sha0coder
commented
1 day ago Hello, I fixed the structure offsets, but it is not matching well the metasploit hash for kernel32 + LoadLibraryA.
It Is accessing to the FullDllName, that should be “C:\Windows\System32\kernel32.dll” without quotes and in wide.
This python code calculates in same way the emulator does, and matches the hash with the emulator but not with metasploit:
# https://github.com/sha0coder/unsigned
from unsigned import Unsigned32 as u32
from unsigned import Unsigned64 as u64
lib = 'C\x00:\x00\\\x00W\x00i\x00n\x00d\x00o\x00w\x00s\x00\\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\\x00k\x00e\x00r\x00n\x00e\x00l\x003\x002\x00.\x00d\x00l\x00l\x00'
api = 'LoadLibraryA\x00'
r9d = u32(0)
for al in lib:
c = ord(al)
if c >= 0x61:
c -= 0x20
r9d.ror(0x0d)
r9d.add(u32(c))
libhash = r9d
print('libhash',libhash.hex())
r9d = u32(0)
for al in api:
r9d.ror(0x0d)
r9d.add(u32(ord(al)))
r9 = u64(r9d())
r9.add(u64(libhash()))
final = hex(r9() & 0xffffffff)
print('final:',final) # 0xb47e823c
print('metasploit looks for: 0x726774c’)I’m creating the ldr entry in this way:
…
ldr.dll_base = base;
ldr.entry_point = entry_point;
ldr.size_of_image = 0;
ldr.full_dll_name.length = full_libname.len() as u16 * 2;
ldr.full_dll_name.maximum_length = full_libname.len() as u16 * 2;
ldr.full_dll_name.buffer = space_addr + LdrDataTableEntry64::size();
ldr.base_dll_name.length = libname.len() as u16 * 2;
ldr.base_dll_name.maximum_length = libname.len() as u16 * 2;
ldr.base_dll_name.buffer = space_addr + LdrDataTableEntry64::size() + full_libname.len() as u64 * 2 + 10;
ldr.flags = 0;
ldr.load_count = 0;
ldr.tls_index = 0;
ldr.hash_links.flink = next_flink;
ldr.hash_links.blink = prev_flink;
mem.write_wide_string(space_addr + LdrDataTableEntry64::size(), &(full_libname.clone() + "\x00\x00"));
mem.write_wide_string(space_addr + LdrDataTableEntry64::size() + full_libname.len() as u64 * 2 +10, &(libname.to_string() + "\x00"));
ldr.save(space_addr, &mut emu.maps);I have to do some window reversing to get how is the FullDllName, which is the input value of the hashing.
For now Im super busy and will continue on Sunday.
Hi @sha0coder
Please test again with this simple metasploit x64 shellcode. And VirtualAlloc can still failed.
test.bin.gz
I use scemu/pyscemu and Speakeasy in parallel I highly appreciate the speed of scemu
Thank you very much