Blogger templates

Backstreet Boys - Show Me the Meaning.mp3
Found at bee mp3 search engine

Tuesday, January 23, 2024

Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu



In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204


target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204



In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.


Let's see the stack in this moment:


The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.


SCEMU also identify all the Linux  syscalls for 32bits shellcodes:



The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:


We can see where is connecting and which headers is using, so right now we can replicate the communications.



In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.


target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j


target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l


The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi


target/release/scemu -f shellcodes/shikata.bin --reg esi 


In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs





Read more
  1. Hacking Tools Software
  2. Tools For Hacker
  3. How To Install Pentest Tools In Ubuntu
  4. Hacking Tools Usb
  5. Pentest Tools Review
  6. Nsa Hacker Tools
  7. Hacking Tools And Software
  8. Hack App
  9. Hacking Tools Github
  10. Pentest Tools Windows
  11. Hacks And Tools
  12. Hacker Tools Online
  13. Hacker
  14. Hack Tools Download
  15. Hacking Tools Download
  16. Pentest Tools Kali Linux
  17. Hacker Tools Mac
  18. Best Hacking Tools 2020
  19. Hack Website Online Tool
  20. Hackrf Tools
  21. Underground Hacker Sites
  22. Hacker Tools 2019
  23. Hack Tool Apk
  24. Hacker Tools Github
  25. Pentest Tools
  26. Best Hacking Tools 2019
  27. Hacker Tools For Mac
  28. Hacker Tools List
  29. Bluetooth Hacking Tools Kali
  30. Hacker Tool Kit
  31. Hacker Techniques Tools And Incident Handling
  32. Pentest Tools Review
  33. Easy Hack Tools
  34. Hacking Tools Windows
  35. Pentest Tools For Mac
  36. Install Pentest Tools Ubuntu
  37. Hack Apps
  38. Pentest Tools Linux
  39. Hacking Tools Pc
  40. Hacking Tools For Beginners
  41. New Hacker Tools
  42. New Hacker Tools
  43. Pentest Tools Alternative
  44. Hacker Tools For Pc
  45. World No 1 Hacker Software
  46. Hacker Tools
  47. Hacking App
  48. New Hacker Tools
  49. Tools For Hacker
  50. Pentest Tools Url Fuzzer
  51. Hack Tools For Ubuntu
  52. Hacker Tools 2020
  53. Pentest Recon Tools
  54. How To Install Pentest Tools In Ubuntu
  55. Hacking Tools Software
  56. Pentest Tools
  57. Hack Tools Download
  58. Pentest Tools Kali Linux
  59. Hacker Tools
  60. Hacking Tools Kit
  61. Hack Tools Download
  62. Pentest Tools For Ubuntu
  63. World No 1 Hacker Software
  64. How To Install Pentest Tools In Ubuntu
  65. Top Pentest Tools
  66. Hacking Tools Github
  67. Hacker Tools Github
  68. Pentest Tools Kali Linux
  69. Hacking App
  70. Hack Tool Apk No Root
  71. Free Pentest Tools For Windows
  72. Pentest Tools Github
  73. Hack Tools Github
  74. What Is Hacking Tools
  75. Pentest Tools Find Subdomains
  76. Easy Hack Tools
  77. Hak5 Tools
  78. Wifi Hacker Tools For Windows
  79. Hack And Tools
  80. Hack Tools Pc
  81. Best Hacking Tools 2019
  82. Easy Hack Tools
  83. Hacking Tools Name
  84. Pentest Tools
  85. Pentest Tools Apk
  86. Pentest Tools List
  87. Hacker Tools Mac
  88. Pentest Recon Tools
  89. Hacking Tools For Games
  90. Hacker Tool Kit
  91. Hacker Tools Apk
  92. Pentest Automation Tools
  93. Hacker Techniques Tools And Incident Handling
  94. Wifi Hacker Tools For Windows
  95. Pentest Tools Apk
  96. Hack Tools For Ubuntu
  97. Physical Pentest Tools
  98. Hacking Tools Free Download
  99. Hacking Tools 2019
  100. Hacker Tool Kit
  101. Hacking Tools Windows
  102. Hacker Tools Online
  103. Physical Pentest Tools
  104. Hacking Tools 2019
  105. Blackhat Hacker Tools
  106. Hacking Tools Github
  107. Pentest Tools Kali Linux
  108. Hacker Tools 2020
  109. Hack Tools Github
  110. What Is Hacking Tools
  111. Pentest Automation Tools
  112. Pentest Tools Download
  113. Hack Tool Apk No Root
  114. Hacker Tools Apk
  115. Hacker Tools Github
  116. Hacking Tools 2019
  117. Hack And Tools
  118. Ethical Hacker Tools
  119. Hacker Tools For Ios

0 comments:

Post a Comment