Building Obfuscated OpenSSH on Last Week's Cygwin Build

I resurrected an old but capable WinXP box for my upstairs office, which is much more comfy than my subterranean lair in the winter time.  Down there I have an old, diskless IBM NetVista box (the one that used to house EXP V) that boots BT5R3 off a USB stick.  Works great for doing laundry—I'm doing a lot of domestic stuff these days for reasons I won't get into—but for extended stays it's just too cold.  Plus the cell phone reception sucks serious ass, so meetings are pretty much out of the question.

After all the Windows updates I decided to update Cygwin as well and since this box has never had Obfuscated OpenSSH (OOSSH, as I like to call it) on it I decided to do a fresh install on that.

Guess what?  No go.  Something has changed and OOSSH won't compile anymore.

After about a week of dicking around I finally found the fix, so I thought I'd share it with you.

After you "git" the code, the first thing you should do is edit clientloop.c and change both instances of

char buf[8192];

... to

char buf[65535];

And rather than get into why you should do this, I'll just remind you that I went on and on about it in the old ProxyObsession blog before it was taken down for a (totally bogus) DMCA violation.  In any case, it doesn't hurt anything and makes certain things possible that aren't possible with smaller buffers.

But the Big Fix should be put into openbsd-compat/openbsd-compat.h.  Right at the top, ahead of all the #includes, put in this line:

#define NOCRYPT

And then it will compile without errors.  Why?  Do a Google  search and you'll probably find the same answer I found.

BOT House|RELOADED - Part I

At long last, BOT House is finally reincarnated.  And on a much perkier Intel box with a newer, 64-bit version of Debian.  The new, official name is BOT House|RELOADED or BH|R for short.

So much hardware has crashed and burned this year it's hard to keep teack of it all.  First, it was the proxy project box.  It died of—what else—hard drive failure.  It was a strange setup in the first place: a (hardware) "RAID Nuthin" array spread across an IDE and a SATA drive.

And to complete the nightmare... on LVM.

But there were backups.  I re-installed everything on an external USB/IDE drive temporarily just to keep things running.  Later I bought a pair of 3.5T SATA drives & a new RAID card.  I mirrored the drives and plan to use it as the main backup for all this crap I shit out.

But before I finally got around to taking it off the USB, UPS's started to shit themselves.  Power failures have been brutal this year.  It used to be all I had to worry about were a few minor brown-outs during the beginning of "air conditioner season", but this year multi-day blackouts were far too common for my comfort level.  Two UPS's died.  I replaced the batteries in one and upgraded another from 350VA to 1000VA.

A few weeks after the derecho hit and knocked us out for four fucking days (two off, one on, two more off) it was getting a little windy outside, so I decided to check the Weather Channel for a forecast.  I turned on the TV, tuned in, and no sooner than they said "... high winds approaching our area..." the entire house went dark and stayed that way for another forty-eight hours.

A couple of weeks later, there I was, minding my own business and limping away on the USB drive in the proxy project box when one day, after mowing the lawn, I sat down and searched for images of Mossberg shotguns (for this story) on Google.

And... nothing happened.

Then I hear this "click click" sound coming from BOT House.  I switch to the console.  The last thing I saw was a message that said "Replace UPS battery" before I tried to reboot it.

It didn't reboot.  It just went click click click...

I spent the rest of that afternoon recreating the router & firewall on a bootable USB version of the Backtrack5 LiveCD and ran that for a couple of months before buying all the new hardware—computers, UPS's, hard drives—for everything and re-engineering the whole DinkNet NOC from the bottom up.

The things I do for you kids!

Flasad32.dll

Just thought I'd drop a quick "blog turd" to get another hit from Google.

Long story short(ish): had a victim of some type of Russian malware, likely a password stealing bank Trojan.  The anti-virus was clueless.  Found one suspect DLL, deleted it, and another (the title of this post) appeared to take its place.  When I went to Google the name of this DLL, Google had nothing.  So I thought I'd take advantage of that as long as they came up with blanks.

This was a few days ago.  The situation hasn't changed.

There was some silly ASCII stuff inside the DLL, very similar to stuff I found in the first DLL.  I will share it with you here...

He standard alive cutting get cup, point itself sign, were waste establish in happened five, through balloon, smaller sing without thirty set between swim development Andy national without, citizen manufacturing quit fifth in wrong at still pencil egg falloff behind water above taught, threw, thing lips whale alive cutting get cup point breakup aboard went torn draw establish in build wear, five let separate wept, fur sing completely jar development under comeup Illinois above rest increase manufacturing thou lit will still pencil wound over drive falloff breakfast leader from Johnny lips whale alive cutting, get cup, point itself sign draw establish proper five let onto arrive smaller constantly of once development under, ancient, national inside fit before thou in let will, on ranch pencil wound happily movement leader thing lips, whale alive cutting get above, frame point itself between like were waste, establish burst, wear of kill let onto arrive into, spent fur sing, completely jar development Andy national without spread manufacturing quit at scared yet become on ranch pencil egg falloff, breakfast leader thing from bat whale above, clock cutting get above frame point out of offer sign, in comeup, Germany establish burst wear five bar smaller constantly set child development Andy. 

So there you have it.  Not sure what the point is, but the "pencil egg" theme, "thing lips", and "Andy" were in the first DLL as well.  Before you go and make a firewall rule with this data, be advised I don't know if this is the malware itself or part of the payload.  I don't have a full forensic environment (I work for Cheap Bastards), so studying it in depth was out of the question.  I opted to "nuke and forget", but I did keep both DLLs, just to see how long it will take for the AV companies to catch up.

"Flasad" could be construed to be a corruption of "Flash Ad".  Something had to download it to replace the original one that got deleted, so it's not 100% of the infection.  But I did find the text amusing, so there you have it.

Let me know if you got infected by this bug.  Drop a note and we'll compare results.

UPDATE 07/12/2012

This bugger was finally detected today as "Generic PWS.y!1e3" by an AV vendor who will remain nameless.

That took SIX FUCKING WEEKS.

So I was right.  It was a password Trojan.

I'm never wrong.  And when I am I delete that post anyway so there's no proof.