• Home

  • Documents

  • DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c...
70
Leave your malware @home Amit Waisel Hila Cohen

DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

  • Upload
    others

  • View
    0

  • Download
    0

Embed Size (px)

Citation preview

Page 1: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Leave your malware @home MALPROXY

Amit Waisel Hila Cohen

Page 2: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

USAboutAmit Waisel

Offensive Cyber Security Expert

Technology lead, Security Research @ XM Cyber

Trusted Security Advisor

Favorite bit: 1

Private Pilot , Skipper and cat lover

Hila Cohen

Security Researcher @ XM Cyber

@hilaco10

Passionate about Windows Internals and Malware

Analysis

Love to dance, travel the world and capture

moments with my camera

Page 3: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Endpoint protections introduction

Malproxy - A new technique to bypass endpoint protections

Demo Mitigations

TL;DR

Page 4: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

&Organizations heavily rely on endpoint protection solutions in their security stack

Unfair cat-and-mouse game

Security solutions evolved over time, so are the viruses

Page 5: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

What do you know about your

endpointprotectionsolutions?

Page 6: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

not great, not terrible

Anatoly Dyatlov

”

Page 7: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

malicious activity detection mechanisms

Endpoint Protection 101

Static signatures

Behavioral signatures

1 3

Heuristics

2

Page 8: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Static signatures1

Behavioral signatures

Heuristics2

3

//testbin.c int main (){ char *user = "adm.user"; printf("%s\n",user); return 0;}

Page 9: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Static signatures1

Behavioral signatures

Heuristics2

3

rule APT_adm_corp : apt //apt is just a tag, it doesn’t affect the rule.{ meta: //Metadata, they don’t affect the rule author = "xgusix"

strings: $adm = "adm." $corp = "corp." $elf = { 7f 45 4c 46 } //ELF file’s magic numbers

condition: $elf in (0..4) and ($adm or $corp) // If $elf in the first 4 bytes and it matches $adm or $corp}

Page 10: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Static signatures1

Behavioral signatures

Heuristics2

3

# yara -s -m -g rules.yar testbinAPT_adm_corp [apt] [author="xgusix"] testbin0x0:$elf: 7F 45 4C 460x4c0:$adm: adm.

Page 11: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Static signatures1

Behavioral signatures

Heuristics2

3

HackTool:Win32/OurCoolMimikatzSignature:"A La Vie, A L'Amour" - (oe.eo)Benjamin DELPY `gentilkiwi`Vincent LE TOUX## / \ ##sekurlsalogonpasswords

Page 12: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Static signatures1

Heuristics2

Behavioral signatures3

UPX2.data.textProperty

0x000034000x000004000x00000400Raw-address

0x200 bytes0x3000 bytes0x0 bytesRaw-size

0x0040A0000x004070000x00401000Virtual-address

0x1000 bytes0x3000 bytes0x6000 bytesVirtual-size

+-+Executable

-++Writable

Page 13: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Static signatures1

Heuristics2

Behavioral signatures3

Page 14: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Static signatures1

Heuristics2

Behavioral signatures3

Page 15: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Endpointprotectionsolutionsbypass

Page 16: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Endpoint protection solutions bypass

MALPROXY

Page 17: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Looking for my code somewhere?You will neverget this!

Page 18: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Target OS

Process

MA

LPR

OXY

Malicious code interacts with the underlying OS using API function calls

Those actions can be detected and blocked by any security solution

Malicious code

API

Page 19: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

MA

LPR

OXY

Proxy the malicious operations over the network

Never deploying the actual malicious code on the target side

Emulating needed API calls

Attacker OS

Stub

Malicious code

Stub

Innocent code

Target OS

API

Page 20: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

MA

LPR

OXY

Target & attacker stubs

Load the PE file and hook system API functions

Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat.

Attacker OS

Stub

Malicious code

Target OS

Stub

Innocent code

API

Page 21: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

MA

LPR

OXY

Target & attacker stubs

Load the PE file and hook system API functions

Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat.

Attacker OS

Stub

Malicious code

Target OS

Stub

Innocent code

CreateFile(”blah.txt”

)

API

Page 22: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

MA

LPR

OXY

Target & attacker stubs

Load the PE file and hook system API functions

Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat.

Attacker OS

Stub

Malicious code

Target OS

Stub

Innocent code

CreateFile(”blah.txt”

)

API

Page 23: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

MA

LPR

OXY

Target & attacker stubs

Load the PE file and hook system API functions

Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat.

