mirror of
https://github.com/BenjiTrapp/MostShittyAV
synced 2026-06-06 15:24:25 +00:00
Add files via upload
This commit is contained in:
Benjamin-Yves Trapp
committed by
GitHub
GitHub
parent
21900c4060
commit
85f2d2ddc5
@@ -0,0 +1,10 @@
|
||||
.PHONY: build test_extension_bypass test_signature_detection
|
||||
|
||||
build:
|
||||
nim c --app:lib --cpu:amd64 --os:windows amsi_raccoon_lab.nim
|
||||
|
||||
test_extension_bypass:
|
||||
nim c -r nim_antimalware_sim.nim test\document.pdf.exe test\help.hta test\05\legacy.com test\05\malware test\05\suspicious_file
|
||||
|
||||
test_signature_detection:
|
||||
nim c -r nim_antimalware_sim.nim test\02_malware.ps1 test\02_malware_bypass.ps1
|
||||
@@ -1 +1,307 @@
|
||||
# MostShittyAV
|
||||
<div align="center">
|
||||
|
||||
```
|
||||
888b d888 888 .d8888b. 888 d8b 888 888
|
||||
8888b d8888 888 d88P Y88b 888 Y8P 888 888
|
||||
88888b.d88888 888 Y88b. 888 888 888
|
||||
888Y88888P888 .d88b. .d8888b 888888 "Y888b. 88888b. 888 888888 888888 888 888
|
||||
888 Y888P 888 d88""88b 88K 888 "Y88b. 888 "88b 888 888 888 888 888
|
||||
888 Y8P 888 888 888 "Y8888b. 888 "888 888 888 888 888 888 888 888
|
||||
888 " 888 Y88..88P X88 Y88b. Y88b d88P 888 888 888 Y88b. Y88b. Y88b 888
|
||||
888 888 "Y88P" 88888P' "Y888 "Y8888P" 888 888 888 "Y888 "Y888 "Y88888
|
||||
888
|
||||
Y8b d88P
|
||||
"Y88P"
|
||||
```
|
||||
|
||||
# 🦝 AMSI Raccoon Lab
|
||||
|
||||
### *The World's Most Intentionally Terrible Antivirus Scanner*
|
||||
|
||||
[](https://nim-lang.org/)
|
||||
[](LICENSE)
|
||||
[](https://www.microsoft.com/windows)
|
||||
[](README.md)
|
||||
|
||||
**An educational antimalware simulator built in Nim to demonstrate detection techniques and their bypasses.**
|
||||
|
||||
[Features](#-features) • [Quick Start](#-quick-start) • [Challenge](#-the-challenge) • [Examples](#-usage-examples) • [Resources](#-resources)
|
||||
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
## 🎯 Overview
|
||||
|
||||
**MostShittyAVScanner** is a deliberately simplistic antimalware engine designed for **security research**, **education**, and **red team training**. It implements basic heuristic detection methods that mirror real-world AV engines—but with intentional weaknesses to explore.
|
||||
|
||||
> ⚠️ **Disclaimer**: This is NOT production security software. It's an educational tool for understanding antimalware evasion techniques.
|
||||
|
||||
---
|
||||
|
||||
## ✨ Features
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td width="50%">
|
||||
|
||||
### 🔍 Detection Engines
|
||||
|
||||
- **Signature Scanning**
|
||||
- ASCII pattern matching
|
||||
- Case-insensitive detection
|
||||
- Known malware strings
|
||||
|
||||
- **Heuristic Analysis**
|
||||
- Suspicious file extensions
|
||||
- Non-printable byte ratio analysis
|
||||
- Tiny executable detection
|
||||
- Entropy-based checks
|
||||
|
||||
</td>
|
||||
<td width="50%">
|
||||
|
||||
### 🛠️ Technical Features
|
||||
|
||||
- **AMSI Provider Interface**
|
||||
- Compatible with Windows AMSI
|
||||
- Provider architecture pattern
|
||||
- Extensible scanning engine
|
||||
|
||||
- **Detailed Logging**
|
||||
- Timestamped output
|
||||
- Color-coded results
|
||||
- Step-by-step analysis
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
---
|
||||
|
||||
## 🚀 Quick Start
|
||||
|
||||
### Prerequisites
|
||||
|
||||
```bash
|
||||
# Windows with Nim 2.0.4
|
||||
winget install nim-lang.Nim
|
||||
```
|
||||
|
||||
### Installation
|
||||
|
||||
```powershell
|
||||
# Clone the repository
|
||||
git clone https://github.com/yourusername/AMSI-raaccoon-lab.git
|
||||
cd AMSI-raaccoon-lab
|
||||
|
||||
# Allow script execution (if needed)
|
||||
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
|
||||
|
||||
# Generate test files
|
||||
.\create_test_files.ps1
|
||||
|
||||
# Optional: Generate bypass test files
|
||||
.\test\create_bypass_files.ps1
|
||||
```
|
||||
|
||||
### Build & Run
|
||||
|
||||
```powershell
|
||||
# Compile and scan files
|
||||
nim c -r nim_antimalware_sim.nim testfile.txt infected.txt
|
||||
|
||||
# Or use the Makefile
|
||||
make test_all
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🎪 The Challenge
|
||||
|
||||
> **Can you bypass the engine?**
|
||||
> This scanner uses common detection heuristics found in real AV products.
