Lets check different Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.
This stages are fully emulated well and can get the IOC and the behavior of the shellcode.
But lets see another first stage big shellcode with c runtime embedded in a second stage.
In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.
Here there are two types of allocations:
Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.
The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.
Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.
So we have second stage unpacked in alloc_e40064
With "mdd" we do a memory dump to disk we found the size in previous screenshot, and we can do some static reversing of stage2 in radare/ghidra/ida
In radare we can verify that the extracted is the next stage:
I usually do correlation between the emulation and ghidra, to understand the algorithms.
If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and is calling the allocated buffer in 0x4f...
And this stage2 perform several API calls let's check it in ghidra.
We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls
Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;
So lets say yes and continue the emulation.
Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected.
Nevertheless the shellcode detects something and terminates the process.
Lets trace the branches to understand the logic:
target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'
Lets see from the console where is pointing the SEH chain item:
to be continued ...
https://github.com/sha0coder/scemu
- Hack Tools Pc
- Hacking Tools Windows 10
- Hack Tool Apk No Root
- Hacker Tools
- Top Pentest Tools
- Pentest Tools Kali Linux
- Hacks And Tools
- Pentest Automation Tools
- Pentest Tools Review
- Hack Tools Pc
- Nsa Hacker Tools
- Pentest Tools For Windows
- Pentest Tools Windows
- New Hacker Tools
- Hacking Tools Windows
- Pentest Tools Framework
- Hacker Tools For Windows
- Hacker Hardware Tools
- Pentest Tools Windows
- Hacker
- Hack Tools Github
- Pentest Box Tools Download
- Hacker Tools 2020
- Hacker Tools Free
- Hack Tools Github
- Hack Apps
- Kik Hack Tools
- Hacking Tools Software
- How To Hack
- Hacker Tools For Windows
- Hacking Tools Github
- Hack App
- Hacker Tools
- Hacker Tools Mac
- Hacking Tools
- Hack Tools
- Hacks And Tools
- Hackrf Tools
- Game Hacking
- Hacking Tools 2019
- Hacker Tools Windows
- Pentest Tools Tcp Port Scanner
- Hacker Tools Apk
- Hacking Tools For Mac
- Hacker Tools Windows
- Nsa Hack Tools
- Hack Tools
- Hacker Tools For Pc
- Hacking Tools For Beginners
- World No 1 Hacker Software
- Pentest Tools Port Scanner
- Hacker Tools Free
- Hacking Tools Online
- Best Pentesting Tools 2018
- Hacker Tool Kit
- Pentest Tools Website Vulnerability
- Hacking Tools And Software
- Best Pentesting Tools 2018
- Pentest Tools
- Hacking Tools Name
- Hacking Tools And Software
- Hacker Tools For Mac
- Hacking Tools For Kali Linux
- Pentest Automation Tools
- Hacker Tools
- Pentest Tools Android
- Hack Tools For Games
- Pentest Tools For Mac
- Hak5 Tools
- Nsa Hack Tools Download
- Hacking Tools For Windows
- Hack Tools For Mac
- Pentest Tools Online
- Underground Hacker Sites
- Growth Hacker Tools
- Hacker Tool Kit
- Hacking Tools Hardware
- What Is Hacking Tools
- Hacking Tools Free Download
- Pentest Tools Nmap
- Hackers Toolbox
- How To Make Hacking Tools
- Hacking Tools Usb
- Pentest Reporting Tools
- Hacking Tools Github
- Hack Tools Download
- Hacking Tools Free Download
- Pentest Automation Tools
- Hacker Tools Free
- Hacking Tools Kit
- Hacking Tools For Windows
- Kik Hack Tools
- Hacker Tools
No comments:
Post a Comment