.NET Project File Auto Exec Detection

[.NET] Project File Auto Exec Detection - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Project File Auto Exec Detection (/showthread.php?tid=5779377)

Pages: Pages 1 2

RE: Project File Auto Exec Detection - HFDone - Jan 6, 2018

looking for "<Exec " will be better
Dim f As New IO.DirectoryInfo("folder")
For Each n In f.GetFiles("*.*proj", IO.SearchOption.AllDirectories)
If IO.File.ReadAllText(n.FullName).Contains("<Exec ") Then
...

RE: Project File Auto Exec Detection - Washi - Jan 6, 2018

(Jan 6, 2018 12:02 PM)xmods1337 Wrote: if took the time to read the thread you would see

This with in my thread:

Code
PS: idc about making this clean or nice its just an example so if you care more about how i call things then you will be talking to yourself.

And again you completely missed the point that I was trying to make. I am not talking about how clean your code looks or whatever. If the intention of my reply was to comment on your coding style, then I would have criticised you for things like using a RichTextBox to contain the contents of the file instead of just a simple string variable, not naming your variables and components etc. But that is not what I am criticising your code for. Instead I am criticising your method for not being reliable. I am making the exact same point as GhostCode is making, yet you are somewhat acknowledging his criticism and not mine 😧

(Jan 6, 2018 12:02 PM)xmods1337 Wrote: yes 98.7% because i did have a look and hoped what you said earlier what misinterpreted by me or miss said by you.

Ok man, whatever. You're taking that a little too serious...

(Jan 6, 2018 12:02 PM)xmods1337 Wrote: @ GhostCode: xml parsing would be better and yea reading the file is an unreliable way to do it but im just trying to make a simple poc to show people how easy it would be to detect this within the project header.

But that's exactly our point. Checking the entire file for one occurrence of a string might be easy to implement, but is really not a great way of detecting a backdoor. Try creating a new project with the name "Exec", and test your application. You will see that your method will flag the project as malicious, even though it does not contain any Exec tag whatsoever.

(Jan 6, 2018 12:02 PM)xmods1337 Wrote: also some of the those source files have names that look similar to the namespaces or references within the sdk but i did see some odd ones like LazyValue.cs. also they are class files/namespaces which still call with in the sdk so.....

I am not sure what you mean by this. The files in the screenshots, they contain classes and are put in folders that represent the namespaces yes, but they are nowhere to be found in the SDK from what I can tell. And of course these files will call members of the SDK. I mean every VB or C# project will have a reference to members in the SDK. But I really don't see your point.

You are posting this in a coding section, so you can expect to get replies with questions, criticism or pointers for improvement of your code. What other comments did you expect from this thread?

I'm so confused 😧

RE: Project File Auto Exec Detection - Niǌa - Jan 6, 2018

(Jan 6, 2018 12:54 PM)Washi Wrote: You are posting this in a coding section, so you can expect to get replies with questions, criticism or pointers for improvement of your code. What other comments did you expect from this thread?

OP expected praise for his ability to use <string>.Contains("Exec").

RE: Project File Auto Exec Detection - Sn0wX - Jan 11, 2018

What a clueless prat you are ninja. "who checks a string against a string"

Heaven forbids any One wants to check a file at a certain line in their file.

(Jan 5, 2018 01:13 PM)Niǌa Wrote: I kind of agree with the dude above me, and as harsh as it may sound, but this is ridiculous. A tutorial for checking a string for an occurrence of another string?

yeh who would ever do as above

OP expected praise for his ability to use <string>.Contains("Exec").