Skip to content

Commit 825f2d3

Browse files
mgeekymgeeky
committed
first
0 parents  commit 825f2d3

File tree

9 files changed

+861
-0
lines changed

9 files changed

+861
-0
lines changed

‎README.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Thread Stack Spoofing PoC
2+
3+
This is an example implementation for _Thread Stack Spoofing_ technique aiming to evade Malware Analysts, AVs and EDRs looking for references to shellcode's frames in an examined thread's call stack.
4+
The idea is to walk back thread's call stack and overwrite return addresses in subsequent function frames thus masquerading allocations containing malware's code.
5+
6+
An implementation may differ, however the idea is roughly similar to what [MDSec's Nighthawk C2](https://www.mdsec.co.uk/nighthawk/) offers for its agents.
7+
Especially demonstrated in this video:
8+
9+
[Nighthawk - Thread Stack Spoofing](https://vimeo.com/581861665)
10+
11+
12+
## How it works?
13+
14+
This program performs self-injection shellcode (roughly via classic `VirtualAlloc` + `memcpy` + `CreateThread`).
15+
Then when shellcode runs (this implementation specifically targets Cobalt Strike Beacon implants) a Windows function will be hooked intercepting moment when Beacon falls asleep `kernel32!Sleep`.
16+
Whenever hooked `MySleep` function gets invoked, it will spoof its own call stack leading to this `MySleep` function and begin sleeping.
17+
Having awaited for expected amount of time, the Thread's call stack will get restored assuring stable return and shellcode's execution resumption.
18+
19+
The rough algorithm is following:
20+
21+
1. Read shellcode's contents from file.
22+
2. Acquire all the necessary function pointers from `dbghelp.dll`, call `SymInitialize`
23+
3. Hook `kernel32!Sleep` pointing back to our callback.
24+
4. Inject and launch shellcode via `VirtualAlloc` + `memcpy` + `CreateThread`
25+
5. As soon as Beacon attempts to sleep, our `MySleep` callback gets invoked.
26+
6. Stack Spoofing begins.
27+
7. Firstly we walk call stack of our current thread, utilising `ntdll!RtlCaptureContext` and `dbghelp!StackWalk64`
28+
8. We save all of the stack frames that match our `seems-to-be-beacon-frame` criterias (such as return address points back to a memory being `MEM_PRIVATE` or `Type = 0`, or memory's protection flags are not `R/RX/RWX`)
29+
9. We terate over collected frames (gathered function frame pointers `RBP/EBP` - in `frame.frameAddr`) and overwrite _on-stack_ return addresses with a fake `::CreateFileW` address.
30+
10. Finally a call to `::SleepEx` is made to let the Beacon's sleep while waiting for further communication.
31+
11. After Sleep is finished, we restore previously saved original function return addresses and execution is resumed.
32+
33+
Function return addresses are scattered all around the thread's stack memory area, pointed to by `RBP/EBP` register. In order to find them on the stack, we need to firstly collect frame pointers, then dereference them for overwriting:
34+
35+
```
36+
*(PULONG_PTR)(frameAddr + sizeof(void*)) = Fake_Return_Address;
37+
```
38+
39+
This precise logic is provided by `walkCallStack` and `spoofCallStack` functions in `main.cpp`.
40+
41+
42+
## Demo
43+
44+
This is how a call stack may look like when it is **NOT** spoofed:
45+
46+
[images/not-spoofed.png]
47+
48+
This in turn, when thread stack spoofing is enabled:
49+
50+
[images/spoofed.png]
51+
52+
53+
## Example run
54+
55+
Example run that spoofs beacon's thread call stack:
56+
57+
```
58+
C:\> ThreadStackSpoofer.exe beacon64.bin 1
59+
[.] Reading shellcode bytes...
60+
[.] Initializing stack spoofer...
61+
[+] Stack spoofing initialized.
62+
[.] Hooking kernel32!Sleep...
63+
[.] Injecting shellcode...
64+
WalkCallStack: Stack Trace:
65+
2. calledFrom: 0x7ff7abc92de4 - stack: 0x50174ff7d0 - frame: 0x50174ff8e0 - ret: 0x1f255dabd51 - skip? 0
66+
3. calledFrom: 0x1f255dabd51 - stack: 0x50174ff8f0 - frame: 0x50174ff8e8 - ret: 0x1388 - skip? 0
67+
4. calledFrom: 0x 1388 - stack: 0x50174ff8f8 - frame: 0x50174ff8f0 - ret: 0x1f25683ae80 - skip? 0
68+
5. calledFrom: 0x1f25683ae80 - stack: 0x50174ff900 - frame: 0x50174ff8f8 - ret: 0x1b000100000004 - skip? 0
69+
6. calledFrom: 0x1b000100000004 - stack: 0x50174ff908 - frame: 0x50174ff900 - ret: 0x8003600140000 - skip? 0
70+
7. calledFrom: 0x8003600140000 - stack: 0x50174ff910 - frame: 0x50174ff908 - ret: 0x1f255f76040 - skip? 0
71+
8. calledFrom: 0x1f255f76040 - stack: 0x50174ff918 - frame: 0x50174ff910 - ret: 0x1f255d8cd9f - skip? 0
72+
9. calledFrom: 0x1f255d8cd9f - stack: 0x50174ff920 - frame: 0x50174ff918 - ret: 0x1f255d8cdd0 - skip? 0
73+
WalkCallStack: Stack Trace finished.
74+
Spoofed: 0x1f255dabd51 -> 0x7ffeb7f74b60
75+
Spoofed: 0x00001388 -> 0x7ffeb7f74b60
76+
Spoofed: 0x1f25683ae80 -> 0x7ffeb7f74b60
77+
Spoofed: 0x1b000100000004 -> 0x7ffeb7f74b60
78+
Spoofed: 0x8003600140000 -> 0x7ffeb7f74b60
79+
Spoofed: 0x1f255f76040 -> 0x7ffeb7f74b60
80+
Spoofed: 0x1f255d8cd9f -> 0x7ffeb7f74b60
81+
Spoofed: 0x1f255d8cdd0 -> 0x7ffeb7f74b60
82+
MySleep(5000)
83+
[+] Shellcode is now running.
84+
WalkCallStack: Stack Trace:
85+
2. calledFrom: 0x7ff7abc92e14 - stack: 0x50174ff7d0 - frame: 0x50174ff8e0 - ret: 0x7ffeb7f74b60 - skip? 1
86+
3. calledFrom: 0x7ffeb7f74b60 - stack: 0x50174ff8f0 - frame: 0x50174ff8e8 - ret: 0x7ffeb7f74b60 - skip? 1
87+
4. calledFrom: 0x7ffeb7f74b60 - stack: 0x50174ff8f8 - frame: 0x50174ff8f0 - ret: 0x7ffeb7f74b60 - skip? 1
88+
5. calledFrom: 0x7ffeb7f74b60 - stack: 0x50174ff900 - frame: 0x50174ff8f8 - ret: 0x7ffeb7f74b60 - skip? 1
89+
6. calledFrom: 0x7ffeb7f74b60 - stack: 0x50174ff908 - frame: 0x50174ff900 - ret: 0x7ffeb7f74b60 - skip? 1
90+
7. calledFrom: 0x7ffeb7f74b60 - stack: 0x50174ff910 - frame: 0x50174ff908 - ret: 0x7ffeb7f74b60 - skip? 1
91+
8. calledFrom: 0x7ffeb7f74b60 - stack: 0x50174ff918 - frame: 0x50174ff910 - ret: 0x7ffeb7f74b60 - skip? 1
92+
9. calledFrom: 0x7ffeb7f74b60 - stack: 0x50174ff920 - frame: 0x50174ff918 - ret: 0x7ffeb7f74b60 - skip? 1
93+
WalkCallStack: Stack Trace finished.
94+
Restored: 0x7ffeb7f74b60 -> 0x1f255dabd51
95+
Restored: 0x7ffeb7f74b60 -> 0x1388
96+
Restored: 0x7ffeb7f74b60 -> 0x1f25683ae80
97+
Restored: 0x7ffeb7f74b60 -> 0x1b000100000004
98+
Restored: 0x7ffeb7f74b60 -> 0x8003600140000
99+
Restored: 0x7ffeb7f74b60 -> 0x1f255f76040
100+
Restored: 0x7ffeb7f74b60 -> 0x1f255d8cd9f
101+
Restored: 0x7ffeb7f74b60 -> 0x1f255d8cdd0
102+
```
103+
104+
105+
## Author
106+
107+
```
108+
Mariusz Banach / mgeeky,
109+
<mb [at] binary-offensive.com>, '21
110+
```

