Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Playing Malware Injection with Exploit thoughts

229b1596ce57cd0935a2bacd410d87a0?s=47 adr
August 11, 2018

Playing Malware Injection with Exploit thoughts

In the past, when hackers did malicious program code injection, they used to adopt RunPE, AtomBombing, cross-process creation threads, and other approaches. They could forge their own execution program as any critical system service. However with increasing process of anti-virus techniques, these sensitive approaches have been gradually proactively killed. Therefore, hackers began to aim at another place, namely memory-level weakness, due to the breakages of critical system service itself.

This agenda will simply introduce a new memory injection technique that emerged after 2013, PowerLoadEx. Based on this concept, three new injection methods will be disclosed as well. These makes good use of the memory vulnerability in Windows to inject malicious behavior into system critical services. The content will cover Windows reverse analysis, memory weakness analysis, how to use and utilize, and so on. The relevant PoC will be released at the end of the agenda.

229b1596ce57cd0935a2bacd410d87a0?s=128

adr

August 11, 2018
Tweet

More Decks by adr

Other Decks in Technology

Transcript

  1. Playing Malware Injection with Exploit thoughts aaaddress1@chroot.org

  2. • Master degree at CSIE, NTUST • Security Researcher -

    chrO.ot, TDOHacker • Speaker - BlackHat, VXCON, HITCON >_cat ./Bio
  3. • Introduction • Challenge When we meet Anti-Virus • Interesting

    Case - PowerLoader since 2013 • New Vulnerability - 3 idea inspired by PowerLoader • Summary >_ls ./agenda
  4. aaaddress1@chroot.org Quickly Review: What's Malware Injection?

  5. >_man inject (`_´)ゞ Used for bypassing whitelist checking, byassing anti-virus,

    privilege escalation, etc. e.g. • DLL Side-Loading + Digital Signature = Bypassing anti-virus • Remote Inject + whitelisted process = Bypassing whitelist • Inject explorer + DLL Side-Loading + Self-elevate Service
 = Bypassing Windows UAC (User Account Control) *Vista ~ Win8*
  6. >_man inject There're serval well-known techniques • Shellcode Inject or

    DLL Inject - OpenProcess, VirtualAllocExRWX, WriteProcessMemory, CreateRemoteThread
 • Process Hollowing (aka RunPE) - OpenProcess, CreateProcessASuspended, Mapping PE FileVirtualAllocEx + WriteProcessMemory, GetThreadContext, and ResumeThread to Execute exe file from memory
 • Thread Hijack or AtomBombing - QueueUserAPC, Inline Hook, or IAT Hijack
 • Memory Exploit (PowerLoaderEX) - SetWindowLong, SendNotifyMessage
  7. (ꐦ`•ω•´)!!! Here are the 4 primary challenges that you'll encounter

    during injection. >_man inject
  8. There are 4 primary challenges in injection: 1. What's target

    - choose a target to inject, and it should be meaningful. e.g. explorer, svchost
 2. Where to place - find memory for us to place RWX memory or ROPChain payload. e.g. VirtualAllocEx
 3. How to inject payload - any way for us to write payload into remote process memory
 4. How to execute - create a new thread to execute or hijack current thread of that process? >_man inject
  9. aaaddress1@chroot.org Interesting Case: Powerloader since 2013

  10. Powerloader, aka Extra Window Vulnerability

  11. >_Shell_TrayWnd?

  12. >_Shell_TrayWnd? Window event callback function

  13. >_s_WndProc?

  14. >_s_WndProc?

  15. >_how it works Explorer Process Memory Low Address ➔ High

    Address ➔ Shell_TrayWnd Window Class Structure +0 - 0xcafe (vtable) +4 - window hwnd ...
  16. Explorer Process Memory Shell_TrayWnd +0 - 0xcafe (vtable) +4 -

    window hwnd ... vtable @ 0xcafe +0 - Interlocked (inc) +4 - message callback +8 - Interlocked (inc) >_how it works
  17. Explorer Process Memory Shell_TrayWnd +0 - 0xcafe (vtable) +4 -

    window hwnd ... vtable @ 0xcafe +0 - Interlocked (inc) +4 - message callback +8 - Interlocked (inc) Operating System 1) Send Window Message 2) Send Window Message 3) Invoke s_wndProc function 4) Invoke several function from vtable >_how it works
  18. Explorer Process Memory Shell_TrayWnd +0 - 0xcafe (vtable) +4 -

    window hwnd ... vtable @ 0xcafe +0 - Interlocked (inc) +4 - message callback +8 - Interlocked (inc) >_issue? GetWindowLong()
  19. Explorer Process Memory Shell_TrayWnd +0 - 0xbeef 0xcafe +4 -

    window hwnd ... >_issue? GetWindowLong() vtable @ 0xcafe +0 - Interlocked (inc) +4 - message callback +8 - Interlocked (inc) fake vtable @ 0xbeef +0 - shellcode addr +4 - shellcode ... SetWindowLong()
  20. Explorer Process Memory malicious Shell_TrayWnd >_issue? GetWindowLong() payload SetWindowLong() +0

