t db "we dont have root priv,sorry y0u can not use this t00l baby",13,10

pjg_n0tr00t equ $-n0tr00t

;define jynx rootkit checker

jynx_ld_preload_poison_string db "ld_poison.so",0x00

jynx_ld_preload_so_path db "/etc/ld.so.preload",0x00

;define haxpath checker for kbeast lkm

_H4X_PATH_ db "/usr/_h4x_",0x00

;software menu

m3nu1 db "sys1 - Enable source validation by reversed path (checkin the source addr at ip datagram)",13,10

pjg_m3nu1 equ $-m3nu1

m3nu2 db "sys2 - Enable TCP Syn Cookies (protection against syn attack)",13,10

pjg_m3nu2 equ $-m3nu2

m3nu3 db "sys3 - Ignore ICMP Echo Broadcast Requests - (no smurf amplification)!!!",13,10

pjg_m3nu3 equ $-m3nu3

b0nus db "Some bonuses functions :"

pjg_b0nus equ $-b0nus

m3nu5 db "rkc1 - Checking Possible Jynx LD_Preload Rootkit",13,10

pjg_m3nu5 equ $-m3nu5

m3nu6 db "rkc2 - Checking Possible Kernel Beast Ver #1.0 LKM Rootkit -> _H4X_PATH_ /usr/_h4x_",13,10

pjg_m3nu6 equ $-m3nu6

m3nu7 db "quit - quit this t00l",13,10

pjg_m3nu7 equ $-m3nu7

;eof software menu

c0ns0l3 db "cmd:"

pjg_c0ns0l3 equ $-c0ns0l3

pilih  db "%s", 0

teks_continue db "/etc/ld.so.preload found beware ! Sorry i'm lazy it's your job to check for ld_poison.so at /etc/ld.so.preload",13,10

pjg_teks_continue equ $-teks_continue

teks_dont_continue db "No /etc/ld.so.preload found ! Seems like your system is clean from jynx rootkit",13,10

pjg_teks_dont_continue equ $-teks_dont_continue



teks_continuex db "/usr/_h4x_ found !  Please wait !!! You're being infected with Kernel Beast Ver #1.0, why u install kernel headers ???",13,10

pjg_teks_continuex equ $-teks_continuex

teks_dont_continuex db "No /usr/_h4x_ found ! Seems like your system is clean from Kernel Beast Ver #1.0",13,10

pjg_teks_dont_continuex equ $-teks_dont_continuex



section .text

global _start

_start:

;jmp _merikenin_sysc

jmp long _merikenin_start



;starting jynx rootkit checking routine

_merikenin_jynx:

push ebp

mov ebp,esp



       xor eax,eax

       xor ebx,ebx

       xor ecx,ecx

       xor edx,edx



call the_cek

mov ebx,jynx_ld_preload_so_path

int 0x80



mov dword [file],eax

cmp dword [file],0

jle dont_continue

je continue



mov esp,ebp

pop ebp



continue:

push ebp

mov ebp,esp



mov ecx,teks_continue

mov edx,pjg_teks_continue

call _merikenin_writeln

jmp long _merikenin_out

mov esp,ebp

pop ebp



dont_continue:

push ebp

mov ebp,esp



mov ecx,teks_dont_continue

mov edx,pjg_teks_dont_continue

call _merikenin_writeln

jmp long _merikenin_out

mov esp,ebp

pop ebp



the_cek:

push ebp

mov ebp,esp

mov eax,5

xor ecx,0

mov edx,0x100

mov esp,ebp

pop ebp

ret



;eof jynx rootkit checking



;start ipsecs kbeast checking

_merikenin_ipsecs:

push ebp

mov ebp,esp

       xor eax,eax

       xor ebx,ebx

       xor ecx,ecx

       xor edx,edx

call the_cek2

mov ebx,_H4X_PATH_

int 0x80

mov dword [file],eax

cmp dword [file],0

jle dont_continuex

je continuex



mov esp,ebp

pop ebp



continuex:

push ebp

mov ebp,esp

mov ecx,teks_continuex

mov edx,pjg_teks_continuex

call _merikenin_writeln

jmp long _merikenin_out

mov esp,ebp

pop ebp



dont_continuex:

push ebp

mov ebp,esp

mov ecx,teks_dont_continuex

mov edx,pjg_teks_dont_continuex

call _merikenin_writeln

jmp long _merikenin_out

mov esp,ebp

pop ebp



the_cek2:

push ebp

mov ebp,esp

mov eax,5

xor ecx,0

mov edx,0x100

mov esp,ebp

pop ebp

ret



;eof ipsecs kbeast checking





;getpriv.s

_merikenin_pr3p4r3_0pt:

       push ebx

       push esi

       push edi



_merikenin_get_privilege:

       push ebp

       mov ebp, esp

       mov eax, 18h

       push eax

       int 80h



       cmp al,0

       jz _merikenin_g0tr00t

       jmp _merikenin_n0tr00t

       mov esp, ebp

       pop ebp



;eof getpriv.s

_merikenin_g0tr00t:

       push ebp

       mov ebp, esp

       mov ecx,g0tr00t

       mov edx,pjg_g0tr00t

       call _merikenin_writeln

       mov esp, ebp

       pop ebp

       jmp _merikenin_jmpmania



_merikenin_n0tr00t:

       push ebp

       mov ebp,esp

       mov ecx,n0tr00t

       mov edx,pjg_n0tr00t

       call _merikenin_writeln

       mov esp,ebp

       pop ebp

       jmp _merikenin_out



_merikenin_writeln:

