full-disclosure - Re: Alphanumeric Shellcode Encoding and Detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 6 Aug 2008 02:36:38 +0300
From: "Avraham Schneider" <avri.schneider@...il.com>
To: "Avraham Moshe Schneider" <Avraham.Schneider@...ddin.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Alphanumeric Shellcode Encoding and Detection

On Tue, Aug 5, 2008 at 11:31 PM, Avraham Schneider
<avri.schneider@...il.com> wrote:
> Oops - that is not correct - it will only work when the second and
> third bits of ESP are 0
>
> :-) I was to quick on the send button.
>
> EAX is basically XOR's with the length of the string, and instead I
> need to increment it by the length of the string... I'll have to come
> up with a better solution... (I'll probably have to resort to
> patching... but I was looking for a quick and dirty fix)
>
> If anyone comes up with a solution for this before me, I'll buy them a
> Shawarma next time they're in Israel ;-)
>
> Regards,
> Avri
>
> On Tue, Aug 5, 2008 at 7:00 PM, Avraham Moshe Schneider
> <Avraham.Schneider@...ddin.com> wrote:
>> I fixed a couple of bugs -
>>
>> 1. The srand() function was called after calls to rand() - causing a fixed string in the decoder which an IDS could signature on
>> 2. Case of ESP register pointing to the head of the decoder was not handled, it is fixed now, but needs to be randomized. Right now, in the case of ESP pointing to the shellcode, the following fixed string would exist at the head of the decoder routine: "TX4640"
>> This translates to:
>> _asm
>> {
>>        push esp;
>>        pop eax;
>>        xor al, 0x36;
>>        xor al, 0x30;
>> }
>>
>> The '6' and the '0' can be any alphanumeric byte where the first is the second+6 or vice versa.
>>
>> You may add alphanumeric NOP instructions in between and change the diff between the bytes accordingly.
>> The diff between the two XOR values should be the length of the resulting string.
>>
>> I used the EAX register, as XOR'ing it with an immediate value is alphanumeric.
>>
>> Regards,
>> Avri
>> **********************************************************************************************
>>
>> The contents of this email and any attachments are confidential.
>> It is intended for the named recipient(s) only.
>> If you have received this email in error please notify the system manager or  the
>> sender immediately and do not disclose the contents to anyone or make copies.
>> ** eSafe scanned this email for viruses, vandals and malicious content **
>>
>> **********************************************************************************************
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>

View attachment "alnum_decoder_encoder.c" of type "text/plain" (107270 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/