|
||||
> Your mission: Evade detection while executing your "payloads"!
|
||||
|
||||
### Known Vulnerabilities
|
||||
|
||||
- 🔓 Extension checking doesn't enforce blocking
|
||||
- 🔓 Limited signature database
|
||||
- 🔓 Uncommon extensions not flagged (`.hta`, `.com`, `.wsf`, `.pif`)
|
||||
- 🔓 No deep content inspection
|
||||
- 🔓 Case sensitivity issues
|
||||
- 🔓 No archive/container scanning
|
||||
|
||||
**Try it yourself!** Use `create_bypass_files.ps1` to generate test cases.
|
||||
|
||||
---
|
||||
|
||||
## 📋 Usage Examples
|
||||
|
||||
### Basic Scanning
|
||||
|
||||
```powershell
|
||||
# Scan single file
|
||||
nim c -r nim_antimalware_sim.nim suspicious.exe
|
||||
|
||||
# Scan multiple files
|
||||
nim c -r nim_antimalware_sim.nim *.txt *.exe *.bat
|
||||
```
|
||||
|
||||
### Example Output
|
||||
|
||||
```console
|
||||
[2025-11-08 21:33:26] AMSI: Starting scan for file: infected.txt
|
||||
[2025-11-08 21:33:26] AMSI: Reading file content...
|
||||
[2025-11-08 21:33:26] AMSI: File successfully read (41 bytes)
|
||||
[2025-11-08 21:33:26] AMSI: Checking for known malware signatures...
|
||||
[2025-11-08 21:33:26] AMSI: Threat detected - Signature found in infected.txt
|
||||
--------------------------------------------
|
||||
Result for infected.txt: MALICIOUS ⛔
|
||||
```
|
||||
|
||||
### Testing Bypasses
|
||||
|
||||
```powershell
|
||||
# Generate bypass test files
|
||||
.\test\create_bypass_files.ps1
|
||||
|
||||
# Test double extensions
|
||||
nim c -r nim_antimalware_sim.nim test\document.pdf.exe
|
||||
|
||||
# Test uncommon extensions
|
||||
nim c -r nim_antimalware_sim.nim test\help.hta test\legacy.com
|
||||
|
||||
# Test no extension
|
||||
nim c -r nim_antimalware_sim.nim test\malware
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📁 Project Structure
|
||||
|
||||
```
|
||||
AMSI-raaccoon-lab/
|
||||
├── 📄 nim_antimalware_sim.nim # Main scanner engine
|
||||
├── 📄 create_test_files.ps1 # Test file generator
|
||||
├── 📄 Makefile # Build automation
|
||||
├── 📄 README.md # This file
|
||||
└── 📁 test/
|
||||
├── 📄 create_bypass_files.ps1 # Bypass technique generator
|
||||
├── 📄 01_clean.txt # Clean test file
|
||||
├── 📄 02_malware.ps1 # Malicious test file
|
||||
└── 📄 ... # Various test cases
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔬 Detection Methods Explained
|
||||
|
||||
### 1. Signature Detection
|
||||
```nim
|
||||
const signatures = [
|
||||
"malware", "virus", "trojan", "evil_payload",
|
||||
"dropper", "ransomware", "payload.exe"
|
||||
]
|
||||
```
|
||||
Simple string matching against known malicious patterns.
|
||||
|
||||
### 2. Extension Heuristic
|
||||
```nim
|
||||
const suspicious = [
|
||||
".exe", ".dll", ".bat", ".cmd", ".sh",
|
||||
".ps1", ".scr", ".js", ".vbs", ".jar", ".lnk"
|
||||
]
|
||||
```
|
||||
Flags files with potentially dangerous extensions.
|
||||
|
||||
### 3. Non-Printable Byte Analysis
|
||||
```nim
|
||||
# Threshold: 40% non-printable bytes
|
||||
if ratio > 0.40:
|
||||
# Possibly packed/obfuscated
|
||||
```
|
||||
Detects binary/encoded content that might be malicious.
