Lets check different Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.
This stages are fully emulated well and can get the IOC and the behavior of the shellcode.
But lets see another first stage big shellcode with c runtime embedded in a second stage.
In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.
Here there are two types of allocations:
Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.
The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.
Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.
So we have second stage unpacked in alloc_e40064
With "mdd" we do a memory dump to disk we found the size in previous screenshot, and we can do some static reversing of stage2 in radare/ghidra/ida
In radare we can verify that the extracted is the next stage:
I usually do correlation between the emulation and ghidra, to understand the algorithms.
If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and is calling the allocated buffer in 0x4f...
And this stage2 perform several API calls let's check it in ghidra.
We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls
Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;
So lets say yes and continue the emulation.
Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected.
Nevertheless the shellcode detects something and terminates the process.
Lets trace the branches to understand the logic:
target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'
Lets see from the console where is pointing the SEH chain item:
to be continued ...
https://github.com/sha0coder/scemu
Related links
- Hack App
- Hacker Hardware Tools
- Hacker Tools For Mac
- Hacker Tools Apk Download
- Pentest Tools Alternative
- Pentest Tools Website Vulnerability
- Hacker Tools For Mac
- Hacking Tools For Games
- Hacking Tools
- Pentest Tools Apk
- Hacker Tools Free
- Usb Pentest Tools
- Hacking Tools And Software
- World No 1 Hacker Software
- Hacker Techniques Tools And Incident Handling
- Wifi Hacker Tools For Windows
- Best Hacking Tools 2019
- Pentest Tools Linux
- Tools 4 Hack
- Hack Tools For Games
- Hack Tools For Mac
- Hacking Apps
- Pentest Tools Kali Linux
- Hacker Tools Free Download
- Pentest Tools Framework
- New Hack Tools
- Wifi Hacker Tools For Windows
- Pentest Tools Windows
- Hacker Tools
- Underground Hacker Sites
- Usb Pentest Tools
- Top Pentest Tools
- Hacking Tools Online
- Pentest Tools Subdomain
- Hacker Tools Hardware
- Pentest Tools For Windows
- Pentest Tools For Windows
- Usb Pentest Tools
- Nsa Hack Tools
- Free Pentest Tools For Windows
- Best Pentesting Tools 2018
- Hack Tools Mac
- Pentest Tools List
- Hack Tools
- Tools Used For Hacking
- Pentest Recon Tools
- Hacking Tools Windows 10
- Hacking Tools For Windows Free Download
- Hacker Tools 2020
- Hacking Tools Mac
- Hack Tool Apk No Root
- Hacking Tools For Windows
- Hacker Tools Apk
- Hack Tools Github
- Easy Hack Tools
- Hacker
- Black Hat Hacker Tools
- Pentest Tools Review
- Hacker Techniques Tools And Incident Handling
- Hacking Tools For Kali Linux
- Hack Tool Apk
- Pentest Tools Download
- Bluetooth Hacking Tools Kali
- Hack Tools For Pc
- What Are Hacking Tools
- Growth Hacker Tools
- Pentest Tools Find Subdomains
- Hacking Tools 2020
- Easy Hack Tools
- How To Install Pentest Tools In Ubuntu
- Hackrf Tools
- Hacker Tools Free Download
- Nsa Hacker Tools
- Pentest Tools For Mac
- Hack Tools Download
- Hack Tools For Pc
- Best Hacking Tools 2020
- Black Hat Hacker Tools
- Hacker Security Tools
- Game Hacking
- Hack Tools
- Nsa Hack Tools Download
- Hacker Tools Hardware
- Blackhat Hacker Tools
- New Hacker Tools
- Pentest Box Tools Download
- Kik Hack Tools
- Hacking Tools For Kali Linux
- Usb Pentest Tools
- Hacker Tools Free
- Hacking Tools Github
- Hacking Tools For Windows Free Download
- Nsa Hack Tools
- Hacking Tools For Kali Linux
- Hacking Tools 2019
- Pentest Recon Tools
- Pentest Tools List
- Hacking Tools For Windows
- Hackrf Tools
- Hacker Tools Hardware
- Hacker Tools For Mac
- Ethical Hacker Tools
- Hacker Tools Online
- Best Hacking Tools 2019
- Hacking Tools For Windows
- Hacker Tools 2019
- Top Pentest Tools
- Pentest Tools Apk
- Hack Tool Apk No Root
- Hacking Tools For Mac
- Game Hacking
- Ethical Hacker Tools
- Hacker Tools 2019
- Hacking Tools For Kali Linux
- Hacking Tools Kit
- Github Hacking Tools
- Pentest Tools Review
- What Is Hacking Tools
- Hack Tools Download
- Tools For Hacker
- Pentest Tools Subdomain
- Physical Pentest Tools
- Hacker Tools 2019
- Hack Tool Apk No Root
- How To Install Pentest Tools In Ubuntu
- Computer Hacker
- Hacker Techniques Tools And Incident Handling
- Hacking Tools Windows 10
- Underground Hacker Sites
- Pentest Automation Tools
- Hacker Techniques Tools And Incident Handling
- Hack Tools For Games
- Hack Tools
- Bluetooth Hacking Tools Kali
- Hacking Tools Hardware
- Wifi Hacker Tools For Windows
- Hacking Tools For Windows Free Download
- Hack App
- Hack Tools For Games
- Hack Tools Pc
- Hack Tool Apk
- Hacking Tools Name
- Hack Tools For Ubuntu
- Hacker Tools 2019
- How To Make Hacking Tools
- Hacking Tools Mac
- New Hacker Tools
- Pentest Tools Find Subdomains
- Pentest Tools Subdomain
- Blackhat Hacker Tools
- Computer Hacker
- Pentest Tools Open Source
- Hacking Tools For Windows 7
- Best Pentesting Tools 2018
No comments:
Post a Comment