DEF CON 27 - AMIT WAISEL and HILA COHEN - malproxy
•
0 likes•78 views
DEF CON 27 - AMIT WAISEL and HILA COHEN - malproxy
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to DEF CON 27 - AMIT WAISEL and HILA COHEN - malproxy
Similar to DEF CON 27 - AMIT WAISEL and HILA COHEN - malproxy (20)
More from Felipe Prado
More from Felipe Prado (20)
Recently uploaded
Recently uploaded (20)
DEF CON 27 - AMIT WAISEL and HILA COHEN - malproxy
- 1. Leave your malware @home MALPROXY Amit Waisel Hila Cohen
- 2. US AboutAmit Waisel Offensive Cyber Security Expert Technology lead, Security Research @ XM Cyber Trusted Security Advisor Favorite bit: 1 Private Pilot , Skipper and cat lover Hila Cohen Security Researcher @ XM Cyber @hilaco10 Passionate about Windows Internals and Malware Analysis Love to dance, travel the world and capture moments with my camera
- 3. Endpoint protections introduction Malproxy - A new technique to bypass endpoint protections Demo Mitigations TL;DR
- 4. &Organizations heavily rely on endpoint protection solutions in their security stack Unfair cat-and-mouse game Security solutions evolved over time, so are the viruses
- 5. What do you know about your endpoint protection solutions?
- 6. not great, not terrible Anatoly Dyatlov ”
- 7. malicious activity detection mechanisms Endpoint Protection 101 Static signatures Behavioral signatures 1 3 Heuristics 2
- 8. Static signatures1 Behavioral signatures Heuristics2 3 //testbin.c int main () { char *user = "adm.user"; printf("%sn",user); return 0; }
- 9. Static signatures1 Behavioral signatures Heuristics2 3 rule APT_adm_corp : apt //apt is just a tag, it doesn’t affect the rule. { meta: //Metadata, they don’t affect the rule author = "xgusix" strings: $adm = "adm." $corp = "corp." $elf = { 7f 45 4c 46 } //ELF file’s magic numbers condition: $elf in (0..4) and ($adm or $corp) // If $elf in the first 4 bytes and it matches $adm or $corp }
- 10. Static signatures1 Behavioral signatures Heuristics2 3 # yara -s -m -g rules.yar testbin APT_adm_corp [apt] [author="xgusix"] testbin 0x0:$elf: 7F 45 4C 46 0x4c0:$adm: adm.
- 11. Static signatures1 Behavioral signatures Heuristics2 3 HackTool:Win32/OurCoolMimikatzSignature: "A La Vie, A L'Amour" - (oe.eo) Benjamin DELPY `gentilkiwi` Vincent LE TOUX ## / ## sekurlsa logonpasswords
- 12. Static signatures1 Heuristics2 Behavioral signatures3 UPX2.data.textProperty 0x000034000x000004000x00000400Raw-address 0x200 bytes0x3000 bytes0x0 bytesRaw-size 0x0040A0000x004070000x00401000Virtual-address 0x1000 bytes0x3000 bytes0x6000 bytesVirtual-size +-+Executable -++Writable
- 17. Looking for my code somewhere? You will never get this!
