概述

在上一篇《以中国为目标的DinodasRAT Linux后门剖析及通信解密尝试》文章中，笔者对DinodasRAT Linux后门的功能及通信数据包进行了简单剖析，实现了对DinodasRAT Linux后门心跳数据包的解密尝试。

虽然目前可对DinodasRAT Linux后门的通信数据包进行解密，但笔者认为目前对DinodasRAT Linux后门的了解还不是很充分。

因此，为了能够更进一步的对DinodasRAT Linux后门的攻击活动进行剖析，笔者准备从如下几个角度复现DinodasRAT Linux后门的攻击场景及攻击利用过程中的DinodasRAT Linux后门的通信模型：

• 后门攻击场景复现：基于模拟构建的DinodasRAT Linux后门控制端程序，复现DinodasRAT Linux后门的远控攻击场景；
• 关键代码分析：梳理分析DinodasRAT Linux后门通信模型相关的关键代码；
• 后门通信模型剖析：梳理DinodasRAT Linux后门各远控指令的通信模型；
• 模拟构建DinodasRAT Linux后门控制端：通过模拟构建DinodasRAT Linux后门控制端程序以实现与DinodasRAT Linux后门的交互效果；

• 后门攻击场景复现

  为了能够更好的还原DinodasRAT Linux后门的攻击利用场景，笔者尝试模拟构建了一款DinodasRAT Linux后门控制端程序，目前可有效的与DinodasRAT Linux后门进行交互，相关运行效果如下：

• 

相关通信数据包截图如下：

相关操作流程如下：

• 被控端执行UninstallMm指令（卸载自身）前运行情况
• 

 

• 被控端执行UninstallMm指令（卸载自身）后运行情况
• 

• 控制端

F:\GolandProjects\awesomeProject5>awesomeProject5.exe
Server started. Listening on 0.0.0.0:80
请选择需执行的功能:help、DirClass、DelDir、EnumProcess、DealExShell、UninstallMm
>help
********支持功能如下********
DirClass：查看目录
DelDir：删除目录
EnumProcess：查看进程
DealExShell：执行shell命令
UninstallMm：卸载自身
**************************
请选择需执行的功能:help、DirClass、DelDir、EnumProcess、DealExShell、UninstallMm
>DealExShell
DealExShell指令-请输入需执行的shell命令：
>ifconfig
*******************DealExShell:ifconfig*******************
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.153.133  netmask 255.255.255.0  broadcast 192.168.153.255
        inet6 fe80::51d9:b9bf:4800:15b1  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:7a:63:b6  txqueuelen 1000  (Ethernet)
        RX packets 117418  bytes 10766685 (10.2 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 127228  bytes 56957898 (54.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 4  bytes 240 (240.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4  bytes 240 (240.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


请选择需执行的功能:help、DirClass、DelDir、EnumProcess、DealExShell、UninstallMm
>DirClass
DirClass指令-请输入需查看的目录路径：
>/tmp/
*******************DirClass:/tmp/*******************
.X0-lock        1       11      2023-07-20 21:07:38     2
.XIM-unix       0       0       2023-07-20 21:07:37     2
systemd-private-07e721d8e32643438b178572cb153efe-colord.service-Oil9iv  0       0       2023-07-20 21:08:35     2
vmware-root_484-868851811       0       0       2023-07-20 21:07:38     2
.font-unix      0       0       2023-07-20 21:07:37     2
.xfsm-ICE-V8T571        1       398     2023-07-20 21:08:33     2
ssh-XXXXXXVA2uMv        0       0       2023-07-20 21:08:33     2
systemd-private-07e721d8e32643438b178572cb153efe-systemd-logind.service-3sTMOv  0       0       2023-07-20 21:07:38     2
systemd-private-07e721d8e32643438b178572cb153efe-haveged.service-hyFQUI 0       0       2023-07-20 21:07:37     2
systemd-private-07e721d8e32643438b178572cb153efe-upower.service-OpfV78  0       0       2023-07-20 21:08:34     2
.X11-unix       0       0       2024-05-06 02:04:10     2
systemd-private-07e721d8e32643438b178572cb153efe-ModemManager.service-r0SmEk    0       0       2023-07-20 21:07:38     2
VMwareDnD       0       0       2024-04-29 21:59:26     2
.ICE-unix       0       0       2023-07-20 21:08:33     2

