HackerTrans
TopNewTrendsCommentsPastAskShowJobs

evandrix

no profile record

Submissions

New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer

unit42.paloaltonetworks.com
1 points·by evandrix·11 maanden geleden·0 comments

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

unit42.paloaltonetworks.com
4 points·by evandrix·vorig jaar·0 comments

comments

evandrix
·12 jaar geleden·discuss
Ah! that explains so much (and also why i've wasted a whole hour figuring out why what I observed was happening) I'm a CLI curl guy, rather than relying on these browsers which randomly would add a 0x0d 0x0a to my form submissions, for example. I also noticed that compiling (assembling-linking) the .S to execute it would not print anything (just hang there like a normal webserver), but I was getting stuff written to stdout with the final.c/webserver.c version using its shellcode.
evandrix
·12 jaar geleden·discuss
ok, now it compiles, thanks for that. However, I'm getting an incomplete response "<h1>hello world</h1" without the trailing closing angled bracket. And when I try to run final.c after setting the FUNCTION_ADDR and ADDR as per your tutorial, I get some stray HTTP/1.0 200 and Content-type text/html being displayed on stdout as I start the program final.c (compiled to a.out by default)
evandrix
·12 jaar geleden·discuss
Yes, segfault for me too after i changed ADDR preprocessor directive to the VMA address from objdump, as the instruction says. I'm on Ubuntu Linux 13.10 x64.