Lets check different Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.
This stages are fully emulated well and can get the IOC and the behavior of the shellcode.
But lets see another first stage big shellcode with c runtime embedded in a second stage.
In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.
Here there are two types of allocations:
Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.
The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.
Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.
So we have second stage unpacked in alloc_e40064
With "mdd" we do a memory dump to disk we found the size in previous screenshot, and we can do some static reversing of stage2 in radare/ghidra/ida
In radare we can verify that the extracted is the next stage:
I usually do correlation between the emulation and ghidra, to understand the algorithms.
If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and is calling the allocated buffer in 0x4f...
And this stage2 perform several API calls let's check it in ghidra.
We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls
Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;
So lets say yes and continue the emulation.
Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected.
Nevertheless the shellcode detects something and terminates the process.
Lets trace the branches to understand the logic:
target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'
Lets see from the console where is pointing the SEH chain item:
to be continued ...
https://github.com/sha0coder/scemu
Related links
- Hacker Tools For Ios
- New Hack Tools
- Pentest Tools Website
- Easy Hack Tools
- Nsa Hacker Tools
- Free Pentest Tools For Windows
- Pentest Tools Website Vulnerability
- Pentest Tools Subdomain
- Hacker Tools For Ios
- Hacking Tools For Pc
- Hacking Tools For Kali Linux
- Kik Hack Tools
- Install Pentest Tools Ubuntu
- Hacker Tools Apk
- Hacking Apps
- Hack Tools For Mac
- Hacking Tools Windows 10
- Hacking Tools 2019
- Hacking Tools Hardware
- Hack Tools For Windows
- How To Make Hacking Tools
- Hacking Tools Github
- Termux Hacking Tools 2019
- Hacker Hardware Tools
- Hacker Tools Linux
- Tools Used For Hacking
- Tools Used For Hacking
- Hacking Tools Windows
- Easy Hack Tools
- Beginner Hacker Tools
- Hacker Tools Apk Download
- Hacker Tools 2020
- How To Install Pentest Tools In Ubuntu
- Hacker Security Tools
- Hackrf Tools
- Pentest Tools Find Subdomains
- Pentest Automation Tools
- Termux Hacking Tools 2019
- Hacking App
- Pentest Tools Tcp Port Scanner
- Tools Used For Hacking
- Hack And Tools
- Hacking Tools 2019
- Pentest Reporting Tools
- Hack App
- Underground Hacker Sites
- Hack Tools For Games
- Hacking Tools Online
- Nsa Hacker Tools
- Hacking Tools Kit
- New Hack Tools
- Hacking Tools Github
- Hacker Tools Free Download
- Hacker Tools 2019
- Hacking Tools Download
- Hack Tools 2019
- World No 1 Hacker Software
- Pentest Tools Download
- Hacker Tools Hardware
- Install Pentest Tools Ubuntu
- Pentest Tools Windows
- Growth Hacker Tools
- Hack Tools
- Black Hat Hacker Tools
- Pentest Tools Apk
- Blackhat Hacker Tools
- Pentest Tools Android
- Hack Tools
- Pentest Tools For Android
- Hack Tool Apk
- Hacker Tools For Pc
- Pentest Tools Download
- Pentest Tools Port Scanner
- Hacking Tools Usb
- Hack Apps
- Usb Pentest Tools
- Hacking Tools For Pc
- Hacker Search Tools
- Hacker Tools Free
- Hacking Tools Free Download
- Pentest Tools For Windows
- Hacking Tools Online
- Blackhat Hacker Tools
- Best Hacking Tools 2020
- Hacking Tools Usb
- Best Hacking Tools 2020
- Nsa Hack Tools
- Hack Tools For Games
- Pentest Tools Website
- Hacker Hardware Tools
- Hacking Tools For Windows
- Hacker Tools 2020
- Underground Hacker Sites
- Tools 4 Hack
- Hack Tool Apk
- Hacking Tools Mac
- Ethical Hacker Tools
- Hacking Tools Kit
- New Hack Tools
- How To Make Hacking Tools
- Pentest Tools Framework
- Pentest Tools Subdomain
- Hack Tools Github
- Hak5 Tools
- Hacker Tools Apk