Re: ascii decoder

[Slawek <sgp () TELSATGP COM PL>]

Wednesday, October 11, 2000 12:43 AM +0200, Alex Schuetz wrote:
> Hi Slawek, I appreciate your idea, but what I do not understand is, why
are you
> using such a "complicated" encoding anyway? Remember ascii to hex ?
>
> {decoding routine}.aff2d3f400c5.......somedomain.com
>
> is much easier. I.e. Write your hexbytes directly in ascii :-) Decoding
ascii to
> bytes will be trivial.



Hi Alex, hi all,



As far as I can see both encodings use two bytes for each byte of shell
code, so there's no real difference which one we'll be using.

There's one one problem I can see with your method - do you really think
it's trivial to write a code that will decode hex and it's machine code'd be
acceptable as host name?

My decode routine looks like this:
LLLLZTYT_T639WX-LLLL0B1RYkA20A3A2A2B20B2BWX4.8A2rS

It's only 50 bytes long and it can decode a shell code, encoded string uses
only chars 'A'-'P' and it allows dots in it..

Of course if you can write a hex decoder that will look like a host name,
than no problem - you can do that :) I will be really happy to see such code
on the list :)


Note that if somebody really needs to have shellcode encoded in hex than
he/she can encode hex decoder by my encoding sheme and just doesn't care
there're improper bytes in the hex decoder. But I think it's not the best
idea, becouse we're limited by host name length (255 bytes).



Oh, and by the way - there was a bug in the encoder's "pseudo code". In fact
I have just attached an old version that was working with previous version
of decoder ;) (and this decoder couldn't easily be coded as a host name)

So .. correct encoder should look like this:

For each byte of shell code:
    A = lower nibble
    if (A = 0) then { B = 5 } else { B = 4 }
    C = higher nibble xor B
    D = hightab [C and 0x0f]
    put (D + 0x40)
    put (B*0x10 + A)
put ('-A.')

hightab[] = { 0x10, 0xb, 0x6, 0x1, 0xc, 0x7, 0x2, 0xd, 0x8, 0x3, 0xe, 0x9,
0x4, 0xf, 0xa, 0x5 }



I hope I can add here something that probably can be useful if somebody
wants to use my decoder to exploit the ntalkd bug on OpenBSD.


The problem looks like this: we've got two things we control that we can put
into the format string: a login name of attacker and his host name. Yes, I
know it's impossible to insert %'s in the host name (I've received a *huge*
amount of private mails that all said "it's not possible, so we cannot
exploit this").

Can't we put %'s in login name of an attacker? And yes, I know the host name
that's 255 chars long will not be inserted in the "bigbuf", but won't it be
present in the memory in the other place? (I'm not sure about this, but
probably in the buffer that has been used in host name resolving).

So login name is too short to insert the hole shell code there - we can put
the shell code in host name (that's why I wrote the decoder ;) ) and put the
format string attack in the login name..


but I hate writing exploits :)



I'm still waiting for comments, I really appreciate them :)
Slawek