Kali Linux

TrojanSourceFinder : Help Find Trojan Source Vulnerability In Code

TrojanSourceFinder is a Trojan Source vulnerability allows an attacker to make malicious code appear innocent. In general, the attacker tries to lure by passing his code off as a comment (visually). It is a serious threat because it concerns many languages. Projects with multiple “untrusted” sources could be concerned.

Install

With go

Via go install

go install github.com/ariary/TrojanSourceFinder/cmd/tsfinder@latest

Make sure $GOPATH is in your $PATH

From source

git clone https://github.com/ariary/TrojanSourceFinder
cd TrojanSourceFinder
make before.build
make build.tsfinder

If the command make build.tsfinder failed, try:

env GOOS=target-OS GOARCH=target-architecture
go build -o tsfinder cmd/main.go

With curl

From release

curl -lO -L https://github.com/ariary/TrojanSourceFinder/releases/latest/download/tsfinder && chmod +x tsfinder

Detect Trojan Source

> Help the detection of Trojan source for manual code review or with CI/CD pipelines (Unicode bidirectional characaters)

To detect Trojan source in file or directory <path>:

tsfinder [path]

Detect only in text file

> Source code files are likely text files. Withdraw them for scan could help to rule out false positives

tsfinder -t [path]

Add -v help to see which file has been skipped by scan.

Go further (Homoglyph)

Trojan Source is not new and isn’t the only hazard. Another one is “Homoglyph”.(Kezako?)

tsfinder help detecting them with homoglyph command:

tsfinder homoglyph [filename] [flags]

You could see if there is a sibling (ie word with same “skeleton”) for the homographs found in path using the flag --sibling:

tsfinder homoglyph [filename] –sibling [path]

Visualize Trojan Source

> Visualize how the code is really interpreted by machines/compiler

tsfinder is deliberately not very verbose. By default, it will only output if Trojan Source code has been detected. To have more verbosity and visualize the dangerous line add the flag -v.

To better see where Trojan Sources were, you could enable colored output with -c flag (also useful with directory scan):

tsfinder -c -v

Demo

Homoglyph

R K

Recent Posts

ModTask – Task Scheduler Attack Tool

ModTask is an advanced C# tool designed for red teaming operations, focusing on manipulating scheduled…

20 hours ago

HellBunny : Advanced Shellcode Loader For EDR Evasio

HellBunny is a malleable shellcode loader written in C and Assembly utilizing direct and indirect…

20 hours ago

SharpRedirect : A Lightweight And Efficient .NET-Based TCP Redirector

SharpRedirect is a simple .NET Framework-based redirector from a specified local port to a destination…

20 hours ago

Flyphish : Mastering Cloud-Based Phishing Simulations For Security Assessments

Flyphish is an Ansible playbook allowing cyber security consultants to deploy a phishing server in…

2 days ago

DeLink : Decrypting D-Link Firmware Across Devices With A Rust-Based Library

A crypto library to decrypt various encrypted D-Link firmware images. Confirmed to work on the…

2 days ago

LLM Lies : Hallucinations Are Not Bugs, But Features As Adversarial Examples

LLMs (e.g., GPT-3.5, LLaMA, and PaLM) suffer from hallucination—fabricating non-existent facts to cheat users without…

2 days ago