Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Sadmind


Aliases:


Sadmind
Sadmind/IIS, Unix/Sadmind, Solaris/Sadmind.worm
Worm.PoizonBox

Malware
Worm
W32

Summary

Sadmind is a worm, that propagates from a Sun Solaris machine to another. It also compromises Windows NT/2000 servers running Internet Information Server 4.0 or 5.0.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details


Variant:Sadmind.A

The worm uses an old vulnerability in the Solaris operating system to enter the system. In the system it first opens remote shell (rsh) service for the root user. It then extracts itself to "/dev/cuc" directory, and adds a worm startup code to the "/etc/rc2.d/S71rpc". The worm also attempts to download and install Perl on the system, and starts itself by executing "/dev/cuc/start.sh" on the victim using the rsh service.

"start.sh" creates a directory "/dev/cup", and starts worms main processes in the background.

The worm goes through random Class-B subnets looking for unpatched Windows NT/2000 machines running IIS web server. If a vulnerable machine is found, the worm will copy the "\winnt\system32\cmd.exe" to "wwwroot\scripts\root.exe" directory and replace "index.htm", "index.asp", "default.htm" and "default.asp" files with its own.

Sadmind also looks for vulnerable Solaris systems from randon Class-B networks. If a vulnerable host is found, the worm creates a tar archive "uni.tar" out of itself, and sends it to the victim using rsh service.

Both vulnerabilities have been fixed by vendors.

Futher information about the problem and the fix in sandmind service in Solaris is available from Sun: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/191&...

Further information about the IIS unicode vulnerability, including a fix, is available from Microsoft at: http://www.microsoft.com/technet/security/bulletin/MS00-078.asp and additional information at: http://www.microsoft.com/technet/security/bulletin/MS00-086.asp





Technical Details: Sami Rautiainen, F-Secure; May 2001



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.

Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free