Malc0de » Tools http://www.blog.malc0de.com Tue, 23 Mar 2010 01:25:23 +0000 en hourly 1 BETA3 multi-format shellcode encoding tool http://www.blog.malc0de.com/2010/01/06/beta3-multi-format-shellcode-encoding-tool/ http://www.blog.malc0de.com/2010/01/06/beta3-multi-format-shellcode-encoding-tool/#comments Thu, 07 Jan 2010 01:31:41 +0000 JD http://www.blog.malc0de.com/?p=588 BETA can convert raw binary shellcode into text that can be used in exploit source-code. It can convert raw binary data to a large number of encodings. It can also do the reverse: decode encoded data into binary from the same types of encodings. The official page where you can download it can be found here.

]]> http://www.blog.malc0de.com/2010/01/06/beta3-multi-format-shellcode-encoding-tool/feed/ 35 Converting Shellcode into an Executable For Further Analysis http://www.blog.malc0de.com/2009/09/12/converting-shellcode-to-an-executable-for-further-analysis/ http://www.blog.malc0de.com/2009/09/12/converting-shellcode-to-an-executable-for-further-analysis/#comments Sat, 12 Sep 2009 18:54:11 +0000 JD http://www.blog.malc0de.com/?p=292 Exploit Tool kit’s out in the wild often utilize Download and execute shell-code which when run on the end system downloads and executes a file to allow the attacker to control the system. This is commonly used in Drive By Download attacks where a victim visits a malicious web page that in turn attempts to execute the shell-code in order to install software on the victim’s machine.

More often then not the shell-code is buried within obfuscated javascript. Searching the Murls database reveals one such URL (hxxp://rrrxgvdf.6600.org/kuaile/19.htm).

The above image visualizes the series of redirects that occur via Iframe tags after the victim browses to (hxxp://rrrxgvdf.6600.org/kuaile/19.htm). The example below was found at the following URL. (wm.yxnjs.com_x148_of.js) This shows a simple form of obfuscation where they substitute “%u” for “MTV”

Example of Obfuscated Shellcode

Exploits that target browsers commonly encode shellcode in a JavaScript string using Percent-encoding, “%uXXXX”-encoding or entity encoding. Some exploits also obfuscate the encoded shellcode string further to prevent detection by IDS. The example above is one such example of obfuscation because they are substituting the characters MTV with %u and in this case utilizing percent encoding.

Thanks to David Zimmer over at Idefense the following tool can be used to investigate shell-code either by static or dynamic analysis. Before we can do that we have to clean up the code by replacing MTV with %u and eliminating everything so that we have a “%uXXXX” format. Once the code is all cleaned up you can submit it here The script will then return you a file named shecode.exe_ (the underscore is so that you dont execute it by accident). After saving to the desktop you can then submit to Virus Total, open in your debugger/disassembler or submit to Anubis for a behavioral analysis.

Virus Total Report
Threatexpert Report

]]> http://www.blog.malc0de.com/2009/09/12/converting-shellcode-to-an-executable-for-further-analysis/feed/ 1 Installing Jsunpack-n v0.1e On Ubuntu 9.04 http://www.blog.malc0de.com/2009/09/04/installing-jsunpack-n-v0-1e-on-ubuntu-9-04/ http://www.blog.malc0de.com/2009/09/04/installing-jsunpack-n-v0-1e-on-ubuntu-9-04/#comments Sat, 05 Sep 2009 05:13:41 +0000 JD http://www.blog.malc0de.com/?p=247 A new version of Jsunpack-n was posted recently and i have finally got around to installing it. There are some very cool new features such as

1) improved URL tracking using ‘urlattr’ class and urls dictionary
1a) new command line option -g, to create a URL graph (only when pcap contains 10 or fewer URL requests)

2) bug fixes for stream reassembly and pdf parsing
2a) stream reassembly now handles all streams when processing a pcap file, regardless of whether the nids state is in end_states
4) detection of NOP sled shellcode and performance improvements in shellcode processing (this was one of the performance bottlenecks)
5) new output format with ./files/ directory or -d OUTDIR command line option
6) CVE references are available in the ‘rules’ file but are temporarily unavailable in alerts

One of the major differences is this release is dependent on Yara.. Before you attempt to install Yara make sure you install PCRE by running the following command

apt-get install libpcre3 libpcre3-dev

Now download the following files

1) http://yara-project.googlecode.com/files/yara-1.2.1.tar.gz
2) http://yara-project.googlecode.com/files/yara-python-1.2.1.tar.gz

For yara-python-1.2.1.tar.gz you can build by running the following commands

$ tar xzvf yara-python-1.2.0.tar.gz
$ cd yara-python-1.2.0
$ python setup.py build
$ sudo python setup.py install

And then for yara-1.2.1.tar.gz simply run

$ tar xzvf yara-1.2.1.tar.gz
$ cd yara-1.2.1
$ sudo ./configure; make; make install