|
||||
|
||||
### 4. Small Executable Check
|
||||
```nim
|
||||
if size < 32 and isSuspiciousExtension:
|
||||
# Suspicious tiny scripts
|
||||
```
|
||||
Catches unusually small executable files.
|
||||
|
||||
---
|
||||
|
||||
## 🧪 Test File Categories
|
||||
|
||||
| Category | Files | Purpose |
|
||||
|----------|-------|---------|
|
||||
| **Clean** | `clean.txt`, `umlaut.txt` | Baseline benign files |
|
||||
| **Infected** | `infected.txt`, `trojan_sample.txt` | Signature matches |
|
||||
| **Binary** | `packed.bin`, `mixed.bin` | High entropy content |
|
||||
| **Small Scripts** | `tiny.bat` | Tiny executable detection |
|
||||
| **Encoding** | `utf16.txt` | Character encoding tests |
|
||||
| **Bypass** | `*.hta`, `*.com`, `no-ext` | Evasion techniques |
|
||||
|
||||
---
|
||||
|
||||
## 🎓 Educational Value
|
||||
|
||||
This project demonstrates:
|
||||
|
||||
- ✅ **Basic AV Architecture** - Provider pattern, scan engines
|
||||
- ✅ **Signature Detection** - Pattern matching limitations
|
||||
- ✅ **Heuristic Analysis** - Behavioral detection methods
|
||||
- ✅ **Evasion Techniques** - Common bypass strategies
|
||||
- ✅ **AMSI Integration** - Windows antimalware interface
|
||||
- ✅ **Nim Programming** - Systems programming in Nim
|
||||
|
||||
---
|
||||
|
||||
## 🔗 Resources
|
||||
|
||||
### AMSI Documentation
|
||||
- [IAntimalwareProvider Interface](https://learn.microsoft.com/en-us/windows/win32/api/amsi/nn-amsi-iantimalwareprovider)
|
||||
- [AMSI Provider Sample](https://github.com/Microsoft/Windows-classic-samples/tree/main/Samples/AmsiProvider)
|
||||
- [AMSI Overview](https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal)
|
||||
|
||||
### Nim Language
|
||||
- [Nim Official Website](https://nim-lang.org/)
|
||||
- [Nim Documentation](https://nim-lang.org/documentation.html)
|
||||
- [Nim by Example](https://nim-by-example.github.io/)
|
||||
|
||||
### Security Research
|
||||
- [MITRE ATT&CK - Defense Evasion](https://attack.mitre.org/tactics/TA0005/)
|
||||
- [AV Evasion Techniques](https://www.offensive-security.com/metasploit-unleashed/antivirus-evasion/)
|
||||
|
||||
---
|
||||
|
||||
## 📜 License
|
||||
|
||||
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
|
||||
|
||||
---
|
||||
|
||||
## ⚠️ Legal Notice
|
||||
|
||||
**This tool is for educational and research purposes only.**
|
||||
|
||||
- ❌ Do not use on systems you don't own or have explicit permission to test
|
||||
- ❌ Do not use for malicious purposes
|
||||
- ❌ Not a replacement for real security software
|
||||
- ✅ Use in controlled lab environments only
|
||||
- ✅ Understand applicable laws and regulations in your jurisdiction
|
||||
|
||||
**The author assumes no liability for misuse of this software.**
|
||||
|
||||
---
|
||||
|
||||
<div align="center">
|
||||
|
||||
### 🦝 Happy Hunting!
|
||||
|
||||
*Made with ❤️ and Nim for the security research community*
|
||||
|
||||
**[⭐ Star this repo](../../stargazers)** • **[🐛 Report Bug](../../issues)** • **[💡 Request Feature](../../issues)**
|
||||
|
||||
</div>
|
||||
|
||||
Binary file not shown.
