search

BenChaliah / MIPS-CVE-2014-9222

Lets have fun by digging into a Zyxel router firmware and MIPS Arch
5 stars 1 forks source link

mateeeeeeeee where is the part twooooooo ? #1

Closed minanagehsalalma closed 4 years ago

BenChaliah commented 4 years ago

I was super busy for long working on many private projects (0days), Hope u enjoyed part one, I'll publish part II in few days ;)

minanagehsalalma commented 4 years ago

I was super busy for long working on many private projects (0days), Hope u enjoyed part one, I'll publish part II in few days ;)

@BenChaliah thanks mate i really enjoyed it as it's the only one who went into details and step by step writing

i will be waiting for it :))))

hope you are doing great with life ;)

BenChaliah commented 4 years ago

Glad to hear that, just give me a couple of days, I've been working on a big project for months, I finished it so I just need to put the read of the details in Markdown format and push it, it'll be available by this weekend hopefully. I really appreciate that you like it and found it useful

On Tue, 6 Oct 2020 at 18:22, mina nageh salama notifications@github.com wrote:

I was super busy for long working on many private projects (0days), Hope u enjoyed part one, I'll publish part II in few days ;)

@BenChaliah https://github.com/BenChaliah thanks mate i really enjoyed it as it's the only one who went into details and step by step writing

i will be waiting for it :))))

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-704394008, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRFF4S2KLRYOLDXE2F3SJM73RANCNFSM4RGIP7QQ .

minanagehsalalma commented 4 years ago

I've been working on a big project for months

I wish you good luck :)

minanagehsalalma commented 4 years ago

@BenChaliah hi mate are you still working on it ?

BenChaliah commented 4 years ago

Sorry for the delay, I just got stuck in some other business, also I needed to look for the router (It been a while, but I found it), I just published a new Repo you may find it interesting https://github.com/BenChaliah/PoseidonDNS , anyway I'm working on it and I'll publish the second part ASAP. Sorry and thank you for following up ;)

On Tue, 20 Oct 2020 at 21:02, mina nageh salama notifications@github.com wrote:

@BenChaliah https://github.com/BenChaliah hi mate are you still working on it ?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-713074118, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRAJJ7Y3ZRDHPT57C7DSLXNCVANCNFSM4RGIP7QQ .

minanagehsalalma commented 4 years ago

Sorry for the delay

@BenChaliah no problem mate.

a new Repo you may find it interesting https://github.com/BenChaliah/PoseidonDNS

Great project btw and very informative too .... it's rare to find such ones like it.

I'll publish the second part ASAP.

I will be waiting :)

BenChaliah commented 4 years ago

I'm sorry for the delay I ordered a new router from the same model I'll be receiving it in the next few days, anyway meanwhile I'll be publishing other projects, if you're interested :)

On Mon, 26 Oct 2020 at 16:22, mina nageh salama notifications@github.com wrote:

Sorry for the delay

@BenChaliah https://github.com/BenChaliah no problem mate.

a new Repo you may find it interesting https://github.com/BenChaliah/PoseidonDNS

Great project btw and very informative too .... it's rare to find such ones like it.

I'll publish the second part ASAP.

I will be waiting :)

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-716619175, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRFQFROBW6EYPRZCPQ3SMWHZZANCNFSM4RGIP7QQ .

minanagehsalalma commented 4 years ago

I ordered a new router from the same model

@BenChaliah

also I needed to look for the router (It been a while, but I found it),

So what happened to the old one?

minanagehsalalma commented 3 years ago

@BenChaliah yo mate it's been a month.

minanagehsalalma commented 3 years ago

@BenChaliah are Youuuuuuu still aliveeeeeeeeeeeee?!!!!!!!!!!!

BenChaliah commented 3 years ago

I'm so sorry, I know it has been very long, there were some unforeseeable issues that occurred, and the situation with Covid only made things harder. If you would just give me couple of weeks I ensure I'll finish that repo, sorry again mate

On Fri, 1 Jan 2021 at 18:00, mina nageh salama notifications@github.com wrote:

@BenChaliah https://github.com/BenChaliah are Youuuuuuu still aliveeeeeeeeeeeee?!!!!!!!!!!!

