Teaching Old Shellcode New Tricks REcon Brussels 2017 - - PowerPoint PPT Presentation

▶
teaching old shellcode new tricks
SMART_READER_LITE
LIVE PREVIEW

Teaching Old Shellcode New Tricks REcon Brussels 2017 - - PowerPoint PPT Presentation

Nov 30, 2022 301 likes •1.37k views

Teaching Old Shellcode New Tricks REcon Brussels 2017 @midnite_runr Cest Moi US Marine (out in 2001) Wrote BDF/BDFProxy Co-Authored Ebowla Found OnionDuke Work @ Okta Twitter: @midnite_runr Why This Talk Its

slide-1
SLIDE 1

Teaching Old Shellcode New Tricks

REcon Brussels 2017

@midnite_runr

slide-2
SLIDE 2

C’est Moi

  • US Marine (out in 2001)
  • Wrote BDF/BDFProxy
  • Co-Authored Ebowla
  • Found OnionDuke
  • Work @ Okta
  • Twitter: @midnite_runr
slide-3
SLIDE 3

Why This Talk

  • It’s fun
  • It’s time to update publicly available shellcode
slide-4
SLIDE 4

Part 1

slide-5
SLIDE 5

Stephen Fewer’s Hash API

  • SFHA or Hash API or MetaSploit Payload Hash
  • Introduced: 8/2009
  • Uses a 4 byte hash to identify DLL!WinAPI in EAT
  • JMPs to the WinAPI ; return to payload
  • Some code borrowed from M.Miller’s 2003

Understanding Windows Shellcode paper

http://blog.harmonysecurity.com/2009/08/calling-api-functions.html

slide-6
SLIDE 6

Typical SHFA Based Payload

[—SHFA—][the actual payload logic]

slide-7
SLIDE 7

Typical SHFA Based Payload

[—SHFA—][the actual payload logic] 1

slide-8
SLIDE 8

Typical SHFA Based Payload

[—SHFA—][the actual payload logic] 1 2

slide-9
SLIDE 9

Typical SHFA Based Payload

[—SHFA—][the actual payload logic] 1 2 3

slide-10
SLIDE 10

Typical SHFA Based Payload

[—SHFA—][the actual payload logic] [some winAPI] 1 2 3

slide-11
SLIDE 11

Typical SHFA Based Payload

[—SHFA—][the actual payload logic] [some winAPI] 1 2 3 4

slide-12
SLIDE 12

Typical SHFA Based Payload

[—SHFA—][the actual payload logic] [some winAPI] 1 2 3 4 5, Continue to 2 until done

slide-13
SLIDE 13

Defeating SFHA

  • EMET
  • Piotr Bania Phrack 63:15 // HAVOC - POC||GTFO

12:7

  • CFG/RFG
slide-14
SLIDE 14

EMET Caller/EAF(+)

  • EAF(+)
  • Introduced: 2010/2014(+)
  • Protect reading KERNEL32/NTDLL and

KERNELBASE(+)

  • Caller
  • 2013
  • Block ret/jmp into a winAPI (Anti/rop) for

critical functions

slide-15
SLIDE 15

EMET is EOL

  • Supported through July 31, 2018
  • Still works**

** Depends on threat model

slide-16
SLIDE 16

Tor Browser Exploit vs EMET

slide-17
SLIDE 17
slide-18
SLIDE 18

Bypassing EMET EAF(+)

  • 2010: Berend-Jan Wever (Skypher Blog) - ret-2-

libc via ntdll

  • 1/2012 Piotr Bania - Erase HW Breakpoints via

NtContinue

  • 9/2014 - Offensive Security - EAF+ bypass via

EMET function reuse calling ZwSetContextThread directly

http://web.archive.org/web/20101125174240/http://skypher.com/index.php/2010/11/17/bypassing-eaf/ http://piotrbania.com/all/articles/anti_emet_eaf.txt https://www.offensive-security.com/vulndev/disarming-emet-v5-0/

slide-19
SLIDE 19

Bypassing EMET Caller

2/2014 - Jared Demot - Demo’ed a payload that directly used LoadLibraryA (LLA)

https://bromiumlabs.files.wordpress.com/2014/02/bypassing-emet-4-1.pdf

slide-20
SLIDE 20

IAT Based Payloads in BDF

  • May 30, 2014
  • Added IAT based payloads/shellcode to BDF
  • Directly used IAT API thunks
  • This bypassed EMET Caller/EAF(+) checks
slide-21
SLIDE 21

