Skip to content

Commit d3e3088

Browse files
mantvydasbgitbook-bot
authored andcommitted
GITBOOK-1868: change request with no subject merged in GitBook
1 parent e47eda8 commit d3e3088

File tree

125 files changed

+865
-645
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

125 files changed

+865
-645
lines changed
Loading
Loading
Loading
18.3 KB
Loading

.gitbook/assets/evil64 (1) (1).dll

5 KB
Binary file not shown.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
Delivered-To: mantvydo@gmail.com
2+
Received: by 2002:a81:1157:0:0:0:0:0 with SMTP id 84-v6csp5048438ywr;
3+
Tue, 2 Oct 2018 12:48:56 -0700 (PDT)
4+
X-Google-Smtp-Source: ACcGV63RAD6LtVnbie/Kqdj1bHRyM8rNKIS6TY1ZIcHgAtFi/IsrKv9h1TDKA4skX5r4wqy7CFsC
5+
X-Received: by 2002:a62:98d5:: with SMTP id d82-v6mr8196233pfk.97.1538509736553;
6+
Tue, 02 Oct 2018 12:48:56 -0700 (PDT)
7+
ARC-Seal: i=1; a=rsa-sha256; t=1538509736; cv=none;
8+
d=google.com; s=arc-20160816;
9+
b=wYES/0YHmuxw5mZqe5Z53+4t/P+eA18CTZ3+4JCGG3ZfMMlkcZWB6ewT2U3W/BybLu
10+
kURFu2LYPplWyRwFI3/uqQAxdK67j2SB6hwgVUah2YvE/SWQJpMfSG09spWVvpRciL0i
11+
SV+WxJ+Mo6+dpWn2W27rjRDC+kCn7eDpwmlLyHvQjCohdBuRv8Xd/9xBaey2OC7b1zjs
12+
/NZbBFqxiEG2ppy+/9Tcki4i7mmCVhPDC5lcYhncwijY19xy0ZYFUCKW/IDrdOqvbpJw
13+
Z9r+a94cUnjLV3utAeTcev1l3rZguh6uzuvIrFMINh0Rbom2N6O4Fx7Lo70iWgvfbbc1
14+
YTKQ==
15+
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
16+
h=from:date:message-id;
17+
bh=IXgsblUVNMiBXFF6vPcJNGPsIc8JF5BXk+LADOkT2XY=;
18+
b=oTH1wYZ7XrcrWUyNngAY1exaietJ2Sm0uM+Z2AHb8fHMnfBF9RaKnJX47JW1zjTG3x
19+
5XBRL2nrAmxGP/5/g+qk8fF0q0VVvOG7HRaZh3hhmoKMS/mKsduqYMUFPbssurWgfxvy
20+
BLaid3EAMmnqcN1MQ8D8j9YsCiTLmqkuukjrtXF3Zdz0Xcdhrmwl9bC1U4oHcHJj4Nlo
21+
Fph8UGvtFbvGg8+vGqnW21SN0W1FwhB2KcfSahoRV+b5XQ69nTpL/1MG8Ap8kmsmM1Xh
22+
4sliLVPNL8Qnzlw4ilSj55P0u06+BIoO+f2m2txDhFL90JxSSxlUF0IA3JV5YwilBPcl
23+
OBLw==
24+
ARC-Authentication-Results: i=1; mx.google.com;
25+
spf=pass (google.com: domain of root@nodspot.com designates 206.189.221.162 as permitted sender) smtp.mailfrom=root@nodspot.com
26+
Return-Path: <root@nodspot.com>
27+
Received: from ubuntu-s-1vcpu-1gb-sfo2-01 ([206.189.221.162])
28+
by mx.google.com with ESMTP id 3-v6si17019015pln.324.2018.10.02.12.48.56
29+
for <mantvydo@gmail.com>;
30+
Tue, 02 Oct 2018 12:48:56 -0700 (PDT)
31+
Received-SPF: pass (google.com: domain of root@nodspot.com designates 206.189.221.162 as permitted sender) client-ip=206.189.221.162;
32+
Authentication-Results: mx.google.com;
33+
spf=pass (google.com: domain of root@nodspot.com designates 206.189.221.162 as permitted sender) smtp.mailfrom=root@nodspot.com
34+
Received: from kali (host* [109.146.x.x])
35+
by ubuntu-s-1vcpu-1gb-sfo2-01 (Postfix) with ESMTP id 280D33F155
36+
for <mantvydo@gmail.com>; Tue, 2 Oct 2018 19:48:56 +0000 (UTC)
37+
Received: by kali (Postfix, from userid 0)
38+
id 862A642009E; Tue, 2 Oct 2018 20:48:55 +0100 (BST)
39+
Message-Id: <20181002194855.862A642009E@kali>
40+
Date: Tue, 2 Oct 2018 20:48:48 +0100 (BST)
41+
From: root <root@nodspot.com>
42+
43+
relaying phish like a sir
Loading