- 18. Target OS Process ALPROX Malicious code interacts with the underlying OS using API function calls Those actions can be detected and blocked by any security solution Malicious code A PI
- 19. ALPROX Proxy the malicious operations over the network Never deploying the actual malicious code on the target side Emulating needed API calls Attacker OS Stub Malicious code Stub Innocent code Target OS A PI
- 20. ALPROX Target & attacker stubs Load the PE file and hook system API functions Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat. Attacker OS Stub Malicious code Target OS Stub Innocent code A PI
- 21. ALPROX Target & attacker stubs Load the PE file and hook system API functions Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat. Attacker OS Stub Malicious code Target OS Stub Innocent code Cre ateFile(”blah.t xt”) A PI
- 22. ALPROX Target & attacker stubs Load the PE file and hook system API functions Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat. Attacker OS Stub Malicious code Target OS Stub Innocent code Cre ateFile(”blah.t xt”) A PI
- 23. ALPROX Target & attacker stubs Load the PE file and hook system API functions Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat. Attacker OS Stub Malicious code Target OS Stub Innocent code H ANDLE blah.t xtA PI
- 24. ALPROX Target & attacker stubs Load the PE file and hook system API functions Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat. Attacker OS Stub Malicious code Target OS Stub Innocent code H ANDLE blah.t xtA PI
- 25. Key terms: SYSTEM CALLS OVERVIEW USER MODE KERNEL MODE Kernel32.dll CreateFile Call CreateFile Call NtCreateFile SYSENTERSYSCALL Find relevant function in SSDT and executes it NtCreateFile ZwCreateFile Ntdll.dll Ntoskrnl Windows Application
- 26. Key terms: SYSTEM CALLS OVERVIEW USER MODE KERNEL MODE Kernel32.dll CreateFile Call CreateFile Call NtCreateFile SYSENTERSYSCALL Find relevant function in SSDT and executes it NtCreateFile ZwCreateFile Ntdll.dll Ntoskrnl Windows Application
- 27. Key terms: SYSTEM CALLS OVERVIEW USER MODE KERNEL MODE Kernel32.dll CreateFile Call CreateFile Call NtCreateFile SYSENTERSYSCALL Find relevant function in SSDT and executes it NtCreateFile ZwCreateFile Ntdll.dll Ntoskrnl Windows Application
- 28. Key terms: SYSTEM CALLS OVERVIEW USER MODE KERNEL MODE Kernel32.dll CreateFile Call CreateFile Call NtCreateFile SYSENTERSYSCALL Find relevant function in SSDT and executes it NtCreateFile ZwCreateFile Ntdll.dll Ntoskrnl Windows Application
- 29. Key terms: SYSTEM CALLS OVERVIEW USER MODE KERNEL MODE Kernel32.dll CreateFile Call CreateFile Call NtCreateFile SYSENTERSYSCALL Find relevant function in SSDT and executes it NtCreateFile ZwCreateFile Ntdll.dll Ntoskrnl Windows Application Process Innocent code COMPUTER OS A PI
- 30. Key terms: SYSTEM CALLS OVERVIEW USER MODE KERNEL MODE Kernel32.dll CreateFile Call CreateFile Call NtCreateFile SYSENTERSYSCALL Find relevant function in SSDT and executes it NtCreateFile ZwCreateFile Ntdll.dll Ntoskrnl Process Innocent code COMPUTER OS Windows Application A PI
- 31. Key terms: HOOKING Redirect system API calls to our code Control all arguments & return value Imported system API function addresses are resolved during PE load process and can be overridden later – IAT hooking This allows us to separate the code’s logic from its interaction with the OS IMPORT ADDRESS TABLE NtQuerySystemInformation Malproxy OpenProcess Malproxy ReadProcessMemory Malproxy BCryptGenerateSymetricKey Bcrypt.dll ConvertSidToStringSidW Advapi32.dll … … RtlAdjustPrivilege Malproxy NtQueryInformationProcess Malproxy RtlEqualUnicodeString Ntdll.dll
- 32. Key terms: BOOL stdcall ReadProcessMemory(HANDLE hProcrss, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead); Return Type Calling Convention Function arguments FUNCTION PROTOTYPE
- 33. Dealing with all aspects of different prototypes Proxying Win32 API Calling convention – same for all Win32API and Native API calls Input Arguments: Primitives Pointers to primitives User-allocated buffers Output Arguments: User-allocated output buffer System- allocated output buffer Return values
- 34. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength );
- 35. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE Request Message ProcessHandle
- 36. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE Request Message ProcessHandle ProcessInformationClass
