CheckPlease - Payload-Agnostic Implant Security

CheckPlease -
Payload-Agnostic
Implant Security
@Arvanaghi & @ChrisTruncer

Brandon Arvanaghi
Associate Consultant at Mandiant
Red teaming, reverse engineering, tool development
Vanderbilt University 2

Chris Truncer
Previous Sys Admin turned Red Team
West Coast Red Team Lead
Open Source Developer
Veil, EyeWitness, WMImplant
3

Pop Quiz
Which is more effective at stopping malicious
applications from executing?
1) Application Whitelisting
2) Application Blacklisting
4
@Arvanaghi
@ChrisTruncer

Pop Quiz
• Answer: Application Whitelisting!
• Rather than trying to figure out everything we don’t want to allow, we
identify what we do want
• Disallow all else!
• AppLocker on Windows 7, 8, 10
5
@Arvanaghi
@ChrisTruncer

Sandbox Detection
• A sandbox is a virtual environment designed to
monitor malware behavior
• Dynamic analysis
• Malware acts benign if it thinks it is being dynamically
analyzed
6
@Arvanaghi
@ChrisTruncer

Sandbox Detection
• Old thinking: sandboxes look a certain way, so let’s specifically check if we
are in a sandbox in our payloads
• Avoid running if it’s the case
• Registry keys and values, MAC addresses, limited RAM, etc.
• Can be useful!
7
@Arvanaghi
@ChrisTruncer

Realization
• Trying to detect if you are in a sandbox is a form of
blacklisting!
• Identifying every kind of sandbox is too hard!
• Why do we write sandbox detection checks in the first place?
9
@Arvanaghi
@ChrisTruncer

Realization
We want our malware to run where
we expect.
Avoiding sandboxes is a byproduct of that.
10
@Arvanaghi
@ChrisTruncer

Workflow for Implant Security
1. Get initial access into domain
a. Limited information
2. Immediately exfiltrate domain data
a. We don’t dump creds initially, do we?
3. Never use a non-targeted payload again for that domain!
12
@Arvanaghi
@ChrisTruncer

The Problems with Pure Sandbox Detection
1. You are not that smart.
13

1. You are not that smart.
Hard enough debugging failed payloads.
AV? RAT? Whitelisting? Hard to say.
14

2. Uptick in VM usage
15

2. Uptick in VM usage
VMs used to be indicative of sandboxes
Today, they are critical assets.
We want to target them!
16

3. Sandboxes look like legacy systems
17

3. Sandboxes look like legacy systems
Legacy systems are easiest to target
Blacklisting sandboxes means
missing out!
18

4. Anti-Anti-VM
19

4. Anti-Anti-VM
How many more Anti-s do you want?
• Attackers strike
• Defenders detect
• Attackers mod
• Goto 1
20

Creating a Payload-Agnostic Repository
• Implant security modules are exclusively written in C!
• Or discussed abstractly
• Payload deliverance growing in non-standard languages
• Let’s make a centralized library implementing these
techniques in all languages!
22
@Arvanaghi
@ChrisTruncer

CheckPlease: Languages Supported
• C
23

• C
• C#
24

• C
• C#
• PowerShell
25

• C
• C#
• PowerShell
• Python
26

• C
• C#
• PowerShell
• Python
• Go
27

• C
• C#
• PowerShell
• Python
• Go
• Ruby
28

• C
• C#
• PowerShell
• Python
• Go
• Ruby
• Perl
29

Why don’t sandboxes follow all paths?
• Design decision for sandboxes
• Don’t have the computing power to follow all trees
32
@Arvanaghi
@ChrisTruncer

Why don’t sandboxes follow all paths?
Example problem:
if ($env:username -eq “USERNAME THAT WOULD NEVER EXIST”) {
# Expand into several branches of nonsense
# Goal: waste the sandbox’s time and resources
# Sandbox rendered useless
}
33
@Arvanaghi
@ChrisTruncer

Parent Process
• Every time we launch a payload, we know exactly
what the parent process should be!
• Word document?
• PDF document?
• HTA application?
• Most languages support finding the ppid
• Use that to find the string name of process
35
@Arvanaghi
@ChrisTruncer

Payload Sleeping
39
@Arvanaghi
@ChrisTruncer
• This is the first thing most people will try
• Making your code sleep an hour
• Should work right?
• Sandbox can’t keep resources running that long!
• Nope

Payload Sleeping
40
@Arvanaghi
@ChrisTruncer
• Developers obviously know this too
• Look for sleep calls and hook them
• Fast-forward any sleep call
• Immediately jump to next part of the code
• So… how can this be beaten?

