Category Archives: code execution

Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?

Posted on by

To be honest, I’m not really sure the best title for this question, or the full scope of it, but the motivation behind it is:

Motivation

Assume your server was hacked, you open up your UTF-8 encoded php script and you find a block or lines of characters that mean nothing to you mostly mapping in the UTF-8 char set to “????????????? hacker.ru”

I’m trying to get a grasp on what this could be and do:

Thoughts I’m considering

  • Perhaps the text editor selected font doesn’t support those chars?
  • Perhaps those chars were copied and pasted from non UTF-8 into the UTF-8 document
    • Crude Example:
      • non-UTF-8 binary 1111->A
      • UTF-8 binary 1111->B
      • Effectively copying bits that don’t map properly
  • Is there a way to properly display those chars?
  • This is my priority question about these characters Can I assume that these non-mapping chars do nothing? (i.e., they don’t execute aka do damage)
  • Are programming languages multi-lingual?
    • Can I write php in russain?
    • Can i write php in english and russian in the same file?

Assumption: if I or anyone opens a UTF-8 encoded file and type into it, in any language or chars it will properly map them and display properly.

Can anyone shine some light on this subject?

Continue reading Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?→

Special characters in filename leads to starting virus executable [duplicate]

Posted on by

This question already has an answer here:

So I’ve just downloaded torrent with one file in it – the formal name of file should be “123.avi.exe” (which is typical for viruses and trojans). Now, interesting thing is that name is encoded in UTF16-LE as following bytes:

FFFE3100320033002E002D202E202D202E206900760061002E00650078006500

which gives us strange, partially reversed over “.exe” text (try to move cursor left-to-right and you will be surprised):

123.‭‮‭‮iva.exe

But the bad part of all – is that utorrent showing non-suspicious “.avi” extension while when you double click it in GUI – it goes as as “.exe” and program runs.

You can test it yourself by creating dummy file with the name I wrote above. One more interesting thing – Total Commander prevents executing such file if it’s name contains these special characters.

P.S. I’ve started similar thread on uTorrent tracker (not yet approved by moderator)

Continue reading Special characters in filename leads to starting virus executable [duplicate]→

Impact of New Linux Kernel DCCP Vulnerability Limited

Posted on by

Existing mitigations and limitations around a newly disclosed Linux kernel vulnerability in the DCCP module mute the potential impact of local attacks. Continue reading Impact of New Linux Kernel DCCP Vulnerability Limited→