Saturday, April 17, 2010

Changing filenames to lowercase/capital

Changing to ALL lowercase

Say we have tonnes of AVI files:

 for i in *.avi; do mv $i `echo $i |tr [A-Z] [a-z]`;done

Another way around, changing from mixed to CAPITAL

 for i in *.avi; do mv $i `echo $i |tr [a-z] [A-Z]`;done
I bought this book, Hacking Exposed: Malware & Rootkits several months back, while it is still new! A good read and really worth for your money. It keeps you update with current stuffs and first of its kind within Hacking Exposed series. Perhaps more to come in the same title in future!

If you comfortable shopping online, just visit Amazon and get the latest copy here HACKING EXPOSED MALWARE AND ROOTKITS

sctest, tool in libemu



I recently just tested out sctest, a tool to process shellcode provided in libemu.

The usage is as follows:



 

sctest -gS -s 10000 -v -G test.dot 





Basically there are several steps prior to that (which I need a friend to help me out!).

Say, I have a file called hexdump.txt;



Try with 10, 000 steps:

$ sctest -Ss 10000 -g < hexdump.txt

verbose = 0 success 

offset = 0x00000005  

stepcount 10000 




Try with 100, 000 steps we got this:

 

$ sctest -Ss 100000 -gv < hexdump.txt


 


verbose = 1 success 

offset = 0x00000005 

stepcount 100000




HMODULE LoadLibraryA ( LPCTSTR lpFileName = 0x0012fe80 => = "ws2_32"; ) = 0x71a10000; int WSAStartup ( WORD wVersionRequested = 2; LPWSADATA lpWSAData = 1244276; ) = 0; SOCKET WSASocket ( int af = 2; int type = 1; int protocol = 0; LPWSAPROTOCOL_INFO lpProtocolInfo = 0; GROUP g = 0; DWORD dwFlags = 0; ) = 66; int bind ( SOCKET s = 66; struct sockaddr_in * name = 0x0012fe6c => struct = { short sin_family = 2; unsigned short sin_port = 23569 (port=4444); struct in_addr sin_addr = { unsigned long s_addr = 0 (host=0.0.0.0); }; char sin_zero = " "; }; int namelen = 16; ) = 0; int listen ( SOCKET s = 66; int backlog = 2; ) = 0; SOCKET accept ( SOCKET s = 66; struct sockaddr * addr = 0x0012fe4c => struct = { }; int addrlen = 0x0012fe50 => none; ) = 68; int closesocket ( SOCKET s = 66; ) = 0;


Now, let us create a flow graph. We will add -G flag this time. 



$ sctest -Ss 100000 -gvG bla.dot






You will get a file, bla.dot ... and by using Graphviz package later you just choose whether to use fdp, circo, neato to create your flow graph. Say, I am comfortable with dot. Remember, since we may create a lot of flow lines, include splines=true in your dot file.

I got a graph as above.






Friday, April 16, 2010

Marking Nepenthes' log with GeoIP

I always wanted to let my Nepenthes log meaningful, rather than cryptic columns which is pretty much boring.

So this is what I did after several searches on the Net... some of the link just show the result, and I wonder why don't they just *put* the script online. Here goes!


Let say, I am processing /var/log/nepenthes/logged_downloads

116.7.16.130 df51e3310ef609e908a6b487a28ac068
116.80.225.172 1d419d615dbe5a238bbaa569b3829a23
116.80.227.106 e269d0462eb2b0b70d5e64dcd7c676cd
116.80.81.221 98eb0fdadf8a403c013a8b1882ec986d
116.80.85.224 e269d0462eb2b0b70d5e64dcd7c676cd
116.81.88.146 2fa0e36b36382b74e6e6a437ad664a80


I want it to be:

Russian Federation ,95.28.56.118 , 7d99b0e9108065ad5700a899a1fe3441
Russian Federation ,95.28.63.209 , 7d99b0e9108065ad5700a899a1fe3441

Russian Federation ,95.28.71.57 , 7d99b0e9108065ad5700a899a1fe3441

Russian Federation ,95.28.82.129 , 7d99b0e9108065ad5700a899a1fe3441

Russian Federation ,95.28.89.135 , 7d99b0e9108065ad5700a899a1fe3441

Russian Federation ,95.29.28.40 , 7d99b0e9108065ad5700a899a1fe3441

United States ,98.101.106.156 , 7d99b0e9108065ad5700a899a1fe3441


If I just invoked "geoip" tool from the BASH command line, it's going to be:

for ip in `awk {'print $1'} hcountry.txt`; do echo "$ip" `geoiplookup $ip|awk
-F "GeoIP Country Edition" {'print $2'}`; done

This, however only like this:

114.136.161.59 : TW, Taiwan
114.136.83.68 : TW, Taiwan
114.137.222.91 : TW, Taiwan
114.43.232.67 : TW, Taiwan
115.171.144.48 : CN, China
115.177.145.254 : JP, Japan
116.10.232.29 : CN, China
116.11.39.46 : CN, China
116.1.222.156 : CN, China
116.19.174.223 : CN, China
116.206.128.101 : MY, Malaysia
116.206.147.239 : MY, Malaysia
116.226.37.237 : CN, China
116.227.187.234 : CN, China

without the hash.

I solve the problem by using Python language.. it worked, despite my minimal knowledge in Python.. also some clue from a friend :)

import re
import sys

import GeoIP

GEOIP_DATABASE='/usr/share/GeoIP/GeoIP.dat'

geoip=GeoIP.open(GEOIP_DATABASE,GeoIP.GEOIP_STANDARD)

for line in open("chcountry.txt"):

columns = line.split(',')

negara=geoip.country_name_by_addr(columns[0])

x=columns[1].strip("\n")

print columns[0],(','),negara,(','),x



Also, if you simply want to use geoiplookup from CLI directly, I asked a friend who gave me a solution here (final one)

awk '{ ("geoiplookup " $1) | getline d; split(d, data, ":"); print data[2]
";" $1 ";" $2; close ("geoiplookup "$1); }' hcountry.txt