请选择需执行的功能:help、DirClass、DelDir、EnumProcess、DealExShell、UninstallMm
>EnumProcess
*******************EnumProcess:*******************
systemd         root    1
kthreadd                root    2
rcu_gp          root    3
rcu_par_gp              root    4
slub_flushwq            root    5
netns           root    6
kworker/0:0H-events_highpri             root    8
mm_percpu_wq            root    10
rcu_tasks_kthread               root    11
rcu_tasks_rude_kthread          root    12
rcu_tasks_trace_kthread         root    13
ksoftirqd/0             root    14
rcu_preempt             root    15
migration/0             root    16
cpuhp/0         root    18
cpuhp/1         root    19
migration/1             root    20
ksoftirqd/1             root    21
cpuhp/2         root    24
migration/2             root    25
ksoftirqd/2             root    26
kworker/2:0H-events_highpri             root    28
cpuhp/3         root    29
migration/3             root    30
ksoftirqd/3             root    31
kworker/3:0H-events_highpri             root    33
kdevtmpfs               root    38
inet_frag_wq            root    39
kauditd         root    40
khungtaskd              root    42
oom_reaper              root    43
writeback               root    44
kcompactd0              root    45
ksmd            root    46
khugepaged              root    47
kintegrityd             root    48
kblockd         root    49
blkcg_punt_bio          root    50
tpm_dev_wq              root    51
edac-poller             root    52
devfreq_wq              root    53
kworker/0:1H-kblockd            root    54
kswapd0         root    55
kthrotld                root    64
irq/24-pciehp           root    66
irq/25-pciehp           root    67
irq/26-pciehp           root    68
irq/27-pciehp           root    69
irq/28-pciehp           root    70
irq/29-pciehp           root    71
irq/30-pciehp           root    72
irq/31-pciehp           root    73
irq/32-pciehp           root    74
irq/33-pciehp           root    75
irq/34-pciehp           root    76
irq/35-pciehp           root    77
irq/36-pciehp           root    78
irq/37-pciehp           root    79
irq/38-pciehp           root    80
irq/39-pciehp           root    81
irq/40-pciehp           root    82
irq/41-pciehp           root    83
irq/42-pciehp           root    84
irq/43-pciehp           root    85
irq/44-pciehp           root    86
irq/45-pciehp           root    87
irq/46-pciehp           root    88
irq/47-pciehp           root    89
irq/48-pciehp           root    90
irq/49-pciehp           root    91
irq/50-pciehp           root    92
irq/51-pciehp           root    93
irq/52-pciehp           root    94
irq/53-pciehp           root    95
irq/54-pciehp           root    96
irq/55-pciehp           root    97
acpi_thermal_pm         root    98
xenbus_probe            root    99
mld             root    100
ipv6_addrconf           root    101
kstrp           root    106
zswap-shrink            root    111
kworker/u65:0-hci0              root    112
kworker/1:1H-kblockd            root    160
kworker/2:1H-kblockd            root    171
kworker/3:1H-kblockd            root    172
cryptd          root    181
ata_sff         root    182
scsi_eh_0               root    183
scsi_tmf_0              root    184
mpt_poll_0              root    185
scsi_eh_1               root    187
mpt/0           root    188
scsi_tmf_1              root    189
irq/16-vmwgfx           root    204
card0-crtc0             root    206
card0-crtc1             root    207
card0-crtc2             root    208
card0-crtc3             root    209
card0-crtc4             root    210
card0-crtc5             root    212
card0-crtc6             root    214
card0-crtc7             root    215
scsi_eh_2               root    268
scsi_tmf_2              root    269
kworker/1:2H-kblockd            root    278
jbd2/sda1-8             root    309
ext4-rsv-conver         root    310
systemd-journal         root    364
vmware-vmblock-         root    381
systemd-udevd           root    390
haveged         root    462
vmtoolsd                root    484
irq/56-vmw_vmci         root    588
irq/57-vmw_vmci         root    590
kworker/u65:2-hci0              root    668
dbus-daemon             message+        811
polkitd         polkitd 814
systemd-logind          root    816
rpciod          root    817
xprtiod         root    818
NetworkManager          root    819
cron            root    835
ModemManager            root    838
lightdm         root    858
Xorg            root    872
agetty          root    873
rtkit-daemon            rtkit   997
lightdm         root    1461
systemd /usr/lib/systemd/systemd        kali    1467
(sd-pam)                kali    1468
pipewire        /usr/bin/pipewire       kali    1483
wireplumber     /usr/bin/wireplumber    kali    1484
pipewire-pulse  /usr/bin/pipewire       kali    1485
dbus-daemon     /usr/bin/dbus-daemon    kali    1487
gnome-keyring-d /usr/bin/gnome-keyring-daemon   kali    1488
xfce4-session   /usr/bin/xfce4-session  kali    1498
ssh-agent               kali    1567
at-spi-bus-laun /usr/libexec/at-spi-bus-launcher        kali    1578
dbus-daemon     /usr/bin/dbus-daemon    kali    1585
at-spi2-registr /usr/libexec/at-spi2-registryd  kali    1596
gpg-agent               kali    1608
xfwm4   /usr/bin/xfwm4  kali    1610
gvfsd   /usr/libexec/gvfsd      kali    1614
gvfsd-fuse      /usr/libexec/gvfsd-fuse kali    1620
xfsettingsd     /usr/bin/xfsettingsd    kali    1635
upowerd         root    1639
xfce4-panel     /usr/bin/xfce4-panel    kali    1645
Thunar  /usr/bin/thunar kali    1650
xfdesktop       /usr/bin/xfdesktop      kali    1661
panel-1-whisker /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0       kali    1665
panel-13-cpugra /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0       kali    1670
xiccd   /usr/bin/xiccd  kali    1671
panel-14-systra /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0       kali    1672
panel-15-genmon /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0       kali    1676
xfce4-notifyd   /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd   kali    1678
panel-16-pulsea /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0       kali    1686
colord          colord  1698
panel-17-notifi /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0       kali    1701
nm-applet       /usr/bin/nm-applet      kali    1703
xcape   /usr/bin/xcape  kali    1708
panel-18-power- /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0       kali    1711
light-locker    /usr/bin/light-locker   kali    1716
panel-22-action /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0       kali    1722
dconf-service   /usr/libexec/dconf-service      kali    1725
polkit-gnome-au /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1  kali    1727
xfce4-power-man /usr/bin/xfce4-power-manager    kali    1752
agent   /usr/libexec/geoclue-2.0/demos/agent    kali    1755
blueman-applet  /usr/bin/python3.11     kali    1782
vmtoolsd        /usr/bin/vmtoolsd       kali    1783
obexd   /usr/libexec/bluetooth/obexd    kali    2006
gvfs-udisks2-vo /usr/libexec/gvfs-udisks2-volume-monitor        kali    2019
udisksd         root    2023
gvfs-mtp-volume /usr/libexec/gvfs-mtp-volume-monitor    kali    2038
gvfs-afc-volume /usr/libexec/gvfs-afc-volume-monitor    kali    2043
gvfs-gphoto2-vo /usr/libexec/gvfs-gphoto2-volume-monitor        kali    2049
gvfs-goa-volume /usr/libexec/gvfs-goa-volume-monitor    kali    2054
gvfsd-trash     /usr/libexec/gvfsd-trash        kali    2068
gvfsd-metadata  /usr/libexec/gvfsd-metadata     kali    2074
qterminal       /usr/bin/qterminal      kali    2211
zsh     /usr/bin/zsh    kali    2214
linux_server64  /home/kali/Desktop/linux_server64       kali    6586
zsh     /usr/bin/zsh    kali    6611
kworker/3:2-mm_percpu_wq                root    666030
kworker/2:0-events              root    671000
kworker/1:1-mm_percpu_wq                root    676828
kworker/0:0-cgroup_destroy              root    687692
kworker/u64:0-flush-8:0         root    693826
kworker/2:1-mm_percpu_wq                root    696046
kworker/2:2-mpt_poll_0          root    698531
kworker/1:2-ata_sff             root    699316
kworker/u64:2-flush-8:0         root    699787
kworker/0:2-events              root    699926
kworker/u64:3-events_unbound            root    699928
kworker/3:0-cgroup_destroy              root    699936
tumblerd        /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd    kali    700635
kworker/1:0-ata_sff             root    702014
test    /home/kali/Desktop/test kali    702951
sh      /usr/bin/dash   kali    702959
test    /home/kali/Desktop/test kali    702960

