A webshell and a normal file that have the same MD5
1–10 of 49 posts
Re: A webshell and a normal file that have the same MD5
#2The normal file doesn't look that normal
Re: A webshell and a normal file that have the same MD5
#3The normal file doesn't look that normal
Keep in mind that the stated use is cache-poisoning of automated scanners, not fooling humans.
Re: A webshell and a normal file that have the same MD5
#4It's a pity that there is no description of what it is supposed to be used for.
Re: A webshell and a normal file that have the same MD5
#5Proof of Concept or GTFO issue 0x14 is a PDF document file that can also be run as a NES ROM. The file will display its own MD5 hash in a PDF viewer, and also displays its own MD5 hash in a NES emulator (only first 40KB+16 bytes are actually loaded there)
https://github.com/angea/pocorgtfo#0x14
And yes, documents are not normally supposed to be able to display their own MD5 hash.
Re: A webshell and a normal file that have the same MD5
#6The idea here is you can trigger a server to run the "safe" php file, then send it the webshell version, which passes hash based scanning?
Re: A webshell and a normal file that have the same MD5
#7The idea here is you can trigger a server to run the "safe" php file, then send it the webshell version, which passes hash based scanning?
Yes, but you'd need a situation where:
1. You can upload scripts that get scanned for malicious code 2. These scripts can be executed once deemed "safe" 3. The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it
3. Is where the issue is. It should probably always re-scan it and it definitely should not be using MD5.
Re: A webshell and a normal file that have the same MD5
#8It's a pity that there is no description of what it is supposed to be used for.
Because there's unlikely to be a use case
Re: A webshell and a normal file that have the same MD5
#9It's a pity that there is no description of what it is supposed to be used for.
The answer is likely wordpress, because its default wp_hash algorithm is still MD5.
Re: A webshell and a normal file that have the same MD5
#10It's a pity that there is no description of what it is supposed to be used for.
If you don't know, then you aren't the target audience.
But there are two applications: the first is breaking in to a system under some very obscure set of circumstances that you are very unlikely to encounter in the real world. The second is to bump up your karma on HN.