Metasploit mailing list archives

Re: Transient Context when encoding payloads

From: HD Moore <hdm () metasploit com>
Date: Tue, 22 Dec 2009 22:30:26 -0600

On 12/22/2009 10:05 PM, Jeffs wrote:

What does "Use transient context when encoding payloads" mean under the
show advanced menu?


Paper on the technique here:
http://www.uninformed.org/?v=9&a=3&t=pdf

Basically you can use a "shared secret" (existing memory) to encode the
shellcode so that even with full network captures it is impossible to
decrypt without knowing what memory was used. Think of it as a really
bad one-time-bad, but still good enough to break automated analysis.

-HD
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework

Current thread:

AutoRunScript option anil saini (Dec 16)
- Re: AutoRunScript option HD Moore (Dec 16)
  - include my own bin in metasploit exploits Jeffs (Dec 19)
  - Transient Context when encoding payloads Jeffs (Dec 22)
    - Re: Transient Context when encoding payloads HD Moore (Dec 22)