README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Most of these techniques are discovered by other security researchers and I do n
2323

2424
{% hint style="danger" %}
2525
**Warning**\
26-
****[ired.team](https://ired.team) Red Teaming Experiments GitBook is created by [@spotheplanet](https://twitter.com/spotheplanet). \
26+
[ired.team](https://ired.team) Red Teaming Experiments GitBook is created by [@spotheplanet](https://twitter.com/spotheplanet). \
2727
Cloning it and presenting it as your own is illegal and strictly forbidden, don't do it.
2828
{% endhint %}
2929

miscellaneous-reversing-forensics/reversing-password-checking-routine.md

+12-12
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,15 @@ A couple of my internet fellas were working on a CTF that presented them a binar
88

99
I did a quick `file bin` to check what type of file it was:
1010

11-
![](../.gitbook/assets/screenshot-from-2018-12-19-12-43-29.png)
11+
![](<../.gitbook/assets/Screenshot from 2018-12-19 12-43-29.png>)
1212

1313
The file was a non-stripped out linux binary file, which means debugging will be easier since we will be able to see original function names used in the binary.
1414

1515
## Strings
1616

1717
I ran the file through strings `strings bin` to see if anything stood out:
1818

19-
![](../.gitbook/assets/screenshot-from-2018-12-19-12-47-01.png)
19+
![](<../.gitbook/assets/Screenshot from 2018-12-19 12-47-01.png>)
2020

2121
We can notice some interesting things that we can make some assumptions about - notably the following strings:
2222

@@ -26,7 +26,7 @@ We can notice some interesting things that we can make some assumptions about -
2626

2727
Simply running the file prompted for a password and failed with an error message `ACCESS DENIED`:
2828

29-
![](../.gitbook/assets/screenshot-from-2018-12-19-12-47-37.png)
29+
![](<../.gitbook/assets/Screenshot from 2018-12-19 12-47-37.png>)
3030

3131
## Disassembly
3232

@@ -36,7 +36,7 @@ Let's have a quick look at the disassembly of the file and look at its `main` fu
3636
objdump -d bin | more
3737
```
3838

39-
![](../.gitbook/assets/screenshot-from-2018-12-19-13-22-04.png)
39+
![](<../.gitbook/assets/Screenshot from 2018-12-19 13-22-04.png>)
4040

4141
Note the following from the above screenshot:
4242

@@ -58,21 +58,21 @@ disas
5858
b check_pw
5959
```
6060

61-
![](<../.gitbook/assets/Screenshot from 2018-12-19 13-29-31.png>)
61+
![](<../.gitbook/assets/Screenshot from 2018-12-19 13-29-31 (1).png>)
6262

6363
Let's hit `c` to continue running the program until the `scanf` function is called and then provide it with some dummy password, say `test`:
6464