@@ -0,0 +1,203 @@
|
||||
import os, times, strformat, strutils
|
||||
|
||||
type
|
||||
IAntimalwareProvider* = ref object of RootObj
|
||||
name*: string
|
||||
|
||||
proc scan*(self: IAntimalwareProvider, filePath: string): bool =
|
||||
discard
|
||||
|
||||
type
|
||||
LoggingAntimalwareProvider* = ref object of IAntimalwareProvider
|
||||
|
||||
|
||||
proc log(msg: string) =
|
||||
let timestamp = now().format("yyyy-MM-dd HH:mm:ss")
|
||||
echo fmt"[{timestamp}] {msg}"
|
||||
|
||||
###########################################################################
|
||||
# Example ASCII signatures (checked lowercase) #
|
||||
###########################################################################
|
||||
const
|
||||
signatures = [
|
||||
"malware",
|
||||
"virus",
|
||||
"trojan",
|
||||
"evil_payload",
|
||||
"dropper",
|
||||
"ransomware",
|
||||
"payload.exe"
|
||||
]
|
||||
|
||||
proc toLowerAsciiByte(b: byte): byte =
|
||||
if b >= 0x41 and b <= 0x5A:
|
||||
return b + 0x20.byte
|
||||
else:
|
||||
return b
|
||||
|
||||
proc containsSignatureBytes(content: seq[byte]): bool =
|
||||
if content.len == 0:
|
||||
return false
|
||||
var lower = newString(content.len)
|
||||
for i, b in content:
|
||||
lower[i] = chr(toLowerAsciiByte(b))
|
||||
for sig in signatures:
|
||||
if lower.find(sig.toLowerAscii()) >= 0:
|
||||
return true
|
||||
return false
|
||||
|
||||
proc nonPrintableRatioBytes(content: seq[byte]): float =
|
||||
if content.len == 0:
|
||||
return 0.0
|
||||
var nonPrintable = 0
|
||||
for b in content:
|
||||
if b < 9 or (b > 13 and b < 32) or b > 126:
|
||||
inc(nonPrintable)
|
||||
return nonPrintable.float / content.len.float
|
||||
|
||||
proc fileExtLower(path: string): string =
|
||||
let idx = path.rfind('.')
|
||||
if idx >= 0:
|
||||
return path[idx .. ^1].toLowerAscii()
|
||||
else:
|
||||
return ""
|
||||
|
||||
proc isSuspiciousExtension(ext: string): bool =
|
||||
const suspicious = [".exe", ".dll", ".bat", ".cmd", ".sh", ".ps1", ".scr", ".js", ".vbs", ".jar", ".lnk"]
|
||||
return ext in suspicious
|
||||
|
||||
# Implement the scan method provided by IAntimalwareProvider
|
||||
proc scan*(self: LoggingAntimalwareProvider, filePath: string): bool =
|
||||
log("AMSI: Starting scan for file: " & filePath)
|
||||
|
||||
if not fileExists(filePath):
|
||||
log("AMSI: Scan aborted - File not found: " & filePath)
|
||||
return false
|
||||
|
||||
var content: seq[byte] = @[]
|
||||
try:
|
||||
log("AMSI: Reading file content...")
|
||||
var f = open(filePath, fmRead)
|
||||
let size = getFileSize(filePath)
|
||||
setLen(content, size)
|
||||
var buf: array[1024, byte]
|
||||
var readSoFar = 0
|
||||
while readSoFar < size:
|
||||
let toRead = min(size - readSoFar, buf.len)
|
||||
let n = f.readBuffer(addr buf[0], toRead)
|
||||
for i in 0..<n:
|
||||
content[readSoFar + i] = buf[i]
|
||||
readSoFar += n
|
||||
f.close()
|
||||
log(fmt"AMSI: File successfully read ({size} bytes)")
|
||||
except OSError as e:
|
||||
log("AMSI: Error reading file: " & e.msg)
|
||||
return false
|
||||
|
||||
#########################################################################################
|
||||
# Welcome to the MostShitty Heuristic Based Scan Engine #
|
||||
# This is a simple simulation of an antimalware scan using basic heuristics. #
|
||||
# It checks for known signatures, suspicious file extensions, and analyzes byte content.#
|
||||
# It is NOT a real antimalware solution and is intended for educational purposes only. #
|
||||
#########################################################################################
|
||||
# CHALLENGE: #
|
||||
# ---------- #
|
||||
# Can you bypass the engine? How far can you go? Try to run Malware samples or #
|
||||
# abuse this code to the max and see if it gets detected! #
|
||||
#########################################################################################
|
||||
|
||||
type
|
||||
ScanEngine = object
|
||||
content: seq[byte]
|
||||
filePath: string
|
||||
ext: string
|
||||
|
||||
proc signatureScan(self: ScanEngine): bool =
|
||||
log("AMSI: Checking for known malware signatures...")
|
||||
if containsSignatureBytes(self.content):
|
||||
log("AMSI: \e[31mThreat detected - Signature found in " & self.filePath & "\e[0m")
|
||||
return false
|
||||
else:
|
||||
log("AMSI: No known signatures found.")
|
||||
return true
|
||||
|
||||
proc extensionHeuristic(self: ScanEngine): bool =
|
||||
log("AMSI: Checking file extension: " & self.ext)
|
||||
if isSuspiciousExtension(self.ext):
|
||||
log("AMSI: \e[33mWarning - Suspicious file extension detected: " & self.ext & "\e[0m")
|
||||
return false
|
||||
else:
|
||||
log("AMSI: File extension considered benign.")
