I’ve released a bugfix for my OllyDbg plugin OllyStepNSearch.
Thanks to Ngan Truong for finding and reporting bugs in the help function. My program worked with an uninitialized pointer, shame on me.
Sunday 19 November 2006
Monday 6 November 2006
Challenger
Challenger is a small program I’ve used in reverse-engineering challenges (without success ;-)). It performs dictionary and brute-force attacks on the reverse-engineering challenge program.
The programs used in reverse-engineering challenges are usually console programs. You start the program, it asks for the password (standard output), you type the password (standard input), the program responds and ends.
Challenger automates this process: it runs the program against a list of passwords (dictionary) or it tries out all combinations (brute-force).
Challenger is also a console program taking command-line arguments.
- /executable:program is the only required argument, you use it to specify the program to be challenged
- /arguments:parameters is needed when the program to be challenged also takes command-line arguments. You cannot provide them with the /executable argument, you need to use the /arguments argument. This parameter is optional
- /log:file allows you to write all results to a file. Results are always displayed on the console, with /log:log.txt, all results are also appended to file log.txt
- /dictionary:file is used to perform a dictionary attack and specify the file containing the words to test as a password
- /bruteforce:password is used to specify the starting password of a brute-force attack. By default, Challenger will execute a brute-force attack, starting with password a.
- /characters:characters allows you to specify the characters used in a brute-force attack. By default, this is abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
- /search:keyword allows you to specify a keyword that will stop the attack. Once this keyword is detected in the output of the challenged program, Challenger will stop the attack. Searching for the keyword is case-sensitive. Challenger will go on indefinitely if no keyword is provided, it will only report each time the challenged program produces output it has not produced before. If you now what the challenged program outputs when you provide the correct password, you use this search argument to look for it. If you don’t know it, you just let Challenger run and review its output
- /timeout:milliseconds allows you to specify the timeout for the challenged program. By default, this is 100 ms: if the challenged program runs longer than 100 ms, Challenger will stop it.
- /heartrate:count allows you to define how often Challenger writes status info to the log. By default, it’s every 1000 passwords tested
Here is an example where I use my program on F-secure’s Khallenge level 1 program with a tiny wordlist from Openwall. Since I don’t know the output produced by the program when a correct password is entered, I don’t use the search argument: challenger /executable:level1.exe /dictionary:lower.lst /log:log.txt
Here is the result:
Start > 2/11/2006 21:49:45
Start > Challenger v1.0.0.0 (https://DidierStevens.com) Config > dictionary Config > file: lower.lst Config > executable: level1.exe Config > arguments: Config > timeout: 100 Config > heartbeat: 1000 Config > search: not enabled Config > log: log.txt New output> a -> ASSEMBLY'06 REVERSE ENGINEERING CHALLENGE
*** LEVEL 1 *** Challenge Copyright (c) 2006 F-Secure Corporation
For more information, please see http://www.f-secure.com/weblog/asm.htm
Enter the password:
Try another one.
Heartbeat > 2/11/2006 21:49:58 counter: 1000 password: anonymity Heartbeat > 2/11/2006 21:50:11 counter: 2000 password: barge Heartbeat > 2/11/2006 21:50:23 counter: 3000 password: brass Heartbeat > 2/11/2006 21:50:34 counter: 4000 password: cement Heartbeat > 2/11/2006 21:50:45 counter: 5000 password: compendia Heartbeat > 2/11/2006 21:50:57 counter: 6000 password: cuisine Heartbeat > 2/11/2006 21:51:10 counter: 7000 password: disavow Heartbeat > 2/11/2006 21:51:21 counter: 8000 password: emergency Heartbeat > 2/11/2006 21:51:34 counter: 9000 password: feeble Heartbeat > 2/11/2006 21:51:45 counter: 10000 password: g Heartbeat > 2/11/2006 21:51:58 counter: 11000 password: handbarrow Heartbeat > 2/11/2006 21:52:11 counter: 12000 password: identical Heartbeat > 2/11/2006 21:52:23 counter: 13000 password: ion Heartbeat > 2/11/2006 21:52:35 counter: 14000 password: lev Heartbeat > 2/11/2006 21:52:47 counter: 15000 password: meatball Heartbeat > 2/11/2006 21:53:00 counter: 16000 password: naivete New output> obvious -> ASSEMBLY'06 REVERSE ENGINEERING CHALLENGE
*** LEVEL 1 *** Challenge Copyright (c) 2006 F-Secure Corporation
For more information, please see http://www.f-secure.com/weblog/asm.htm
Enter the password:
Yup, thats it!
To continue, send an email to: level1-solution_was_obvious@khallenge.com
Heartbeat > 2/11/2006 21:53:13 counter: 17000 password: orthograph Heartbeat > 2/11/2006 21:53:26 counter: 18000 password: pestle Heartbeat > 2/11/2006 21:53:39 counter: 19000 password: presume Heartbeat > 2/11/2006 21:53:51 counter: 20000 password: recount Heartbeat > 2/11/2006 21:54:04 counter: 21000 password: sandy Heartbeat > 2/11/2006 21:54:16 counter: 22000 password: sis Heartbeat > 2/11/2006 21:54:29 counter: 23000 password: stomp Heartbeat > 2/11/2006 21:54:42 counter: 24000 password: tenor Heartbeat > 2/11/2006 21:54:54 counter: 25000 password: tunisia Heartbeat > 2/11/2006 21:55:07 counter: 26000 password: venerate Heartbeat > 2/11/2006 21:55:19 counter: 27000 password: withhold
For the first password (a), the challenge program outputs “Try another one.”. The challenge program outputs this for every password in the list, until the password “obvious” is tested. When obvious is entered as the password, the output of the challenge program is “Yup, thats it!”, allong with the e-mail address. Since no /search argument was provided, the Challenger program continues until the wordlist is exhausted.