         push ebp

         mov ebp,esp

         mov ebx,0x1

         mov eax,0x4

         int 80h

       ;mov ah,09h

       ;mov dx,offset str1ng

       ;int 21h

         mov esp,ebp

         pop ebp

         ret





_merikenin_banner:

push ebp

mov ebp,esp

mov ecx,t00lname

mov edx,pjg_t00lname

call _merikenin_writeln



mov ecx,c0d3r

mov edx,pjg_c0d3r

call _merikenin_writeln

mov esp,ebp

pop ebp

ret





_merikenin_do:

       mov eax, 11

       int 80h

       ret



_merikenin_net.ipv4.icmp_echo_ignore_broadcasts_1:

       push ebp

       mov ebp, esp



       xor eax,eax

       xor ebx,ebx

       xor ecx,ecx

       xor edx,edx



       push   0xb

       pop    eax

       push   edx



       push 0x313d             ;=1

       push 0x73747361                 ;stsa

       push 0x6364616f                 ;cdao

       push 0x72625f65                 ;rb_e

       push 0x726f6e67                 ;rong

       push 0x695f6f68                 ;i_oh

       push 0x63655f70                 ;ce_p

       push 0x6d63692e                 ;mci.

       push 0x34767069         ;4vpi

       push 0x2e74656e         ; .ten



       mov    esi,esp

       push   edx



       push   0x772d ;w-

       mov    ecx,esp



       push   edx

       push  0x6c746373

       push  0x79732f6e

       push  0x6962732f

       mov    ebx,esp



       push   edx

       push   esi

       push   ecx

       push   ebx

       mov    ecx,esp

       int    80h







       mov esp,ebp

       pop ebp

       jmp long _merikenin_out



_merikenin_net.ipv4.tcp_syncookies_1:

       push ebp

       mov ebp, esp



       xor eax,eax

       xor ebx,ebx

       xor ecx,ecx

       xor edx,edx



       push   0xb

       pop    eax

       push   edx



       push 0x2031             ;1

       push 0x3d736569         ;=sei

       push 0x6b6f6f63         ;kooc

       push 0x6e79735f         ;nys_

       push 0x7063742e         ;pct.

       push 0x34767069         ;4vpi

       push 0x2e74656e         ; .ten



       mov    esi,esp

       push   edx



       push   0x772d ;w-

       mov    ecx,esp



       push   edx

       push  0x6c746373

       push  0x79732f6e

       push  0x6962732f

       mov    ebx,esp



       push   edx

       push   esi

       push   ecx

       push   ebx

       mov    ecx,esp

       int    80h



       xor eax,eax

       xor ebx,ebx

       xor ecx,ecx

       xor edx,edx



       mov esp,ebp

       pop ebp

       jmp long _merikenin_out



_merikenin_sysctl_w_net.ipv4.conf.all.rp_filter_1:

       push ebp

       mov ebp, esp



       xor eax,eax

       xor ebx,ebx

       xor ecx,ecx

       xor edx,edx



       push   0xb

       pop    eax

       push   edx



       push 0x2031             ;1

       push 0x3d726574         ;=ret

       push 0x6c69665f         ;lif_

       push 0x70722e6c         ;pr.l

       push 0x6c612e66         ;la.f

       push 0x6e6f632e         ;noc.

       push 0x34767069         ;4vpi

       push 0x2e74656e         ; .ten





       mov    esi,esp

       push   edx



       push   0x772d ;w-

       mov    ecx,esp



       push   edx

       push  0x6c746373

       push  0x79732f6e

       push  0x6962732f

       mov    ebx,esp



       push   edx

       push   esi

       push   ecx

       push   ebx

       mov    ecx,esp

       int    80h



       xor eax,eax

       xor ebx,ebx

       xor ecx,ecx

       xor edx,edx

       mov esp,ebp

       pop ebp

       jmp long _merikenin_out





_merikenin_jmpmania:

       push ebp

       mov ebp, esp

       jmp _merikenin_start2

       mov esp,ebp

       pop ebp



_merikenin_start:

push ebp

mov ebp,esp

call (_merikenin_banner)

jmp _merikenin_pr3p4r3_0pt

mov esp,ebp

pop ebp





_merikenin_start2:

       push ebp

       mov ebp, esp





       mov ecx,m3nu1

       mov edx,pjg_m3nu1

       call (_merikenin_writeln)



       mov ecx,m3nu2

       mov edx,pjg_m3nu2

       call (_merikenin_writeln)



       mov ecx,m3nu3

       mov edx,pjg_m3nu3

       call (_merikenin_writeln)







       mov ecx,m3nu5

       mov edx,pjg_m3nu5

       call (_merikenin_writeln)



       mov ecx,m3nu6

       mov edx,pjg_m3nu6

       call (_merikenin_writeln)







       mov ecx,c0ns0l3

       mov edx,pjg_c0ns0l3

       call (_merikenin_writeln)



       mov  eax,3

       mov  ebx,0

       mov  ecx,pilih_on_heap

       int    80h



       push eax





       xor eax,eax

       mov eax, dword [pilih_on_heap]



       cmp eax,'sys1'

       je _merikenin_sysctl_w_net.ipv4.conf.all.rp_filter_1



       cmp eax,'sys2'

       je _merikenin_net.ipv4.tcp_syncookies_1



       cmp eax,'sys3'

       je _merikenin_net.ipv4.icmp_echo_ignore_broadcasts_1





       cmp eax,'rkc1'

       je _merikenin_jynx



       cmp eax,'rkc2'

       je _merikenin_ipsecs



       jmp _merikenin_out

       mov esp,ebp

       pop ebp



_merikenin_out:

nop

mov eax,0x01

int 80h

You are viewing proxied material from sdf.org. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.