Emulating Shellcodes - Chapter 2
Lets check different Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.
This stages are fully emulated well and can get the IOC and the behavior of the shellcode.
But lets see another first stage big shellcode with c runtime embedded in a second stage.
In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.
Here there are two types of allocations:
Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.
The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.
Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.
So we have second stage unpacked in alloc_e40064
With "mdd" we do a memory dump to disk we found the size in previous screenshot, and we can do some static reversing of stage2 in radare/ghidra/ida
In radare we can verify that the extracted is the next stage:
I usually do correlation between the emulation and ghidra, to understand the algorithms.
If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and is calling the allocated buffer in 0x4f...
And this stage2 perform several API calls let's check it in ghidra.
We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls
Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;
So lets say yes and continue the emulation.
Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected.
Nevertheless the shellcode detects something and terminates the process.
Lets trace the branches to understand the logic:
target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'
Lets see from the console where is pointing the SEH chain item:
to be continued ...
https://github.com/sha0coder/scemu
More info
- Hack And Tools
- Hacker Tools For Windows
- Hacking Tools Name
- Hacker Tools For Ios
- Blackhat Hacker Tools
- Growth Hacker Tools
- Hacker Tools
- Hacker Search Tools
- Hacking Tools Windows 10
- Pentest Tools For Ubuntu
- What Are Hacking Tools
- Hacker Tools Software
- Hacker Hardware Tools
- Hack Tools For Pc
- Hacking Tools For Windows 7
- Hacking Tools Mac
- Bluetooth Hacking Tools Kali
- Hack Tools
- Easy Hack Tools
- Hacking Tools For Windows Free Download
- Easy Hack Tools
- Install Pentest Tools Ubuntu
- Hacking Tools For Kali Linux
- Hacking Tools Windows
- Hack Tool Apk
- Hacking Tools 2019
- Hack Tool Apk No Root
- Github Hacking Tools
- Hack Tools Pc
- Pentest Tools Url Fuzzer
- Best Pentesting Tools 2018
- Hacker Tools Online
- Pentest Tools
- Pentest Tools For Android
- Hack Tools
- Pentest Tools Tcp Port Scanner
- Bluetooth Hacking Tools Kali
- Hacker Techniques Tools And Incident Handling
- Hacker Tools Github
- Tools 4 Hack
- Hak5 Tools
- Android Hack Tools Github
- Hacker Tools Free Download
- Pentest Tools List
- Pentest Tools Port Scanner
- Pentest Tools Android
- Game Hacking
- How To Install Pentest Tools In Ubuntu
- Hack Tools Github
- Pentest Tools Nmap
- Pentest Tools
- Hacking Tools For Games
- Hacker Hardware Tools
- Hack Tools For Games
- Hacker
- Hack Tools
- Game Hacking
- Wifi Hacker Tools For Windows
- Pentest Tools Framework
- Hacking Tools Windows
- Blackhat Hacker Tools
- Pentest Tools Website
- Best Pentesting Tools 2018
- Hack Apps
- Pentest Tools Bluekeep
- Tools Used For Hacking
- Hack Tools Github
- Nsa Hack Tools
- Github Hacking Tools
- Hacking Tools Mac
- Hacker Tools Windows
- Game Hacking
- Pentest Tools Open Source
- World No 1 Hacker Software
- Hacker
- What Is Hacking Tools
- Pentest Tools Port Scanner
- Free Pentest Tools For Windows
- Pentest Tools Bluekeep
- Hack Tools For Pc
- Hacking Tools Free Download
- Pentest Tools For Ubuntu
- How To Install Pentest Tools In Ubuntu
- Android Hack Tools Github
- Hackrf Tools
- Hacking Tools For Beginners
- Pentest Tools Kali Linux
- Tools 4 Hack
- Hack Tool Apk
- Pentest Tools For Android
- Hacking Tools Software
- Hacking Tools 2019
- Free Pentest Tools For Windows
- Hacker Tools List
- Hacking Tools Online
- Free Pentest Tools For Windows
- Pentest Tools Nmap
- Android Hack Tools Github
- Hacking Tools Windows
- Hacking Tools Kit
- Hacker Tools For Pc
- Hacking Tools For Pc
- Pentest Tools Github
- Bluetooth Hacking Tools Kali
- Pentest Tools Subdomain
- Hack Tools For Games
- Hacker Hardware Tools
- Hack Tool Apk
- Hack Tools For Mac
- Pentest Tools Github
- Hack Tool Apk
- Tools Used For Hacking
0 Comments:
Post a Comment
<< Home