5 replies to this topic

[webdevil]

PHP is not just a web language, I deny to write in that section cause my post really has nothing to with that
[cut]
I just edited, will post more details later. sorry!

[webdevil]

This is what I am upto

<?php

function strsplt($thetext,$num)

{

if (!$num)

{

$num=1;

}

$i=$j=0;

$arr=array();

$x=floor(strlen($thetext)/$num);

while ($i<=$x)

{

$y=substr($thetext,$j,$num);

if ($y)

{

array_push($arr,$y);

}

$i++;

$j=$j+$num;

}

return $arr;

}





$myFile = "File.exe";

$fh = fopen($myFile, 'r');

$theData = fread($fh, filesize($myFile));

fclose($fh);

$str = bin2hex($theData);



$arr1 = strsplt($str,2);



$A=chr(0x41).chr(0x41).chr(0x41).chr(0x41).chr(0x41);

$total=count($arr1);

$arr2=$arr1;



####for ($i=1;$i<$total;$i++)

for ($i=0;$i<5;$i++) //change this to the bytes you want

{

$arr1[$i]=$A;

print hexdec(implode($arr1));


$myFile = "File".$i.".exe";

$fh = fopen($myFile,'wb');

fwrite($fh, $newstr);

fclose($fh);

$arr1=$arr2;

}
?>

I want the hexcode to be written as the file, but I dont seem to be able to do that.

[webdevil]

Ok, I guess I got the most important part working. I just need to develop a few more things.....thanks to Glyph for the advise
There is some unused data in it as of now, but thats on purpose

<?php
$myFile = "test.exe";
$fh = fopen($myFile, 'r');
$theData = fread($fh, filesize($myFile));
fclose($fh);

$A=chr(0x41);

$str_hex = bin2hex($theData);
$len = count($str_hex);

for ($i=0;$i<12;$i++)
{

$str_hex[$i] = $A;
$str_bin = pack('H*', $str_hex);
}

$myFile = "File.exe";
$fh = fopen($myFile,'w');
fwrite($fh, $str_bin);
fclose($fh);


?>

[pwnedomina]

hi. you may try this tool
download here http://up.cih.ms/ipwn/v1.22.rar

[webdevil]

My intent was no where related to bypassing AV's.
I was writing a small php script which would do something that FileFuzz wouldn't do for me

[pwnedomina]

i know.. i was just presenting a tool coded in PHP that interact with executables.