From koesterb@ncr.disa.mil Thu Jun 20 22:35:44 1996 Received: from hail.ncr.disa.mil (hail.ncr.disa.mil [164.117.176.115]) by suburbia.net (8.7.4/Proff-950810) with ESMTP id WAA04633 for ; Thu, 20 Jun 1996 22:33:54 +1000 Received: from ncr.disa.mil ([164.117.176.106]) by hail.ncr.disa.mil (8.7.3/DISA 8.7.3.01) with SMTP id IAA01866 for ; Thu, 20 Jun 1996 08:25:33 -0400 (EDT) Received: from ccMail by ncr.disa.mil (SMTPLINK V2.11.01) id AA835284052; Thu, 20 Jun 96 08:10:10 EST Date: Thu, 20 Jun 96 08:10:10 EST From: "Bernard Koester" Message-Id: <9605208352.AA835284052@ncr.disa.mil> To: best-of-security@suburbia.net, ellerj@ncr.disa.mil, martin5s@ncr.disa.mil, veaseyr@ncr.disa.mil, koesterb@ncr.disa.mil, kleinp@ncr.disa.mil, rogalskr@ncr.disa.mil, dunningm@ncr.disa.mil Subject: amodload.tar.gz - dynamic SunOS modules Dear best-of-security@suburbia.net, I have been asked to test amodload. I understand Amodload will load modules of code into a SunOS kernel. I would like to know more about Amodload before I try it. Can you supply me with details on how it was designed and tested. What is the desired end result and how can I best recover, if something goes wrong. Thanks alot, :-) Ben Koester koesterb@ncr.disa.mil (703) 681-7923 ______________________________ Forward Header __________________________________ Subject: amodload.tar.gz - dynamic SunOS modules Author: Jack Eller at SKY2 Date: 5/28/96 10:56 AM Ben, please work with Sonia and Rick and look at capabilities. Thanks, Jack ______________________________ Forward Header __________________________________ Subject: BoS: amodload.tar.gz - dynamic SunOS modules Author: Mark S. Roed at PNT2 Date: 5/28/96 10:22 AM fyi: ______________________________ Forward Header __________________________________ Subject: BoS: amodload.tar.gz - dynamic SunOS modules Author: best-of-security@suburbia.net at smtp Date: 5/26/96 12:45 AM Avalon Security Research Tool Release (1) 05/16/96 This release serves two purposes: First, to let you know of important changes in the direction being taken by ASR and secondly to release the first in our series of security tools. Whereas at first ASR was a completely not-for-profit venture we have recently become involved in a commercial undertaking. This change will be transparent to our subscribers as we will continue to release various bug reports and exploits to the security community. Amodload will