> For the complete documentation index, see [llms.txt](https://www.vincentyiu.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.vincentyiu.com/red-team/cve-exploitation/ipfuscation.md).
# IPFuscation
{% hint style="warning" %}
Images are broken. I will fix when I have time.
{% endhint %}
## What the...
IPFuscation is a technique that allows for IP addresses to be represented in hexadecimal, octal, or a combination, instead of the decimal encoding that we are used to.
## What can we do?
Normal:\
`ping 45.54.123.21`
Hexadecimal + Decimal + Octal:\
`ping 0x2d.54.123.025`
Hexadecimal:\
`ping 0x2d367b15`
Hexadecimal with period symbol:\
`ping 0x2d.0x36.0x7b.0x15`
Hexadecimal with 0 padding:\
`ping 0x0000000002d.0x00000000036.0x00000007b.0x0000000015`
Decimal:\
`ping 758545173`
Octal:\
`ping 05515475425`
Octal with period symbol:\
`ping 055.066.0173.025`
Octal with 0 padding:\
`ping 000000055.000066.000000173.0000000025`
As we can see there's a bunch of ways you can ping the same IP. For a moment, I wondered if this was just how Ping worked. However, given that this works with `OpenURL`, I decided to try it with Cobalt Strike!
## GitHub
I wrote a script that automatically outputs a set of known formats for the same IP address that you specify. Hopefully will be useful for some people!
### Usage
```
python .\ipfuscator.py 127.0.0.1
IPFuscator
Author: Vincent Yiu (@vysecurity)
https://www.github.com/vysec/IPFuscator
Version: 0.1.0
IP Address: 127.0.0.1
Decimal: 2130706433
Hexadecimal: 0x7f000001
Octal: 017700000001
Full Hex: 0x7f.0x0.0x0.0x1
Full Oct: 0177.0.0.01
Random Padding:
Hex: 0x000000000000000007f.0x00000000000000000000.0x0000000000000000000.0x0000000000000000000001
Oct: 0000000000000000000000000177.000000000000000.0000000000000000000000.0000000000000000000000000000001
Random base:
#1: 0x7f.0x0.0.1
#2: 127.0.0x0.0x1
#3: 0177.0x0.0.1
#4: 0x7f.0.0.1
#5: 127.0x0.0x0.1
Random base with random padding:
#1: 0x0000000007f.0.0000000000.00000000000001
#2: 0x000000000007f.0x0000000000000000000000.0x00000000000000.0x00000000001
#3: 00000000000000000000000177.0x00000000.000000000000000.00000000000000000000000001
#4: 000000000000000177.0.0.1
#5: 127.0000000000000000000000.00000000000000.0x0000000000001
```
## Cobalt Strike
Although I rarely use IP addresses compared to hostnames when it comes to connecting to resources, we know for a fact that many threat actors do. In some cases you may want to resort to using IP addresses and this technique can add a bit of flavor to the mix.
To use this technique in Cobalt Strike, you simply create a listener like you normally would. Let's say my IP was `45.54.123.21`, run IPFuscator as shown below:
You can immediately take this information and use any of these representations in your listener address. For example:\
Generate a payload as you would normally, and it all works fantastically!
You could even mix it up a bit:
## Cobalt Strike Aggressor Script
I actually wrote a Cobalt Strike Aggressor Script to automatically convert an IP that you can issue with the `ping` command that will convert and use ping with a hexadecimal equivalent IP. If you want to use this you can obtain this script in my [Aggressor repository](https://github.com/vysec/Aggressor-VYSEC/blob/master/ping.cna). This was released back in 2017.
## Conclusion
IPFuscation is not an advanced technique. However, it can be used to:
1. potentially break regex rules for command line logging looking for IP addresses. Eg. when you issue a command such as `ping 0055.0x0036.000173.0x0015`
2. obfuscate previously unobfuscated / unencrypted cleartext strings to C2 locations within the payload
According to inphosys on Reddit, the proxy sees the regular decimal IP address notation:
To keep it simple, make the use of IPs cool again! :)