Re: burneye, how i can defeat it?

From: Varg Meik Grishnack` (meik_at_altern.org)
Date: 11/17/03

  • Next message: Aaron Adams: "Re: GetPC code (was: Shellcode from ASCII)" 
    Date: Mon, 17 Nov 2003 23:46:17 +0100
To: vuln-dev@securityfocus.com

    Hi;

    Was it encrypted with the first version ? if so, have a look at
    UNF-burninhell tool (I don't remember any url, but google seems to be
    the best friend in these situations)...and else, have a look at a tool
    contained in http://www.rootshell.be/~ioc/releases/ioc6-final.tar.gz
    (written by an anonymous).

    Meik

    Le 15 Nov 2003 16:26:18 -0300
    gr00vy <groovy2600@yahoo.com.ar> écrit:

    > hi list, im writting because i have a problem with a binary, it is
    > encrypted with teso burneye, get it at teso's home.
    > i would apreciate if you *point me to a some kind of text explaining
    > how to debug this kind of problems.
    > I have been trying whit pice but it is for kernels bellow .17 -(i
    > can't download it :S ).
    >
    > thanks for the possyble replys
    >
    > TEEE burneye - TESO ELF Encryption Engine
    >
    > -------BEGIN PGP PUBLIC KEY BLOCK-----
    > Version: GnuPG v1.2.1 (GNU/Linux)
    >
    > mQGiBD+MWD0RBAD0zsMD23euntPmXJScQ6aqId4s6SGHw5FdcgSdxM2rRo1/HJ10
    > yZhApRGKCbnM/RW8P1+pIKlKBvSIp9wmeIgikz4KGmzGIfuhaHwzVOTEBmY3PBqn
    > Q73LLC+tsUPRDDuEQY5OmtbiukRmCBWFezAzFOmD3RhbgjtkGXP3nCfKbwCgnMDh
    > /cBR9cMJDJSBnt+s3odafjMD/io6JbwCL7s3EUjU/QtNI3Zwflm/biPjMu0++wIb
    > IEtfTLKiAKWGpnoIVjPe8bH6uQgbp4n8G1fFkkvlmvXc2Yz012MFLJyyJLRLg4L1
    > ZG72ExhGz54D3GV9t5VqG9IsNfDSYrH/GC6zE6N2jRFL/e6K/sg82zZqBGRpkmdM
    > 48xyBACuNgIWtPpaMdM+WeC7nh6+j5E5eT+x1RinDHGH95y4gpKBhBr/Yc4nQvh5
    > e07wHHO4iWuTrnCbxEaKFOk1iTY3b1eZXZvcdJPiyq2nfp7OoRs69JZ40HQSA+aF
    > O60rlEh8UgnD3fDD9/JzxW3iAdDPk8BLuoAC1Qdt1qpbhv0UkrQ1Z3IwMHZ5ICha
    > ZW5DcmFja2luZy5jb20uYXIpIDxncm9vdnkyNjAwQHlhaG9vLmNvbS5hcj6IWQQT
    > EQIAGQUCP4xYPQQLBwMCAxUCAwMWAgECHgECF4AACgkQTKxJeVJCmvAmrwCfZSL3
    > bx1vyW4pTNwyez0fdOJmQ+EAoIOUDo0aO9LdfpruyrTzvkQaOlnSuQENBD+MWD4Q
    > BADcytQOgY+pPtQdgKTn53VIEOzyagqNdfd3ei0K+TIEl9x9rdOwYWn5bf8m6QIn
    > EgWi9+cvvXIl7+ziHUOCyx/BmB3bNQ9TSIlrpx+S42BJvTAJEb0hTDn6FkeupBea
    > edxCyt25hJjb0NoMhn32kDiWIEGqh16Tt+h0W6MbFVDilwADBQQAmY+DT5cx6u9Y
    > urffLDVq2/FHUncJQ5jIZy+ThqRWG+DBg46UzGqSIZzXhyB49k1EBgTPA8d8rJML
    > fLnre1ccRvzo++VR6iIEAX5ur2mosM2SCePbJ4yTugkFPGt7dfgnQnWhNMO8GMYo
    > x0HyN+VM72VmqEKG+k7c5cVZ8GvEH4uIRgQYEQIABgUCP4xYPgAKCRBMrEl5UkKa
    > 8ILrAJoCQOtCNlNOdbImuMTLu8hN9GHgiACgkQZQTHy1ielq23Vyl0A5Vy98bkQ=
    > =LiOi
    > -----END PGP PUBLIC KEY BLOCK-----
    > 

    -- 
http://vinnland.ath.cx/meik/

  • Next message: Aaron Adams: "Re: GetPC code (was: Shellcode from ASCII)"