|
||||
return true
|
||||
|
||||
proc nonPrintableRatioCheck(self: ScanEngine): bool =
|
||||
log("AMSI: Analyzing ratio of non-printable bytes...")
|
||||
let ratio = nonPrintableRatioBytes(self.content)
|
||||
log(fmt"AMSI: Non-printable bytes: {ratio:.3f} (Threshold: 0.40)")
|
||||
if self.content.len >= 64 and ratio > 0.40:
|
||||
log("AMSI: \e[31mThreat detected - High ratio of non-printable bytes (possibly packed/obfuscated)\e[0m")
|
||||
return false
|
||||
else:
|
||||
log("AMSI: Ratio of non-printable bytes is unremarkable.")
|
||||
return true
|
||||
|
||||
proc smallExecutableCheck(self: ScanEngine): bool =
|
||||
log("AMSI: Checking for very small executable/script files...")
|
||||
if self.content.len < 32 and isSuspiciousExtension(self.ext):
|
||||
log("AMSI: \e[31m Threat detected - Very small executable/script file\e[0m")
|
||||
return false
|
||||
else:
|
||||
log("AMSI: File size within expected range.")
|
||||
return true
|
||||
|
||||
#########################################################################################
|
||||
# Now run the scan engine with the loaded content #
|
||||
#########################################################################################
|
||||
let engine = ScanEngine(content: content, filePath: filePath, ext: fileExtLower(filePath))
|
||||
|
||||
if not engine.signatureScan():
|
||||
return false
|
||||
|
||||
discard engine.extensionHeuristic() # Only logs, doesn't block
|
||||
|
||||
if not engine.nonPrintableRatioCheck():
|
||||
return false
|
||||
|
||||
if not engine.smallExecutableCheck():
|
||||
return false
|
||||
|
||||
log("AMSI: \e[32mScan complete - No threats found in " & filePath & "\e[0m")
|
||||
return true
|
||||
|
||||
when isMainModule:
|
||||
let provider = LoggingAntimalwareProvider(name: "MostShittyAVScanner")
|
||||
echo """
|
||||
888b d888 888 .d8888b. 888 d8b 888 888 d8888 888 888
|
||||
8888b d8888 888 d88P Y88b 888 Y8P 888 888 d88888 888 888
|
||||
88888b.d88888 888 Y88b. 888 888 888 d88P888 888 888
|
||||
888Y88888P888 .d88b. .d8888b 888888 "Y888b. 88888b. 888 888888 888888 888 888 d88P 888 Y88b d88P
|
||||
888 Y888P 888 d88""88b 88K 888 "Y88b. 888 "88b 888 888 888 888 888 d88P 888 Y88b d88P
|
||||
888 Y8P 888 888 888 "Y8888b. 888 "888 888 888 888 888 888 888 888 d88P 888 Y88o88P
|
||||
888 " 888 Y88..88P X88 Y88b. Y88b d88P 888 888 888 Y88b. Y88b. Y88b 888 d8888888888 Y888P
|
||||
888 888 "Y88P" 88888P' "Y888 "Y8888P" 888 888 888 "Y888 "Y888 "Y88888 d88P 888 Y8P
|
||||
888
|
||||
Y8b d88P
|
||||
"Y88P"
|
||||
"""
|
||||
echo "MostShittyAVScanner - AMSI Raccoon Lab - Nim Antimalware Simulator"
|
||||
echo "=================================================================="
|
||||
echo ""
|
||||
|
||||
if paramCount() == 0:
|
||||
|
||||
echo "Usage: nim c -r nim_antimalware_sim.nim <file1> [file2 ...]"
|
||||
echo "Run ./create_test_files.nim to generate test files."
|
||||
echo "Example: nim c -r nim_antimalware_sim.nim testfile.txt infected.txt"
|
||||
else:
|
||||
for i in 1..paramCount():
|
||||
let fp = paramStr(i)
|
||||
let ok = provider.scan(fp)
|
||||
let verdict = if ok: "\e[32mBENIGN\e[0m" else: "\e[31mMALICIOUS\e[0m"
|
||||
echo "--------------------------------------------"
|
||||
echo "\e[34mResult for ", fp, ": ", verdict, "\e[0m"
|
||||
echo ""
|
||||
Binary file not shown.
@@ -0,0 +1 @@
|
||||
Hello, this is a clean file.
|
||||
@@ -0,0 +1 @@
|
||||
Über Stöcke und andere fürchterlich schönen Schößer. Dies ist ein normaler Satz :)
|
||||
@@ -0,0 +1 @@
|
||||
Write-Host "malware.ps1 executed";
|
||||
@@ -0,0 +1 @@
|
||||
Write-Host "mal" + "ware.ps1 executed";
|
||||
Binary file not shown.
