sheep-wolf: Wolves Among the Sheep
Wolves Among the Sheep
Some security tools still stick to MD5 when identifying malware samples years after practical collisions were shown against the algorithm. This can be exploited by first showing these tools a harmless sample (Sheep) and then a malicious one (Wolf) that have the same MD5 hash. Please use this code to test if the security products in your reach use MD5 internally to fingerprint binaries and share your results by issuing a pull request updating the contents of results/!
Works-on-a-different-machine-than-mine version, feedback is welcome!
How does it work?
- shepherd.bat executes shepherd.exe with the user-supplied command line arguments
- shepher.exe generates a header file (sc.h) that contains the encrypted shellcode, the password and the CRC of the plain shellcode
- shepherd.bat executes the build process of sheep.exe
- sheep.exe is built with sc.h included by Visual Studio
- shepherd.bat executes evilize.exe
- evilize.exe calculates a special IV for the chunk of sheep.exe right before the block where the collision will happen
- evilize.exe executes fastcoll.exe with the IV as a parameter
- fastcoll.exe generates two 128 byte colliding blocks: a and b
- evilize.exe replaces the original string buffers of sheep.exe so that they contain combinations a and b
- The resulting files (evilize/wolf.exe and evilize/sheep.exe ) have the same MD5 hashes but behave differently. The real code to be executed only appears in the memory of evilize/wolf.exe.
Testing Methodology
To test the security products in your reach you should generate two pairs of samples (SHEEP1-WOLF1 and SHEEP2-WOLF2), preferably with the same payload. Since samples (or their fingerprints) are usually uploaded to central repositories (or “the cloud”) precompiled samples are not included to avoid conflicts between independent testers.
After the samples are ready follow the methodology shown in the diagram below:
(*) If the product is not able to detect the first malicious sample, there are more serious problems to worry about than crypto-fu. In fact, the simple cryptography included in the provided boilerplate code poses as a hard challenge for various products… Try to use more obvious samples!
(**) The product most probably uses some trivial method to detect the boilerplate instead of the actual payload. You can try to introduce simple changes to the code like removing debug strings.
Please don’t forget to share your positive results by issuing a pull request to the RESULTS.md file!
Download
git clone https://github.com/silentsignal/sheep-wolf.git
Usage
Extract Fastcoll to the fastcoll directory. Name the executable fastcoll.exe
Use shepherd.bat to generate wolf.exe and sheep.exe (in the VS Development Command Prompt):
shepherd.bat YOURPASSWORD your_shellcode.raw
After this step, you should have your two colliding binaries (sheep.exe and wolf.exe in the evilize directory).
For more information see the tutorial of Peter Selinger, older revisions of this document or the source code…
