Re: Linux Kernel Exploits / ABFrag

[h2g.sec.list () zipmail com br]

Curt,
to unwrap burneye binaries you need know the binary password... to unwrap
you can use UNFburninhell made by [ByteRage] (thanks to him).
ABfrag is FAKE, so, you don't need audit that binary.
Regards...
Nilton Gomes


-- Mensagem original --

> In-Reply-To: <20021018184346.B44C5425C () sitemail everyone net>
>
>
> > I smell Burneye !! ..... what do you guys think ?
>
> If you download the ABfrag file from
> http://www.linuxsecurity.com/articles/intrusion_detection_article-
> 5933.html, and view or run strings on the file, you will see the burneye
>
> signature in the file header:
>
> TEEE burneye - TESO ELF Encryption Engine
>
> I'm wondering if there is any way to determine the burneye options used
by
> analyzing the encrypted file? I doubt it, but does anyone have any
> experience with this?
>
> Looks like we need to get brute forcing that password (could be nearly

> impossible), or perhaps find a good reverse engineer. I recall reading

> material by Dave Dittrich about trying to reverse engineer the x2 SSH
> exploit that had been protected with burneye. I also came across an
> article somewhere, perhaps on the teso website, that talked about the
> sorry state of the "white hat" reverse engineers. Personally, I could not
>
> reverse engineer myself out of a wet paper bag.
>
> I'm very curious to learn more about this exploit, and would enjoy seeing
>
> the IDS activity discussed in the first message in this thread. Do we have
>
> enough to make a snort signature? Did you get an image of the systems
> memory at the time of the exploit? Perhaps there is a snowballs chance
in
> hell that the password used to run the executable could be recovered.
>
>
> Curt Wilson
> Netw3 Security
> www.netw3.com
>
>
> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com



------------------------------------------
Use o melhor sistema de busca da Internet
Radar UOL - http://www.radaruol.com.br




----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com