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-753400905, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NREWFAHYZKLEESBYXSLSXZHZZANCNFSM4RGIP7QQ .

minanagehsalalma commented 3 years ago

If you would just give me couple of weeks I ensure I'll finish that repo, sorry again mate

@BenChaliah okay bro you are good.

minanagehsalalma commented 3 years ago

@BenChaliah oh looks like you got your self busy Arbitrium-RAT and totally forgot about this ;|

BenChaliah commented 3 years ago

Hhhhhhh not really I was working on Arbitrium Rat for quite awhile but didn't have the time to publish it, I wanted to get it off my schedule for few days so I can publish another project (embedded systems, broadcom SoC and firmwares) I made couple of years ago, along side the continuation of MIPS-...-cookie so don't worry I didn't forget about it :)

On Mon, Jan 18, 2021, 9:33 PM mina nageh salama notifications@github.com wrote:

@BenChaliah https://github.com/BenChaliah oh looks like you got your self busy Arbitrium-RAT https://github.com/BenChaliah/Arbitrium-RAT and totally forgot about this ;|

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-762458789, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRAVY7KTXDAJ33PGE63S2SLITANCNFSM4RGIP7QQ .

minanagehsalalma commented 3 years ago

@BenChaliah great ... i also see that the RAT gained a lot of popularity in no time ;) nice job image

BenChaliah commented 3 years ago

Thank u it was on GitHub trending page today and the 4th top python trending repo, im quite overwhelmed by the reactions

On Tue, Jan 19, 2021, 12:30 AM mina nageh salama notifications@github.com wrote:

@BenChaliah https://github.com/BenChaliah great ... i also see that the RAT gained a lot of popularity in no time ;) nice job [image: image] https://user-images.githubusercontent.com/20546638/104970943-e04e0080-59f5-11eb-9115-ef3ed99c6601.png

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-762512916, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRHXGOPGRNWD72WVVQ3S2TAC5ANCNFSM4RGIP7QQ .

minanagehsalalma commented 3 years ago

Thank u

@BenChaliah U R welcome

it was on GitHub trending page today and the 4th top python
trending repo, im quite overwhelmed by the reactions

you deserve it , it's quite well designed

BenChaliah commented 3 years ago

In few days I'll push an update to Arbitrium, I have a (in my believe) very cool project around Broadcom chipsets and firmwares, I think of publishing it next before adding part 2 to the previous repo if that's okay with you cause I told you earlier I'm gonna publish part 2 ASAP. I think you'd be even more interested in this one specially because of it wide possibilities and applications :)

On Tue, 19 Jan 2021 at 00:41, mina nageh salama notifications@github.com wrote:

Thank u

@BenChaliah https://github.com/BenChaliah U R welcome

it was on GitHub trending page today and the 4th top python trending repo, im quite overwhelmed by the reactions

you deserve it , it's quite well designed

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-762515473, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRHR3IJ4TUNOTEMXIFTS2TBJRANCNFSM4RGIP7QQ .

minanagehsalalma commented 3 years ago

have a (in my believe) very cool project around Broadcom chipsets and firmwares, I think of publishing it next before adding part 2 to the previous repo

@BenChaliah yeah that would be great.

but also there is something about that project the rat one why don't you use some kind of Cryptor to make it really FUD?

BenChaliah commented 3 years ago

the windows version is just POC for the protocol, at the end it looks like an app that sends http requests to an API, and pipes the output to a new ephemeral port each time, the content of the transfer can be encrypted using https. I'm working on a CLI to automate clients' generation and offer encoders/crypt. My focus was on Android's client and making a model that can be easily converted for other platforms so the Windows and Linux version weren't optimized as well. Android binaries (x86 and x86_64) can be used for Windows after a slight adjustment (using winsock2.h instead of sys/socket.h). The points I wanted to emphasize in this beta version is the protocol the clients use, solutions to Android customizations' restrictions and using simple common tools like netcat and piping to remotely control targets so the clients with each update won't have common signatures that would flag them to AVs