Attacker OS

Stub

Malicious code

Target OS

Stub

Innocent code

HANDLE blah.txt

API

Page 24: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

MA

LPR

OXY

Target & attacker stubs

Load the PE file and hook system API functions

Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat.

Attacker OS

Stub

Malicious code

Target OS

Stub

Innocent code

HANDLE blah.txt

API

Page 25: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Key terms:SYSTEM CALLS OVERVIEW

USER MODE

KERNEL MODE

Kernel32.dll CreateFileCall CreateFile

Call NtCreateFile

SYSENTER\SYSCALLFind relevant function in SSDT and executes it

NtCreateFile

ZwCreateFile

Ntdll.dll

Ntoskrnl

Windows Application

Page 26: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Key terms:SYSTEM CALLS OVERVIEW

USER MODE

KERNEL MODE

Kernel32.dll CreateFileCall CreateFile

Call NtCreateFile

SYSENTER\SYSCALLFind relevant function in SSDT and executes it

NtCreateFile

ZwCreateFile

Ntdll.dll

Ntoskrnl

Windows Application

Page 27: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Key terms:SYSTEM CALLS OVERVIEW

USER MODE

KERNEL MODE

Kernel32.dll CreateFileCall CreateFile

Call NtCreateFile

SYSENTER\SYSCALLFind relevant function in SSDT and executes it

NtCreateFile

ZwCreateFile

Ntdll.dll

Ntoskrnl

Windows Application

Page 28: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Key terms:SYSTEM CALLS OVERVIEW

USER MODE

KERNEL MODE

Kernel32.dll CreateFileCall CreateFile

Call NtCreateFile

SYSENTER\SYSCALLFind relevant function in SSDT and executes it

NtCreateFile

ZwCreateFile

Ntdll.dll

Ntoskrnl

Windows Application

Page 29: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Key terms:SYSTEM CALLS OVERVIEW

USER MODE

KERNEL MODE

Kernel32.dll CreateFileCall CreateFile

Call NtCreateFile

SYSENTER\SYSCALLFind relevant function in SSDT and executes it

NtCreateFile

ZwCreateFile

Ntdll.dll

Ntoskrnl

Windows Application Process

Innocent code

COMPUTER OS

API

Page 30: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Key terms:SYSTEM CALLS OVERVIEW

USER MODE

KERNEL MODE

Kernel32.dll CreateFileCall CreateFile

Call NtCreateFile

SYSENTER\SYSCALLFind relevant function in SSDT and executes it

NtCreateFile

ZwCreateFile

Ntdll.dll

Ntoskrnl

Process

Innocent code

COMPUTER OS

Windows Application

API

Page 31: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Key terms:

HOOKINGRedirect system API calls to our code

Control all arguments & return value

Imported system API function addresses are resolved during PE load process and can be overridden later – IAT hooking

This allows us to separate the code’s logic from its interaction with the OS

IMPORT ADDRESS TABLE

NtQuerySystemInformation Malproxy

OpenProcess Malproxy

ReadProcessMemory Malproxy

BCryptGenerateSymetricKey Bcrypt.dll

ConvertSidToStringSidW Advapi32.dll

… …

RtlAdjustPrivilege Malproxy

NtQueryInformationProcess Malproxy

RtlEqualUnicodeString Ntdll.dll

Page 32: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Key terms:

BOOL stdcall ReadProcessMemory(HANDLE hProcrss, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead);

Return Type Calling Convention Function arguments

FUNCTIONPROTOTYPE

Page 33: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Dealing with all aspects of different prototypes

ProxyingWin32 API

Calling convention – same for all Win32API and Native API calls

Input Arguments:

Primitives

Pointers to primitives

User-allocated buffers

Output Arguments:

