Changeset 435
- Timestamp:
- 03/27/06 03:29:29 (3 years ago)
- Files:
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
nepenthes/trunk/modules/shellcode-signatures/shellcode-signatures.sc
r433 r435 9 9 [n] [+] 4) GenericCMD generic CMD decoder 10 10 [n] [+] 5) LinkTrans handles linkbot/linkshellcode connectback transfers 11 [ +] [] 6) LinkBindTrans handles linkbot/linkshellcode bind transfers11 [n] [+] 6) LinkBindTrans handles linkbot/linkshellcode bind transfers 12 12 [n] [+] 7) Stuttgart handles "stuttgart" shellcode 13 13 [s] [ ] 8) Wuerzburg handles "wuerzburg" shellcode … … 16 16 [n] [ ] 11) KonstanzXOR Konstanz XOR decoder 17 17 [n] [+] 12) GenericConnectTrans various csends 18 [ ?] [ ] 13) GenericUniCode generic UniCode decoder18 [E] [ ] 13) GenericUniCode generic UniCode decoder 19 19 [n] [+] 14) GenericWinExec generic WinExec decoder 20 20 [n] [ ] 15) LeimbachUrlXOR generic XOR decoder 21 21 [?] [ ] 16) Genericwget generic wget decoder 22 22 [?] [ ] 17) ASN1IISBase64 handles oc192 dcom bindshell 23 [ a] [] 18) ASN1SMBBind handles oc192 dcom bindshell23 [n] [+] 18) ASN1SMBBind handles oc192 dcom bindshell 24 24 [n] [+] 19) THCConnect handles thc iis connectbackshells 25 [ 25 [?] [ ] 20) THCBind handles thc iis bindshells 26 26 [n] [+] 21) HODBind handles oc192 dcom bindshell 27 27 [n] [+] 22) HODConnect handles oc192 dcom bindshell 28 [ n] [+] 23) HODBind handles house of dabus msmq bindshells28 [s] [ ] 23) HODBind handles house of dabus msmq bindshells 29 29 [n] [+] 24) HODBind handles house of dabus netdde bindshells 30 30 [n] [+] 25) HODConnect handles house of dabus netdde bindshells … … 33 33 [n] [+] 28) HATSQUADConnect handles hat-squad wins connect 34 34 [n] [+] 29) HATSQUADBind handles hat-squad wins bindshell 35 [ +] [+] 30) ZUCConnect handles zuc wins connect ( dupe of 19))35 [n] [+] 30) ZUCConnect handles zuc wins connect ( dupe of 19)) 36 36 =--- 31 ShellcodeHandlers registerd 37 37 … … 202 202 wuerzburgxor::wuerzburg 203 203 { 204 /*205 * this xor chain ckecks if the value too xor is equal to the xor key to avoid zeros 206 */ 204 205 // this xor chain sucks hard 206 207 207 pattern 208 208 "(.*\\xEB\\x27......)(\\x5D\\x33\\xC9\\x66\\xB9(..)\\x8D\\x75\\x05\\x8B\\xFE\\x8A" … … 832 832 }; 833 833 834 /* 834 835 835 // taken from shellcode-generic/sch_generic_link_bind_trans.cpp 836 836 bindfiletransfer::bindlinktransfer … … 878 878 "\\xff\\xd0\\x57\\x68\\xef\\xce\\xe0\\x60\\xff\\xd6\\xff\\xd0"; 879 879 880 mapping ( port,key);881 }; 882 */ 880 mapping (none,port); 881 }; 882 883 883 884 884
