ECL Labs

Roboo - HTTP Robot Mitigator released!

We’re happy to announce the release of Roboo - the first and most advanced open-source HTTP Robot mitigator of its kind!

Roboo uses advanced non-interactive HTTP challenge/response mechanisms to detect and subsequently mitigate HTTP robots, by verifying the existence of HTTP, HTML, DOM, Javascript and Flash stacks at the client side.

Such deep level of verification weeds out the larger percentage of HTTP robots which do not use real browsers or implement full browser stacks, resulting in the mitigation of various web threats:

HTTP Denial of Service tools - e.g. Low Orbit Ion Cannon
Vulnerability Scanning - e.g. Acunetix Web Vulnerability Scanner, Metasploit Pro, Nessus
Web exploits
Automatic comment posters/comment spam as a replacement of conventional CAPTCHA methods
Spiders, Crawlers and other robotic evil

You can find the first public version here - for more information, refer to the presentation “Building Floodgates: Cutting-Edge Denial of Service Mitigation” given at Black Hat Europe 2011 (slides) and the Roboo source code repository.

A tool for creating IDS/IPS signatures for SMTP based worms

Worminator (source & binary) - A Win32 tool for easing/automating the process of creating IDS/IPS signatures for SMTP based worms, providing a comfortable GUI, including raw base64 variants and Snort signatures support. Written in Delphi.

PoC exploit for the NetFilter SNMP ALG helper DoS vulnerability

Proof of concept exploit code for the double-free vulnerability in NetFilter’s snmp_trap_decode() function in Linux kernels 2.6.16.17 and older, causing a kernel panic (CVE-2006-2444)

NIDS polymorphic evasion - The End?

Today’s Network Intrusion Detection Systems, alarmed of the dangers brought by polymorphic shellcodes, try to detect them using desperate methods that eat up CPU cycles. This is done so the claim can be made that such NIDS foil even the most devious crackers. The truth of the matter is, they don’t.

This paper demonstrates the weaknesses in today’s polymorphism detection methods, and explores techniques to exploit them. The accompanying ECL-Polynop tool can be obtained from here.

Exploit for a stack-based buffer overflow in MySQL MaxDB

An exploit for the HTTP GET request with long file parameter after a percent (”%”) character vulnerability in MySQL MaxDB 7.5.00.26 and earlier (CVE-2005-0684)

PoC remote DoS code for MS05-019

Proof of concept exploit code for the IP options parsing off-by-one vulnerability in Microsoft Windows: Vulnerabilities in TCP/IP Could Allow Remote Code Execution and Denial of Service MS05-019 (CVE-2005-0048)

Exploit code for Exim's SPA vulnerability

Release of exploit code for a buffer bounds checking vulnerability in Exim’s SPA authentication routines (CVE-2005-0022)

Advisory for privilege escalation vulnerabilities in W-Channel embedded Linux

TC-IDE’s W-Channel embedded Linux contains multiple local vulnerabilities in versions prior to v1.54. The advisory is here