@@ -0,0 +1,2 @@
|
||||
RGllcyBpc3QgVVRGLTE2IFRleHQgbWl0IFVtbGF1dGVuIHVuZCBFbW9qaTogYWVvw4PFuMODwqTD
|
||||
g8K8WcOi4oCawqzDsMW4wqYK
|
||||
@@ -0,0 +1,2 @@
|
||||
ThisHasNoMal+wareP�Py��Q;��"���ԗ�tMХcZp��,�C�\0%* yQ>���Ń��!���g����լt�����g��� �6�Ý���p
|
||||
B?H�n�z�a�{�6<��z�}��#nnW��
|
||||
@@ -0,0 +1,7 @@
|
||||
ThisHasNoMal+wareP�Py��Q;��"���ԗ�tMХcZp��,�C�\0%* yQ>���Ń��!���g����լt�����g��� �6�Ý���p
|
||||
B?H�n�z�a�{�6<��z�}��#nnW��
|
||||
To compensate the packed structure we need a lot of gibberish text:
|
||||
|
||||
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Quisque orci diam, venenatis in velit lacinia, ullamcorper consectetur magna.
|
||||
Integer auctor egestas gravida. Vestibulum porttitor vestibulum lectus vel feugiat.
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
Mixed case
|
||||
@@ -0,0 +1,4 @@
|
||||
#!/usr/bin/python3
|
||||
filename = '05_extensionfailed_RTLO_\u202Ebypass.sh'
|
||||
with open(filename, 'w') as f:
|
||||
f.write('#!/usr/bin/bash\necho "THIS COULD BE A MALICIOUS FUNCTION CALL"')
|
||||
@@ -0,0 +1 @@
|
||||
Uppercase EXE
|
||||
@@ -0,0 +1 @@
|
||||
Windows Script Component
|
||||
@@ -0,0 +1 @@
|
||||
This looks like a PDF but is actually an EXE
|
||||
@@ -0,0 +1 @@
|
||||
Unicode fun
|
||||
@@ -0,0 +1 @@
|
||||
Windows Help Executable
|
||||
@@ -0,0 +1 @@
|
||||
This looks like a JPG but is actually a BAT file
|
||||
@@ -0,0 +1 @@
|
||||
This file contains MALWARE signature
|
||||
@@ -0,0 +1 @@
|
||||
COM executable
|
||||
@@ -0,0 +1 @@
|
||||
Another no-ext file
|
||||
@@ -0,0 +1 @@
|
||||
Executable with trailing space
|
||||
@@ -0,0 +1 @@
|
||||
Program Information File
|
||||
Binary file not shown.
@@ -0,0 +1 @@
|
||||
Script with multiple dots
|
||||
@@ -0,0 +1 @@
|
||||
This looks like TXT but is actually PowerShell
|
||||
@@ -0,0 +1 @@
|
||||
Weird case
|
||||
@@ -0,0 +1 @@
|
||||
Script with multiple trailing spaces
|
||||
@@ -0,0 +1 @@
|
||||
Executable content without extension
|
||||
@@ -0,0 +1 @@
|
||||
Executable with trailing dot
|
||||
@@ -0,0 +1 @@
|
||||
This file is getting flagged by it's extension
|
||||
@@ -0,0 +1,2 @@
|
||||
#!/usr/bin/bash
|
||||
echo "THIS COULD BE A MALICIOUS FUNCTION CALL"
