AV Evasion
Last updated
Last updated
This documentation has been made using the box AV Evasion Shellcode from Tryhackme. You can work on it here
Windows Executable file format, aka PE (Portable Executable), is a data structure that holds information necessary for files.
.text stores the actual code of the program
.data holds the initialized and defined variables
.bss holds the uninitialized data (declared variables with no assigned values)
.rdata contains the read-only data
.edata: contains exportable objects and related table information
.idata imported objects and related table information
.reloc image relocation information
.rsrc links external resources used by the program such as images, icons, embedded binaries, and manifest file, which has all information about program versions, authors, company, and copyright!
Example steps in which the Windows loader reads an executable binary and runs it as a process
Header sections: DOS, Windows, and optional headers are parsed to provide information about the EXE file. For example,
The magic number starts with "MZ," which tells the loader that this is an EXE file.
File Signatures
Whether the file is compiled for x86 or x64 CPU architecture.
Creation timestamp.
Parsing the section table details, such as
Number of Sections the file contains.
Mapping the file contents into memory based on
The EntryPoint address and the offset of the ImageBase.
RVA: Relative Virtual Address, Addresses related to Imagebase.
Imports, DLLs, and other objects are loaded into the memory.
The EntryPoint address is located and the main execution function runs.
Defining the shellcode as a local variable within the main function will store it in the .TEXT PE section.
Defining the shellcode as a global variable will store it in the .Data section.
Another technique involves storing the shellcode as a raw binary in an icon image and linking it within the code, so in this case, it shows up in the .rsrc Data section.
We can add a custom data section to store the shellcode.
PE-Bear is a software which helps to check the PE structure: Headers, Sections, etc. PE-Bear provides a graphic user interface to show all relevant EXE details.
We can get it here
Shellcode is a set of crafted machine code instructions that tell the vulnerable program to run additional functions and, in most cases, provide access to a system shell or create a reverse command shell.
Once the shellcode is injected into a process and executed by the vulnerable software or program, it modifies the code run flow to update registers and functions of the program to execute the attacker's code.
It is generally written in Assembly language and translated into hexadecimal opcodes (operational codes). Writing unique and custom shellcode helps in evading AV software significantly.
Methodology:
First we write our code in assembly. Here is an example provided by tryhackme
We compile and link the ASM code to create an x64 linux executable file and execute the program.
We extract the shellcode with the objdump command by dumping the .text section of the compiled binary.
We use objcopy to dump the .text section into a new file called thm.text in a binary format objcopy -j .text -O binary thm thm.text
The thm.text contains our shellcode in binary format, so to be able to use it, we will need to convert it to hex first. The xxd command has the -i option that will output the binary file in a C string directly xxd -i thm.text
To confirm that the extracted shellcode works as we expected, we can execute our shellcode and inject it into a C program.
Then, we compile gcc -g -Wall -z execstack thm.c -o thmx and we execute it ./thmx
msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -f c this shellcode generated with msfvenom will launch calc in the target.
Hackers inject shellcode into a running or new thread and process using various techniques. Shellcode injection techniques modify the program's execution flow to update registers and functions of the program to execute the attacker's own code.
This documentation has been made from my notes of this room on TryHackme:
Other convenient resources on the subject includes