User-allocated output buffer

System-allocated output buffer

Return values

Page 34: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

Page 35: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE

Request Message

ProcessHandle

Page 36: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE

Request Message

ProcessHandleProcessInformationClass

Page 37: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE

Request Message

ProcessHandleProcessInformationClass

Page 38: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE

Request Message

ProcessHandleProcessInformationClass

ProcessInformationLength

Page 39: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE

Request Message

ProcessHandleProcessInformationClass

ProcessInformationLength

Page 40: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE TARGET SIDE

Request Message

ProcessHandleProcessInformationClass

ProcessInformationLength

Page 41: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE TARGET SIDE

Request Message

ProcessHandleProcessInformationClass

ProcessInformationLength

Page 42: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE TARGET SIDE

Response Message

ReturnLength

Page 43: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE TARGET SIDE

Response Message

ReturnLength

Page 44: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE TARGET SIDE

Response Message

ProcessInformationReturnLength

Page 45: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE TARGET SIDE

Response Message

ProcessInformationReturnLengthReturn value

Page 46: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

Response Message

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

TARGET SIDEATTACKER SIDE

ProcessInformationReturnLengthReturn value

Page 47: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

HandlingARGUMENTS

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

NTSTATUS NtQueryInformationProcess(IN HANDLE ProcessHandle,IN PROCESSINFOCLASS ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength

);

ATTACKER SIDE TARGET SIDE

Response Message

ProcessInformationReturnLengthReturn value

Page 48: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Attacker OS

Process

Malicious code

Target OS

Process

Innocent code

RECAPTarget & attacker stubs

Load the PE file and hook system API functions

Execution flow – hook, serialize, send, execute, serialize, send, return. Repeat.

API

Page 49: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE TARGET SIDE

Page 50: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE TARGET SIDE

Page 51: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

IMPORT ADDRESS TABLENtQuerySystemInformation Kernel32.dll

OpenProcess Kernel32.dll

ReadProcessMemory Ntdll.dll

BCryptGenerateSymetricKey Bcrypt.dll

ConvertSidToStringSidW Advapi32.dll

… …

RtlAdjustPrivilege Ntdll.dll

NtQueryInformationProcess Ntdll.dll

RtlEqualUnicodeString Ntdll.dll

TARGET SIDE

Page 52: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

IMPORT ADDRESS TABLENtQuerySystemInformation Malproxy

OpenProcess Malproxy

ReadProcessMemory Malproxy

BCryptGenerateSymetricKey Bcrypt.dll

ConvertSidToStringSidW Advapi32.dll

… …

RtlAdjustPrivilege Malproxy

NtQueryInformationProcess Malproxy

RtlEqualUnicodeString Ntdll.dll

TARGET SIDE

Page 53: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

RtlAdjustPrivilegeNtQuerySystemInformationRtlEqualUnicodeStringOpenProcessNtQueryInformationProcessReadProcessMemoryBCryptDecrypt

TARGET SIDE

Page 54: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

RtlAdjustPrivilegeNtQuerySystemInformationRtlEqualUnicodeStringOpenProcessNtQueryInformationProcessReadProcessMemoryBCryptDecrypt

RtlAdjustPrivilege

TARGET SIDE

Page 55: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

RtlAdjustPrivilegeNtQuerySystemInformationRtlEqualUnicodeStringOpenProcessNtQueryInformationProcessReadProcessMemoryBCryptDecrypt

RtlAdjustPrivilegeNtQuerySystemInformation

Chrome.exe, explorer.exe Calc.exe, lsass.exe

TARGET SIDE

Page 56: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

RtlAdjustPrivilegeNtQuerySystemInformationRtlEqualUnicodeStringOpenProcessNtQueryInformationProcessReadProcessMemoryBCryptDecrypt

RtlAdjustPrivilegeNtQuerySystemInformation

TARGET SIDE

Page 57: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

RtlAdjustPrivilegeNtQuerySystemInformationRtlEqualUnicodeStringOpenProcessNtQueryInformationProcessReadProcessMemoryBCryptDecrypt

RtlAdjustPrivilegeNtQuerySystemInformation

OpenProcessHandle 0x00000080

PID 1234

TARGET SIDE

Page 58: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

RtlAdjustPrivilegeNtQuerySystemInformationRtlEqualUnicodeStringOpenProcessNtQueryInformationProcessReadProcessMemoryBCryptDecrypt

RtlAdjustPrivilegeNtQuerySystemInformation

OpenProcessNtQueryInformationProcess

Handle 0x00000080

PEB at 0xdeadbeef

TARGET SIDE

Page 59: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

RtlAdjustPrivilegeNtQuerySystemInformationRtlEqualUnicodeStringOpenProcessNtQueryInformationProcessReadProcessMemoryBCryptDecrypt

RtlAdjustPrivilegeNtQuerySystemInformation

OpenProcessNtQueryInformationProcessReadProcessMemory

Read 0xdeadbeef

[0x12, 0x34, 0x56, 0x78]

TARGET SIDE

Page 60: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

RtlAdjustPrivilegeNtQuerySystemInformationRtlEqualUnicodeStringOpenProcessNtQueryInformationProcessReadProcessMemoryBCryptDecrypt

RtlAdjustPrivilegeNtQuerySystemInformation

OpenProcessNtQueryInformationProcessReadProcessMemory

TARGET SIDE

Page 61: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

RunningMALPROXY

ATTACKER SIDE

RtlAdjustPrivilegeNtQuerySystemInformation

OpenProcessNtQueryInformationProcessReadProcessMemoryPWNED!