|
||||
@@ -0,0 +1,60 @@
|
||||
# create_test_files.ps1
|
||||
# Erstellt mehrere Testdateien für den Nim Antimalware-Simulator.
|
||||
|
||||
$here = Get-Location
|
||||
|
||||
Write-Host "Erzeuge Testdateien in $here ..." -ForegroundColor Cyan
|
||||
|
||||
# 1) Saubere Textdatei (UTF-8, mit LF/CRLF je nach Plattform)
|
||||
"Hello, this is a clean file." | Out-File -FilePath .\clean.txt -Encoding utf8
|
||||
Write-Host " - clean.txt erstellt"
|
||||
|
||||
# 2) Infizierte Textdatei (enthält die Signatur MALWARE)
|
||||
"This file contains MALWARE signature" | Out-File -FilePath .\infected.txt -Encoding utf8
|
||||
Write-Host " - infected.txt erstellt"
|
||||
|
||||
# 3) Noch ein Beispiel mit Trojanschriftzug
|
||||
"Trojan detected in this sample" | Out-File -FilePath .\trojan_sample.txt -Encoding utf8
|
||||
Write-Host " - trojan_sample.txt erstellt"
|
||||
|
||||
# 4) Saubere Datei mit Umlauten / Sonderzeichen (UTF-8)
|
||||
"Dies ist eine saubere Datei mit Umlauten: aeoß - Gruße!" | Out-File -FilePath .\umlaut.txt -Encoding utf8
|
||||
Write-Host " - umlaut.txt erstellt"
|
||||
|
||||
# 5) Sehr kleine 'ausführbare' Datei (kleiner als 32 Bytes) mit .bat Endung
|
||||
# -> simuliert verdächtige kleine script/exe
|
||||
"@echo off`necho hi" | Out-File -FilePath .\tiny.bat -Encoding ascii
|
||||
Write-Host " - tiny.bat erstellt"
|
||||
|
||||
# 6) Binärdatei mit hohem Anteil nicht-druckbarer Bytes (z.B. 'gepackt')
|
||||
$binSize = 1024
|
||||
$bytes = New-Object byte[] $binSize
|
||||
# Verwende kryptographisch sicheren RNG (RandomNumberGenerator) für echte Zufallsbytes
|
||||
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
|
||||
[System.IO.File]::WriteAllBytes(".\packed.bin", $bytes)
|
||||
Write-Host " - packed.bin (random bytes) erstellt"
|
||||
|
||||
# 7) Kleine Binärdatei mit einige Textanteilen (gemischt) - nützlich zum Testen
|
||||
$mix = New-Object byte[] 128
|
||||
$rand = New-Object System.Random
|
||||
$rand.NextBytes($mix)
|
||||
# Ein paar ASCII-Buchstaben in den ersten 32 Bytes einfügen (lesbarer Bereich)
|
||||
[System.Text.Encoding]::ASCII.GetBytes("ThisHasNoMalware") | ForEach-Object -Begin { $i=0 } -Process { $mix[$i] = $_; $i++ }
|
||||
[System.IO.File]::WriteAllBytes(".\mixed.bin", $mix)
|
||||
Write-Host " - mixed.bin (gemischt) erstellt"
|
||||
|
||||
# 8) UTF-16 LE (Windows Unicode) Datei
|
||||
"Dies ist UTF-16 Text mit Umlauten und Emoji: aeoßäüY€🦝" | Out-File -FilePath .\utf16.txt -Encoding Unicode
|
||||
Write-Host " - utf16.txt (UTF-16 LE) erstellt"
|
||||
|
||||
# Fertig
|
||||
Write-Host ""
|
||||
Write-Host "Alle Testdateien erstellt:" -ForegroundColor Green
|
||||
Get-ChildItem -Path .\ -Include clean.txt,infected.txt,trojan_sample.txt,umlaut.txt,tiny.bat,packed.bin,mixed.bin,utf16.txt | Format-Table Name,Length
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "Zum Testen mit deinem Nim-Scanner (wenn exe im selben Ordner):" -ForegroundColor Yellow
|
||||
Write-Host " .\nim_antimalware_sim.exe .\clean.txt .\infected.txt .\trojan_sample.txt .\packed.bin .\tiny.bat .\umlaut.txt .\mixed.bin .\utf16.txt"
|
||||
Write-Host ""
|
||||
Write-Host "Hinweis: Falls PowerShell das Script nicht ausführen darf, starte:"
|
||||
Write-Host " powershell -ExecutionPolicy Bypass -File .\\create_test_files.ps1"
|
||||
@@ -0,0 +1,72 @@
|
||||
# Extension Bypass Test File Creator
|
||||
# Erstellt verschiedene Dateien zum Testen von Extension-Bypass-Techniken
|
||||
|
||||
Write-Host "Creating extension bypass test files..." -ForegroundColor Cyan
|
||||
Write-Host ""
|
||||
|
||||
# Test 1: Double Extension (funktioniert in Windows)
|
||||
Write-Host "[1] Creating double extension files..." -ForegroundColor Yellow
|
||||
"This looks like a PDF but is actually an EXE" | Out-File -FilePath "document.pdf.exe" -Encoding ASCII
|
||||
"This looks like a JPG but is actually a BAT file" | Out-File -FilePath "image.jpg.bat" -Encoding ASCII
|
||||
"This looks like TXT but is actually PowerShell" | Out-File -FilePath "readme.txt.ps1" -Encoding ASCII
|
||||
Write-Host " Created: document.pdf.exe, image.jpg.bat, readme.txt.ps1" -ForegroundColor Green
