XyliBox: useless

Saturday, 6 August 2011

Decode/Encode data send to the gate (SpyEye 1.3.x)

In search of things to do this night, i've looked into how data's was recevied and decoded when SpyEye call the 'gate'
Finaly i've removed the useless shit for keep this:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

<title>SpyEye 1.3.x Gate Decoder/Encoder</title>

</head>

<body>

<p>Structure example:<br />

  guid=5.1.2600!XYLITOL-F12F085!8065D52C&amp;ver=10345&amp;ie=6.0.2900.5512&amp;os=5.1.2600&amp;ut=Admin&amp;ccrc=615CDC86&amp;md5=598b42846ac8a301ea44a80b397e2056&amp;plg=ccgrabber;customconnector;ftpbc;socks5&amp;plgstat=0;0;0;0&amp;wake=90&amp;stat=online<br>

</p>

<table width="607" border="1">

  <tr>

    <td><form id="Decoder" name="Eye" method="POST" action="<?php basename($_SERVER['PHP_SELF']) ?>">

  <label for="datz">Data: </label>

  <input name="data" type="text" id="datz" value="" size="50" />

  <input type="submit" name="button" id="button" value="Decode" />

</form></td>

  </tr>

  <tr>

    <td>

<?php

error_reporting(E_ALL ^ E_NOTICE ^ E_DEPRECATED);

## decode data from bot 

    function DeCode($content)

    {

        $res = '';

        for($i = 0; $i < strlen($content); $i++) 

        {

            $num = ord($content[$i]);

            if( $num != 219) $res .= chr($num^219); 

        }

        return $res;

    }

    if( !isset($_POST['data']) );

    else $DATA = str_replace(" ","+",$_POST['data']); 

    $data = base64_decode($DATA);

    echo "<font color='red'>" . htmlentities(DeCode($data)) . "</font>";

?></td>

  </tr>

</table>

<br>

<table width="607" border="1">

  <tr>

    <td><form id="Encoder" name="Eye2" method="POST" action="<?php basename($_SERVER['PHP_SELF']) ?>">

  <label for="datz2">Data: </label>

  <input name="data2" type="text" id="datz2" value="" size="50" />

  <input type="submit" name="button" id="button" value="Encode" />

</form></td>

  </tr>

  <tr>

    <td>

<?php

## encode data from bot

   function encode($str2)

    {

        $string2 = '';

        for ($i2 = 0; $i2 < strlen($str2); $i2++)

        {

            $num2 = ord($str2[$i2]);

            if ($num2 != 219)

                $string2 .= chr($num2 ^ 219);

        }

        $string2 = str_replace('+', ' ', $string2);

        return base64_encode($string2);

    }

        if( !isset($_POST['data2']) );

    else

    $DATA2 = $_POST['data2'];

    echo "<font color='red'>" . htmlentities(encode($DATA2)) . "</font>";

?></td>

  </tr>

</table>

</body>

</html>

Tested with samples found in the wild and work like a charm

For don't make this post more useless, here is a 'guide' on the SpyEye gate and the data transmission to the C&C http://blog.fortinet.com/a-guide-to-spyeye-cc-messages/

And hey, good guys use also IRC :þ

Sinus scroller & IDLE like in 1999 :þ

random pwnz panels ~