Lets check different Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.
This stages are fully emulated well and can get the IOC and the behavior of the shellcode.
But lets see another first stage big shellcode with c runtime embedded in a second stage.
In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.
Here there are two types of allocations:
Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.
The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.
Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.
So we have second stage unpacked in alloc_e40064
With "mdd" we do a memory dump to disk we found the size in previous screenshot, and we can do some static reversing of stage2 in radare/ghidra/ida
In radare we can verify that the extracted is the next stage:
I usually do correlation between the emulation and ghidra, to understand the algorithms.
If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and is calling the allocated buffer in 0x4f...
And this stage2 perform several API calls let's check it in ghidra.
We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls
Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;
So lets say yes and continue the emulation.
Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected.
Nevertheless the shellcode detects something and terminates the process.
Lets trace the branches to understand the logic:
target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'
Lets see from the console where is pointing the SEH chain item:
to be continued ...
https://github.com/sha0coder/scemu
More articles
- Wifi Hacker Tools For Windows
- Hacking Tools Windows 10
- Hack Tools Online
- Pentest Tools Download
- Pentest Reporting Tools
- Hack Tool Apk No Root
- Pentest Tools Apk
- Pentest Tools For Mac
- Hacker Tools Hardware
- Hacker Tools For Mac
- Hack Tools For Windows
- Pentest Tools Nmap
- Hacking Tools Mac
- Hacker Tools Software
- Hacking Tools
- Pentest Tools Review
- Hack And Tools
- Game Hacking
- Hacking Tools Kit
- Hack Tools For Games
- Hack Tools For Games
- Android Hack Tools Github
- Hack Tools Pc
- Hacking Tools Windows
- Pentest Tools Nmap
- Hack Tools Download
- Hacking Tools Windows 10
- Hack Tools For Mac
- Underground Hacker Sites
- Free Pentest Tools For Windows
- Black Hat Hacker Tools
- How To Make Hacking Tools
- Hack Tools Download
- Best Pentesting Tools 2018
- Easy Hack Tools
- Hacker Tools Free
- Hacking App
- Pentest Tools Framework
- Hacking Tools Free Download
- Hacking Tools Hardware
- Pentest Tools Review
- Hacking Tools Software
- Easy Hack Tools
- Hack Tools
- Hacker Tools Free
- World No 1 Hacker Software
- Hacking Tools For Pc
- Hacking Tools Windows 10
- Pentest Tools Kali Linux
- Hack App
- Pentest Tools Alternative
- How To Make Hacking Tools
- Pentest Tools For Windows
- Kik Hack Tools
- Pentest Tools Port Scanner
- Pentest Tools Bluekeep
- Hacking Tools Free Download
- New Hacker Tools
- Hacker Tools Online
- Best Pentesting Tools 2018
- Physical Pentest Tools
- Hackrf Tools
- Pentest Tools Linux
- Hacking Tools Usb
- Hack Rom Tools
- Hacking Tools Kit
- Hacking Tools For Kali Linux
- Hacking Tools And Software
- Termux Hacking Tools 2019
- New Hack Tools
- Hacker Tools Apk Download
- Pentest Tools Online
- Hack Tools For Ubuntu
- Wifi Hacker Tools For Windows
- Game Hacking
- Hacking Tools Hardware
- Hacking Tools For Games
- Hacker Tools 2020
- Hack Tools For Pc
- Growth Hacker Tools
- Pentest Tools For Windows
- Usb Pentest Tools
- Github Hacking Tools
- Pentest Reporting Tools
- Hacker Tools 2019
- Hacker Tools 2019
- Pentest Tools Android
- Hack Tool Apk
- Hack Tool Apk
- Hackers Toolbox
- Hack Tools
- Pentest Tools Find Subdomains
- Hacking Tools Software
- Hacking Tools For Pc
- Hacking Tools Windows 10
- Hacking Tools For Windows Free Download
- Hacking Tools 2020
- Nsa Hack Tools
- Pentest Tools Android
- Hack Tools For Games
- Hacking Tools Hardware
- Hacking Tools For Windows Free Download
- Best Hacking Tools 2019
- Pentest Tools Windows
- Hacking Tools Online
- World No 1 Hacker Software
- Hacker Tools For Windows
- Android Hack Tools Github
- Hack Tools Download
- Hacker
- Hacker Search Tools
- Hacking Tools Download
- Hack Tools Online
- Hack Tools For Ubuntu
- Hacking Tools Name
- Pentest Tools Bluekeep
- Hacking Tools For Windows Free Download
- Pentest Automation Tools
- Hacking Tools For Pc
- Hacking Tools For Games
No comments:
Post a Comment