Re: pen testing & obfuscated shell code

From: Marius Huse Jacobsen (mahuja_at_c2i.net)
Date: 02/10/04

  • Next message: Michael Krymson: "RE: Which software requires the Messenger Service?" 
    Date: Mon, 9 Feb 2004 22:07:14 -0800
To: "Don Parker" <dparker@rigelksecurity.com>

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Hello Don,

    Friday, January 30, 2004, 5:44:53 AM, you wrote:

    DP> Hello group, have a question to ask which is about using obfuscated shell code during a
    DP> pen test. Do any of you actually use home cooked obfuscated shell code during a pen test?
    DP> By that I mean do you replace the known sled of x90 with another 1 byte instruction that
    DP> won't affect the egg?

    There are many instructions that would fit the bill... Incrementing
    and decrementing registers, for example. To avoid further filters,
    you may wish to alternate. E.g.
    NOP
    INC EAX
    INC EDX
    NOP
    NOP
    INC EAX
    DEC EDX
    INC EAX
    XOR EAX,EAX

    The clue is that the instruction, in machine code, should be one byte
    only. Simply because if there were two, there would be a chance it
    "landed" on the odd byte.

    - --
    Best regards,
     Marius mailto:mahuja@c2i.net

    -----BEGIN PGP SIGNATURE-----

    iQA/AwUBQCh1EpfZ2CSWpu1rEQK2/ACfdem7rx1ZAjGDH0gkHnYlCt8wp1UAoJdC
    jssl3iQxyaI6nT+ptaCgLqP7
    =iJ1j
    -----END PGP SIGNATURE-----

    ---------------------------------------------------------------------------
    Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection

    Protect your network with the comprehensive security solution that
    integrates six applications for ease of use and lower TCO.

    Firewall - Virus protection - Spam protection - URL blocking - VPN
    - Wireless security.

    Download 30-day evaluation at:
    http://www.astaro.com/php/contact/securityfocus.php
    ----------------------------------------------------------------------------

  • Next message: Michael Krymson: "RE: Which software requires the Messenger Service?"