65-
![](../.gitbook/assets/screenshot-from-2018-12-19-14-27-02.png)
65+
![](<../.gitbook/assets/Screenshot from 2018-12-19 14-27-02.png>)
6666

6767
### Check\_pw Routine: Round 1
6868

6969
Once the password is entered, the program breaks on `check_pw`:
7070

71-
![](../.gitbook/assets/screenshot-from-2018-12-19-13-30-49.png)
71+
![](<../.gitbook/assets/Screenshot from 2018-12-19 13-30-49.png>)
7272

7373
If we skip through instructions one by one and keep observing how register values change over time and what instructions are executed, we will soon end up at `check_pw+88`:
7474

75-
![](../.gitbook/assets/screenshot-from-2018-12-19-13-33-13.png)
75+
![](<../.gitbook/assets/Screenshot from 2018-12-19 13-33-13.png>)
7676

7777
Note this from the above screenshot:
7878

@@ -82,22 +82,22 @@ Note this from the above screenshot:
8282

8383
However, stepping through the instructions further, we can see that the jump is NOT taken - the program continues executing instructions at offset `check_pw+92` - suggesting the first character of the password does NOT start with a **`t`**:
8484

85-
![](../.gitbook/assets/screenshot-from-2018-12-19-13-43-00.png)
85+
![](<../.gitbook/assets/Screenshot from 2018-12-19 13-43-00.png>)
8686

8787
### Check\_pw Routine: Round 2
8888

8989
What if we rerun the program and supply it with a password **`b`**`est` this time (replacing the first `t` with `b`, since the binary seemed to be expecting to see in the `dl` register)?
9090

9191
Well, this time the `cmp al,dl` sets the `zero` flag to `true` and the jump at `check_pw+90` is taken - suggesting that the first character of the password is indeed a **`b`**:
9292

93-
![](../.gitbook/assets/screenshot-from-2018-12-19-13-38-14.png)
93+
![](<../.gitbook/assets/Screenshot from 2018-12-19 13-38-14.png>)
9494

9595
If we repeat this process 32 more times (remember the `%32s` string discussed previously?), we will eventually get the full password:
9696

97-
![](../.gitbook/assets/screenshot-from-2018-12-19-13-43-39.png)
97+
![](<../.gitbook/assets/Screenshot from 2018-12-19 13-43-39.png>)
9898

9999
Going back to the long strings we saw earlier - they were indeed used in the password decryption routine, but going through the algorithm is out of scope for today:
100100

101-
![](../.gitbook/assets/screenshot-from-2018-12-19-14-47-40.png)
101+
![](<../.gitbook/assets/Screenshot from 2018-12-19 14-47-40.png>)
102102

103103
Now, there is probably a better/automated way of solving this, so if you know a better way, I would like to hear about it!

miscellaneous-reversing-forensics/windows-kernel-internals/exploring-process-environment-block.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ dt _peb
1616

1717
There are many fields in the structure among which there are `ImageBaseAddresss` and `ProcessParameters` which are interesting to us for this lab:
1818

19-
![](../../.gitbook/assets/peb-structure.png)
19+
![](<../../.gitbook/assets/peb-structure (1).png>)
2020

2121
Getting the PEB address of the process:
2222

@@ -33,7 +33,7 @@ The `_PEB` structure can now be overlaid on the memory pointed to by the `$peb`
3333

3434
`_PEB` structure is now populated with the actual data pulled from the process memory:
3535

36-
![](../../.gitbook/assets/peb-overlay.png)
36+
![](<../../.gitbook/assets/peb-overlay (1).png>)
3737

3838
Let's check what's in memory at address `0000000049d40000` - pointed to by the `ImageBaseAddress` member of the `_peb` structure:
3939

miscellaneous-reversing-forensics/windows-kernel-internals/manipulating-activeprocesslinks-to-unlink-processes-in-userland.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@ Lab is performed on Windows 10 Professional x64, 1903.
99
{% endhint %}
1010

