HackerTrans
トップ新着トレンドコメント過去質問紹介求人

evandrix

no profile record

投稿

New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer

unit42.paloaltonetworks.com
1 ポイント·投稿者 evandrix·11 か月前·0 コメント

コメント

evandrix
·12 年前·議論
Ah! that explains so much (and also why i've wasted a whole hour figuring out why what I observed was happening) I'm a CLI curl guy, rather than relying on these browsers which randomly would add a 0x0d 0x0a to my form submissions, for example. I also noticed that compiling (assembling-linking) the .S to execute it would not print anything (just hang there like a normal webserver), but I was getting stuff written to stdout with the final.c/webserver.c version using its shellcode.
evandrix
·12 年前·議論
ok, now it compiles, thanks for that. However, I'm getting an incomplete response "<h1>hello world</h1" without the trailing closing angled bracket. And when I try to run final.c after setting the FUNCTION_ADDR and ADDR as per your tutorial, I get some stray HTTP/1.0 200 and Content-type text/html being displayed on stdout as I start the program final.c (compiled to a.out by default)
evandrix
·12 年前·議論
Yes, segfault for me too after i changed ADDR preprocessor directive to the VMA address from objdump, as the instruction says. I'm on Ubuntu Linux 13.10 x64.