RtlAdjustPrivilegeNtQuerySystemInformationRtlEqualUnicodeStringOpenProcessNtQueryInformationProcessReadProcessMemoryBCryptDecrypt

TopSecretPassword

TARGET SIDE

Page 62: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

DEMO

Page 63: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

”You came off

as a naive idiot. and naive idiots are not a threat

Page 64: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Endpoint protections

BYPASSBehavioral Signatures

Bypassing Heuristic Rules

Bypassing Static Signatures

Page 65: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Security Solution Mimikatz sekurlsa::logonpasswords

Microsoft Defender Malproxied!

Symantec Norton Security Malproxied!

Kaspersky Internet Security Blocks ReadProcessMemory without a verdict

ESET Smart Security Malproxied!

Avast Free Antivirus Blocks OpenProcess on lsass.exe without a verdict

Bitdefender Total Security Malproxied!

McAfee Total Protection Malproxied!

Page 66: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

”Why worry

about something that isn't going

to happen?

Page 67: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

MITIGATIONSAny more ideas?Hunt and sign

the target-side proxy stub

Improve the behavioral signature engines to handle their known weaknesses

Page 68: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

MITIGATIONSAny more ideas? /dev/nullHunt and sign

the target-side proxy stub

Improve the behavioral signature engines to handle their known weaknesses

Page 69: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

CREDITSThe Crazy Ideas Section - Remote Syscalls by Yaron Shani:

http://breaking-the-system.blogspot.com/2016/06/the-crazy-ideas-section-remote-syscalls.html

Syscall Proxying - Simulating remote execution by Maximiliano Caceres:http://www.vodun.org/papers/exploits/SyscallProxying.pdf

Syscall Proxying || Pivoting Systems by Filipe Balestra and Rodrigo Rubira Branco:https://www.kernelhacking.com/rodrigo/docs/H2HCIII.pdf

https://breaking-the-system.blogspot.com/2016/06/the-crazy-ideas-section-remote-syscalls.html
http://www.vodun.org/papers/exploits/SyscallProxying.pdf
https://www.kernelhacking.com/rodrigo/docs/H2HCIII.pdf
Page 70: DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27...s s Malicious code Target OS P r o c e s s Innocent code RE CAP Target & attacker stubs Load the PE le and hook system

Questions?


Aaron Bayles DC101 @ DEF CON 22 - DEF CON® Hacking Conference · Aaron Bayles DC101 @ DEF CON 22 ... //media.blackhat.com/us ... Lockpicking, Hackers, Infosec, Hardware Hacking,

Aaron Bayles DC101 @ DEF CON 22 - DEF CON® Hacking Conference · Aaron Bayles DC101 @ DEF CON 22 ... //media.blackhat.com/us ... Lockpicking, Hackers, Infosec, Hardware Hacking,

Documents
Introduction to SDR & the Wireless Village - DEF CON CON 23/DEF CON 23 presentations/DEF… · Introduction to SDR & the Wireless Village ! Who the Frig...! satanklawz!! DaKahuna!

Introduction to SDR & the Wireless Village - DEF CON CON 23/DEF CON 23 presentations/DEF… · Introduction to SDR & the Wireless Village ! Who the Frig...! satanklawz!! DaKahuna!