|
||||
|
||||
# Test 2: Trailing Spaces (Windows ignoriert diese)
|
||||
Write-Host "[2] Creating files with trailing spaces..." -ForegroundColor Yellow
|
||||
"Executable with trailing space" | Out-File -FilePath "malware.exe " -Encoding ASCII
|
||||
"Script with multiple trailing spaces" | Out-File -FilePath "script.bat " -Encoding ASCII
|
||||
Write-Host " Created: 'malware.exe ', 'script.bat ' (with trailing spaces)" -ForegroundColor Green
|
||||
|
||||
# Test 3: Trailing Dots (Windows entfernt diese)
|
||||
Write-Host "[3] Creating files with trailing dots..." -ForegroundColor Yellow
|
||||
"Executable with trailing dot" | Out-File -FilePath "trojan.exe." -Encoding ASCII
|
||||
"Script with multiple dots" | Out-File -FilePath "payload.bat..." -Encoding ASCII
|
||||
Write-Host " Created: 'trojan.exe.', 'payload.bat...' (with trailing dots)" -ForegroundColor Green
|
||||
|
||||
# Test 4: Uncommon but executable extensions
|
||||
Write-Host "[4] Creating files with uncommon executable extensions..." -ForegroundColor Yellow
|
||||
"Windows Help Executable" | Out-File -FilePath "help.hta" -Encoding ASCII
|
||||
"COM executable" | Out-File -FilePath "legacy.com" -Encoding ASCII
|
||||
"Windows Script Component" | Out-File -FilePath "component.wsf" -Encoding ASCII
|
||||
"Program Information File" | Out-File -FilePath "old.pif" -Encoding ASCII
|
||||
Write-Host " Created: help.hta, legacy.com, component.wsf, old.pif" -ForegroundColor Green
|
||||
|
||||
# Test 5: Case variations (Windows ist case-insensitive)
|
||||
Write-Host "[5] Creating files with case variations..." -ForegroundColor Yellow
|
||||
"Uppercase EXE" | Out-File -FilePath "VIRUS.EXE" -Encoding ASCII
|
||||
"Mixed case" | Out-File -FilePath "Malware.BaT" -Encoding ASCII
|
||||
"Weird case" | Out-File -FilePath "script.Ps1" -Encoding ASCII
|
||||
Write-Host " Created: VIRUS.EXE, Malware.BaT, script.Ps1" -ForegroundColor Green
|
||||
|
||||
# Test 6: Null-Byte Simulation (im Dateiinhalt, nicht im Namen)
|
||||
Write-Host "[6] Creating file to test null-byte handling..." -ForegroundColor Yellow
|
||||
$nullByteContent = "malware.exe" + [char]0 + ".txt SAFE FILE"
|
||||
[System.IO.File]::WriteAllText("nullbyte_test.txt", $nullByteContent)
|
||||
Write-Host " Created: nullbyte_test.txt (contains null-byte in content)" -ForegroundColor Green
|
||||
|
||||
# Test 7: No extension files
|
||||
Write-Host "[7] Creating files without extensions..." -ForegroundColor Yellow
|
||||
"Executable content without extension" | Out-File -FilePath "suspicious_file" -Encoding ASCII
|
||||
"Another no-ext file" | Out-File -FilePath "malware" -Encoding ASCII
|
||||
Write-Host " Created: suspicious_file, malware (no extensions)" -ForegroundColor Green
|
||||
|
||||
# Test 8: Unicode/Special Characters (wenn möglich)
|
||||
Write-Host "[8] Creating files with special characters..." -ForegroundColor Yellow
|
||||
try {
|
||||
"Unicode fun" | Out-File -FilePath "file．exe" -Encoding UTF8 # Fullwidth dot
|
||||
Write-Host " Created: file．exe (with fullwidth dot)" -ForegroundColor Green
|
||||
} catch {
|
||||
Write-Host " Could not create unicode filename" -ForegroundColor Red
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "All test files created!" -ForegroundColor Green
|
||||
Write-Host ""
|
||||
Write-Host "Test these files with:" -ForegroundColor Cyan
|
||||
Write-Host " nim c -r ..\nim_antimalware_sim.nim *.exe *.bat *.ps1" -ForegroundColor White
|
||||
Write-Host ""
|
||||
Write-Host "Expected bypasses:" -ForegroundColor Yellow
|
||||
Write-Host " - Files with uncommon extensions (hta, com, wsf, pif) might pass" -ForegroundColor Gray
|
||||
Write-Host " - No extension files will likely pass" -ForegroundColor Gray
|
||||
Write-Host " - Case variations should be caught (if scanner normalizes)" -ForegroundColor Gray
|
||||
Write-Host " - Trailing spaces/dots depend on how OS vs scanner handles them" -ForegroundColor Gray
|
||||
Binary file not shown.
@@ -0,0 +1,2 @@
|
||||
@echo off
|
||||
echo hi
|
||||
@@ -0,0 +1 @@
|
||||
Trojan detected in this sample
|
||||
Reference in New Issue
Block a user