Lets check different Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.
This stages are fully emulated well and can get the IOC and the behavior of the shellcode.
But lets see another first stage big shellcode with c runtime embedded in a second stage.
In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.
Here there are two types of allocations:
Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.
The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.
Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.
So we have second stage unpacked in alloc_e40064
With "mdd" we do a memory dump to disk we found the size in previous screenshot, and we can do some static reversing of stage2 in radare/ghidra/ida
In radare we can verify that the extracted is the next stage:
I usually do correlation between the emulation and ghidra, to understand the algorithms.
If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and is calling the allocated buffer in 0x4f...
And this stage2 perform several API calls let's check it in ghidra.
We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls
Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;
So lets say yes and continue the emulation.
Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected.
Nevertheless the shellcode detects something and terminates the process.
Lets trace the branches to understand the logic:
target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'
Lets see from the console where is pointing the SEH chain item:
to be continued ...
https://github.com/sha0coder/scemu
- Hacker Tools 2020
- Hacking Tools Usb
- Hacking Tools Online
- Android Hack Tools Github
- Hack Tools For Windows
- Hacking Tools For Windows 7
- Pentest Tools For Mac
- Hacker Tools Online
- Hacking Tools Name
- Hacking Tools Download
- Pentest Tools Website
- Nsa Hack Tools Download
- Hack Tools Mac
- Pentest Tools Github
- Pentest Tools Android
- Hacking Tools For Beginners
- Android Hack Tools Github
- How To Hack
- Best Pentesting Tools 2018
- Pentest Recon Tools
- Pentest Tools Bluekeep
- Hacker Tools Apk Download
- Hacking Tools 2020
- How To Hack
- Hacker Tools For Windows
- Pentest Tools Nmap
- Hacking Tools For Pc
- Hacking Tools Windows
- Hacker Tools Online
- Best Hacking Tools 2019
- Wifi Hacker Tools For Windows
- Nsa Hack Tools Download
- Hacking Tools For Kali Linux
- Hacker Tools Apk Download
- Hack Tools For Pc
- Hackrf Tools
- Growth Hacker Tools
- Hacking Tools For Kali Linux
- Usb Pentest Tools
- Best Pentesting Tools 2018
- Pentest Tools Tcp Port Scanner
- Hacker Tools Free
- Hackers Toolbox
- Hacks And Tools
- Hacking Tools Github
- Hacker Tools Hardware
- Hacking Tools For Beginners
- How To Hack
- Nsa Hack Tools Download
- Free Pentest Tools For Windows
- Hacker Tools Linux
- Hacking Tools For Beginners
- Tools 4 Hack
- Hacker Tools Apk Download
- Pentest Tools Free
- Pentest Tools Kali Linux
- Hacker Tools 2019
- Hacking Tools Kit
- Hacking Tools For Games
- Hacking Tools For Kali Linux
- How To Install Pentest Tools In Ubuntu
- Hacking Tools For Mac
- Hacking Tools Free Download
- Tools For Hacker
- Pentest Box Tools Download
- Hacking Tools For Pc
- Hacking Tools Hardware
- Hacking Tools For Windows 7
- Hack App
- Ethical Hacker Tools
- Hacking Tools Usb
- Ethical Hacker Tools
- Hacking Tools For Windows Free Download
- Ethical Hacker Tools
- Hacker Hardware Tools
- Hacking Tools Usb
- Hacking Tools For Games
- Hacking Tools For Mac
- Pentest Tools Download
- Hacker Tools Windows
- Hack Tools For Ubuntu
- Install Pentest Tools Ubuntu
- Physical Pentest Tools
- Pentest Tools Nmap
- Hacker Tools For Ios
- New Hacker Tools
- Pentest Tools Apk
- Pentest Tools Online
- Hacker Techniques Tools And Incident Handling
- Hacker Tools 2019
- Hack Tools
- Pentest Automation Tools
- Hacker Techniques Tools And Incident Handling
- Hacking Tools Usb
- Best Hacking Tools 2020
- Pentest Tools Open Source
- Hack Tools Download
- Blackhat Hacker Tools
- Pentest Tools Free
- Easy Hack Tools
- Hacking Tools For Windows
- Hacker Tools 2019
- Hack Tools For Mac
- Hack Tools For Pc
- Game Hacking
- Hacking Tools For Pc
- Hacking Tools Mac
- Bluetooth Hacking Tools Kali
- Hack Tools For Windows
- Hack Tools For Games
- Hack Tools For Mac
- Pentest Tools List
- Hacking Tools 2019
- Hacking Tools Windows 10
- Termux Hacking Tools 2019
- Hackers Toolbox
- Hacker Tools
- Hacking Tools And Software
- Hack Tools For Pc
- Hacker Tools Online
- Hack Website Online Tool
- Pentest Tools Online
- What Are Hacking Tools
- Pentest Tools For Mac
No hay comentarios:
Publicar un comentario