├── README.md
├── eicar.txt
├── evador.html
└── picture.txt
/README.md:
--------------------------------------------------------------------------------
1 | # IPS / IDS download evasion
2 |
3 | ## Background
4 | I was hired by a customer to run a malware phishing campaign, but had to improvise after a recon which uncovered:
5 | - The customer email spam server was link-crawling
6 | - The customer has IPS (Intrusion Prevention Firewall) with SSL inspection enabled
7 | - IPS is able to unpack / decode multiple levels of compressions
8 | - IPS has both signature detection and sandboxing functionality
9 | - IPS is also blocking known bad file extensions, such as bat, dll, jar, hlp, lnk, e.g.
10 |
11 | This prevented me from doing any attachment-based or standard download related phishing, so had to think outside the box.
12 | Solution was a JavaScript downloader, which first grabbed an encoded payload and loaded it into the DOM, then decoded it and saved the file locally on the victim's computer.
13 |
14 | Proof of Concept can be tested here http://hisec.no/evador.html
15 |
--------------------------------------------------------------------------------
/eicar.txt:
--------------------------------------------------------------------------------
1 | JQICVINyDRSDJmEpHScLAGDbHS4cA0AQXGq9WRIWD0SFYIAHDH5RDIWRYHSBIRyJFIWIHl1HEIAHYHMWGRHuWRteFPb=
2 |
--------------------------------------------------------------------------------
/evador.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
53 |
54 |
55 |