full-disclosure - Bypass of 22 Antivirus software with GDI+bug exploit Mutations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20050308005103.87B435D635@lists.grok.org.uk>
From: randallm at fidmail.com (Randall M)
Subject: Bypass of 22 Antivirus software with GDI+bug
	exploit Mutations - part 2

I don't think he did. McAfee newest update now catches it. He did mention
embedding in to.

RandallM 

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Trog
Sent: Monday, March 07, 2005 10:54 AM
To: Full-Disclosure@...ts.grok.org.uk
Subject: Re: [Full-Disclosure] Bypass of 22 Antivirus software with GDI+bug
exploit Mutations - part 2

(re-sending to new FD address)

On Fri, 2005-03-04 at 15:03 -0600, Andrey Bayora wrote:

> The issue is: only 1 out of 23 tested antivirus software can detect 
> malicious JPEG image (after 6 month from the public disclosure date).

Perhaps this fact should have rung some alarm bells in your mind.

> 
> Here is the link to results, JPEG file and my paper (GCIH practical) 
> that describes how to create this one:
> http://www.hiddenbit.org/jpeg.htm

I had a look at your supposed JPEG exploit file, bulzano2.jpg, downloaded
from the URL you supplied above, and read the 84 page PDF you've generated
to explain your processes.

You appear to have made an error.

The segments of a JPEG file are chained together. In bulzano2.jpg, the chain
goes as follows:

Offset Marker Size Comment
--------------------------

0x0000 FFDB        Start of image marker
0x0002 FFE0   0010 JFIF APP0 marker: next in chain = 0x0004
+0x0010=0x0014
0x0014 FFED   191c APP marker: next in chain = 0x0016+0x191c=0x1932

According to your paper you've added your exploit at offset 0x0210, which is
in the middle of the APP segment that ranges from 0x0018 to 0x1932, as such
this is not a valid exploit. The data at 0x0210 may look like a segment
marker, but isn't.

Please explain if I have missed something.

-trog