‎ThreadStackSpoofer.sln‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 16
4+
VisualStudioVersion = 16.0.31105.61
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ThreadStackSpoofer", "ThreadStackSpoofer\ThreadStackSpoofer.vcxproj", "{9EED9E19-9475-4D2E-9B06-37D6799417FE}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{9EED9E19-9475-4D2E-9B06-37D6799417FE}.Debug|x64.ActiveCfg = Debug|x64
17+
{9EED9E19-9475-4D2E-9B06-37D6799417FE}.Debug|x64.Build.0 = Debug|x64
18+
{9EED9E19-9475-4D2E-9B06-37D6799417FE}.Debug|x86.ActiveCfg = Debug|Win32
19+
{9EED9E19-9475-4D2E-9B06-37D6799417FE}.Debug|x86.Build.0 = Debug|Win32
20+
{9EED9E19-9475-4D2E-9B06-37D6799417FE}.Release|x64.ActiveCfg = Release|x64
21+
{9EED9E19-9475-4D2E-9B06-37D6799417FE}.Release|x64.Build.0 = Release|x64
22+
{9EED9E19-9475-4D2E-9B06-37D6799417FE}.Release|x86.ActiveCfg = Release|Win32
23+
{9EED9E19-9475-4D2E-9B06-37D6799417FE}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {C5AF3E09-A902-42DF-9A8C-D63A66F8F25B}
30+
EndGlobalSection
31+
EndGlobal

