[PPT] - Reconstructing the Scene of the Crime Reconstructing the Scene of PowerPoint Presentation

SLIDE 1

Reconstructing the Scene of the Crime Reconstructing the Scene of the Crime

SLIDE 2

Who are they?

STEVE DAVIS STEVE DAVIS PETER SILBERMAN PETER SILBERMAN

Security Consultant /

Security Consultant / Researcher Researcher at MANDIANT at MANDIANT

Engineer / Researcher

Engineer / Researcher at MANDIANT at MANDIANT

SLIDE 3

Agenda

½

½ Demo Demo

－－ Pop it like its

Pop it like its hotttt hotttt

Problem / Solution

Problem / Solution

Process Acquisition

Process Acquisition

Metasploit

Metasploit

Meterpreter Communication

Meterpreter Communication

Metasploit Forensic Framework (MSFF)

Metasploit Forensic Framework (MSFF)

½ Demo

½ Demo

－－ Reconstructing it like its

Reconstructing it like its hotttt hotttt

SLIDE 4

Demo Part 1

Box Windows XP Fresh SP3

Box Windows XP Fresh SP3 Same box that our slides are running from Same box that our slides are running from… … Oh Oh noes noes! !

MS08-067 meterpreter bind tcp

MS08-067 meterpreter bind tcp

SLIDE 5

Back to our regularly scheduled slides...

SLIDE 6

Problem

Meterpreter

Meterpreter

－－ Traditional disk forensics is helpless

Traditional disk forensics is helpless

Attack vector may never touch disk

Attack vector may never touch disk

－－ No way to determine what happened

No way to determine what happened

Goal

Goal

－－ Reconstruct attacker

Reconstruct attacker’ ’s Meterpreter sessions s Meterpreter sessions with as much reliability as possible with as much reliability as possible

SLIDE 7

Solution

Acquire exploited processes

Acquire exploited processes’ ’ address address space space

Parse out meterpreter protocol from

Parse out meterpreter protocol from acquired memory sections acquired memory sections

－－ Reconstruct meterpreter sessions

Reconstruct meterpreter sessions

SLIDE 8

MANDIANT Memoryze

ENUMERATION ENUMERATION ACQUISITION ACQUISITION

All running processes

All running processes

－－ Handle table

Handle table

－－ Memory sections

Memory sections

－－ Ports

Ports

－－ Strings

Strings

Drivers

Drivers

－－ Including layered ones

Including layered ones

Certain kernel hooks

Certain kernel hooks

Physical memory image

Physical memory image

Running process

Running process’ ’s s memory space memory space

－－ Binary

Binary

－－ Loaded DLL

Loaded DLL’ ’s s

－－ Stacks

Stacks

－－ Heaps

Heaps

－－ Data sections

Data sections

Drivers

Drivers

SLIDE 9

MANDIANT Memoryze

Can analyze memory live, or from image

Can analyze memory live, or from image

－－ Live analysis can use paging file for a more

Live analysis can use paging file for a more complete picture of memory complete picture of memory

Supported platforms

Supported platforms

－－ 32-bit Windows 2000, XP, 2003 Server

32-bit Windows 2000, XP, 2003 Server

－－ Beta support for Vista

Beta support for Vista

Download at

Download at

－－ http://www.mandiant.com/

http://www.mandiant.com/

SLIDE 10

Process Acquisition

SLIDE 11

Why Process Acquisition?

Acquisition was originally used mostly for

Acquisition was originally used mostly for malware analysis malware analysis

－－ Acquire packed binaries running in memory

Acquire packed binaries running in memory

Usually utilized debuggers

Usually utilized debuggers

Can defeat most packers

Can defeat most packers

Acquisition has other uses:

Acquisition has other uses:

－－ Acquire unknown binaries for

Acquire unknown binaries for Virustotal Virustotal

－－ Acquire memory to look for protocol strings

Acquire memory to look for protocol strings

Encrypted strings are

Encrypted strings are unecrypted unecrypted in memory in memory

SLIDE 12

Classic Process Acquisition

Current Methodology

Current Methodology

－－ Open handle to process, OR

Open handle to process, OR

－－ Attach to process

Attach to process

ReadProcessMemory

ReadProcessMemory( (hProc hProc,  , ImageBase ImageBase, , buffer,  buffer, ImageSize ImageSize,  , BytesRead BytesRead) )