The “New output>” line lists the exact output produced by the tested program, except that all newlines are replaced by a space character to make it fit on one line (for clarity, I’ve added the newlines back in this example).
Had I known that the level 1 program outputed “Yup, thats it!” when the correct password is entered, I could have issued this command: challenger /executable:level1.exe /dictionary:lower.lst /log:log.txt /search:Yup
And the program would stop once the correct password was found:
Found > counter: 16663 password: obvious ASSEMBLY’06 REVERSE …
It’s also possible to start a brute-force attack, like this: challenger /executable:level1.exe
This will start with password ‘a’ and try all alphanumeric combinations.
During the reversing of the level 3 challenge of F-Secure’s Khallenge, I discovered that only characters 2, 4, 6 and 8 were used in the password. So I used my Challenger program to try all combinations, while I continued reversing:
challenger /executable:level3.exe /bruteforce:2 /characters:2468 /log:log.txt
Output:
Start > 2/11/2006 22:09:25 Start > Challenger v1.0.0.0 (https://DidierStevens.com) Config > brute force Config > start: 2 Config > characters: 2468 Config > executable: level3.exe Config > arguments: Config > timeout: 100 Config > heartbeat: 1000 Config > search: not enabled Config > log: log2.txt New output> 2 -> ASSEMBLY'06 REVERSE ENGINEERING CHALLENGE
*** LEVEL 3 *** Challenge
Copyright (c) 2006 F-Secure Corporation
For more information, please see http://www.f-secure.com/weblog/asm.htm
Enter password:
Nope. Heartbeat > 2/11/2006 22:09:40 counter: 1000 password: 66428 Heartbeat > 2/11/2006 22:09:53 counter: 2000 password: 264868 Heartbeat > 2/11/2006 22:10:06 counter: 3000 password: 464628 Heartbeat > 2/11/2006 22:10:20 counter: 4000 password: 664268 Heartbeat > 2/11/2006 22:10:34 counter: 5000 password: 862828 Heartbeat > 2/11/2006 22:10:48 counter: 6000 password: 2262468 Heartbeat > 2/11/2006 22:11:02 counter: 7000 password: 2462228
...
But I found the correct password through reversing before my Challenger program found it with brute-force: the password was so long that my program would take too long…
Challenger is written in C# with Microsoft Visual C# 2005 Express Edition.
Download:
MD5: FC71CAA3F99CB6EE9094098D60B7E4C3
Monday 16 October 2006
USBVirusScan
When Bruce Scheiner blogged about USBDumper, I downloaded the program and filed it for some later experimentation.
During our vacation I started programming on a rainy evening, and USBVirusScan was born.
USBVirusScan will launch any program you provide as a command line parameter each time a USB stick is inserted. I use it to start a full virus scan on the inserted USB drive, hence the name.
For example, to start a cmd.exe on each USB drive you insert, you start USBVirusScan like this:
USBVirusScan cmd /k %c:
%c is a placeholder for the drive-letter of the inserted USB drive (yes, that’s %c like C’s printf function, and no, that’s not completely secure, but feel free to adapt it…).
USBVirusScan uses a system tray icon and balloons to announce the insertion of a USB drive. If you want to hide this system tray icon, start USBVirusScan with option -i, like this:
USBVirusScan -i cmd /k %c:
You can also hide the command line console with option -c. This only works with Console applications, not with Windows applications.
Here’s a Windows Script example (log.vbs) that will create a log.txt file on the inserted USB drive with the current date & time:
Dim objFSO Dim objTextFile Dim strFilename
strFilename = Wscript.Arguments.Item(0) & ":\\log.txt"
Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FileExists(strFilename) Then
Set objTextFile = objFSO.OpenTextFile(strFilename, 8 )
Else
Set objTextFile = objFSO.CreateTextFile(strFilename)
End If
objTextFile.WriteLine Now()
objTextFile.Close
You start it with this command: USBVirusScan.exe wscript log.vbs %c
Example of the content of the log file after inserting the USB drive twice:
14/10/2006 17:05:00 14/10/2006 17:05:21
I used sample code for system tray programming from this Code Project article, and for the rest I generate a new GUID and did some cosmetic changes to the original USBDumper code.
Here is a YouTube movie showing you the program starting a virus scan. A hires (XviD) version can be found here.
Download:
USBVirusScan_V1_0_0.zip (https)
MD5: 7EC0D456717162B84A229CC4A8335B51
This ZIP file contains both the executable and the source code. If you don’t plan to modify the source code of this program, you’ll only need to extract USBVirusScan.exe.
Compiled with Borland’s free C++ 5.5 compiler. Tested on Windows XP SP2 and Windows Vista.
Thursday 14 September 2006
UserAssist on Windows Vista
Microsoft mailed me Windows Vista Build 5472 (that’s the Black Hat Vista).
The VMware installation went smoothly once I figured out I had to add these lines to the VMX config file:
svga.maxWidth = "640" svga.maxHeight = "480"
The UserAssist registry keys still exists and the format hasn’t changed, my UserAssist utility works without problem:
Only the icon will require some rework:
Didier Stevens 