Lets check different Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.
This stages are fully emulated well and can get the IOC and the behavior of the shellcode.
But lets see another first stage big shellcode with c runtime embedded in a second stage.
In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.
Here there are two types of allocations:
Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.
The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.
Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.
So we have second stage unpacked in alloc_e40064
With "mdd" we do a memory dump to disk we found the size in previous screenshot, and we can do some static reversing of stage2 in radare/ghidra/ida
In radare we can verify that the extracted is the next stage:
I usually do correlation between the emulation and ghidra, to understand the algorithms.
If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and is calling the allocated buffer in 0x4f...
And this stage2 perform several API calls let's check it in ghidra.
We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls
Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;
So lets say yes and continue the emulation.
Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected.
Nevertheless the shellcode detects something and terminates the process.
Lets trace the branches to understand the logic:
target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'
Lets see from the console where is pointing the SEH chain item:
to be continued ...
https://github.com/sha0coder/scemu
More articles
- Pentest Tools Bluekeep
- New Hack Tools
- Pentest Tools Framework
- Free Pentest Tools For Windows
- Tools 4 Hack
- Ethical Hacker Tools
- Pentest Tools Linux
- Hack Tools For Pc
- Hack Tools For Windows
- Easy Hack Tools
- Hacker Tools 2019
- Pentest Tools Online
- Hack And Tools
- Hacking Tools 2020
- Pentest Tools List
- New Hack Tools
- Pentest Tools Download
- Tools 4 Hack
- Hacking Tools For Windows 7
- Free Pentest Tools For Windows
- Pentest Tools Framework
- Pentest Tools Github
- Hacking Tools For Windows
- Hacking Tools 2020
- Nsa Hack Tools
- Hack Apps
- Hacker Tools Mac
- Beginner Hacker Tools
- Black Hat Hacker Tools
- Hacking Tools 2019
- Hacker Tools Apk Download
- Nsa Hacker Tools
- Hacker Search Tools
- Pentest Tools Port Scanner
- Hacker Hardware Tools
- Hacker Tools Online
- Hack Tools 2019
- Pentest Tools Open Source
- Termux Hacking Tools 2019
- Beginner Hacker Tools
- Pentest Tools Framework
- Hacking Tools And Software
- Hack Apps
- Pentest Tools Port Scanner
- Hacker Tools Free Download
- Hack Tools
- Android Hack Tools Github
- Hacking Tools For Windows
- Hack Tools For Windows
- Pentest Tools List
- Hacker
- What Is Hacking Tools
- Hack Tools For Ubuntu
- Pentest Tools For Ubuntu
- Hacking Tools For Beginners
- Pentest Tools Apk
- How To Make Hacking Tools
- Usb Pentest Tools
- Hacking Tools For Windows 7
- Hack Tools For Windows
- Hacker Tools
- Pentest Tools Linux
- Hacking Tools Windows
- Pentest Tools Github
- Pentest Tools Find Subdomains
- Wifi Hacker Tools For Windows
- Pentest Automation Tools
- Bluetooth Hacking Tools Kali
- Hacker Tools For Pc
- Best Pentesting Tools 2018
- Hack Tools Online
- Hack Tools Download
- Hackrf Tools
- Hacker Tools Windows
- Hacking Apps
- Pentest Tools Port Scanner
- Hacking Tools Name
- Usb Pentest Tools
- Hacker Tools Github
- Hack Tools Download
- Tools Used For Hacking
- Hack Tools 2019
- Hacking Tools For Windows 7
- Hacking Tools Windows
- Pentest Tools Open Source
- Hacker Tools Github
- Hacker Tools For Mac
- Pentest Tools Github
- Hacker Tools Software
- Hack Tool Apk No Root
- Pentest Tools Find Subdomains
- World No 1 Hacker Software
- Pentest Tools Find Subdomains
- Hack Tools Mac
- Hacking Tools Pc
- Growth Hacker Tools
- Hacking Tools Free Download
- Underground Hacker Sites
- Termux Hacking Tools 2019
- Hacker Tools Hardware
- Pentest Tools Review
- Hacker Tools Software
- Android Hack Tools Github
- Hack Tools Online
- Hacker Tools
- Hack Tools
- New Hacker Tools
- Pentest Tools Alternative
- Pentest Tools Download
- Hacking Tools For Mac
- Pentest Tools Online
- Hacker Tools Online
- Hacker Tools Apk Download
- Pentest Tools Nmap
- Hacks And Tools
- Best Pentesting Tools 2018
- Pentest Tools Review
0 comments:
Post a Comment