Using a Hex Editor to Produce a POC file

I rarely do this but given the nature of the tutorial, I needed to create a word document with pictures to clearly illustrate the information.

This tutorial takes an example proof of concept file from a bugtraq post and look at exactly what was altered in the zip file and verify if the POC file will actually work. In addition, the tutorial shows you how to navigate a hex value table and how to change the proper values to produce a good POC file should you want to build your own zip file to test the vulnerability reported to bugtraq.

I wrote this tutorial for my junior security staff. They often see vulnerabilities posted but don't know how to validate the claims. Often, vulnerabilities are posted with vital information missing. Because many junior security staff don't know how to go about recreating a valid test, I picked an example off of bugtraq at random and put this tutorial together. I have MD5 hashed the file in case you are the paranoid type. Those who know me should feel comfortable DLing a word doc from me.

Enjoy.

:p

You actually wrote it!!! Thanks Horsey, I'll have to check it out when I get home.

Yep. I told you I would.

One thing I'd like to mention is that the techniques in the tut can be used on just about any file format. Even if you don't have a file map, you can build your own by experimenting.


--TH13

I don't think I trust a Word file from you! I opened it in Vi and it was garbage characters! You put a virus in it didn't you!

Ride Teh PWNY / Horsey/ Mr Ed. Eddie, Fromnt end to Vi.

Haha. Yes, I am out to secretly hax0r the entire planet and if it wasn't for those damn kids I would have gotten away with it. ;)

Anyway, so now I have a few other tut ideas. The next one will be how to look inside binary files and compare them to patched updates in order to pinpoint the vulnerability in the older file. This is a common technique virus writers use to quickly drum out the nasties. Anyone interested?

--TH13

That would be cool Horsey. Showing us how to right a virus toolkit/lab ;). Or we could go oldschool!!! Teach me ASM!!! ;)

Nooooooooooooooooooo. I won't be showing you how to write a virus. What I will do is show you one technique that virus writers use when they write exploits. What I hope you take away from it is 1) an understanding of how virus writers are so quickly able to come up with exploit code and 2) In understanding this, hopefully you will be able to better defend against attacks.

I'm interested. Anything you can write that teaches something write away :).

I'm interested as well horsey, that would be a good read, I hope to see a tutorial about that up on AO very soon :)

Someone asked me a question and I think the answer should be posted.

If you zip a file, the file header CRC value will be the same as the data file CRC. Once you go through the tut, zip a file and you'll be able to spot the CRC values in the hex table within seconds.

Someone else asked me about hiding data within files. Yes, that is called steganography and is a common practice. No, I haven't done a tut on stego - yet.

:)

Quote:

---

Originally posted here by thehorse13
Someone asked me a question and I think the answer should be posted.

If you zip a file, the file header CRC value will be the same as the data file CRC. Once you go through the tut, zip a file and you'll be able to spot the CRC values in the hex table within seconds.

Someone else asked me about hiding data within files. Yes, that is called steganography and is a common practice. No, I haven't done a tut on stego - yet.

:)

---

Ascii Stegonagraphy:

I'm making this up as I go along, so it may suck, I don't care though:



------------------------------------------------------------------------------------------------------------------
---------------------------------- -----------------------------------------
------------------------ ------------------------------
---------------- password for nukes is kjbdsfkjndskfvkdjfvkjdfv ----------------
--------------- ---------------
--------------- ---------------
--------------------------- ----------------------------
---------------------------------- ----------------------------------------
-----------------------------------------------------------------------------------------------------------------------


See in that picture of the sky the password for some weapons is hidden within the data.


OK so that isn't EXACTLY how it is.... Actually it sort of is. Say in the picture you're looking at on your screen there is a red shade in the image. Well, each pixel showing red was told to show red by the computer and the computer only thinks in Binary. Well, say red is in the image and shows up to the computer as 10001011 10001011 10010101 10010101 10001011 10010011 10010101 10011011

Well you could change the last 1 of each binary string there to something else and the image wouldn't look any different to a human eye. The tone change would be so small you wouldn't be able to tell. So you could form a message in the code for red that would say something because you now have a few more bits to work with text.

So I could change that to say a password for something, and only the people who know to check it with Stego tools would be able to decode it.

Ahhh the art of hiding in the open.

So it is kind of neat. You change one bit, no one can tell really, and in that bit you hide messages for people. well, not in ONE bit, but in the bits you change you can fit a whole email message for some. It's kind of neat really. Terrorists use it too.....lol.