Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A webshell and a normal file that have the same MD5

github.com

Post reply on HN
Print view View original

21–30 of 49 posts

Re: A webshell and a normal file that have the same MD5

#21

Post by sim7c00 »

honestly, normal.php is not a valid php file. i do understand that it might bypass some checks if say normal.php was somehow flagged as a valid / benign file but in all honesty that would be really bad sec product u wanna swap with something that more intelligently classifies files... additionally, most products these days also use sha1, sha2 and sometimes things like ssdeep to have multiple hash variants to check. this ensures that any collisions will be mitigated as it's not known yet to make 1 file match on all of these different types of hashes, despite collisions being possible in a number of them for sure.

if normal.php had actual php code in there, being really 'normal' as the name implies, this would be much more severe / interesting because it might be more easy to convince modern security products it's actually a benign file.

Currently if it would be analysed, it would be flagged as suspicious simply because its not a valid file. and really, it dont need to be php, it could be any valid file format as long as it's an actually file that has benign behavior or contents.

plaintext might be easier to generate, but you'd need it to be 'executable' format or something interpretable like a script to have it actually stored in databases marking files as malicious or benign. matching filetype with the malicious file, in a valid form that does actual benign behavior would be 'best'.

don't take me wrong tho. still fun to see these things and honestly props, if it bypasses anything that's always a 'nice result' :)

Re: A webshell and a normal file that have the same MD5

#22

Post by sim7c00 »

Incipient wrote: post #6

The idea here is you can trigger a server to run the "safe" php file, then send it the webshell version, which passes hash based scanning?

the safe file is not a valid php file? it might be executed if php is like javascript ignorning valid chars, but i doubt something actually 'looking at it' would accept it as benign or valid.

Re: A webshell and a normal file that have the same MD5

#23

Post by h33t-l4x0r »

szszrk wrote: post #15
chipsrafferty wrote: post #7

Earlier quoted context omitted.

Yes, but you'd need a situation where: 1. You can upload scripts that get scanned for malicious code 2. These scripts can be executed once deemed "safe" 3. The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it 3. Is where the issue is. It should probably always re-scan it and it definitely should not be using MD5.

Is there any fairly popular software that still uses md5 in this context? Most I've seen (sec scans, backup validation/dedup etc) pushed to phase out md5 very long time ago.

Wordpress uses md5 checksums for core files. That doesn't make it vulnerable to this, except in the sense that it kind of validates using them.

Re: A webshell and a normal file that have the same MD5

#24

Post by h33t-l4x0r »

slow_typist wrote: post #20
o11c wrote: post #3

Earlier quoted context omitted.

Keep in mind that the stated use is cache-poisoning of automated scanners, not fooling humans.

Humans have to put the so called php-file on the server intentionally for any subsequent attack to work. But it is a binary file.

I imagine it's supposed to get onto the server by an exploited vulnerable image upload plugin

Re: A webshell and a normal file that have the same MD5

#25

Post by integralid »

dsab wrote: post #4

It's a pity that there is no description of what it is supposed to be used for.

After, sometimes, the initial scanning, the security and AV industry deals with file hashes, not actual files. This means that if you wrote a legitimate, harmful program, and a malicious version with the same hash, you would be able to troll the security rolls in many cases. Basically, those two files would look the same to the security program.

The thing that makes this blog post not realistic is:

* Such tricks would make much more sense with normal programs, where you're trying to trick an user to download and execute it. Webshells are downloaded by the attacker knowingly.

* Md5 is not used anymore (although I know security vendors who used it for embarrassingly long time). If this was SHA256, that attack would be devastating for many more severe reasons.

But it's still a fun PoC.

Re: A webshell and a normal file that have the same MD5

#26

Post by gruez »

magicalhippo wrote: post #18

Not only is MD5 broken as shown here, if you have a modern CPU it's also quite slow compared to good, non-broken alternatives. See for example this comparison[1] (post says JavaScript but it's actually OpenSSL's implementation that's actually tested). [1]: https://lemire.me/blog/2025/01/11/javascript-hashing-speed-c...

I only see new CPUs benchmarked, maybe that's because newer CPUs have SHA acceleration extensions? I'd expect SHA256 to be more complex and therefore be more computationally expensive.

Re: A webshell and a normal file that have the same MD5

#27

Post by Retr0id »

I made https://github.com/DavidBuchanan314/monomorph, which packs up to 4KB of shellcode into an executable that always has the same hash. So you're not just limited to a good/evil pair, you can arbitrarily change the behaviour in future without changing the hash.

