Skip to main content

Backdoring PE files using code caves : OSCE/CTP Module 0x03 (OSCE Preparation)

Hello Readers,

This post will cover Backdooring of P.E file by using code caves . There are already good tools to do this for you eg. Backdoor Factory and Shelter which will do the same job and even bypass some static analysis of few antiviruses .

I will be covering the manual approach of backdooring a PE file .

Let's understand some terms :

[x] PE file :
The Portable Executable (PE) format is a file format for executables, object code, and DLLs, used in 32-bit and 64-bit versions of Windows operating systems.
[x] Code Cave :
Wikipedia says - "A code cave is a series of null bytes in a process's memory. The code cave inside a process's memory is often a reference to a section of the code’s script functions that have capacity for the injection of custom instructions. For example, if a script’s memory allows for 5 bytes and only 3 bytes are used, then the remaining 2 bytes can be used to add external code to the script."
[x] Shellcode :
Wikipedia - "A shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode."

Let's get started ....

You can download the Putty version which I have used from here .
I will be using Immunity Debugger for debugging purposes.You can use any other debugger like Ollydbg.
First we need to find the available code cave spaces where we can insert our malicious code.You can either add a section or modify an existing section and use the available code cave spaces.

I have used cave-miner script to locate available unused bytes.

Okey, so cave begins from 00445CD5. I will inject my shellcode  from 00445CD6.
I will be hijacking the entry point of the program and redirect the execution flow to our shellcode.
First of all , we have to make .data section executable using Lord P.E or any P.E header editor tool.
Once it is done , we need to copy the first few instructions of the entry point and save it somewhere in notepad.
Insert the first instruction as JMP 00445CD6 which will help in redirection of the execution flow to our newly discovered code cave space.
Once the entry point instructions are replcaed by JMP instruction then we need to note down what instructions are overwritten and those need to be restore later.
Now , let's understand the backdoor part -
3. Shellcode
4. Stack Allignment
7. RETORE instructions
8. JMP to next instruction

PUSHAD instruction is equivilent to writing:
Push EAX
Push ECX
Push EDX
Push EBX
Push ESP
Push EBP
Push ESI
Push EDI
POPAD pops the values back off the stack in reverse order, thus restoring all the register values.
PUSHAD and POPAD are useful for performing a easy save and restore of the general purpose registers without having to PUSH and POP every individual register in turn.
Similarly, PUSHFD and POPFD are used to save and restore the EFLAGS register.
Generate a reverse tcp shellcode from msvenom in hex format and Binary paste in code cave space after PUSHFD instruction.
Note down ESP value before shellcode execution and after shellcode execution for finding the difference and aligning the stack.
Before shellcode -
After shellcode -

Difference = 0018FF68 - 0018FD6C

Now allign stack by adding this value to esp .
After restoring save the newly modified executable and listen on netcat for reverse connection.
As soon as I started putty,it got stuck and didn't open until I closed the reverse connection . This is due to a function called WaitforSingleObject used in msfvenom shellcodes.
Here is a nice article on the same and how to fix this -

Msfvenom shellcode  uses INFINITE as a value for the dwMilliseconds parameter.
Fixing the waitforsingleobject problem by making dwMilliseconds  parameter value to 0 from -1(due to dec esi instruction which I replaced using NOP) -
Once It is fixed save the executable and you are good to Go .. !!!!!!!!!!!!!!!!

As soon as I open putty.exe it gave a reverse shell and at the same time working perfectly like a charm. ;)

Thanks for reading ..Happy Hacking .. :) 


Popular posts from this blog

Review of Pentester Academy - Attacking and Defending Active Directory Lab

Few months ago I didn't know what Active Directory is, and why should I care about it and never heard about ACL abuse and all. Although I had attended a BPAD (Breaking and Pwning Active Directory) training which was provided by Nullcon but I was not confident enough to go for this course exam, since my day-today activity involves VAPT stuffs related to Web/Network/Mobile and sometimes basic malware analysis (very basic one :p).  I started doing offshore lab and took help from some friends in understanding few Active Directory concepts. I did many silly mistakes during the lab and learned a lot. Meanwhile I registered for Active Directory Lab Course and got it in a discounted offer for first 50 students of about 11k INR  ( 1 mont lab access) :). Before wasting time any further let's dive into the review. The course - Certification - Certified Red Team Professional The Course Content  - After paying the course fee,

Brute Force Basic Authentication - PSP Assignment 0x1

Before we start I would like to bring your attention to this PSP course from Pentester Academy   - . The course is focused on Powershell scripting which can be used in pentesting activities. AGENDA  : 1. Introduction to Powershell 2. Basic Authentication lab setup 3. Brute-force Basic Authentication using Powershell Script -   - cmdlet   - IP,Port and word-list should be easily configurable 1.  Introduction to Powershell  -  Microsoft says- PowerShell is a task-based command-line shell and scripting language built on .NET. PowerShell helps system administrators and power-users rapidly automate tasks that manage operating systems (Linux, macOS, and Windows) and processes. PowerShell commands let you manage computers from the command line. PowerShell providers let you access data stores, such as the registry and certificate store, as easily as you access the file system. PowerShell includes a rich expression parser and a fu

Shellcode Analysis x86 - SLAE Assignment 0x5

Before we start , I would like to bring your attention to this SLAE course from securitytube which will help you learn Shellcoding - We all use metasploit in our daily pentest engagements so let's break-up some of the shellcode comes with metasploit. Analysis :  1. linux/x86/chmod  2. linux/x86/exec  3. linux/x86/read_file 1. linux/x86/chmod -   msfvenom -p linux/x86/chmod -f raw | ndisasm -u - msfvenom -p linux/x86/chmod -f c msfvenom -p linux/x86/chmod -f raw | sctest -vvv -Ss 100000 -G dot -Tpng -o chmod.png  2. linux/x86/exec -   msfvenom -p linux/x86/exec CMD=ls FILE=tmp.bin -f raw | ndisasm -u - msfvenom -p linux/x86/exec CMD=ls -f c msfvenom -p linux/x86/exec CMD=ls FILE=tmp.bin -f raw | /opt/libemu/bin/sctest -vvv -Ss 100000 -G dot -Tpng -o exec.png 3. linux/x86/read_file - msfvenom -p linux/x86/shell/revers