- 37. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE Request Message ProcessHandle ProcessInformationClass
- 38. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE Request Message ProcessHandle ProcessInformationClass ProcessInformationLength
- 39. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE Request Message ProcessHandle ProcessInformationClass ProcessInformationLength
- 40. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE TARGET SIDE Request Message ProcessHandle ProcessInformationClass ProcessInformationLength
- 41. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE TARGET SIDE Request Message ProcessHandle ProcessInformationClass ProcessInformationLength
- 42. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE TARGET SIDE Response Message ReturnLength
- 43. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE TARGET SIDE Response Message ReturnLength
- 44. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE TARGET SIDE Response Message ProcessInformation ReturnLength
- 45. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE TARGET SIDE Response Message ProcessInformation ReturnLength Return value
- 46. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); Response Message NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); TARGET SIDEATTACKER SIDE ProcessInformation ReturnLength Return value
- 47. Handling ARGUMENTS NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); NTSTATUS NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); ATTACKER SIDE TARGET SIDE Response Message ProcessInformation ReturnLength Return value
- 48. Attacker OS Process Malicious code Target OS Process Innocent code RECAP Target & attacker stubs Load the PE file and hook system API functions Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat. A PI
- 51. Running MALPROXY ATTACKER SIDE IMPORT ADDRESS TABLE NtQuerySystemInformation Kernel32.dll OpenProcess Kernel32.dll ReadProcessMemory Ntdll.dll BCryptGenerateSymetricKey Bcrypt.dll ConvertSidToStringSidW Advapi32.dll … … RtlAdjustPrivilege Ntdll.dll NtQueryInformationProcess Ntdll.dll RtlEqualUnicodeString Ntdll.dll TARGET SIDE
- 52. Running MALPROXY ATTACKER SIDE IMPORT ADDRESS TABLE NtQuerySystemInformation Malproxy OpenProcess Malproxy ReadProcessMemory Malproxy BCryptGenerateSymetricKey Bcrypt.dll ConvertSidToStringSidW Advapi32.dll … … RtlAdjustPrivilege Malproxy NtQueryInformationProcess Malproxy RtlEqualUnicodeString Ntdll.dll TARGET SIDE
- 58. Running MALPROXY ATTACKER SIDE RtlAdjustPrivilege NtQuerySystemInformation RtlEqualUnicodeString OpenProcess NtQueryInformationProcess ReadProcessMemory BCryptDecrypt RtlAdjustPrivilege NtQuerySystemInformation OpenProcess NtQueryInformationProcess Handle 0x00000080 PEB at 0xdeadbeef TARGET SIDE
- 59. Running MALPROXY ATTACKER SIDE RtlAdjustPrivilege NtQuerySystemInformation RtlEqualUnicodeString OpenProcess NtQueryInformationProcess ReadProcessMemory BCryptDecrypt RtlAdjustPrivilege NtQuerySystemInformation OpenProcess NtQueryInformationProcess ReadProcessMemory Read 0xdeadbeef [0x12, 0x34, 0x56, 0x78] TARGET SIDE
- 62. DEMO
- 63. ”You came off as a naive idiot. and naive idiots are not a threat
- 64. Endpoint protections BYPASS Behavioral Signatures Bypassing Heuristic Rules Bypassing Static Signatures
- 65. Security Solution Mimikatz sekurlsa::logonpasswords Microsoft Defender Malproxied! Symantec Norton Security Malproxied! Kaspersky Internet Security Blocks ReadProcessMemory without a verdict ESET Smart Security Malproxied! Avast Free Antivirus Blocks OpenProcess on lsass.exe without a verdict Bitdefender Total Security Malproxied! McAfee Total Protection Malproxied!
- 66. ”Why worry about something that isn't going to happen?
- 67. MITIGATIONS Any more ideas?Hunt and sign the target-side proxy stub Improve the behavioral signature engines to handle their known weaknesses
- 68. MITIGATIONS Any more ideas? /dev/nullHunt and sign the target-side proxy stub Improve the behavioral signature engines to handle their known weaknesses
- 69. CREDITSThe Crazy Ideas Section - Remote Syscalls by Yaron Shani: http://breaking-the-system.blogspot.com/2016/06/the-crazy-ideas-section- remote-syscalls.html Syscall Proxying - Simulating remote execution by Maximiliano Caceres: http://www.vodun.org/papers/exploits/SyscallProxying.pdf Syscall Proxying || Pivoting Systems by Filipe Balestra and Rodrigo Rubira Branco: https://www.kernelhacking.com/rodrigo/docs/H2HCIII.pdf
- 70. Questions?