Payload Sleeping
41
@Arvanaghi
@ChrisTruncer
• Outsource time requests to NTP servers!
• Request current time from NTP server
• Try to sleep for the requested amount of time
• Make another request for the current time from a
NTP server

Payload Sleeping
42
@Arvanaghi
@ChrisTruncer
• Alternative option
• Can you develop a function which take an
approximate amount of time to compute?
• Iterate over that function as many times as you’d
like to sleep.
• RemoveS the network dependency for the
check

Encrypt with Targeted Indicators
• To protect our implant from running where we don’t
expect, we can encrypt it
• The key? An indicator from our targeted host
• MAC address
• Username + hostname
• Etc.
• Once again, sandbox is a BYPRODUCT!
45
@Arvanaghi
@ChrisTruncer

• How does this work?
• Payload dynamically pulls system information
• System information is concatenated to generate
an encryption key
• If key is correct, decrypt data and run the real
code
• If not, assume on the wrong system and die
46
@Arvanaghi
@ChrisTruncer

Ebowla is a great example of this in practice:
https://github.com/Genetic-Malware/Ebowla
47
@Arvanaghi
@ChrisTruncer

Delay-Analysis Module
• In the hands of a skilled reverse engineer, nothing is infallible
• That’s not the goal, just beat initial automated analysis
• This can start at the source code level
• Used Hyperion?
48
@Arvanaghi
@ChrisTruncer

• Hyperion receives your “file” and outputs a different encrypted file
• The output is encrypted with no key stored inside
• Due to an artificially constrained keyspace, it brute forces itself
• Let’s recreate this!
49
@Arvanaghi
@ChrisTruncer

• The Delay-Analysis Python script receives an input file
• Your source code
• Select the language your code is in
• Output is encrypted code which brute forces itself at runtime
50
@Arvanaghi
@ChrisTruncer

51
Python: Delay Analysis
@Arvanaghi
@ChrisTruncer

Targeted Code
Host Metadata
54

Process Names
• Easy to write code that enumerates running
processes
• Validate that no-blacklisted processes are running at
the same time
• Wireshark
• VMWare
• Process Explorer
• tshark
55
@Arvanaghi
@ChrisTruncer

Process Names
56
@Arvanaghi
@ChrisTruncer

Windows Updates
• The number of recent Windows updates can provide
information about the system
• How often it is patched
• Uptime
• Real users will likely update more than sandboxes
57
@Arvanaghi
@ChrisTruncer

Windows Updates
58
@Arvanaghi
@ChrisTruncer

Registry Size
• Do you know the approximate size of your system’s
registry?
• Fingerprint this information for an approximate size
within the targeted organization
• Validate it at runtime!
59
@Arvanaghi
@ChrisTruncer

User Activity
61
We all love users :)

User Interaction
• Reasons you want a user present
• Authed but don’t have user’s credentials
• Present a prompt to enter creds
• Watch them on VNC, see internal sites they navigate to
• Built-in cobalt strike
• Two-factor push notification
• Etc.
62
@Arvanaghi
@ChrisTruncer

Mouse Clicks
• Check for user presence via mouse activity
• If the mouse is registering clicks, it’s indicative of user activity
• Require a minimum number of clicks prior to executing the
“protected code”
63
@Arvanaghi
@ChrisTruncer

Python: Execute after “N” clicks Mouse Clicks
64
@Arvanaghi
@ChrisTruncer

PowerShell: Execute after “N” clicks Mouse
Clicks
65
@Arvanaghi
@ChrisTruncer

Mouse Position
• In addition to mouse clicks as one metric for user activity, track
mouse location
• Console can be broken down into (x,y) positions
• Perform a comparison of mouse location over a period of time
• 30 seconds?
• Should be near impossible to have the exact same location
66
@Arvanaghi
@ChrisTruncer

Go: Check Mouse Position
67
@Arvanaghi
@ChrisTruncer

Prompt Users!
• Users already get prompted for a variety of reasons, what’s one
more?
• They already just give us passwords, why not click a
button?
• Sole purpose is to require interactive use prior to code execution
• When run, the code will present the user with a pop-up, and will
wait to run
68
@Arvanaghi
@ChrisTruncer

What else can we want to target?
• Number of USB drives mounted on the system
• Number of web browsers
• Minimum number of processes
• Whether certain files exist on disk
• Whether specific Registry keys/values exist (think installed programs, etc.)
• The number of processors on the system
• The minimum RAM size
• The minimum disk size
• The size of the Registry
• Whether a DLL is loaded
• Whether a process is running
71

Only Running on Targeted System
if ((Get-WMIObject -Class Win32_ComputerSystem).Domain -eq
$expectedDomain) {
}
73

$expectedDomain) {
if ($env:username -eq $expectedUsername) {
}
}
74

$expectedDomain) {
if ($env:computername -eq $expectedHostname) {
}
}
}
75

$expectedDomain) {
if ($env:computername -eq $expectedHostname) {
# Passed all checks, proceed!
}
}
}
76

Veil
• This is a great opportunity to contribute to Veil’s codebase
• Add in a means to automatically develop targeted payloads
• Merge the code and quick demo
77

79
THANKS!
Any questions?
https://github.com/Arvanaghi/CheckPlease
@Arvanaghi
@ChrisTruncer

CheckPlease - Payload-Agnostic Implant Security

More Related Content

What's hot

Similar to CheckPlease - Payload-Agnostic Implant Security

Recently uploaded

CheckPlease - Payload-Agnostic Implant Security

Editor's Notes