    - fake vtable ($+4) fake vtable +4 - shellcode addr ($+8) +8 - shellcode pwn!
  21. >_abuse vtable

  22. >_abuse vtable

  23. aaaddress1@chroot.org Demo

  24. aaaddress1@chroot.org 3 more vulnerability: From Exploit to Inject

  25. Actually, Many old-design services in Windows don't have vtable mitigation

    (° ꈊ °)✧˖
  26. aaaddress1@chroot.org #1 Ole32 DropEnter Event

  27. >_cat ./ole32_init

  28. >_cat ./reg_dropevent

  29. >_man LPDROPTARGET IDropTarget actually is a virtual method table :)

  30. >_issue? vtable addr is determined by GetProp() so... it's really

    easy for us to hijack vtable just by SetProp() This callback function is used to deal with dropping file to Start Button of Explorer.exe
  31. >_how it works explorer Process Memory Low Address ➔ High

    Address ➔ DropTarget @ 0xc0fee DropTarget Structure +4 - function 1 ... +8 - function 2 +0C- dropfile func Prop Name Value OleDropTargetInterface 0xc0fee write DropTarget structure address (0xc0fee) via SetPropW() in function explorer!RegisterDragDrop +0 - 0xc0fee (this)
  32. >_how it works explorer Process Memory DropTarget @ 0xc0fee Prop

    Name Value OleDropTargetInterface 0xbeef payload @ 0xbeef +0 - 0xbeef (this) +4 - don't care ... +8 - don't care +0C- shellcode addr it's easy for us to change the return value of GetPropW("OleDropTargetInterface") from 0xc0fee to 0xbeef (malicious payload).
  33. explorer Process Memory Operating System 1) Send Window Message (Drag

    & Drop) 2) GetPropW("OleDropTargetInterface") 3) Invoke drop file function from vtable, invoke shellcode addr = *(beef+0c) >_how it works DropTarget @ 0xc0fee payload @ 0xbeef +0 - 0xbeef (this) +4 - don't care ... +8 - don't care +0C- shellcode addr Prop Name Value OleDropTargetInterface 0xbeef
  34. >_abuse vtable

  35. >_abuse vtable

  36. aaaddress1@chroot.org Demo

  37. aaaddress1@chroot.org #2 Comctl32 SubClass Event

  38. >_cat FastGetSubclsHdr

  39. >_cat MstSubclsProc

  40. >_cat EnterSubclsFram

  41. >_cat CallNxtSubclsProc

  42. >_cat EntrSubclsCallbk

  43. >_abuse vtable

  44. >_abuse vtable

  45. >_abuse vtable

  46. aaaddress1@chroot.org Demo

  47. aaaddress1@chroot.org #3 Thread Hijacking (win10+)

  48. 3) create first thread of this process, point register eax

    to AddressOfEntry, point ebx+8 (TIB base + 8) to image base, and point eip to ntdll!LdrInitializeThunk Process >_Process? Kernel (ring0) Application (ring3) 1) create process via CreateProcess() 2) mapping file into memory iexplorer.exe .data section .text section AddressOfEntry ntdll.dll kernel32.dll ...
  49. >_Process? Process iexplorer.exe ntdll.dll kernel32.dll ... Call Stack -------------- _LdrpSnapModule

    _LdrpMapAndSnapDependency _LdrpMapDllWithSectionHandle _LdrpLoadKnownDll _LdrpFindOrPrepareLoadingModule _LdrpLoadDllInternal _LdrpLoadDll _LdrLoadDll _LdrpInitializeProcess __LdrpInitialize _LdrInitializeThunk fix import address table, fix export directory, apply relocation, etc .text section ntdll!LdrInitializeThunk
  50. >_Process? ntdll!LdrInitializeThunk AddressOfEntry@.text Process iexplorer.exe .text section ntdll.dll kernel32.dll ...

    ntdll!RtlUserThreadStart RtlUserThreadStart is entry-point of every thread. We can hijack thread via write shellcode address into global variable ‘LdrDelegatedRtlUserThreadStart'.
  51. 3) point 'LdrDelegatedRtlUserThreadStart' to shellcode address Process >_Abuse Malware 1)

    get privilege of target process via OpenProcess() 2) mapping shellcode into target process chrome.exe .data section .text section shellcode ... ntdll.dll LdrDelegatedRtlUserThreadStart 4) every new thread of target process can be hijack to invoke shellcode
  52. aaaddress1@chroot.org Demo

  53. Thanks for listening aaaddress1@chroot.org Slide Github @aaaddress1 Facebook