Documents
Secure Tokin’ & Doobiekeys - DEF CON CON 25/DEF CON 25... · 2020. 5. 16. · Insecure Boot Spliff Trusted Platform Module Doobiekey Altered State. Title: Untitled Author: DEF CON

Secure Tokin’ & Doobiekeys - DEF CON CON 25/DEF CON 25... · 2020. 5. 16. · Insecure Boot Spliff Trusted Platform Module Doobiekey Altered State. Title: Untitled Author: DEF CON

Documents
Download - Def Con

Download - Def Con

Documents
Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Documents
Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24...Katea Murray –murrayka@leidos.com 2016-08-05 Estell/Murray Eavesdropping on the Machines 28. Title: DEF CON 24

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24...Katea Murray –[email protected] 2016-08-05 Estell/Murray Eavesdropping on the Machines 28. Title: DEF CON 24

Documents
DEF CON 26 HACKING CONFERENCE CON 26/DEF CON 26 receipt.pdf · Title: DEF CON 26 HACKING CONFERENCE Author: DEF CON 26 Subject: DEF CON 26 RECEIPT Keywords: DEF CON Conference, DEF

DEF CON 26 HACKING CONFERENCE CON 26/DEF CON 26 receipt.pdf · Title: DEF CON 26 HACKING CONFERENCE Author: DEF CON 26 Subject: DEF CON 26 RECEIPT Keywords: DEF CON Conference, DEF

Documents
Hacking travel routers like it’s 1999 - DEF CON Media Server CON 25/DEF CON 25 presentations/DEF… · Hacking travel routers like it’s 1999 Mikhail Sosonkin. Mikhail Sosonkin

Hacking travel routers like it’s 1999 - DEF CON Media Server CON 25/DEF CON 25 presentations/DEF… · Hacking travel routers like it’s 1999 Mikhail Sosonkin. Mikhail Sosonkin

Documents
WPA TOO ! - DEF CON

WPA TOO ! - DEF CON

Documents
WEAPONIZING THE BBC MICRO:BIT - DEF CON CON 25/DEF CON 25 presentations/DEFCON...WEAPONIZING THE BBC MICRO:BIT ... Python code size is limited, ... DEF CON Conference, DEF CON, DEFCON,

WEAPONIZING THE BBC MICRO:BIT - DEF CON CON 25/DEF CON 25 presentations/DEFCON...WEAPONIZING THE BBC MICRO:BIT ... Python code size is limited, ... DEF CON Conference, DEF CON, DEFCON,

Documents
Building AppSec Automation with python - DEF CON CON 25/DEF CON 25... · Building AppSec Automation with python ... Con!guring ZAP to run with Python ... DEF CON, DEFCON, Speeches,

Building AppSec Automation with python - DEF CON CON 25/DEF CON 25... · Building AppSec Automation with python ... Con!guring ZAP to run with Python ... DEF CON, DEFCON, Speeches,

Documents
Cracking Cryptocurrency Brainwallets - DEF CON CON 23/DEF CON 23 presentations/DEF… · Cracking Cryptocurrency Brainwallets Ryan Castellucci ... pass a file with pubkeyhashs,

Cracking Cryptocurrency Brainwallets - DEF CON CON 23/DEF CON 23 presentations/DEF… · Cracking Cryptocurrency Brainwallets Ryan Castellucci ... pass a file with pubkeyhashs,

Documents
Bypass firewalls, application white ... - media.defcon.org CON 22/DEF CON 22 presentations... · DEF CON 22, 2014. Hungary. root@ ... ... DEFCON, DEF CON, Hacker, Security Conference,

Bypass firewalls, application white ... - media.defcon.org CON 22/DEF CON 22 presentations... · DEF CON 22, 2014. Hungary. root@ ... ... DEFCON, DEF CON, Hacker, Security Conference,

Documents
Kartograph - DEF CON

Kartograph - DEF CON

Documents
Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file

Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file

Documents
DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF… · •Dummy frame injection •Delaying acknowledgments ECU CAN High CAN Low ... #wireshark -X lua_script:ethcan.lua

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF… · •Dummy frame injection •Delaying acknowledgments ECU CAN High CAN Low ... #wireshark -X lua_script:ethcan.lua

Documents
DEF CON 26 Voting Village - DEF CON® Hacking Conference CON 26 voting... · 2018-09-27 · DEF CON 26 Voting Village Report on Cyber Vulnerabilities in U.S. Election Equipment, Databases,

DEF CON 26 Voting Village - DEF CON® Hacking Conference CON 26 voting... · 2018-09-27 · DEF CON 26 Voting Village Report on Cyber Vulnerabilities in U.S. Election Equipment, Databases,

Documents
Teaching Old Shellcode New Tricks - DEF CON CON 25/DEF CON 25 presentations/DE… · Teaching Old Shellcode New Tricks DEF CON 2017 @midnite_runr

Teaching Old Shellcode New Tricks - DEF CON CON 25/DEF CON 25 presentations/DE… · Teaching Old Shellcode New Tricks DEF CON 2017 @midnite_runr

