Lets check different Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.
This stages are fully emulated well and can get the IOC and the behavior of the shellcode.
But lets see another first stage big shellcode with c runtime embedded in a second stage.
In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.
Here there are two types of allocations:
Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.
The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.
Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.
So we have second stage unpacked in alloc_e40064
With "mdd" we do a memory dump to disk we found the size in previous screenshot, and we can do some static reversing of stage2 in radare/ghidra/ida
In radare we can verify that the extracted is the next stage:
I usually do correlation between the emulation and ghidra, to understand the algorithms.
If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and is calling the allocated buffer in 0x4f...
And this stage2 perform several API calls let's check it in ghidra.
We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls
Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;
So lets say yes and continue the emulation.
Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected.
Nevertheless the shellcode detects something and terminates the process.
Lets trace the branches to understand the logic:
target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'
Lets see from the console where is pointing the SEH chain item:
to be continued ...
https://github.com/sha0coder/scemu
- Ethical Hacker Tools
- Hack Tools
- Hack And Tools
- Pentest Tools Download
- Hacker Tools Software
- Hacker Tools Apk
- Ethical Hacker Tools
- Pentest Tools Free
- Pentest Tools Review
- Pentest Tools List
- Best Pentesting Tools 2018
- Hacker Tools Github
- Easy Hack Tools
- Hacking Tools For Beginners
- Pentest Tools For Windows
- Hacking Tools 2020
- Hacking Tools For Mac
- Hacking Tools For Mac
- Blackhat Hacker Tools
- Hack Tools Download
- Tools Used For Hacking
- Hacker Techniques Tools And Incident Handling
- Game Hacking
- World No 1 Hacker Software
- Hacking Apps
- Hacker Tools Github
- Pentest Tools Alternative
- Hacker Tools For Ios
- Pentest Tools Review
- New Hacker Tools
- Hacker Tools Hardware
- How To Hack
- Pentest Tools Github
- Hack Tools
- Hack Tools Download
- Hacking Tools For Pc
- Pentest Reporting Tools
- Hack Tools For Mac
- Pentest Tools Online
- Hacker Tools For Mac
- Hacker Tool Kit
- Hacking Tools And Software
- Hacker Tools Free Download
- Hacker Tools 2019
- Usb Pentest Tools
- Hacker Tools 2020
- Hacker Security Tools
- Hacker Tools For Pc
- Hack Tools Pc
- Pentest Tools For Android
- Growth Hacker Tools
- Pentest Tools Download
- Hacking Tools Hardware
- Easy Hack Tools
- Hacking Tools Free Download
- Hack Tool Apk
- Install Pentest Tools Ubuntu
- Hacker
- Pentest Tools Framework
- Hacking Tools Free Download
- Pentest Tools For Ubuntu
- Pentest Tools Free
- Pentest Tools List
- Pentest Tools Download
- World No 1 Hacker Software
- Hacker Tools Hardware
- Hacker Tools For Ios
- Pentest Tools Free
- Hack Website Online Tool
- Pentest Tools Nmap
- Hacker Tools Windows
- Pentest Automation Tools
- Best Pentesting Tools 2018
- Top Pentest Tools
- Hacker Tools For Ios
- Nsa Hack Tools
- Tools Used For Hacking
- Hack Tools For Games
- Hacking Tools Name
- Best Hacking Tools 2020
- Pentest Tools Kali Linux
- Beginner Hacker Tools
- Hacker Tools Github
- Beginner Hacker Tools
- Pentest Tools Tcp Port Scanner
- Hacker Tools List
- Pentest Tools Bluekeep
- Pentest Tools Find Subdomains
- Hacking Tools Pc
- Pentest Tools Kali Linux
- Beginner Hacker Tools
- Hacker Tools For Mac
- Hack Tool Apk
- Hacking Tools Free Download
- Blackhat Hacker Tools
- Pentest Tools Url Fuzzer
- Physical Pentest Tools
- Hacking Apps
- Hacking Tools Mac
- Growth Hacker Tools
- Hacking Tools 2020
- Hack Apps
- Tools For Hacker
- Pentest Tools For Android
- Hacking Tools For Beginners
- Hacking Tools For Mac
- New Hacker Tools
- Hacking Tools For Beginners
- Hacking Tools Software
- Hacking Tools Windows 10
- Pentest Tools Linux
- Hacking App
- Hack Rom Tools
- Nsa Hacker Tools
- Kik Hack Tools
- Tools Used For Hacking
- Hacking Tools Mac
- Hacking Tools For Windows Free Download
- Hacking Tools For Windows 7
- Hacking Tools Windows 10
- Easy Hack Tools
- Hacking Tools Github
- Hacking Tools For Mac
- Hacker Tools For Ios
- Hack Tools 2019
- Nsa Hack Tools Download
- Hacking Tools Windows
- Hack Tools
- Hacking Tools Name
- Free Pentest Tools For Windows
- Hack Tools 2019
No comments:
Post a Comment