load modules of code into a SunOS kernel. What this amounts to is essentially a tool which would allow hackers to load arbitrary code into the kernel which would be invisible to any conventional means of detection. This code is offered up as proof of a concept tool. We are aware of these types of tools on the Internet and in active use. In order to counteract tools like this, we first must understand how they work. Amodload should provide some people with this insight. This being said, it should be noted that amodload itself can do no damage, the damage done by amodload and tools like it is from the programs they load into the kernel. Our example code which comes with amodload at the moment is as innocuous as possible. ASR Note: If you wish to subscribe to the ASR mailing list, send mail to mcpheea@cadvision.com with the word SUB and *only* the word SUB in the body. Email directed to ASR may also be sent to mcpheea@cadvision.com. If you wish to correspond with ASR please make use of the PGP key given below. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBtAy1GTuMAAAEDAM2X2UnGZkuzT5kL8BUfiDniW6rPZgymD8IqUVy7we6Eo7Gm H1iQBEjDoRoBBpm2nCmzOHsHVCs4ABJJH2ByoQ9mpXUZZRu0SbBVpDVQXR09qINs Yp2GhyWA3p0z6AAOzQAFEbQbQVNSIDxtY3BoZWVhQGNhZHZpc2lvbi5jb20+ =qYbo -----END PGP PUBLIC KEY BLOCK----- ------------------------------------------------------------------------------- The following is an attached File item from cc:Mail. It contains information that had to be encoded to ensure successful transmission through various mail systems. To decode the file use the UUDECODE program. --------------------------------- Cut Here --------------------------------- begin 644 amod.tar M'XL("/B4LRT``V%M;V0N=&%R`.T]:U?;2++[%?V*BN>2R&`;23:/"2'WDH3, ML)-`#C";NY>P'%F2;0VRY-$#0V;RWV]5=;<>ML%D$LC,KOLDMM5=757]JD=W MM7B[>[#_>N_XY&_WF`!@H],!^@8PY+\PJ]*,Y)(SM#VP_U>KG.0*'S M0Q@@,2^>KHCPWI4]'`5>@DT#UX\])XWB:W"B,,6*V`20`(!5,H3#*H%KA]X5 M,74\P5`<9:D?8K]DB>>"7W1.R]&T).O&5&E)S7^HP52J:=K8;!VW4@^)VBD. MQ&XRG&KXV%2D$-R:#VX5X'+\U4#?YQS#YG1N6__FNES_IKF^;FS0^N]8B_7_ M(.GEZS>[/QS##C3[\!TT7_WTC[>O]E[\_(-V^.+OQSL@IWA43.`(>/Y&Q0I[ M"O^E$W1=6W(:JHM`AF;-5;`+N]%!4RXDJ\ M`L2./=`$1E2?6'C-68C^`I_'?CJH4/=#&U6URO81G7>50I+:,?.@V2F#=[V^ M'[(JCWJE^F0T)/UNUD-NT%!`71)=DH:W48) M"7E)@B8-:$BNY\4-(",I]E!E.]AL@O3"%-M"RCIU1N=9$L?>K]3;V"]I,B[: M;KMNC,A`DQ1DWZ%5LH3]ZPMD/3].4E4$R%S7XQ&5O,LA=;'A^RDX.