On Fri, 22 Jan 2021 at 23:56, mina nageh salama notifications@github.com wrote:

have a (in my believe) very cool project around Broadcom chipsets and firmwares, I think of publishing it next before adding part 2 to the previous repo

@BenChaliah https://github.com/BenChaliah yeah that would be great.

but also there is something about that project the rat one why don't you use some kind of Cryptor to make it really FUD?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-765732176, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRDMA2DZ7NFZQLQUKHTS3H7C3ANCNFSM4RGIP7QQ .

minanagehsalalma commented 3 years ago

the windows version is just POC for the protocol, at the end it looks like an app that sends http requests to an API

@BenChaliah this the not the point of being fud.

it still gets detected by AVs using strings check or what ever. a Cryptor is meant for the output payload file so it comes different every time and prevents the AV from being able to read it.

if it's just a poc then remove FUD cause it's misleading

BenChaliah commented 3 years ago

I agree, but since it's currently undetectable and the CLI is coming out just in few days which will deal with this issue I don't want to commit anything bcz many followers and watchers ...etc will be notified of a meaningless change in the README.

On Sat, 23 Jan 2021 at 18:04, mina nageh salama notifications@github.com wrote:

the windows version is just POC for the protocol, at the end it looks like an app that sends http requests to an API

@BenChaliah https://github.com/BenChaliah this the not the point of being fud.

it still gets detected by AVs using strings check or what ever. a Cryptor is meant for the output payload file so it comes different every time and prevents the AV from being able to read it.

if it's just a poc then remove FUD cause it's misleading

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-766141867, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRBTK6STBRTRKZ4E4XLS3L6TRANCNFSM4RGIP7QQ .

minanagehsalalma commented 3 years ago

it's currently undetectable

@BenChaliah no it's not.

etc will be notified of a meaningless change in the README.

ah what ever fits you.

BenChaliah commented 3 years ago

I scan it many times on no-distribution scanner, short of heuristic analysis by 3-4 AVs (only bcz it wrapped in Python which is the same result I get for any non malicious executable that is wrapped in an interpreter) no AV have confirmed that it's a malware. Yet thank u for letting me know I'll try to hurry up on publishing CLI

On Sat, Jan 23, 2021, 6:15 PM mina nageh salama notifications@github.com wrote:

it's currently undetectable

@BenChaliah https://github.com/BenChaliah no it's not.

etc will be notified of a meaningless change in the README.

ah what ever fits you.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-766143587, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRE2VKVSTW7KM575FZ3S3L73RANCNFSM4RGIP7QQ .

minanagehsalalma commented 3 years ago

I scan it many times on no-distribution scanner, short of heuristic analysis by 3-4 AVs (only bcz it wrapped in Python which is the same result I get for any non malicious executable that is wrapped in an interpreter) no AV have confirmed that it's a malware.

@BenChaliah it's already there on VT and detected by 46 engine !

https://www.virustotal.com/gui/file/5cf784da346a55c15259f755ffc19790a90cd616449a47bb9617cf93bfe91441/detection

BenChaliah commented 3 years ago

damn it, Thank you for notifying me

On Sat, 23 Jan 2021 at 18:23, mina nageh salama notifications@github.com wrote:

I scan it many times on no-distribution scanner, short of heuristic analysis by 3-4 AVs (only bcz it wrapped in Python which is the same result I get for any non malicious executable that is wrapped in an interpreter) no AV have confirmed that it's a malware.

@BenChaliah https://github.com/BenChaliah it's already there on VT and detected by 46 engine !

https://www.virustotal.com/gui/file/5cf784da346a55c15259f755ffc19790a90cd616449a47bb9617cf93bfe91441/detection

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/BenChaliah/MIPS-CVE-2014-9222/issues/1#issuecomment-766144706, or unsubscribe https://github.com/notifications/unsubscribe-auth/AKO4NRDKO7HBMIUX2M3LH4LS3MAY5ANCNFSM4RGIP7QQ .