Position Independent IAT Shellcode

  • Dec, 2014
  • 12/2003 - Skape (M. Miller) Understanding Windows

Shellcode

  • 2005 - Piotr Bania - IAT Parser - Phrack 63:15

http://www.hick.org/code/skape/papers/win32-shellcode.pdf http://phrack.org/issues/63/15.html

slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25

Emailed the EMET Team

slide-26
SLIDE 26

¯\_()_/¯

slide-27
SLIDE 27
slide-28
SLIDE 28

IAT Based Stub

  • LoadLibraryA(LLA)/GetProcAddress(GPA) in Main

Module

https://gist.github.com/secretsquirrel/2ad8fba6b904c2c952b8

slide-29
SLIDE 29
slide-30
SLIDE 30

IAT Based Stub(s)

  • LoadLibraryA/GetProcAddress in Main Module
  • LoadLibraryA/GetProcAddress in a loaded Module

(dll)

slide-31
SLIDE 31

GetProcAddress Only Stub

slide-32
SLIDE 32

GetProcAddress Only Stub

GetProcAddress LoadLibraryA

slide-33
SLIDE 33

GetProcAddress Only Stub

GetProcAddress LoadLibraryA LoadLibraryA.Handle = GetProcAddress(Kernel32.addr, ‘LoadLibraryA’)

slide-34
SLIDE 34

GetProcAddress Only Stub

GetProcAddress LoadLibraryA LoadLibraryA.Handle = GetProcAddress(Kernel32.addr, ‘LoadLibraryA’) Push eax; LLA is in EAX mov ebx, esp; mov ptr to LLA in ebx … call [ebx]

slide-35
SLIDE 35

IAT Based Stub(s)

  • LoadLibraryA(LLA)/GetProcAddress(GPA) in main

module

  • LLA/GPA in a loaded module (dll)
  • GPA to LLA in main module
  • GPA to LLA in loaded module
slide-36
SLIDE 36

System Binaries/DLLs with LLAGPA or GPA in IAT

LLAGPA GPA XPSP3 1300 5426 VISTA 645 26855 WIN7 675 48383 WIN8 324 31158 WIN10 225 50522

slide-37
SLIDE 37

FireEye Flash Malware w/ EMET Bypass Jun 06, 2016

https://www.fireeye.com/blog/threat-research/2016/06/angler_exploit_kite.html

slide-38
SLIDE 38

POC: https://github.com/ShellcodeSmuggler/IAT_POC

https://www.okta.com/blog/2016/07/the-emet-serendipity-emets-ineffectiveness-against-non-exploitation-uses/

slide-39
SLIDE 39

What now?

  • More payloads
  • Many MetaSploit payloads were based off of Hash

API stub

  • Much work
  • Some ideas
slide-40
SLIDE 40

Part II

slide-41
SLIDE 41

Two Ideas

  • Remove SFHA and replace it with X
  • Build something to rewrite the payload logic for

use with an IAT parsing stub

slide-42
SLIDE 42

REWRITE ALL THE THINGS

slide-43
SLIDE 43

MSF Winx86 Payloads Follow a pattern

https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_recv.asm

slide-44
SLIDE 44

Workflow

  • Take Input via stdin or from file
  • Disassemble
  • Capture blocks of instructions
  • Capture API calls
  • Capture control flow between two locations
  • Protect LLA/GPA registers from being clobbered
slide-45
SLIDE 45

LOE

slide-46
SLIDE 46

LOE

  • Five days straight at about 12-15 hour days
slide-47
SLIDE 47

LOE

  • Five days straight at about 12-15 hour days
  • When I solved one problem, 2-3 more appeared
slide-48
SLIDE 48

LOE

  • Five days straight at about 12-15 hour days
  • When I solved one problem, 2-3 more appeared
  • There is a point where a manual rewrite would

have been easier - I crossed it

slide-49
SLIDE 49

LOE

  • Five days straight at about 12-15 hour days
  • When I solved one problem, 2-3 more appeared
  • There is a point where a manual rewrite would

have been easier - I crossed it

  • 🔦BURN IT DOWN🔦
slide-50
SLIDE 50

Next idea

slide-51
SLIDE 51

Next idea

[—SFHA—]

slide-52
SLIDE 52

Next idea

[the actual payload logic] [—SFHA—]

slide-53
SLIDE 53

Next idea

[the actual payload logic]

slide-54
SLIDE 54

Next idea

[the actual payload logic] [IAT Stub]

slide-55
SLIDE 55

Next idea

[the actual payload logic] [IAT Stub] [offset table]

slide-56
SLIDE 56

Some requirements

  • Support Read/Execute Memory
  • Try to keep it small
  • Support any Metasploit Shellcode that uses SFHA
slide-57
SLIDE 57