‎ThreadStackSpoofer/ThreadStackSpoofer.vcxproj‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>16.0</VCProjectVersion>
23+
<Keyword>Win32Proj</Keyword>
24+
<ProjectGuid>{9eed9e19-9475-4d2e-9b06-37d6799417fe}</ProjectGuid>
25+
<RootNamespace>ThreadStackSpoofer</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>Application</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v142</PlatformToolset>
33+
<CharacterSet>Unicode</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>Application</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v142</PlatformToolset>
39+
<WholeProgramOptimization>true</WholeProgramOptimization>
40+
<CharacterSet>Unicode</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>Application</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v142</PlatformToolset>
46+
<CharacterSet>Unicode</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>Application</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v142</PlatformToolset>
52+
<WholeProgramOptimization>true</WholeProgramOptimization>
53+
<CharacterSet>Unicode</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<LinkIncremental>true</LinkIncremental>
75+
</PropertyGroup>
76+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
77+
<LinkIncremental>false</LinkIncremental>
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
80+
<LinkIncremental>true</LinkIncremental>
81+
</PropertyGroup>
82+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
83+
<LinkIncremental>false</LinkIncremental>
84+
</PropertyGroup>
85+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
86+
<ClCompile>
87+
<WarningLevel>Level3</WarningLevel>
88+
<SDLCheck>true</SDLCheck>
89+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
90+
<ConformanceMode>true</ConformanceMode>
91+
<LanguageStandard>stdcpp17</LanguageStandard>
92+
</ClCompile>
93+
<Link>
94+
<SubSystem>Console</SubSystem>
95+
<GenerateDebugInformation>true</GenerateDebugInformation>
96+
</Link>
97+
</ItemDefinitionGroup>
98+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
99+
<ClCompile>
100+
<WarningLevel>Level3</WarningLevel>
101+
<FunctionLevelLinking>true</FunctionLevelLinking>
102+
<IntrinsicFunctions>true</IntrinsicFunctions>
103+
<SDLCheck>true</SDLCheck>
104+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
105+
<ConformanceMode>true</ConformanceMode>
106+
<LanguageStandard>stdcpp17</LanguageStandard>
107+
</ClCompile>
108+
<Link>
109+
<SubSystem>Console</SubSystem>
110+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
111+
<OptimizeReferences>true</OptimizeReferences>
112+
<GenerateDebugInformation>true</GenerateDebugInformation>
113+
</Link>
114+
</ItemDefinitionGroup>
115+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
116+
<ClCompile>
117+
<WarningLevel>Level3</WarningLevel>
118+
<SDLCheck>false</SDLCheck>
119+
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
120+
<ConformanceMode>true</ConformanceMode>
121+
<LanguageStandard>stdcpp17</LanguageStandard>
122+
<BufferSecurityCheck>false</BufferSecurityCheck>
123+
<ControlFlowGuard>false</ControlFlowGuard>
124+
</ClCompile>
125+
<Link>
126+
<SubSystem>Console</SubSystem>
127+
<GenerateDebugInformation>true</GenerateDebugInformation>
128+
</Link>
129+
</ItemDefinitionGroup>
130+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
131+
<ClCompile>
132+
<WarningLevel>Level3</WarningLevel>
133+
<FunctionLevelLinking>true</FunctionLevelLinking>
134+
<IntrinsicFunctions>true</IntrinsicFunctions>
135+
<SDLCheck>true</SDLCheck>
136+
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
137+
<ConformanceMode>true</ConformanceMode>
138+
<LanguageStandard>stdcpp17</LanguageStandard>
139+
</ClCompile>
140+
<Link>
141+
<SubSystem>Console</SubSystem>
142+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
143+
<OptimizeReferences>true</OptimizeReferences>
144+
<GenerateDebugInformation>true</GenerateDebugInformation>
145+
</Link>
146+
</ItemDefinitionGroup>
147+
<ItemGroup>
148+
<ClCompile Include="main.cpp" />
149+
</ItemGroup>
150+
<ItemGroup>
151+
<ClInclude Include="header.h" />
152+
</ItemGroup>
153+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
154+
<ImportGroup Label="ExtensionTargets">
155+
</ImportGroup>
156+
</Project>

‎ThreadStackSpoofer/ThreadStackSpoofer.vcxproj.filters‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Source Files">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Header Files">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Resource Files">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<ClCompile Include="main.cpp">
19+
<Filter>Source Files</Filter>
20+
</ClCompile>
21+
</ItemGroup>
22+
<ItemGroup>
23+
<ClInclude Include="header.h">
24+
<Filter>Header Files</Filter>
25+
</ClInclude>
26+
</ItemGroup>
27+
</Project>

‎ThreadStackSpoofer/ThreadStackSpoofer.vcxproj.user‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
4+
<LocalDebuggerCommandArguments>d:\dev2\ThreadStackSpoofer\ThreadStackSpoofer\x64\Debug\beacon64.bin</LocalDebuggerCommandArguments>
5+
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
6+
</PropertyGroup>
7+
</Project>

0 commit comments

Comments
 (0)