Sadmind is a worm, that propagates from a Sun Solaris machine to
another. It also compromises Windows NT/2000 servers running Internet
Information Server 4.0 or 5.0.
The worm uses an old vulnerability in the Solaris operating system to
enter the system. In the system it first opens remote shell (rsh)
service for the root user. It then extracts itself to "/dev/cuc"
directory, and adds a worm startup code to the "/etc/rc2.d/S71rpc".
The worm also attempts to download and install Perl on the system, and
starts itself by executing "/dev/cuc/start.sh" on the victim using the
rsh service.
"start.sh" creates a directory "/dev/cup", and starts worms main
processes in the background.
The worm goes through random Class-B subnets looking for unpatched
Windows NT/2000 machines running IIS web server. If a vulnerable
machine is found, the worm will copy the "\winnt\system32\cmd.exe" to
"wwwroot\scripts\root.exe" directory and replace "index.htm",
"index.asp", "default.htm" and "default.asp" files with its own.
Sadmind also looks for vulnerable Solaris systems from randon Class-B
networks. If a vulnerable host is found, the worm creates a tar
archive "uni.tar" out of itself, and sends it to the victim using rsh
service.
