OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Topic created on: December 24, 2008 12:14 CST by gecko45 .

I recently obtained two botnet clients on my honeypot, and am trying to look at them with OllyDBG and IDAPro to determine exactly their capabilities. I already know what IRC channel they connect to, which port they use, and what channel they join. I would like to determine (through RCE) what their capabilities are. I noticed that there is an encrypted/encoded segment called .tr1p0d, which I believe holds the data that I want to look at. My question is, can I use something like OllyDump to decrypt/decode the segment and take a look at what it does? I'm pretty new to RCE and looking to start off with some real world examples like these. If you're up for helping out, I can fire over a copy of the files I'm looking at, as well as the analysis I've done thus far. Thanks!

b0ne		December 24, 2008 14:08.04 CST
Look for calls to network related APIs like recv() and send(). The buffers that are passed to these functions most likely contain commands (possibly encrypted) and responses. Typically after a buffer is received, some operations will be performed on the buffer to decrypt or process the information contained within. (often switch statements on integer command keys and/or if/elseif strcmp() equivalents) The other angle you could go after is looking at the APIs it calls and try to trace them back to the recv() calls.

bunn		December 26, 2008 00:29.15 CST
You could upload the binaries to http://www.offensivecomputing.net/. People there would probably be interested in helping reverse the bot code, I'll help if you want. You should read some basic papers about packers and how they work if you want to decrypt this segment. The easy way would be to use Commview or wireshark. If you just want to find who is responsible for the botnet or how to shut it down, packet sniffers are good enough in many cases.

gecko45		December 28, 2008 14:51.08 CST
Thanks for the feedback. I have already run the files through Anubis, CWSandbox, Norman, and through a VM running filemon, regmon, process explorer, ollydbg, wireshark. So, in short, I know what they modify in the filesystem, where they connect, and what channels they join. The next step is to figure out their capabilities once they have joined the C&C channel. b0ne suggested that I look at recv() and send() API calls. I was thinking I would have to decode the encoded segment in order to even see those API calls, unless you are talking about running it through a debugger and watching for calls to send() and recv(). IF that's what you meant, could you elaborate a bit on what tools to use and how to get at those API calls? Thanks!

b0ne		December 29, 2008 11:46.11 CST
1) Determine if the binary is packed. If it is, you have to unpack and reconstruct it. (using unpacking tools, using a debugger, etc) 2) Once unpacked, look at the strings as they usually give away much of the functionality without having to do a lot of research. (possibly bot command strings...) 3) Use IDA or Ollydbg to hunt down the recv/send calls and see what data is delivered and received. In IDA, you would look at the imports tab, and check cross references, in Olly you can search for references to an API or more simply just set a breakpoint on those APIs and run it in a virtualized environment.

neoxfx		December 29, 2008 12:37.36 CST
Try dumping the process memory when it is running. there is a good chance that, the packed segment you are looking might well get decompressed/decoded (unless it re-encodes as it the case of advanced packers). It makes me believe that it is one of those less advanced (probably custom lame obfuscated sample, Since you could run it in VM with all the tools along without any trouble). share the sample, let me take a look.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit