Книга: Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
Назад: Lab 9-1 Solutions
Дальше: Lab 9-3 Solutions
. at ❶, and then a function call within the Lab09-02.exe malware to 0x401550. If we try to analyze this function in OllyDbg, we’ll find that it’s rather complicated. If we examine it in IDA Pro, we’ll see that it is the C runtime library function _strrchr. OllyDbg missed this due to the lack of symbol support. If we load the binary into IDA Pro, we can let IDA Pro use its FLIRT signature detection to correctly identify these APIs, as shown as shown at ❷... on TCP port 9999. If the connection succeeds, the malware will continue executing until 0x40137A. If it fails, the malware will sleep for 30 seconds, go back to the beginning of the main function, and repeat the process again. We can use Netcat and ApateDNS to fool the malware into connecting back to an IP we control.If we step-into the function call made at 0x4013a9 (step-into 0x401000), we see two function calls to 0x4013E0. Again, this is another example where OllyDbg does not identify a system call of memset, whereas IDA Pro does identify the function. Next, we see a call to CreateProcessA at 0x40106E, as shown in . Before the call, some structure is being populated. We’ll turn to IDA Pro to shed some light on what’s going on here.
shows this method of reverse shell creation in action., we will cover data-encoding techniques like this in more detail.
Назад: Lab 9-1 Solutions
Дальше: Lab 9-3 Solutions
Войти в систему
Войти с помощью соц. сетей:
_strrchr. OllyDbg missed this due to the lack of symbol support. If we load the binary into IDA Pro, we can let IDA Pro use its FLIRT signature detection to correctly identify these APIs, as shown as shown at ❷..
. shows this method of reverse shell creation in action.
on TCP port 9999. If the connection succeeds, the malware will continue executing until 0x40137A. If it fails, the malware will sleep for 30 seconds, go back to the beginning of the
main function, and repeat the process again. We can use Netcat and ApateDNS to fool the malware into connecting back to an IP we control.If we step-into the function call made at 0x4013a9 (step-into 0x401000), we see two function calls to 0x4013E0. Again, this is another example where OllyDbg does not identify a system call of memset, whereas IDA Pro does identify the function. Next, we see a call to CreateProcessA at 0x40106E, as shown in . Before the call, some structure is being populated. We’ll turn to IDA Pro to shed some light on what’s going on here.
shows this method of reverse shell creation in action., we will cover data-encoding techniques like this in more detail.
Назад: Lab 9-1 Solutions
Дальше: Lab 9-3 Solutions
Войти в систему
Войти с помощью соц. сетей: