Emulating Shellcodes - Chapter 2

 Lets check different  Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.

This stages are fully emulated well and can get the IOC and the behavior of the shellcode.

But lets see another first stage big shellcode with c runtime embedded in a second stage.

In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.

Here there are two types of allocations:

Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.

The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.

Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.

So we have second stage unpacked in alloc_e40064

With "mdd" we do a memory dump to disk we found the size in previous screenshot,  and we can do  some static reversing of stage2 in radare/ghidra/ida

In radare we can verify that the extracted is the next stage:

I usually do correlation between the emulation and ghidra, to understand the algorithms.

If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and  is calling the allocated buffer in 0x4f...

And this  stage2 perform several API calls let's check it in ghidra.

We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls

Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;

So lets say yes and continue the emulation.

Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected. 

Nevertheless the shellcode detects something and terminates the process.

Lets trace the branches to understand the logic:

target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'

Continuing the emulation it's setting the SEH  pointer to previous stage:

Lets see from the console where is pointing the SEH chain item:

to be continued ...

https://github.com/sha0coder/scemu

Read more

1. Hacking Tools For Games
2. Pentest Tools Open Source
3. Pentest Tools Tcp Port Scanner
4. Pentest Tools For Windows
5. Bluetooth Hacking Tools Kali
6. Pentest Tools Apk
7. Hacker Tools For Ios
8. Best Pentesting Tools 2018
9. What Are Hacking Tools
10. Hackers Toolbox
11. Pentest Tools For Android
12. Hacking Tools For Windows
13. Hacker Tools Hardware
14. Pentest Tools Alternative
15. Pentest Tools Tcp Port Scanner
16. Hacking Tools For Beginners
17. Hacking Tools For Kali Linux
18. Hack Rom Tools
19. Hacker Tools Apk Download
20. Hacker Tools For Ios
21. Hacking Tools Free Download
22. Top Pentest Tools
23. Hack Tools Pc
24. Hacker Search Tools
25. Hack Tools Online
26. Usb Pentest Tools
27. Android Hack Tools Github
28. Hacking App
29. Ethical Hacker Tools
30. Hacking Tools For Beginners
31. Pentest Tools Windows
32. Install Pentest Tools Ubuntu
33. Pentest Tools Open Source
34. Pentest Tools For Mac
35. Best Pentesting Tools 2018
36. Pentest Tools List
37. Hacking Tools
38. Hacking Tools Online
39. Pentest Tools For Android
40. Hacking Tools Name
41. Hacking Tools Download
42. Hacker Tools Linux
43. Hacker Tools For Windows
44. Hacking Tools For Mac
45. Hacker Tools Software
46. New Hack Tools
47. Hacking Tools 2019
48. Pentest Tools Bluekeep
49. Hacker Tools Apk
50. Top Pentest Tools
51. Hacker Tools Free Download
52. Hacker Search Tools
53. Hacking Tools And Software
54. Easy Hack Tools
55. Hack Tools Pc
56. Pentest Tools Kali Linux
57. Hacking Tools Free Download
58. Kik Hack Tools
59. Pentest Tools Android
60. Pentest Tools Download
61. Hacker Tools 2020
62. Pentest Tools Framework
63. Pentest Tools Subdomain
64. Hacker Tools Apk Download
65. Hack Tools For Mac
66. Hack Tools Online
67. Pentest Tools Alternative
68. Pentest Tools Linux
69. Best Pentesting Tools 2018
70. Growth Hacker Tools
71. Pentest Tools Nmap
72. Pentest Tools Android
73. Nsa Hack Tools
74. Hacking Tools Github
75. Hacker Search Tools
76. Hacking Tools For Games
77. Best Hacking Tools 2019
78. Hack And Tools