Current drawbacks

Current drawbacks

－－ Requires

Requires “ “touching touching” ” a process a process

－－ Detecting debuggers is trivial

Detecting debuggers is trivial

－－ Gives an incomplete picture of memory

Gives an incomplete picture of memory

SLIDE 13

Process Acquisition: Memoryze

RELIES ON RELIES ON DOES NOT RELY ON DOES NOT RELY ON

Physical memory access

Physical memory access

Virtual to physical

Virtual to physical address translation address translation

Attaching to a process

Attaching to a process with a debugger with a debugger

Opening handles to

Opening handles to processes or threads processes or threads

API calls

API calls

The OS

The OS’ ’s Virtual Memory s Virtual Memory Manager Manager

SLIDE 14

Memoryze: Process Acquisition

Accessing Physical Memory

Accessing Physical Memory

－－ Live analysis

Live analysis

－－ Acquisition

Acquisition

\Device\

\Device\PhysicalMemory PhysicalMemory

－－ Section object exposed by Windows

Section object exposed by Windows

－－ Reading from handle allows application to

Reading from handle allows application to read physical memory read physical memory

－－ Every virtual address must be translated to a

Every virtual address must be translated to a physical offset within the section object physical offset within the section object

SLIDE 15

Virtual Address Page Tables

Byte Index (4096) Page Table Index (512) Page Directory Index (512)

KPROCESS

Page Dir Individual page table

PDE PTE

Physical address

Physical Memory

Page Frame 9 bits 9 bits 12 bits

CR3

Page Dir Pointers

PDP

2 bits

PDP index (4)

PAE

SLIDE 16

Memoryze: Process Acquisition

Map physical memory into buffer

Map physical memory into buffer

Acquisition:

Acquisition:

－－ Write buffer to disk (

Write buffer to disk (dd dd) )

Analysis:

Analysis:

－－ Scan buffer for known signatures of kernel

Scan buffer for known signatures of kernel structures, e.g. structures, e.g. EPROCESS EPROCESS

SLIDE 17

New Process Acquisition

Find all processes (EPROCESS) in physical

Find all processes (EPROCESS) in physical memory memory

－－ VadRoot

VadRoot within the EPROCESS structure within the EPROCESS structure

－－ The

The VadRoot VadRoot is the top node of a tree of Memory is the top node of a tree of Memory Manager Virtual Address Descriptor (MMVAD) Manager Virtual Address Descriptor (MMVAD) entries entries

－－ MMVAD entries contain the virtual start address

MMVAD entries contain the virtual start address and size of each memory section within a process and size of each memory section within a process

－－ MMVAD entries containing mapped DLL

MMVAD entries containing mapped DLL’ ’s or s or EXE EXE’ ’s will have a pointer to the path of the binary s will have a pointer to the path of the binary

Helps manage process

Helps manage process’ ’ virtual address space virtual address space

SLIDE 18

Memoryze: Process Acquisition

OllyDbg

OllyDbg’ ’s s memory map view shows the memory map view shows the different sections different sections

Each address range is an entry in

Each address range is an entry in VadRoot VadRoot, represented by a MMVAD , represented by a MMVAD structure structure

Enumeration of

Enumeration of VadRoot VadRoot allows access to allows access to heaps, stacks, and binary images heaps, stacks, and binary images

SLIDE 19

Finding Processes

…

Kernel Address Space

0x8aadb830 0x8aadb834 0x8aadb838 0x8aadb83C 0x8aadb840 0x8aadb844 0x8aadb848 0x8aadb84C … 0x8aadb850

SLIDE 20

Finding Processes

…

Kernel Address Space

0x8aadb830 0x8aadb834 0x8aadb838 0x8aadb83C 0x8aadb840 0x8aadb844 0x8aadb848 0x8aadb84C … 0x8aadb850 0x001b0003 0x00000000 0x8aadb838 0x8aadb838 0x8aadb840 0x8aadb840 0x0b100020 0x0000b084 0x00000000

SLIDE 21

Finding Processes

…

Kernel Address Space

0x8aadb830 0x8aadb834 0x8aadb838 0x8aadb83C 0x8aadb840 0x8aadb844 0x8aadb848 0x8aadb84C … 0x8aadb850 0x001b0003 0x00000000 0x8aadb838 0x8aadb838 0x8aadb840 0x8aadb840 0x0b100020 0x0000b084 0x00000000

