MySoftware [phpwiki]

My (Evil) Software

Some of the software I've written over the years for my... uummm... proof of concepts... <cough>

Some of this stuff is still pretty neat!

  • Lightgate: cut-and-paste miniature perl servers
  1. lightftp: lightftp is an extremely short, yet handy file transfer client
  2. lightftpd: the worlds smallest (practical) file transfer daemon EVER
  3. lightgated: Lightgated is an extremely short shell daemon
  4. lightunnel: Lightunnel is an extremely short reverse-tunnel remote access program
  5. lightunneld: Lightunneld is an extremely short tunnel daemon
  • Xexec: Parallel execution templates
Xexec is a cool little Perl utility. Xexec lets the user run a specific command/code/program using as many processes he wants to. You'll need the bundled JobControl? module to be installed first.
  • UniShare?: magic perl front-end to Unix shared memory
IPC::UniShare? is the most wicked tie voodoo perl code I've yet come across. It's a stab at transparent perl support for shared memory. UniShare? allows you to share objects, scalars, arrays, and hashes between processes through IPC shared memory with seamless transparent ease.
  • Perl ORB: transparent Object Request Broker
ORB is an object request broker for Perl, featuring support for sandbox support and encryption + authentication using SiriSSL. Tie interfaces, and other high-level interpreted features of Perl makes it possible to transparently network enable any perl code almost instantly with minimal overhead. It's really neat, try it out!
  • SiriSSL: magic perl front-end to OpenSSL
SiriSSL was developed for rapid application development of cryptographic software. SiriSSL implements a simple, clean perl interface to OpenSSL that hides all of OpenSSL's unnecessary complexity under the carpet, adhering to the perl philosophy of making simple things simple and hard things possible. SiriSSL allows you to SSL enable old perl code transparently. For the unintiated, OpenSSL is a huge encryption library covering public and symmetric cryptography, X509 certificate handling code, cryptographic hash routines, and a full implementation of SSL. It's just too bad it's so difficult to use.
  • Libasm: nice shellcode with simple bufferoverflow API
Have you ever noticed how overflow exploits re-implement the same old bufferoverflow code over and over again, and pretty badly too? Libasm implements a bufferoverflow assembly library with a simple API, for rapid exploit development. Includes well documented quality assembler shellcode.
  • SSH ESP: SSH over raw IP packets (ICMP/UDP)
SSH_ESP a hacked version of SSH that establishes an SSH session over raw ICMP, UDP or TCP packets. SSH_ESP implements a TCP like (including error and flow control) transfer protocol on top of whatever IP protocols (TCP, UDP, ICMP) are available. SSH_ESP allows it's user to tunnel through many firewalls, and does not register with the kernel as a network connection (which means it's connections won't show under netstat, making the sessions more difficult to detect).
  • BASS v1.0 (1998): Bulk Auditing Security Scanner
Security scanner I developed for the Internet Auditing Project. Scanned the entire Internet for 18 common security vulnerabilities with it. Later versions of BASS have not yet been released.
PortaTrojan is a tcpwrapper patch that turns tcpd into a drop-in backdoor that grants a rootshell to an attacker connecting from a certain arbitrary source port, regardless of the destination service. Very simple, reliable and portable on any UNIX with tcpwrappers.
  • GarbleStrings?: anti-strings preprocessor
garble-strings is an anti-strings compiler preprocessor wrapper that encrypts string literals in a compiled program or library. Scanning suspicious binary code for string literals (for example, using the UNIX program "strings") is a very common and useful forensics technique. Garble-cpp is an effective countermeasure to this technique.
  • libpcloak (1998): process stealth via direct memory manipulation
Process cloak. A direct memory manipulation technique that can conceal and protect a process, by making it:
  1. immune to signals.
  2. invisible on the process list.
  • Liraz's Linux Kernel Trojan (1998): an especially evil kernel trojan
The Linux Kernel Trojan implements kernel level stealth techniques that allows an attacker to subvert security integrity mechanisms on a penetrated host, and remain completely invisible. Features:
  1. process stealth: conceals malicious processes, files and network records.
  2. integrity subversion: subverts integrity programs (such as tripwire).
  3. self protection: hide lkt kernel module itself (including kernel symbols)
  • Portacelo (1998): real blackhat's rootkit
Portacelo is a complete, highly stealthy integrated backdoor kit for Linux featuring:
  1. LKT (see description above): stealth security countermeasures kernel module
  2. SSH ESP: A patched SSH which establishes SSH connections over a stream of raw innocent looking ICMP, UDP or TCP packets.
  3. Init trojan.
  4. Log cleaner, secure delete program, installation scripts.
  • Blackice (1997) binary forensics / reverse engineering countermeasures
BlackICE is a working implementation of research into practical reverse engineering countermeasure techniques under UNIX. BlackICE wraps a binary in an encryption + anti-debugging protection layer that makes it more difficult to disassemble or attach a process trace (strace, ltrace, gdb, etc.) to reverse engineer a protected program.
  • Rasam (1996): Remotely Activated Stealth Access Module
Originally part of Lukemia, Rasam is a stealthy backdoor that cannot be detected by portscanning, because it doesn't normally listen on any TCP or UDP ports. Instead, RASAM listens for certain magic ICMP packets that trigger the backdoor into binding a rootshell to any arbitrary TCP port selected by the attacker's ICMP activation client.
  • Lukemia (1996): POC advanced networm worm.
"Practicly speaking, Lukemia uses a combination of methodical network intelligence techniques, with an updated version of an internal OS binary exploit library, to seed itself into as many affiliated hosts as possible. It's operation is not haist, but patient, careful, almost paranoid. Every seed will quitely learn it's enviorment, identifying potentaily favourable and unfavourable OS flavours in it's neighberhood as well as other members of 'Lukemia' (So not to re-seed a seeded OS), in attempt minimize it's network presence as much as possible."
  • Bindscan (1996) a simple BIND vulnerability scanner, the last single purpose scanner written before BASS.

Browse the archive