Also, a more recent innovation in MD5 collisions is textcoll, which creates colliding blocks that are completely plaintext. This would allow for colliding PHP source files like in OP but without any obvious binary artefacts (although this requires identical prefixes).

https://github.com/cr-marcstevens/hashclash?tab=readme-ov-fi...

Re: A webshell and a normal file that have the same MD5

#28

Post by sltkr »

gruez wrote: post #26
magicalhippo wrote: post #18

Not only is MD5 broken as shown here, if you have a modern CPU it's also quite slow compared to good, non-broken alternatives. See for example this comparison[1] (post says JavaScript but it's actually OpenSSL's implementation that's actually tested). [1]: https://lemire.me/blog/2025/01/11/javascript-hashing-speed-c...

I only see new CPUs benchmarked, maybe that's because newer CPUs have SHA acceleration extensions? I'd expect SHA256 to be more complex and therefore be more computationally expensive.

Yes, SHA256 is faster than MD5 only if you have hardware accelleration. But SHA256 itself is pretty slow compared to the state of the art. For example, BLAKE3 is just as secure as SHA256 but an order of magnitude faster.

Try this on your own system:

    $ head -c 1000000000 /dev/urandom > random-1gb
    
    $ time md5sum random-1gb 
    ef72a3616aad5117ddf40a7d5f5d0162  random-1gb
    
    real 0m2.428s
    user 0m2.192s
    sys 0m0.202s
    
    $ time sha256sum random-1gb 
    ec7d7f31c4489acae8328fddbe54157f1cb9e97b220ef502a07e1f9230969310  random-1gb
    
    real 0m3.894s
    user 0m3.697s
    sys 0m0.181s
    
    $ time b3sum random-1gb 
    11fe11cc5721faf65369d18893d7b7631f6178b4692bc0bb03b1b180273cd384  random-1gb
    
    real 0m0.282s !!!
    user 0m0.876s
    sys 0m0.124s
    
    $ time b3sum --num-threads=1 random-1gb 
    11fe11cc5721faf65369d18893d7b7631f6178b4692bc0bb03b1b180273cd384  random-1gb
    
    real 0m0.597s
    user 0m0.488s
    sys 0m0.107s
This is on an old Chromebook with Intel(R) Core(TM) m3-6Y30 CPU @ 0.90GHz CPU (dual core, but with hyperthreading). Note that even using only a single thread (which SHA256 and MD5 are limited to by their design), BLAKE3 is 6x as fast as SHA256 and 4x as fast as MD5.

Re: A webshell and a normal file that have the same MD5

#29

Post by dnet »

falcor84 wrote: post #19
chipsrafferty wrote: post #7

Earlier quoted context omitted.

Yes, but you'd need a situation where: 1. You can upload scripts that get scanned for malicious code 2. These scripts can be executed once deemed "safe" 3. The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it 3. Is where the issue is. It should probably always re-scan it and it definitely should not be using MD5.

>The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it Wouldn't the sensible thing for a server that gets an upload matching an existing file's hash be to just treat it as an idempotent no-op? What reason would it have to replace the old version with a presumably identical copy? What am I missing?

I assume the scanner is a separate library/service that receives the contents and returns a boolean safe/malicious result, and the implementation using MD5 to avoid expensive re-scans is an internal detail hidden from the caller.

Re: A webshell and a normal file that have the same MD5

#30

Post by adrian_b »

gruez wrote: post #26
magicalhippo wrote: post #18

Not only is MD5 broken as shown here, if you have a modern CPU it's also quite slow compared to good, non-broken alternatives. See for example this comparison[1] (post says JavaScript but it's actually OpenSSL's implementation that's actually tested). [1]: https://lemire.me/blog/2025/01/11/javascript-hashing-speed-c...

I only see new CPUs benchmarked, maybe that's because newer CPUs have SHA acceleration extensions? I'd expect SHA256 to be more complex and therefore be more computationally expensive.

Hardware SHA-1 and SHA-256 are now supported by many CPUs, many of which are already older than a decade, i.e. almost all 64-bit ARM-based CPUs, all AMD Zen, many generations of Intel Atom and the Intel Core CPUs starting with Ice Lake.

The only CPUs still likely to be in use and without SHA support are the Intel Core CPUs until and including the Skylake derivatives (i.e. up to Comet Lake, i.e. up to 6 years ago).

The Intel Atoms have received SHA support many years before Intel Core, because they competed with ARM, which already had such support.

The support in Intel Core has been added due to AMD Zen, but the products with it have been delayed by the failure of Intel to achieve acceptable fabrication yields in their 10-nm CMOS process, before 2019/2020.

Post reply on HN