Workflow

  • Take Input via stdin or from file
  • Disassemble
  • Capture blocks of instructions
  • Capture API calls
  • Build a lookup/offset table
  • Find an appropriate IAT for the EXE
  • OUTPUT
slide-58
SLIDE 58

Offset Table Approach

slide-59
SLIDE 59

Offset Table Approach

[876f8b31][XX][XX][a2a1de0][XX][XX][9dbd95a6] [XX] [XX]

slide-60
SLIDE 60

Offset Table Approach

[876f8b31][XX][XX][a2a1de0][XX][XX][9dbd95a6] [XX] [XX]

DLL API

slide-61
SLIDE 61

Offset Table Approach

b'RtlExitUserThread\x00ExitThread\x00kernel32\x00WinExec\x00GetVersion\x00ntdll\x00'

[876f8b31][XX][XX][a2a1de0][XX][XX][9dbd95a6] [XX] [XX]

DLL API

slide-62
SLIDE 62

Offset Table Approach

b'RtlExitUserThread\x00ExitThread\x00kernel32\x00WinExec\x00GetVersion\x00ntdll\x00'

[876f8b31][XX][XX][a2a1de0][XX][XX][9dbd95a6] [XX] [XX]

DLL API

slide-63
SLIDE 63

Offset Table Approach

b'RtlExitUserThread\x00ExitThread\x00kernel32\x00WinExec\x00GetVersion\x00ntdll\x00'

[876f8b31][XX][XX][a2a1de0][XX][XX][9dbd95a6] [XX] [XX]

DLL API

slide-64
SLIDE 64

Offset Table Approach

b'RtlExitUserThread\x00ExitThread\x00kernel32\x00WinExec\x00GetVersion\x00ntdll\x00'

[876f8b31][XX][XX][a2a1de0][XX][XX][9dbd95a6] [XX] [XX]

DLL API

slide-65
SLIDE 65

Offset Table Approach

b'RtlExitUserThread\x00ExitThread\x00kernel32\x00WinExec\x00GetVersion\x00ntdll\x00'

[876f8b31][XX][XX][a2a1de0][XX][XX][9dbd95a6] [XX] [XX]

DLL API

slide-66
SLIDE 66

Offset Table Approach

b'RtlExitUserThread\x00ExitThread\x00kernel32\x00WinExec\x00GetVersion\x00ntdll\x00'

[876f8b31][XX][XX][a2a1de0][XX][XX][9dbd95a6] [XX] [XX]

DLL API

slide-67
SLIDE 67

Offset Table Approach

b'RtlExitUserThread\x00ExitThread\x00kernel32\x00WinExec\x00GetVersion\x00ntdll\x00'

[876f8b31][XX][XX][a2a1de0][XX][XX][9dbd95a6] [XX] [XX]

DLL API

slide-68
SLIDE 68
slide-69
SLIDE 69
slide-70
SLIDE 70

The new workflow

[IAT Stub ][Lookuptable][the actual payload logic]

slide-71
SLIDE 71

The new workflow

[IAT Stub ][Lookuptable][the actual payload logic] 1

slide-72
SLIDE 72

The new workflow

[IAT Stub ][Lookuptable][the actual payload logic] 1 2

slide-73
SLIDE 73

The new workflow

[IAT Stub ][Lookuptable][the actual payload logic] [some winAPI] 1 2

slide-74
SLIDE 74

The new workflow

[IAT Stub ][Lookuptable][the actual payload logic] [some winAPI] 1 2 3

slide-75
SLIDE 75

The new workflow

[IAT Stub ][Lookuptable][the actual payload logic] [some winAPI] 1 2 3 4

slide-76
SLIDE 76

The new workflow

[IAT Stub ][Lookuptable][the actual payload logic] [some winAPI] 1 2 3 5 4

slide-77
SLIDE 77

The new workflow

[IAT Stub ][Lookuptable][the actual payload logic] [some winAPI] 1 2 3 5 6, Continue to 2 until done 4

slide-78
SLIDE 78

LOE

  • The initial POC took < 12 hours
  • Adding the workflow and stubs:12 hours
  • Finalizing the tool: ಠ_ಠ
  • But I’m happy 🤔
slide-79
SLIDE 79

