Skip to main content

Backdoring PE files using code caves : OSCE/CTP Module 0x03 (OSCE Preparation)

Hello Readers,

This post will cover Backdooring of P.E file by using code caves . There are already good tools to do this for you eg. Backdoor Factory and Shelter which will do the same job and even bypass some static analysis of few antiviruses .

I will be covering the manual approach of backdooring a PE file .

Let's understand some terms :

[x] PE file :
The Portable Executable (PE) format is a file format for executables, object code, and DLLs, used in 32-bit and 64-bit versions of Windows operating systems.
[x] Code Cave :
Wikipedia says - "A code cave is a series of null bytes in a process's memory. The code cave inside a process's memory is often a reference to a section of the code’s script functions that have capacity for the injection of custom instructions. For example, if a script’s memory allows for 5 bytes and only 3 bytes are used, then the remaining 2 bytes can be used to add external code to the script."
[x] Shellcode :
Wikipedia - "A shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode."

Let's get started ....

You can download the Putty version which I have used from here .
I will be using Immunity Debugger for debugging purposes.You can use any other debugger like Ollydbg.
First we need to find the available code cave spaces where we can insert our malicious code.You can either add a section or modify an existing section and use the available code cave spaces.

I have used cave-miner script to locate available unused bytes.


Okey, so cave begins from 00445CD5. I will inject my shellcode  from 00445CD6.
I will be hijacking the entry point of the program and redirect the execution flow to our shellcode.
First of all , we have to make .data section executable using Lord P.E or any P.E header editor tool.
Once it is done , we need to copy the first few instructions of the entry point and save it somewhere in notepad.
Insert the first instruction as JMP 00445CD6 which will help in redirection of the execution flow to our newly discovered code cave space.
Once the entry point instructions are replcaed by JMP instruction then we need to note down what instructions are overwritten and those need to be restore later.
Now , let's understand the backdoor part -
1. PUSHAD
2. PUSHFD
3. Shellcode
4. Stack Allignment
5. POPFD
6. POPAD
7. RETORE instructions
8. JMP to next instruction

PUSHAD instruction is equivilent to writing:
Push EAX
Push ECX
Push EDX
Push EBX
Push ESP
Push EBP
Push ESI
Push EDI
POPAD pops the values back off the stack in reverse order, thus restoring all the register values.
PUSHAD and POPAD are useful for performing a easy save and restore of the general purpose registers without having to PUSH and POP every individual register in turn.
Similarly, PUSHFD and POPFD are used to save and restore the EFLAGS register.
Generate a reverse tcp shellcode from msvenom in hex format and Binary paste in code cave space after PUSHFD instruction.
Note down ESP value before shellcode execution and after shellcode execution for finding the difference and aligning the stack.
Before shellcode -
After shellcode -

Difference = 0018FF68 - 0018FD6C

Now allign stack by adding this value to esp .
After restoring save the newly modified executable and listen on netcat for reverse connection.
As soon as I started putty,it got stuck and didn't open until I closed the reverse connection . This is due to a function called WaitforSingleObject used in msfvenom shellcodes.
Here is a nice article on the same and how to fix this -
https://simonuvarov.com/msfvenom-reverse-tcp-waitforsingleobject/

Msfvenom shellcode  uses INFINITE as a value for the dwMilliseconds parameter.
Fixing the waitforsingleobject problem by making dwMilliseconds  parameter value to 0 from -1(due to dec esi instruction which I replaced using NOP) -
Once It is fixed save the executable and you are good to Go .. !!!!!!!!!!!!!!!!
POC-

As soon as I open putty.exe it gave a reverse shell and at the same time working perfectly like a charm. ;)

Thanks for reading ..Happy Hacking .. :) 

Comments

Popular posts from this blog

Review of Pentester Academy - Attacking and Defending Active Directory Lab

Few months ago I didn't know what Active Directory is, and why should I care about it and never heard about ACL abuse and all. Although I had attended a BPAD (Breaking and Pwning Active Directory) training which was provided by Nullcon but I was not confident enough to go for this course exam, since my day-today activity involves VAPT stuffs related to Web/Network/Mobile and sometimes basic malware analysis (very basic one :p).  I started doing offshore lab and took help from some friends in understanding few Active Directory concepts. I did many silly mistakes during the lab and learned a lot. Meanwhile I registered for Active Directory Lab Course and got it in a discounted offer for first 50 students of about 11k INR  ( 1 mont lab access) :). Before wasting time any further let's dive into the review. The course -  https://www.pentesteracademy.com/activedirectorylab Certification - Certified Red Team Professional The Course Content  - After paying the course fee,

Hacking Thick Clients – Authorization Bypass

Hello Readers, This post will be focused on setting up a vulnerable thick client application and finding vulnerabilities. The blog post is an unofficial part of the on going series of post by NetSPI. NetSPI has released a vulnerable thick client app called BetaFast which has two versions - BetaBank and BetaFast based on 2-tier and 3-tier architecture respectively. The app is coded by Austin Altmann  and he is writing the walk-through series. Note: At the time of writing this blog, the walk-through/write-up for authorization bypass vulnerability was yet to be published by NetSPI and therefore I decided to create this blog post. All the credit for developing and maintaining this app goes to Austin and NetSPI team. You can find some of the cool write-ups here . Let's start. Setting up Betafast - 1. Download the files from github -  https://github.com/NetSPI/BetaFast  . 2. Extract and open the .sln file with