Documents
Keren Elazari aka @K3r3n3 - DEF CON Media Server CON 22/DEF CON 22...Empowering Hackers to Create a Positive Impact, Keren Elazari, DEFCON, DEF CON, Hacker, Security Conference, Presentations,

Keren Elazari aka @K3r3n3 - DEF CON Media Server CON 22/DEF CON 22...Empowering Hackers to Create a Positive Impact, Keren Elazari, DEFCON, DEF CON, Hacker, Security Conference, Presentations,

Documents
Introduction to x86 disassembly - DEF CON CON 24/DEF CON 24 workshops/DEF CON 24... · x86 •Today, “x86” generally refers to all architectures based off of the original 8086

Introduction to x86 disassembly - DEF CON CON 24/DEF CON 24 workshops/DEF CON 24... · x86 •Today, “x86” generally refers to all architectures based off of the original 8086

Documents
Hacking MANET - Def Con

Hacking MANET - Def Con

Documents
Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24 presentations/DEF… · Network Protocol Reverse Engineering ... Linux, Mac •Scapy –Python based, extensible •Fuzzing

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24 presentations/DEF… · Network Protocol Reverse Engineering ... Linux, Mac •Scapy –Python based, extensible •Fuzzing

Documents
DEF CON 23 Presentation CON 23/DEF CON 23... · DEF CON 23 Presentation Keywords: DEF CON Conference, DEF CON, DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer Security,

DEF CON 23 Presentation CON 23/DEF CON 23... · DEF CON 23 Presentation Keywords: DEF CON Conference, DEF CON, DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer Security,

Documents
Exploiting Administrator Insecurities - DEF CON CON 26/DEF CON 26... · Exploiting Active Directory Administrator Insecurities Sean Metcalf (@Pyrotek3) s e a n @ adsecurity . org

Exploiting Administrator Insecurities - DEF CON CON 26/DEF CON 26... · Exploiting Active Directory Administrator Insecurities Sean Metcalf (@Pyrotek3) s e a n @ adsecurity . org

Documents
Beyond the MCSE: Red Teaming Active Directory - DEF CON CON 24/DEF CON 24 presentations/DEFCON... · Beyond the MCSE: Red Teaming Active Directory Sean Metcalf (@Pyrotek3) s e a n

Beyond the MCSE: Red Teaming Active Directory - DEF CON CON 24/DEF CON 24 presentations/DEFCON... · Beyond the MCSE: Red Teaming Active Directory Sean Metcalf (@Pyrotek3) s e a n

Documents
TASBot the perfectionist - DEF CON CON 24/DEF CON 24 presentations/DEF CON 24... · TASBot the perfectionist The amazing life & achievements of... Agenda Intro to Speedrunning video

TASBot the perfectionist - DEF CON CON 24/DEF CON 24 presentations/DEF CON 24... · TASBot the perfectionist The amazing life & achievements of... Agenda Intro to Speedrunning video

Documents
Starting the Avalanche - DEF CON CON 25/DEF CON 25 presentations/DEF… · Starting the Avalanche: Application DoS ... DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer

Starting the Avalanche - DEF CON CON 25/DEF CON 25 presentations/DEF… · Starting the Avalanche: Application DoS ... DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer

Documents
Crypto for Hackers - DEF CON CON 23/DEF CON 23 presentations/DEF CON 23... · Crypto for Hackers Eijah v1.00 August 7th, 2015 “Shall we play a game?

Crypto for Hackers - DEF CON CON 23/DEF CON 23 presentations/DEF CON 23... · Crypto for Hackers Eijah v1.00 August 7th, 2015 “Shall we play a game?

Documents
Beyond the MCSE: Red Teaming Active Directory CON 24/DEF CON 24 presentations/DEF CON 24... · Beyond the MCSE: Red Teaming Active Directory Sean Metcalf (@Pyrotek3) s e a n @ adsecurity

Beyond the MCSE: Red Teaming Active Directory CON 24/DEF CON 24 presentations/DEF CON 24... · Beyond the MCSE: Red Teaming Active Directory Sean Metcalf (@Pyrotek3) s e a n @ adsecurity

Documents
DEF CON 26 Hacking Conference CON 26/DEF CON 26...Find us on Twitter: @michaelossmann / @dominicgs Title DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

DEF CON 26 Hacking Conference CON 26/DEF CON 26...Find us on Twitter: @michaelossmann / @dominicgs Title DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

Documents