About those API Hashes

slide-80
SLIDE 80

About those API Hashes

  • They are now meaningless
slide-81
SLIDE 81

About those API Hashes

  • They are now meaningless
  • AVs depend on them for signatures
slide-82
SLIDE 82

About those API Hashes

  • They are now meaningless
  • AVs depend on them for signatures
  • What happens if we mangle them?
slide-83
SLIDE 83

AV Demo

DEMO: https://youtu.be/p3vFRx5dur0

slide-84
SLIDE 84

Introducing FIDO

slide-85
SLIDE 85

Introducing FIDO

slide-86
SLIDE 86

Introducing FIDO

slide-87
SLIDE 87

Issues with some DLLs

slide-88
SLIDE 88

System Binaries/DLLs with LLAGPA or GPA in IAT

LLAGPA GPA XPSP3 1300 5426 VISTA 645 26855 WIN7 675 48383 WIN8 324 31158 WIN10 225 50522

slide-89
SLIDE 89

API-MS-WIN-CORE*

slide-90
SLIDE 90

API-MS-WIN-CORE*

  • These files are the exposed implementation of the

windows API

slide-91
SLIDE 91

API-MS-WIN-CORE*

  • These files are the exposed implementation of the

windows API

  • Existed since win7
slide-92
SLIDE 92

API-MS-WIN-CORE*

  • These files are the exposed implementation of the

windows API

  • Existed since win7
  • GPA is implemented via API-MS-WIN-CORE-

LIBRARYLOADER-*.DLL

slide-93
SLIDE 93

API-MS-WIN-CORE*

  • These files are the exposed implementation of the

windows API

  • Existed since win7
  • GPA is implemented via API-MS-WIN-CORE-

LIBRARYLOADER-*.DLL

  • Normally used in system dlls
slide-94
SLIDE 94

API-MS-WIN-CORE*

  • These files are the exposed implementation of the

windows API

  • Existed since win7
  • GPA is implemented via API-MS-WIN-CORE-

LIBRARYLOADER-*.DLL

  • Normally used in system dlls
  • Can be called by userland applications via IAT

parsing

slide-95
SLIDE 95

Because it is in…

slide-96
SLIDE 96

Because it is in… Kernel32.dll

slide-97
SLIDE 97
slide-98
SLIDE 98

SAY AGAIN?

slide-99
SLIDE 99

SAY AGAIN?

  • We just need GPA in any DLL Import Table to

access the entire windows API

slide-100
SLIDE 100

SAY AGAIN?

  • We just need GPA in any DLL Import Table to

access the entire windows API

  • Since win7, GPA has been in Kernel32.dll Import

Table

slide-101
SLIDE 101

SAY AGAIN?

  • We just need GPA in any DLL Import Table to

access the entire windows API

  • Since win7, GPA has been in Kernel32.dll Import

Table

  • We’ve had a stable EMET EAF(+)/Caller bypass
  • pportunity since Win7 (works for win7 - win10)
slide-102
SLIDE 102

One more thing

  • GetProcAddress is not the only one
  • LoadlibraryExA is in API-MS-WIN-CORE-

LIBRARYLOADER-L1-2-0.dll

LoadLibraryA(‘moo.dll’) == LoadLibraryExA(‘moo.dll’, 0)

  • This is completely reliable for Win7
  • Maybe Windows 8
  • Not on windows Win10 - Must use ExternGPA with

API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.dll

slide-103
SLIDE 103

Tor Exploit w/My Stub vs EAF+/Caller

DEMO: https://youtu.be/oqHT6Ienudg

slide-104
SLIDE 104

Issues

  • Multi-staged payloads should not use SFHA - will

be flagged by EMET

  • Meterpreter DLL flagged by EMET EAF because of

Reflective DLL loader

  • Updating MSF will take some work
  • Need to do winx64
slide-105
SLIDE 105

Questions?

  • CFG/RGF Implications? ¯\_()_/¯
  • Get the code: https://github.com/secretsquirrel/

fido

  • Thanks: @SubTee, @FreedomCoder, @Wired33,

@__blue__