OWASP Code Sprint 2017

[Pratik Patel]

Hi all,

Creating this post to track OWASP Code Sprint tasks.

Regards,
Pratik

[Ali Razmjoo]

Hello Nikhil,

2 tasks are in priority

1) Encoding for macOS shellcodes

2) Start working on windows shellcode by beginning with trying to make to get command execution.

Please start the first one, MacOS shellcodes already exists and you can look up the samples for linux x86 encoders in here https://github.com/zscproject/OWASP-ZSC/tree/master/lib/encoder/linux_x86

more information:

in this file, line 14 will be replaced with "ebx" values generated in line 35, these values must be encode.

the other values need to encode are line 24,25 and 27,28 

let me know if you need any help or more information. 

Sincerely yours,

Ali Razmjoo

Iran Chapter Leader

OWASP ZSC Project Leader

[Pratik Patel]

Hi,

Sorry guys lately I got busy with my job. Nikhil, can you update on the tasks that you are working on? Please let us know if you need any help.

Regards,

Pratik

[Ali Razmjoo]

Hello Nikhil, Please report details about the following the tasks. Thanks.

[Nikhil R]

Hi Mr. Pratik and Mr. Ali,

I first apologise for the slow start. 

As I mentioned before, I started working on encoding for macOS shellcodes. I started with doing the "add_random". However, I wasn't able to understand the shell code properly so I started reading the Shellcoders handbook to make sense of it which is why it's taking so long. I don't understand why the particular values have to be encoded and not others. At present I am reading that book and trying to draw parallels between the linux version of shell code and osx using which i am trying to write the encode module for OS X_x86

[Nikhil R]

Hi,

Update: So, I understood what's happening in the shellcode now and why certain values have to be encoded. Basically the values where you pass syscall numbers to eax( %al)

I finished writing add_random encode for the 'exec' job. You can check it here[1]. I reused a lot of code from the linux encodings. I think I am understanding what's happening on the inside compared to like 10 hours ago and going by the same rate I hope I can catch up on the left out tasks as fast as possible. 

I am currently working on add the rest of the jobs to the add_random shellcode and then moving onto others. 

[1]https://github.com/rnikhil275/OWASP-ZSC/blob/code_sprint_dev/lib/encoder/osx_x86/add_random.py

[Ali Razmjoo]

Hi Nikhil, let me check it. please continue your tasks, keep it up.

--
You received this message because you are subscribed to the Google Groups "OWASP ZSC" group.
To unsubscribe from this group and stop receiving emails from it, send an email to owasp-zsc+unsubscribe@googlegroups.com.
To post to this group, send email to owas...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/owasp-zsc/ac10b5a0-19dd-470f-a318-31953f40670b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Ali Razmjoo]

for the record, code sprint commits are available in here

 

Sincerely yours,

Ali Razmjoo

Iran Chapter Leader

OWASP ZSC Project Leader

[Ali Razmjoo]

first code sprint commits which merged.

https://github.com/zscproject/OWASP-ZSC/pull/120

Sincerely yours,

Ali Razmjoo

Iran Chapter Leader

OWASP ZSC Project Leader

[Nikhil R]

Hi,

You had asked me for the mid-term report. I had sent the pull request and here is small outline of the ongoing work. 

Here are the tasks finished till midterm. 

1) Rot13 obfuscation for javascript, python, php, ruby and perl

2) MacOS x_86 shellcode encoding - > add/dec random/your value, inc/sub random/yourvalue, xor random/yourvalue

3) Winexec shellcode in intel assembly and a partial opcoder

To be done from mid-term to the end

1) Once winexec assembly is successfully ported, port the remaining shellcode to at&t which is written in intel assemly

2) Add encoders for the same shellcode

3) Based on time left work on control flow flattening technique implementing chenzi wang algo. 

Regards,

Nikhil.R

[Ali Razmjoo]

thanks nikhil, I'm checking out