|
Writing anti-IDS Shellcode |
|
|
|
Source: Security-Protocols - Posted by Adam Chalemian
|
In the last few weeks i had made an intensive study of Intrusion - Detection Systems like snort. I found that several ways of escaping from being detected while checking for vulnerable CGI's were already made by RFP (rfp@wiretrip.net). Also many . . .
In the last few weeks i had made an intensive study of Intrusion - Detection Systems like snort. I found that several ways of escaping from being detected while checking for vulnerable CGI's were already made by RFP (rfp@wiretrip.net). Also many other common intrusion tactics like port-scanning was also escaped by using stealth-scanners like nmap. But I noticed that the IDS had also checked for a person trying to remotely buffer overflow a daemon. When I searched through the net for anti-IDS tactics for escaping form being tracked, I found none. So i decided to do a bit of thinking :). IDS detect a cracker trying to smash the stack by analyzing the network trafic, and if they find a 0x90 (NOP), they report to the logs as penetration with the packet's details. The main problem here is the presence of NOP's in the shellcode. Exploits usually pad the stack with NOP's so that the return address dosent have to be exact. It is this NOP which is the problem. The main shellcode (which probably start execve or append a line to passwd) need not be changed because it dosent contain NOP's. The problem lies here:
Read this full article at Security-Protocols
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
