Emulating Shellcodes - Chapter 2

 Lets check different  Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.

This stages are fully emulated well and can get the IOC and the behavior of the shellcode.

But lets see another first stage big shellcode with c runtime embedded in a second stage.

In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.

Here there are two types of allocations:

Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.

The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.

Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.

So we have second stage unpacked in alloc_e40064

With "mdd" we do a memory dump to disk we found the size in previous screenshot,  and we can do  some static reversing of stage2 in radare/ghidra/ida

In radare we can verify that the extracted is the next stage:

I usually do correlation between the emulation and ghidra, to understand the algorithms.

If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and  is calling the allocated buffer in 0x4f...

And this  stage2 perform several API calls let's check it in ghidra.

We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls

Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;

So lets say yes and continue the emulation.

Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected. 

Nevertheless the shellcode detects something and terminates the process.

Lets trace the branches to understand the logic:

target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'

Continuing the emulation it's setting the SEH  pointer to previous stage:

Lets see from the console where is pointing the SEH chain item:

to be continued ...

https://github.com/sha0coder/scemu

Continue reading

1. Hack Tools For Pc
2. Pentest Reporting Tools
3. Hackers Toolbox
4. Hack Tools Pc
5. Hacker Tools For Pc
6. Beginner Hacker Tools
7. Pentest Recon Tools
8. What Is Hacking Tools
9. Hacking Tools
10. Beginner Hacker Tools
11. Pentest Tools Website
12. Pentest Recon Tools
13. Best Hacking Tools 2020
14. Pentest Tools Linux
15. Hacking Tools For Mac
16. Hacker Tools Apk Download
17. Pentest Tools
18. Hacks And Tools
19. Hacking Apps
20. Pentest Tools For Windows
21. Hack Tools For Mac
22. Hacking Tools Windows
23. Black Hat Hacker Tools
24. Pentest Tools Website Vulnerability
25. Hacking Tools Mac
26. Hacker Tools Linux
27. Hacking Tools Pc
28. Hacker Tools Free
29. Install Pentest Tools Ubuntu
30. Hack Tool Apk No Root
31. Hacking Tools Software
32. Pentest Box Tools Download
33. Hack Tool Apk
34. Hacker Tools For Windows
35. Install Pentest Tools Ubuntu
36. Pentest Tools Windows
37. Pentest Tools Find Subdomains
38. How To Install Pentest Tools In Ubuntu
39. Pentest Tools Alternative
40. Hack Tools Mac
41. Pentest Box Tools Download
42. Hacker Tools Apk Download
43. Pentest Tools Port Scanner
44. Kik Hack Tools
45. New Hack Tools
46. Hacker Tools For Mac
47. Pentest Tools Port Scanner
48. Pentest Tools Linux
49. Pentest Tools Url Fuzzer
50. Hacking Tools 2019
51. Beginner Hacker Tools
52. Hack Tools For Games
53. Hack Tools Github
54. Hacking Tools For Windows Free Download
55. Pentest Recon Tools
56. Hackers Toolbox
57. Hacker Tools Apk
58. Hacks And Tools
59. Hacker Hardware Tools
60. Hacking Tools Mac
61. Pentest Tools Apk