Next run the following commands

$ sudo echo “/usr/local/lib” >> /etc/ld.so.conf
$ sudo ldconfig

I then ran jsunpack-n against one the sample .pcap files with the new -g option to generate an image file however immediately received the following error

sudo ./jsunpack-n.py sample-http-exploit.pcap -g url
Traceback (most recent call last):
File “./jsunpack-n.py”, line 1030, in
main()
File “./jsunpack-n.py”, line 1026, in main
graph(file, js.urls, options.graphfile)
File “./jsunpack-n.py”, line 924, in graph
import yapgvb
ImportError: No module named yapgvb

The error is from a missing python module which can easily be installed by running the following command.

apt-get install python-yapgvb

Now that everything is working I scraped MalwareURL.com for the most recently IPs/Domains associated with Exploits by using the following command.

links2 -dump http://www.malwareurl.com/search.php?domain=\&s=exploits\&match=0\&rp=100\&urls=on\&redirs=on\&ip=on\&reverse=on\&as=on | awk ‘{print $1}’ | sed ‘s/|//’ | egrep “[A-Za-z0-9\/]” | awk ‘{print “http://”$1}’ >> t3stURLS.txt

The result of the command stores a list of URLs into a file called t3stURLS.txt while running jsunpack-n in the background we can use wget to loop through the file t3stURLS.txt and download the content to see what gets picked up and decoded.

wget -i t3stURLS.txt -T 1 -t 3

Below is a small sample of the Jsunpack Output that was generated.

*Caution Malicious URLS*

[suspicious:5] 55x5h.2288.org/fkzd/2.htm
[impact=5] DecodedIframe  detected <iframe
[info] [iframe http] http://wm.7udij.cn/x87/xx.html
[info] [script http] http://js.tongji.linezing.com/1240663/tongji.js
[suspicious:5] wm.7udij.cn/x87/xx.html
[impact=5] DecodedIframe  detected <iframe
[info] [iframe .] wm.7udij.cn/x87/Td14.htm
[info] [iframe .] wm.7udij.cn/x87/yt.htm
[info] [iframe .] wm.7udij.cn/x87/td09.htm
[info] [iframe .] wm.7udij.cn/x87/yut.htm
[suspicious:5] 44x5h.2288.org/fkzd/2.htm
[impact=5] DecodedIframe  detected <iframe
[info] [iframe http] http://wm.7udij.cn/x87/xx.html
[info] [script http] http://js.tongji.linezing.com/1240663/tongji.js
[suspicious:5] wm.6bief.cn/x3/xx.html
[impact=5] DecodedIframe  detected <iframe
[info] [iframe .] wm.6bief.cn/x3/Td14.htm
[info] [iframe .] wm.6bief.cn/x3/yt.htm
[info] [iframe .] wm.6bief.cn/x3/td09.htm
[info] [iframe .] wm.6bief.cn/x3/yut.htm

[suspicious:5] 55x5h.2288.org/fkzd/2.htm
[impact=5] DecodedIframe  detected <iframe
[info] [iframe http] http://wm.7udij.cn/x87/xx.html
[info] [script http] http://js.tongji.linezing.com/1240663/tongji.js
[suspicious:5] wm.7udij.cn/x87/xx.html
[impact=5] DecodedIframe  detected <iframe
[info] [iframe .] wm.7udij.cn/x87/Td14.htm
[info] [iframe .] wm.7udij.cn/x87/yt.htm
[info] [iframe .] wm.7udij.cn/x87/td09.htm
[info] [iframe .] wm.7udij.cn/x87/yut.htm
[suspicious:5] 44x5h.2288.org/fkzd/2.htm
[impact=5] DecodedIframe  detected <iframe
[info] [iframe http] http://wm.7udij.cn/x87/xx.html
[info] [script http] http://js.tongji.linezing.com/1240663/tongji.js
[suspicious:5] wm.6bief.cn/x3/xx.html
[impact=5] DecodedIframe  detected <iframe
[info] [iframe .] wm.6bief.cn/x3/Td14.htm
[info] [iframe .] wm.6bief.cn/x3/yt.htm
[info] [iframe .] wm.6bief.cn/x3/td09.htm
[info] [iframe .] wm.6bief.cn/x3/yut.h

As you can see from the output above jsunpack-n was able to decode the obfuscated JavaScript and output the Iframes that were buried within. Because I am using Wget the Iframes are not followed so this test only touches on some of the functionality jsunpack-n provides. Originally I believe jsunpack-n was developed to act as an IDS application however it can also be used for research purposes.

The New file directory now organizes the decodings by MD5 and also saves the executables.
decoding_048c802efcc40b164a42cf29c95ad9e13cf28995
decoding_742d479309d69fd4bc7353647cc66f5cc9418bf9
decoding_d6641a882f77807034ff0a1f5530b1b781ee1019
original_86c2d76a7ba524487ab518c7fae29dcc60c6fc54
decoding_17278448f71fbb774fd420d6bb6dc9f1bf1d8689
decoding_75d715bee572a79d9fba6bae2fff79cf2cb1620d
decoding_f867d1bc0da9a69c286131639f474a5c2521f46d

This tool has come along way and has become one of my favorite. Many thanks to the author for sharing with everyone in the community.

]]> http://www.blog.malc0de.com/2009/09/04/installing-jsunpack-n-v0-1e-on-ubuntu-9-04/feed/ 137