Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by bangoodirro on Friday March 29, 2024 @02:47PM
(#39867568)
00011900: 0000 4883 f804 7416 b85f 5f5f 5f33 010f ..H...t..____3.. │
00011910: b651 0483 f25a 09c2 0f84 5903 0000 488d .Q...Z....Y...H. │
00011920: 7c24 40e8 5875 0000 488b 4c24 4848 3b4c |[email protected]$HH;L │
00011930: 2440 7516 4885 c074 114d 85ff 0f84 3202 [email protected]. │
00011940: 0000 498b 0ee9 2c02 0000 b9fe ffff ff45 ..I...,........E │
00011950: 31f6 4885 db74 0289 0b48 8bbc 2470 1300 1.H..t...H..$p.. │
00011960: 0048 85ff 0f85 c200 0000 0f57 c00f 2945 .H.........W..)E │
00011970: 0048 89ac 2470 1300 0048 8bbc 2410 0300 .H..$p...H..$... │
00011980: 0048 8d84 2428 0300 0048 39c7 7405 e8ad .H..$(...H9.t... │
00011990: e6ff ff48 8bbc 24d8 0200 0048 8d84 24f0 ...H..$....H..$. │
000119a0: 0200 0048 39c7 7405 e893 e6ff ff48 8bbc ...H9.t......H.. │
000119b0: 2480 0200 0048 8d84 2498 0200 0048 39c7 $....H..$....H9. │
000119c0: 7405 e879 e6ff ff48 8bbc 2468 0100 004c t..y...H..$h...L │
Please tell me what this code does, Sheldon
[ Parent
| on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by tetromino_ on Friday March 29, 2024 @03:50PM
(#39868259)
You're right - the two exploit files are lzma-compressed and then deliberately corrupted using `tr`, so a hex dump wouldn't show anything immediately suspicious to a reviewer.
Mea culpa!
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by maxcoder4 on Friday March 29, 2024 @05:51PM
(#39869394)
Is this lzma compressed? Hard to tell because of the lack of formatting, but this looks like amd64 shellcode to me.
But that's not really important to the point - I'm not looking at a diff of every committed favicon.ico or ttf font or a binary test file to make sure it doesn't contain a shellcode.
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by bangoodirro on Saturday March 30, 2024 @07:57AM
(#39874005)
it's just an arbitrary section of libcxx-18.1.1/lib/libc++abi.so.1.0