1111
**Update 1**\
12-
****Some replies to my tweet to this post suggested that PatchGuard would normally kick-in and BSOD the OS, which I am sure is the case, although in my lab I experienced no BSODs even though the kernel stayed patched with an unlinked process for 12+ hours.
12+
Some replies to my tweet to this post suggested that PatchGuard would normally kick-in and BSOD the OS, which I am sure is the case, although in my lab I experienced no BSODs even though the kernel stayed patched with an unlinked process for 12+ hours.
1313

1414
**Update 2**\
15-
****I realized that my Windows VM is running in test mode with no integrity checks, possibly explaining the lack os BSODs - unconfirmed.\
15+
I realized that my Windows VM is running in test mode with no integrity checks, possibly explaining the lack os BSODs - unconfirmed.\
1616
\
1717
**Update 3**\
18-
****Thanks **** [**@**FuzzySec](https://twitter.com/FuzzySec) for clarifying the BSOD/PatchGuard matter!
18+
Thanks [**@**FuzzySec](https://twitter.com/FuzzySec) for clarifying the BSOD/PatchGuard matter!
1919

2020
![](<../../.gitbook/assets/image (397).png>)
2121

@@ -142,7 +142,7 @@ Let's do the same for the process referenced by the notepad's BLINK to get the p
142142
kd> da ffffb208`f8b89370-2f0+450
143143
```
144144

145-
![](<../../.gitbook/assets/image (367).png>)
145+
![](<../../.gitbook/assets/image (368).png>)
146146

147147
Looks like our notepad EPROCESS is surrounded by two svchost EPROCESS nodes.
148148

miscellaneous-reversing-forensics/windows-kernel-internals/pe-file-header-parser-in-c++.md

+21-21
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ This lab is going to be light on text as most of the relevant info is shown in t
1313

1414
Below is a graphic showing the end result - a program that parses a 32bit cmd.exe executable and spits out various pieces of information from various PE headers as well as DLL imports.
1515

16-
![](../../.gitbook/assets/peek-2018-11-06-20-13.gif)
16+
![](<../../.gitbook/assets/Peek 2018-11-06 20-13.gif>)
1717

1818
{% hint style="warning" %}
1919
* The code is not able to parse 64bit executables correctly. This will not be fixed.
@@ -25,7 +25,7 @@ Below is a graphic showing the end result - a program that parses a 32bit cmd.ex
2525

2626
For the most part of this lab, header parsing was going smoothly, until it was time to parse the DLL imports. The bit below is the final solution that worked for parsing out the DLL names and their functions:
2727

28-
![](../../.gitbook/assets/screenshot-from-2018-11-06-20-11-12.png)
28+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 20-11-12.png>)
2929

3030
Parsing out imported DLLs and their functions requires a good number of offset calculations that initially may seem confusing and this is the bit I will try to put down in words in these notes.
3131

@@ -46,11 +46,11 @@ First off, we need to define some terms:
4646

4747
If we look at the notepad.exe binary using CFF Explorer (or any other similar program) and inspect the `Data Directories` from under the `Optional Header` , we can see that the Import Table is located at RVA `0x0000A0A0` that according to CFF Explorer happens to live in the `.text` section:
4848

49-
![](../../.gitbook/assets/screenshot-from-2018-11-06-20-51-04.png)
49+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 20-51-04.png>)
5050

5151
Indeed, if we look at the `Section Headers` and note the values `Virtual Size` and `Virtual Address` for the `.text` section:
5252

53-
![](../../.gitbook/assets/screenshot-from-2018-11-06-20-51-27.png)
53+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 20-51-27.png>)
5454

5555
and check if the `Import Directory RVA` of `0x0000A0A0` falls into the range of .text section with this conditional statement in python:
5656

@@ -60,7 +60,7 @@ and check if the `Import Directory RVA` of `0x0000A0A0` falls into the range of
6060

6161
...we can confirm it definitely does fall into the .text section's range:
6262

63-
![](../../.gitbook/assets/screenshot-from-2018-11-06-21-26-56.png)
63+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 21-26-56.png>)
6464

6565
### PIMAGE\_IMPORT\_DESCRIPTOR
6666

@@ -105,19 +105,19 @@ PS C:\Users\mantvydas> [System.Convert]::ToString($importDescriptor, 16)
105105

106106
If we check the file offset 0x95cc, we can see we are getting close to a list of imported DLL names - note that at we can see the VERSION.dll starting to show - that is a good start:
107107

108-
![](../../.gitbook/assets/screenshot-from-2018-11-06-22-08-49.png)
108+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 22-08-49.png>)
109109

110110
Now more importantly, note the value highlighted at offset `0x000094ac` - `7C A2 00 00` (reads A2 7C due to little indianness) - this is important. If we consider the layout of the `PIMAGE_IMPORT_DESCRIPTOR` structure, we can see that the fourth member of the structure (each member is a DWORD, so 4 bytes in size) is `DWORD Name`, which implies that `0x000094ac` contains something that should be useful for us to get our first imported DLL's name:
111111

112-
![](../../.gitbook/assets/screenshot-from-2018-11-06-22-12-26.png)
112+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 22-12-26.png>)
113113

114114
Indeed, if we check the Import Directory of notepad.exe in CFF Explorer, we see that the `0xA27C` is another RVA to the DLL name, which happens to be ADVAPI32.dll - and we will manually [verify](pe-file-header-parser-in-c++.md#first-dll-name) this in a moment:
115115

116-
![](../../.gitbook/assets/screenshot-from-2018-11-06-22-27-43.png)
116+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 22-27-43.png>)
117117

118118
If we look closer at the ADVAPI32.dll import details and compare it with the hex dump of the binary at 0x94A0, we can see that the 0000a27c is surrounded by the same info we saw in CFF Explorer for the ADVAPI32.dll:
119119

120-
![](../../.gitbook/assets/screenshot-from-2018-11-06-22-43-11.png)
120+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 22-43-11.png>)
121121

122122
### First DLL Name
123123

@@ -141,21 +141,21 @@ $firstDLLname = $rawOffsetToTextSection + ($nameRVA - $textVA)
141141
967c
142142
```
143143

