Permutation Oriented Programming

["Nelson Brito" <nbrito () sekure org>]

<++BOF>

-=[ Introduction
Many works have been done regarding evasion techniques against Intrusion Detection System (IDS) and Intrusion 
Prevention System (IPS), but most of them are related to:
 - Packet fragmentation [1]
 - Stream segmentation [1]
 - Byte and traffic insertion [1]
 - Polymorphic shellcode [2]
 - Denial-of-Service [1]
 - URL obfuscation (+ SSL encryption) [3]
 - RPC fragmentation [4]
 - HTML obfuscation [5] and JavaScript obfuscation [6]
 - Etc...

Permutation Oriented Programming (formerly known as Exploit Next Generation) introduces a different and powerful 
approach, which can be applied to almost all vulnerability, which targets the vulnerability trigger - so far none, or 
just few, research has been conducted addressing the vulnerability trigger.

-=[ Approach
To circumvent or avoid a pattern-matching detection approach, there are two options:
 1. Easier (or Harder): know how the vulnerability is detected (access to signature/vaccine [7]).
 2. Harder (or Easier): know deeply how to trigger the vulnerability and how to exploit it (access to vulnerable 
ecosystem).

-=[ Technique
Permutation Oriented Programming (also known as POP) is neither a new technique to obfuscate code nor a new technique 
to polymorphic shellcode, instead, it is a brand-new technique intended to change the behavior of exploit developers, 
and it provides a specific set of procedures for offering set based permutation of key aspects of an exploit to bypass, 
or perform quality assurance, ineffective IDS and IPS technologies:
 - Pattern-matching signatures
 - Stateful Packet Inspection
 - Deep Packet Inspection

POP (pronounced /pŏp/) technique works by deep analysis of a vulnerability and using all the acquired knowledge of this 
analysis to offer a variety of decision points targeting the actual triggering of the vulnerability (i.e., brand-new 
variants), rather than the shellcode that executes after the vulnerability.

For POP technique to be effective, it requires exploit developers, as well as IDS and IPS developers, to determine 
additional paths to execution beyond those that are available in a standard exploit, or even in a standard 
proof-of-concept codes, including commercial automated penetration-test tools.

For POP technique to be effectively stopped, it requires that IDS and IPS developers understand the traits of the 
vulnerability equally well, and can detect multiple paths of execution. In essence, it shows the frailty of signature 
based IDS and IPS solutions. If they are simply based on pattern-matching signatures, they will not match the pattern 
after permutation, because they are skipping paths to execution and their signatures will fail on the permutation. Only 
IDS and IPS solutions that are robust will catch all of the permutation.

-=[ Last words
I have decided to change the name of this technique, because hackers and researchers have repulsion of the term "Next 
Generation"... Anyways, the technique is still the same and still is oriented to programming and knowledge.

The files, including PH-Neutral 0x7db [8] slide-deck and examples, are available at:
 - http://code.google.com/p/permutation-oriented-programming/

-=[ References & Credits
[1] "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection" by Thomas H. Ptacek and Timothy N. 
Newsham
      http://insecure.org/stf/secnet_ids/secnet_ids.html
[2] "DefCon 9: ADMmutate Polymorphic Shellcode API" by K2
      http://www.youtube.com/watch?v=Oc-MyOXbYH0
[3] "A look at whisker's anti-IDS tactics" by Rain Forest Puppy
      http://www.ussrback.com/docs/papers/IDS/whiskerids.html
[4] "Black Hat USA: IPS Shortcomings" by Renaud Bidou
      http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Bidou.pdf
[5] "HTML obfuscation tool" by isnoop.net
      http://isnoop.net/tools/obfuscate.php
[6] "Online JavaScript Obfuscator" by Daft Logic
      http://www.daftlogic.com/projects-online-javascript-obfuscator.htm
[7] "Black Hat USA: A Simpler Way of Finding 0day" by Robert Graham and David Maynor
      https://www.blackhat.com/presentations/bh-usa-07/Maynor_and_Graham/Whitepaper/bh-usa-07-maynor_and_graham-WP.pdf
[8] PH-Neutral 0x7db by Phenoelit
      http://ph-neutral.org/
     http://www.youtube.com/watch?v=IZYQILfxHiw

<--EOF>

Best regards.

Nelson Brito
"Intellectus excedit, praestat tacere."
--
http://about.me/nbrito
8BD6 8CAD 41B7 19C5 EC04 C66D 70ED 23E4 E5AB 95EB

/* CIDR Calculator C Algorithm */
netmask   = ~(0xffffffff >> cidr);
hostid    = (1 << (32 - cidr)) - 2;
_1st_addr = (ntohl(addr) & netmask) + 1;