Indicates EPROCESS, DISPATCH_HEADER, further checks are needed

SLIDE 22

Finding Processes

PCB

EPROCESS

0x00 ObjectTable 0xC4 VadRoot 0x11C ImageFileName 0x174 Cookie 0x258 …

Kernel Address Space

0x8aadb830 0x8aadba88 0x8aadba8C 0x8aadba90 … 0x8aadba94

“calc.exe” _MMVAD HANDLE_TABLE Found an EPROCESS structure

SLIDE 23

Parsing MMVAD

PCB

EPROCESS

0x00 ObjectTable 0xC4 VadRoot 0x11C ImageFileName 0x174 Cookie 0x258 StartingVPN

_MMVAD

Parent LeftChild RightChild EndingVPN StartingVPN

_MMVAD

Parent LeftChild RightChild EndingVPN StartingVPN

_MMVAD

Parent LeftChild RightChild EndingVPN

SLIDE 24

Writing VADs to disk

PCB

EPROCESS

0x00 ObjectTable 0xC4 VadRoot 0x11C ImageFileName 0x174 Cookie 0x258 StartingVPN

_MMVAD

Parent LeftChild RightChild EndingVPN StartingVPN

_MMVAD

Parent LeftChild RightChild EndingVPN StartingVPN

_MMVAD

Parent LeftChild RightChild EndingVPN

For each VAD write to disk: StartVPN to StartVPN+EndingVPN

SLIDE 25

SLIDE 26

New Process Acquisition

Allows dumping of full address space

Allows dumping of full address space

Overcomes most binary packing

Overcomes most binary packing

Captures communication protocol strings

Captures communication protocol strings

Bypasses any anti-debugging techniques

Bypasses any anti-debugging techniques

Acquire(s):

Acquire(s):

－－ DLL

DLL’ ’s that are only in memory s that are only in memory

－－ Code corresponding to injected threads or

Code corresponding to injected threads or shellcode shellcode

SLIDE 27

Have YOU read the developer docs? Have YOU read the developer docs?

Metasploit

SLIDE 28

Metasploit

Open source exploit framework originally

Open source exploit framework originally developed in Perl (1.x, 2.x) by HD Moore developed in Perl (1.x, 2.x) by HD Moore et al. et al.

－－ Currently

Currently Ruby (3.x) Ruby (3.x)

Platform independent

Platform independent

Multiple payloads

Multiple payloads

SLIDE 29

Meterpreter

The next generation of post-exploitation

The next generation of post-exploitation payloads payloads

－－ Forget

Forget /bin/ /bin/sh sh and and cmd.exe cmd.exe

Limited to

Limited to stdin,stderr,stdout stdin,stderr,stdout

Non-interactive

Non-interactive

Full functioning client

Full functioning client → → server interpreter server interpreter

－－ File upload / download

File upload / download

－－ Key logging

Key logging

－－ Simple extension addition

Simple extension addition

Can be completely memory resident

Can be completely memory resident

SLIDE 30

Under the Meterpreter Hood

DLL gets injected into exploited process

DLL gets injected into exploited process

Hooks

Hooks LoadLibrary LoadLibrary (on Windows) (on Windows)

－－ Applies hook to Win32 API

Applies hook to Win32 API LoadLibrary LoadLibrary

－－ Changes lower level API

Changes lower level API’ ’s behavior to allow s behavior to allow LoadLibrary LoadLibrary to load a DLL from memory to load a DLL from memory

Hooked API

Hooked API’ ’s to allow loading of s to allow loading of metsrv.dll metsrv.dll from memory from memory

－－ NtOpenSection

NtOpenSection,  , NtCreateSection NtCreateSection

－－ NtQueryAttributesFile

NtQueryAttributesFile

－－ NtOpenFile

NtOpenFile,  , NtMapViewOfSection NtMapViewOfSection

SLIDE 31

Meterpreter Communication

TLV (really LTV) Structures

TLV (really LTV) Structures

－－ Provide communication protocol for

Provide communication protocol for meterpreter server and client meterpreter server and client

－－ 32 bit Length and Type Fields

32 bit Length and Type Fields

－－ n

n bits Value Field bits Value Field

SLIDE 32

Meterpreter Communication

Attacker Victim Sends Exploit Payload Meterpreter bind_tcp

SLIDE 33

Meterpreter Communication

Attacker Victim Meterpreter Attacker executes “getpid”

SLIDE 34

Meterpreter Communication

Attacker Victim Meterpreter

Type TLV Packet Length Value PACKET_TYPE_REQUEST

stdapi_sys_process_getpi d

Sizeof(TLV Packet)

Request sent when attacker executes getpid

SLIDE 35

Meterpreter Communication

Attacker Victim Meterpreter Meterpreter does an internal lookup for the method requested: stdapi_sys_process_getpid

Dispatch Lookup Table stdapi_sys_process_getpid

stdapi_sys_process_get_processe s

stdapi_sys_process_get_info

Victim

SLIDE 36

Meterpreter Communication

Attacker Victim Meterpreter Victim

Response

Meterpreter builds a response on the heap; response includes the result of GetCurrentProcessId

SLIDE 37

Meterpreter Communication

Attacker Victim Meterpreter Victim

Response Response

Response is sent back to the attacker

SLIDE 38

Meterpreter Communication

Attacker Victim Meterpreter Victim

Response Response

Response packet is freed by meterpreter