144-
![](../../.gitbook/assets/screenshot-from-2018-11-06-22-33-24.png)
144+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 22-33-24.png>)
145145

146146
If we check offset `0x967c` in our hex editor - success, we found our first DLL name:
147147

148-
![](../../.gitbook/assets/screenshot-from-2018-11-06-22-34-51.png)
148+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 22-34-51.png>)
149149

150150
### DLL Imported Functions
151151

152152
Now in order to get a list of imported functions from the given DLL, we need to use a structure called `PIMAGE_THUNK_DATA32`which looks like this:
153153

154-
![](../../.gitbook/assets/screenshot-from-2018-11-06-22-51-11.png)
154+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 22-51-11.png>)
155155

156156
In order to utilise the above structure, again, we need to translate an RVA of the `OriginalFirstThunk` member of the structure `PIMAGE_IMPORT_DESCRIPTOR` which in our case was pointing to `0x0000A28C`:
157157

158-
![](../../.gitbook/assets/screenshot-from-2018-11-06-22-55-16.png)
158+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 22-55-16.png>)
159159

160160
If we use the same formula for calculating RVAs as previously and use the below Powershell to calculate the file offset, we get:
161161

@@ -167,11 +167,11 @@ $firstThunk = $rawOffsetToTextSection + (0x0000A28C - $textVA)
167167
968c
168168
```
169169

170-
![](../../.gitbook/assets/screenshot-from-2018-11-06-22-59-13.png)
170+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 22-59-13.png>)
171171

172172
At that offset 968c+4 (+4 because per `PIMAGE_THUNK_DATA32` structure layout, the second member is called `Function` and this is the member we are interested in), we see a couple more values that look like RVAs - `0x0000a690` and `0x0000a6a2`:
173173

174-
![](../../.gitbook/assets/screenshot-from-2018-11-06-23-03-44.png)
174+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 23-03-44.png>)
175175

176176
If we do a final RVA to file offset conversion for the second (we could do the same for 0x0000a690) RVA 0x0000a6a2:
177177

@@ -184,11 +184,11 @@ $firstFunction = $rawOffsetToTextSection + (0x0000A6A2 - $textVA)
184184
Finally, with the file offset 0x9aa2, we get to see a second (because we chose the offset a6a2 rather than a690) imported function for the DLL ADVAPI32.\
185185
Note that the function name actually starts 2 bytes further into the file, so the file offset 9aa2 becomes 9aa2 + 2 = 9aa4 - currently I'm not sure what the reason for this is:
186186

187-
![](../../.gitbook/assets/screenshot-from-2018-11-06-23-14-05.png)
187+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 23-14-05.png>)
188188

189189
Cross checking the above findings with CFF Explorer's Imported DLLs parser, we can see that our calculations were correct - note the OFTs column and the values a6a2 and a690 we referred to earlier:
190190

191-
![](../../.gitbook/assets/screenshot-from-2018-11-06-23-19-37.png)
191+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 23-19-37.png>)
192192

193193
## Code
194194

@@ -367,13 +367,13 @@ peparser.exe
367367

368368
## Output Screenshots
369369

370-
![](../../.gitbook/assets/screenshot-from-2018-11-06-23-23-15.png)
370+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 23-23-15.png>)
371371

372-
![](../../.gitbook/assets/screenshot-from-2018-11-06-23-23-28.png)
372+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 23-23-28.png>)
373373

374-
![](../../.gitbook/assets/screenshot-from-2018-11-06-23-23-38.png)
374+
![](<../../.gitbook/assets/Screenshot from 2018-11-06 23-23-38.png>)
375375

376-
![](../../.gitbook/assets/peek-2018-11-06-20-13.gif)
376+
![](<../../.gitbook/assets/Peek 2018-11-06 20-13.gif>)
377377

378378
## References
379379

miscellaneous-reversing-forensics/windows-kernel-internals/subscribing-to-process-creation-thread-creation-and-image-load-notifications-from-a-kernel-driver.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ PsSetCreateProcessNotifyRoutine(sCreateProcessNotifyRoutine, FALSE);
5151
5252
Below shows how the routine `sCreateProcessNotifyRoutine` gets executed when a new process hostname.exe (PID 2892) is spawned by powershell (PID 7176). Additionally, it shows that the process 7176 (hostname) terminated:
5353
54-
![](../../.gitbook/assets/pssetcreateprocessnotifyroutine.gif)
54+
![](../../.gitbook/assets/PsSetCreateProcessNotifyRoutine.gif)
5555
5656
## PsSetLoadImageNotifyRoutine
5757
@@ -84,7 +84,7 @@ PsSetLoadImageNotifyRoutine(sLoadImageNotifyRoutine);
8484
8585
Testing the driver - once we open a notepad.exe, our driver gets notified about all the modules that notepad.exe loaded:
8686
87-
![](../../.gitbook/assets/pssetloadimagenotifyroutine.gif)
87+
![](../../.gitbook/assets/PsSetLoadImageNotifyRoutine.gif)
8888
8989
## PsSetCreateThreadNotifyRoutine
9090
@@ -165,7 +165,7 @@ If `PsSetCreateProcessNotifyRoutineEx` is not working in your driver, you will n
165165
166166
Below shows how an attempt to spawn notepad.exe is blocked by our driver:
167167
168-
![](../../.gitbook/assets/pssetcreateprocessnotifyroutineex.gif)
168+
![](../../.gitbook/assets/PsSetCreateProcessNotifyRoutineEx.gif)
169169
170170
## Code
171171

0 commit comments

Comments
 (0)