Re: Metasploit encoding

[H D Moore <sflist () digitaloffense net>]

On Sunday 19 March 2006 06:17, Mohamed Abdel Kader wrote:
> Does anyone have some text explaining how metasploit encodes the
> exploits for the below list:

The best references are the source code and comments.

> Msf::Encoder::Countdown
A tiny encoder that will use a decrementing byte as the key - doesn't work 
well for large payloads and is more of a cool hack than anything else.

> Msf::Encoder::PexAlphaNum
An encoder based on Skylined's original work. To make this payload 100% 
alphanumeric, you must set all invalid characters in the 'BadChar' list 
of your payload -AND- set GETPCTYPE=win32 for it to use the alpha-only 
GETPC stub. The various signature-based IDS/IPS's look for the static 
ASCII decoder strings used by this encoder.

> Msf::Encoder::PexFnstenvMov
Standard XOR dword decoder, uses the Fnstenv opcode to obtain the value of 
EIP and decode the payload (a techniqued originally discovered by Sinan 
Eren).

> Msf::Encoder::JmpCallAdditive
Standard XOR dword decoder, uses a forward-jump and then a call-back to 
obtain the value of EIP and decode the payload. Since this is an additive 
encoder, the dword value is constantly added to the previous pass after 
each loop, making it slightly more annoying to decode.

> Msf::Encoder::ShikataGaNai
Spoonm's psuedo-polymorphic encoder. More random then CLET, but can still 
use some improvements when it comes to byte frequency analysis (should be 
improved in the msf3 tree sometime soon).

> Msf::Encoder::Alpha2
An encoder based on Skylined's alpha2 work. To make this payload 100% 
alphanumeric, you must set all invalid characters in the 'BadChar' list 
of your payload -AND- set GETPCTYPE=seh for it to use the alpha-only 
GETPC stub. 

The Metasploit Framework v3.0 Alpha Release 3 archive is online btw:
- http://metasploit.com/projects/Framework/msf3/

Still buggy, only runs on Linux/BSD/Mac OS X, but we could use some help 
testing before we release alpha-r4.

-HD

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
As attacks through web applications continue to rise, you need to proactively 
protect your applications from hackers. Cenzic has the most comprehensive 
solutions to meet your application security penetration testing and 
vulnerability management needs. You have an option to go with a managed 
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). 
Download FREE whitepaper on how a managed service can help you: 
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com
------------------------------------------------------------------------------