$J(+_3& MYQ=#;WB.CY&CUXEX%)/5A/4Y#\T+;,@P4GP.E$U4H=#23F872.9"U74\.OBA M6L1S0_8W]Z@FQUD!)"/L+:R#[>H/8,WU+M>(X7SX;IF[9"0Q6,D4@L1'F^E: MMI]:@_9>ZMN!_]%.?31L%9R<\[(5FFR:GB49UKR&\VZ$#=+K:'Q^ZT7]&4G8 MXO=+8Y[\;Y/\7U]?[VR:9L?HL/S?["SD_T,D=OJDN!!SH>(8@=DR0/\[NF); M#3"__WZCKG&-41SU8WL(XY)P1"VP>VD'N&*.<;EAYC4>!\H)%;11,J#80L'FATZ0T6(C#R51WJ=RRG!M M0S?VO1Y$EUY\Z7MCJC,>2'&/4N*"9*T;D49!-CW40OB=1$,4P,K=HRKLK*+< M15*Q4#[DJUZ3_)9($F3I@F2.3USLAZA;@H"E`VG+HTP(>W*3(1E$6>!"WPN] MF"0E=IT0/W87I45H#[$Y3W*'%:61Z%#E8JOZI(J%M+?#:SC.PL-CZ+3,UO\B MI#,@20_P5OS"-F![8U).2"S)PDX3/Z*D8UXI8-$J=-6Q>#2*XI3]V[&&H0J():4 M9'M*.G68A31E$)?CQ32^T$4,;D0JQG,&H?]KY@EQ+AFFRB'/#F+(L4D.D\/] MEY*_WSH5NR[W1V.._X]"OR/L_T[;6&^;Y/]OK%L+^?\0J77R(^R^/7SUYG#W M%8Y);0M(V).DKVFMXQ_A8/?M7N[IPX:*TW[XJM!EKZ M:*ZAHV&S/2JS=;,NQ!:*?C2HIPT_K40AN8E7808C!=?OD76.ICBI!@^5BR:% M8L]VTIP,*Q821+&'YE^4(Y6"M,5-.>168--/WE'S/S0OM5&,D@L0:S=":>IZ MW:S?)_7AARC(ABQ1E0SU:6<5D:-4ZV4!M9BT5X3&Z'@0:;1=:\O.8%4QF'+F MD(EWKYB1VO'>'NR^.3[$<7UQI'H.L.L:W,<$\^+G'X[Y(4-DI^R-M>-A?Q_B/2=M+'A67*=K*77([2S!\^U:C9:^VF4C*<+ MT`9,IW.'0SN<`1LY%]X,:/Q/KO=$0>KZ436KYX3I!%1(CD(UZ^)R6,FH%>=` M-70V')+XYRB[_7[2@"S+&G)G!1\2.][66#3;W0A%\XZQK2$ZA%ZYL)-MC1KK M.^`,4-QV[;AW:AI6YRS/3]"!0.T@^PHN;/=C=KJ!Y1HCY8,I.^X[#;3%^Y=U MSJ3G;8TQKJQ0]K;VFX;SG\K\!L0V9N!C=HY>51]64(MU([=!^C+Q/YX2\5+I M.!IA&7XFDR4CS&O`BFO'`I_JA6[DCT0&<^#:R'REHMC^]YRQ7M_&;,5:WTNC MKEYOH(V?)G;H./0[H(,W;"W"4+.:S6UJT.HJ(QP/4/-R\Y\;\/BQ;"WL[,"3 MYI,Z0?P&D*`20U]17]%U+JZOFG4NHV(M/QI#2]^#)Y=/X*D:*=@QMXOR4NK& MGGU1*G*]GIT%*=9D)=S3:S^'%V$T1A=FQ-X<+"R`'%W,P;F$SS2QHI$7Z@<_OWG3@/+GX?G1J_='8IJ<&F>""[\' M.M?<82C5+=Z5GZ(*%]W.,(B7EP5!-]#?O*K#HQTP5!^/O#B.8KV6P]7R5N:X MQB59]\+=W'I8&83_VS5GA.+BV1(+:VP5]=K1>]IGIY.7D*L#SBKJU4 M+#U>VD'FE:G3&L6>TN5LK1.DD4-NSP+1=5U,W;I.1?75=AT>@W'5$\F1?2GV M4B=0FU74*!LF(:P)"!08DR#M$@C!B)7"DZ`!CZOKMQC8HTK__+$Q4DI M-WYY7]O_Z*F^E(BE/##/5K?D5*"%.3:18V:05W==7Q%PJ\95V\#UO+8"]`N< M+!F0%[^R5JK9N:5F"6RC`L9]7B[>FE7,Y2B10!TODGPQ&[).`]Z;YX>O7UM' M>R<-*:=Q*I>FN)C>LNEN=)'5:54TS7R*R^[CF?X4Q47(!FS/1X=`;-*2!R`7 M.J.Y90F0B"P/,M&;G(7$%,,]JB[.&4-;&MWWNT<'^P<_/$7FD,$L""#J]1(O MY24F^$1Q%%PQFX2^X#)(O&E\8SNF7:C/PJ>XUU'3T'"@")?]*G4&Z;GZA`21 M]'IV:@?`G8SCB$Y0FJ&YCY/59?`6TT&\LSL7_Q?]N[HCZ&T72X8(WV'%@%!* MG[5H!.KI-:/$)WNX0GS*7E!9);$PMS8MU8$ZMOJKBZ MZHJY(8NW9A7/7'667'7X_=Z:O>I*75LZZ:%-O=))4C'X8GIQOQ'13]K"^_M3 MI\(\OC\:,&?_K[VQ(>-_C(U.NPT+_^_A$AH!+!NC'MBM*$M5B!QJ2+%9AE;! M=V@VTP'HCWN[KX[W_V\/S8:.08(A+RE4-E!AIRBP)@JPDG246(VS^4?BZC3DR:CD/HAD$BQ8$ MEQ%$$-T(?SOJ8!:HP!Q8TY@#:P)\XL=$HZTO:/0LSB1C,YH\LQTW(#9O;K(Y M`_,D^(PF?^M5]^=)ZAQTK1_%O7O:!)PC_Z&SV5'G_Y;%YS\;F^;B_/]!$LK_ M]_)PEHX64A^=><^.@VLZ!\HHKNJ68WT-5FXXV7].1>H(PX8DS;IYS``%27F) M.*3/#QIDH5;6-S_M'1WLO=%NV*(L-O-DX(W8.E.9V)*)O2ZQM87>@!>'>78Y MU$D8R5B1]F>*?./*DDZO,'-UA,#G3_\64B1?__3#O!\!`//B?\QVOO[-=0NS M-@UC$?_](&G6^J<+!%]W^5,$:`,!ZJ8?&F;I;$?6H(H?P MV&$>DR-/(3E*4H0$VD`&H#IPS1*Z8H(5D?]!Y":`=FS@A^+FQ2PI0R>]H0S1 M":@B'V';3BHB^<2E#7&V2R$_(D+0:[%PNJ-TFCA`L8GJK*./=$8VTH^G<^5I M*DL^*<2D:8NE=%8MOD[IQ$'NWU<$(V_<^_U^X"E))RM8YEDKN3X/[;@/*/F, M[>DR.J#!(E&]+`I-%H1:&;>@)EG+G!C[@*GXC-B=VHM&UGK6R<\JI MEXN;SYWX///=G!\%A1D*6<&%\6\CCA\\3=B M[?VED[K#>)\TYOA_G75+QG]LK&]L&F3_K2/\8OT_1/K"^(\9,1TW!V5H:&SF MUI.\9\C^GM_#W#PKM[!C5 MT['14`2W8'$>VT)0(K@&(;>+,!RL40JR&F@CP+OMCC\5@/9Z& M:D"G&.*IAHAJXG"=.\,X6S6M/\AWE8@ZD<^IE-:^05W^!0?RL\E\^:C,)2QT MI[[[^GS_@`[=CP]?_G1^?'*TM_M66-7%Q)$#0P-YYX%YL,9,3O1Y$P15T?U/ MD.HT_*()@N6T>I0NJ>O4`E@E15;9%4:XOZ`K)%Y&YD_]\YS/OSHK9GFI]L))+AT+=1Q/^:V1<-0(NW+BU)S"W, M1RI5)B;"E*U'E)C*R%59J=VM&)1A81.B+`P\)EF'9]"&WW]78664=UHJ;IIG M9)0\B9X0T&2A)0I;3^I*U-P>`[AW='1X]!3VP8UXMYFOTF!OAV1N-!`N\"C8 M.1EYCM^[!AM:$8=EL-U!%&\/"91FX5=`/U-M@AZB9.Q%,=UZGRUAJ?`6$8Y] M%SJHVG"TF&"#MOZD+J,1E'V+/[EO99"QHL_30F!&0,*#.0VJ6(X652R-;23^ M.,R9(=Y#-G95CA3D89E!V94X=]#06PZN:F)."I!9IB/%2,M*N!RP&[`>[YFA M9=N,R(ILOI"N6?.$'W=A[7+(YQG-`VAZ*D95!*A6;4GN)^8E'YU/DWMS`1F^ M-?'9),N<*]4458N94@&RN1JS0,&]>A31LF4R$ZU\;4M7M81,3-H MQS]Z]`@;H/8.Y<"KLP(VQ^D%'0T0(9:_9&%JJT5.!87KR(&A2OTR7.F61,]6 M![OJ,`1;"4EH?_Q8"F]E*!QOCK@79"G*_O#@S3]OF+D$-&?Z]XB40(U6&9.\ M:140Y&TVQHJ,S$21.M*-AN"_E:3G9*LUX-W1XBL.ZSB?_K[23\1O/$29P@1^T9.*+7(VE_A69]MT\ MP[%QO0_LM'2SY](./^+8(,=B4>"/4HCP4,0Y2&'+#$C>I5A%,SZ) M`.5<&!-7A$_\']&:30#-:%?*-[+M3/.^8V?3W;(4C^*6^XW*4-!"[;8-W4 MAEJR]J\/'QZ-[&39;:VL+2=K-3'"HCT%BG*+1&ZE/942T5:2WL7*IE)N$LJ$ M%6O5K`PA%1I*X8O+YTR-E[R.U+(I&5C`VN4QT_QG6.[;>.B9,WB-/U">W;^ M9"]-.7I9HJ/N(>'(Y&B_VK2;,>7*EB+O^(I]WUK3$4R(2XA37YC.4'1W?Q^HT&_EI8>B9`R+A:Q^@-?-Z[6MRCR/N([(1R8SY<< M@FBBB*/(SJLO&,QQHLEL7#D,%L18PURJ%IG&)-7>EF%8!FHNHE70YFL03+L" M8`E[5O!VBA56Z3[*V0019Y*(:6S1Y0=/X*@`6[-HW@;?F41NF.)J!0.WJ\!; MDE^!_)2:"!/<6DX!TU8PZ,E,PK4-(9J3-(J]B6YM=_(N#S8FRYB'+I1NUTP` M,`-AA#.C6M`QM*FLSG36EO:(0L.@>TTO9TPC.@;4S0V@EXN1,^]'85)?J)'[ M3)67C-\3#9AS_\_:[.3W__@N(&RT%_'?#Y/^F/PG;]5<?O\(IZH"[W$PLH"LF'ET'>%-/- MM3I29$U_4]K_B_<_/DCZ*O;_ ME"4N9)\QTQ"?MN,=;]W;Z(Q MU_ZW2O;_^J:P_Q?[/P^2OMC^5^9W\9:IW`"O^`#EOW%5DP:\JHO@+-'[D7@[ C+TEY9:S/JKW0``L-L$B+M$B+M$B+M$A_./T_+/;S/`!X```` end