Linux Backdoor Deep Dive (Part 2)
In this [RE]laxing new series, I fully reverse a Linux Backdoor (BPFDoor) from start to finish. In Part 2, we fix and label strings related to setting up socket connections, and even manage to find some IPTables shell commands!
These extensive "Deep Dive" segments concentrate on dissecting malware specimens and delving into the individual approaches employed to fully reverse them. Throughout the journey, I attempt to provide explanations of my techniques as much as possible, however, if any ambiguities arise, please feel free to post a comment below.
---
Timestamps:
00:00 Intro
00:50 Begin Ghidra Analysis
01:40 Socket Connections
04:15 htons
06:21 setscokopt
07:23 recvfrom
10:09 Forking
14:38 Swapping Values
16:20 INET_ntoa
18:26 justtryit
21:00 Working through the funtion
23:28 Fixing Incorrectly Typed Arrays
25:30 Setting IP Tables
27:03 Recap
---
Software Links Mentioned in Video:
Ghidra: https://ghidra-sre.org/
---
Malware Examined in the video (BPFDoor):
sha256:fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a
MalwareBazaar Link:
https://bazaar.abuse.ch/sample/fd1b20...
---
laurieWIRED Twitter:
/ lauriewired
laurieWIRED Website:
http://lauriewired.com
laurieWIRED Github:
https://github.com/LaurieWired
laurieWIRED HN:
https://news.ycombinator.com/user?id=...
laurieWIRED Reddit:
/ lauriewired