From: H D Moore (sflist@digitaloffense.net)
Date: Mon Mar 20 2006 - 10:02:05 EST
On Sunday 19 March 2006 06:17, Mohamed Abdel Kader wrote:
> Does anyone have some text explaining how metasploit encodes the
> exploits for the below list:
The best references are the source code and comments.
> Msf::Encoder::Countdown
A tiny encoder that will use a decrementing byte as the key - doesn't work
well for large payloads and is more of a cool hack than anything else.
> Msf::Encoder::PexAlphaNum
An encoder based on Skylined's original work. To make this payload 100%
alphanumeric, you must set all invalid characters in the 'BadChar' list
of your payload -AND- set GETPCTYPE=win32 for it to use the alpha-only
GETPC stub. The various signature-based IDS/IPS's look for the static
ASCII decoder strings used by this encoder.
> Msf::Encoder::PexFnstenvMov
Standard XOR dword decoder, uses the Fnstenv opcode to obtain the value of
EIP and decode the payload (a techniqued originally discovered by Sinan
Eren).
> Msf::Encoder::JmpCallAdditive
Standard XOR dword decoder, uses a forward-jump and then a call-back to
obtain the value of EIP and decode the payload. Since this is an additive
encoder, the dword value is constantly added to the previous pass after
each loop, making it slightly more annoying to decode.
> Msf::Encoder::ShikataGaNai
Spoonm's psuedo-polymorphic encoder. More random then CLET, but can still
use some improvements when it comes to byte frequency analysis (should be
improved in the msf3 tree sometime soon).
> Msf::Encoder::Alpha2
An encoder based on Skylined's alpha2 work. To make this payload 100%
alphanumeric, you must set all invalid characters in the 'BadChar' list
of your payload -AND- set GETPCTYPE=seh for it to use the alpha-only
GETPC stub.
The Metasploit Framework v3.0 Alpha Release 3 archive is online btw:
- http://metasploit.com/projects/Framework/msf3/
Still buggy, only runs on Linux/BSD/Mac OS X, but we could use some help
testing before we release alpha-r4.
-HD
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com
------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:55:42 EDT