请选择需执行的功能:help、DirClass、DelDir、EnumProcess、DealExShell、UninstallMm
>UninstallMm
*******************UninstallMm:*******************
UninstallMm ok

F:\GolandProjects\awesomeProject5>

关键代码分析

通信框架

在《以中国为目标的DinodasRAT Linux后门剖析及通信解密尝试》文章的“DinodasRAT通信解密尝试”章节，笔者对DinodasRAT Linux后门的通信加解密原理进行了详细的剖析，因此，这里笔者将不再对DinodasRAT Linux后门中的通信加解密技术进行描述。

为了能够快速了解DinodasRAT Linux后门的通信逻辑，笔者又对DinodasRAT Linux后门的反编译代码进行了详细的分析梳理，发现：

• DinodasRAT Linux后门运行后，将循环发送心跳通信
• DinodasRAT Linux后门运行后，将从控制端循环接收控制指令，成功执行远控指令后，将返回执行结果信息

相关代码截图如下：

 DinodasRAT Linux后门通信数据接收函数代码截图如下：

DinodasRAT Linux后门通信数据发送函数代码截图如下：

 

 

 

远控功能与远控指令编号的对应关系梳理如下：

远控函数	远控功能	远控编号
DirClass	列目录	0x02
DelDir	删除目录	0x03
UpLoadFile	上传文件	0x05
StopDownLoadFile	停止上传文件	0x06
DownLoadFile	下载文件	0x08
StopDownFile	停止下载文件	0x09
DealChgIp	修改C&C地址	0x0E
CheckUserLogin	检查已登录的用户	0x0F
EnumProcess	枚举进程列表	0x11
StopProcess	终止进程	0x12
EnumService	枚举服务	0x13
ControlService	控制服务	0x14
DealExShell	执行shell	0x18
DealProxy	执行指定文件	0x1A
StartShell	开启shell	0x1B
ReRestartShell	重启shell	0x1C
StopShell	停止当前shell的执行	0x1D
WriteShell	将命令写入当前shell	0x1E
DealFile	下载并更新后门版本	0x27
DealLocalProxy	发送“ok”	0x28
ConnectCtl	控制连接类型	0x2B
ProxyCtl	控制代理类型	0x2C
Trans_mode	设置或获取文件传输模式（TCP/UDP）	0x2D
UninstallMm	卸载自身	0x2E