Malicious Code

Replies are listed 'Best First'.
Re: Malicious Code by cog (Parson) on Apr 19, 2005 at 09:24 UTC
Interesting... if it weren't for the fact that it is old news!!! I used that very same code last year in both Belfast and London, in my Perl Black Magic talk. And IIRC, that code was already old news when I used it.	[reply]
Re: Malicious Code by zentara (Cardinal) on Apr 19, 2005 at 21:03 UTC
You might find this instructive, it was a comment by John Krahn, about this obfu. # krahn # Just change the "s;;$_;see" at the end to "print" to # see the command as it really is perl -le '$??s:;s:s;;$?::s;;=]=>%-{<-\|}<&\|`{;;y; -/:-@[-`{-};`-{/" -;; +print' [download] I'm not really a human, but I play one on earth. flash japh	[reply] [d/l]
Re: Malicious Code by hubb0r (Pilgrim) on Apr 23, 2005 at 05:37 UTC
Ok, so I've read the talk on obfuscation where the offending code is explained, and I do understand the basic s/// and y// parts of the code, but can someone explain how that translates into an system "rm -f /" call?? I don't see the connection, although obviously it does.	[reply]
Re^2: Malicious Code by bunnyman (Hermit) on Apr 26, 2005 at 21:15 UTC
The key is the y///. The code simplifies into this: $_ = '=]=>%-{<-\|}<&\|`{'; y/ -\/:-@[-`{-}/`-{~" -/; [download] The y operator is the same thing as the tr operator. The mapping looks like this: -/:-@[-` ---> `-{~ {-} ---> " - [download] That's the range of space through forward-slash, concatented with the range of colon through at-sign, and left-square-bracket through backquote, maps onto the range from ` to left-curly-bracket, plus the tilde character. If we check the ASCII character set, we can simplify this into: -/ ---> `-o :-@ ---> p-v [-` ---> w-{~ { ---> " \| ---> space } ---> - [download] So now, we can rewrite this as: $_ = '=]=>%-{<-\|}<&\|`{'; tr/!-\//a-o/; tr/:-@/p-v/; tr/[-^/w-z/; tr/`/~/; tr/{/"/; tr/\|/ /; tr/}/-/; print; [download] It's just a sneaky way to map punctuation characters into alphabet letters.	[reply] [d/l] [select]
Re: Malicious Code by BUU (Prior) on Apr 18, 2005 at 23:06 UTC
Holy cow! People can write code that deletes data! Thank you for bringing this to our attention, I never would have thought of deleting data with code!	[reply]
Re^2: Malicious Code by thor (Priest) on Apr 19, 2005 at 00:01 UTC
Don't be an ass. If the OPs post prevents one person from running obfu without understanding it, then it was worth it. thor `Feel the white light, the light within Be your own disciple, fan the sparks of will For all of us waiting, your kingdom will come`	[reply]
Re^3: Malicious Code by eric256 (Parson) on Apr 19, 2005 at 05:35 UTC
/me reads box of matches "do not light and then poke in eye"....sure glad they pointed that out. Realy I agree though. I just wish people didn't need such things pointed out. ___________ Eric Hodges	[reply]
Re^2: Malicious Code by Anonymous Monk on Apr 18, 2005 at 23:14 UTC
A real obfu would be data that deletes code!	[reply]
Re^3: Malicious Code by Fletch (Bishop) on Apr 19, 2005 at 13:38 UTC
IN SOVIET UNI . . . ah, never mind.	[reply]
Re^2: Malicious Code by jdporter (Paladin) on Apr 19, 2005 at 12:19 UTC
Yep... and I always try out mysterious obfus by running them as root. :-)	[reply]