1
00:00:01,500 --> 00:00:06,319
[Music]

2
00:00:06,319 --> 00:00:09,519
hey defcon this is rinzo from sector7

3
00:00:09,519 --> 00:00:11,519
i'm really glad to be here

4
00:00:11,519 --> 00:00:14,480
and today in this quick video i'm gonna

5
00:00:14,480 --> 00:00:16,000
share with you some interesting

6
00:00:16,000 --> 00:00:18,080
technique i have learned

7
00:00:18,080 --> 00:00:19,439
some time ago

8
00:00:19,439 --> 00:00:20,640
that

9
00:00:20,640 --> 00:00:21,760
is about

10
00:00:21,760 --> 00:00:23,519
hiding your payload in the process

11
00:00:23,519 --> 00:00:24,560
memory

12
00:00:24,560 --> 00:00:26,720
so let's jump straight into the source

13
00:00:26,720 --> 00:00:28,000
code

14
00:00:28,000 --> 00:00:30,240
so originally i read about this

15
00:00:30,240 --> 00:00:33,120
technique in a paper by frank block and

16
00:00:33,120 --> 00:00:34,880
ralph palutka

17
00:00:34,880 --> 00:00:36,719
and the technique is really really

18
00:00:36,719 --> 00:00:37,680
simple

19
00:00:37,680 --> 00:00:40,000
we create a file mapping

20
00:00:40,000 --> 00:00:42,079
which is backed by

21
00:00:42,079 --> 00:00:45,360
a page file and then we map a view to

22
00:00:45,360 --> 00:00:47,280
that mapping so that we can use that

23
00:00:47,280 --> 00:00:48,800
memory

24
00:00:48,800 --> 00:00:49,680
uh

25
00:00:49,680 --> 00:00:52,879
which is down here so basically i take

26
00:00:52,879 --> 00:00:54,239
some fake

27
00:00:54,239 --> 00:00:56,399
random bytes uh

28
00:00:56,399 --> 00:00:58,960
which are pretend to be a payload and

29
00:00:58,960 --> 00:01:02,000
just copy them into this memory region

30
00:01:02,000 --> 00:01:05,199
and now if i want to hide that payload i

31
00:01:05,199 --> 00:01:08,000
just unmapped the view okay

32
00:01:08,000 --> 00:01:11,119
and that's it basically

33
00:01:11,119 --> 00:01:14,960
if we want to reuse that um that payload

34
00:01:14,960 --> 00:01:17,680
then we we have to remap the view again

35
00:01:17,680 --> 00:01:19,680
to our process

36
00:01:19,680 --> 00:01:22,730
so let's take a look at

37
00:01:22,730 --> 00:01:25,119
[Music]

38
00:01:25,119 --> 00:01:28,880
a process hacker and how it works uh

39
00:01:28,880 --> 00:01:31,199
in

40
00:01:31,759 --> 00:01:33,520
reality

41
00:01:33,520 --> 00:01:35,280
so let me start

42
00:01:35,280 --> 00:01:37,840
the guy

43
00:01:38,240 --> 00:01:41,559
so implant

44
00:01:45,360 --> 00:01:47,360
and let's take

45
00:01:47,360 --> 00:01:50,159
process hacker

46
00:01:50,159 --> 00:01:53,040
to see so we have mapped this memory

47
00:01:53,040 --> 00:01:54,399
region

48
00:01:54,399 --> 00:01:56,079
it is here

49
00:01:56,079 --> 00:01:58,880
okay it is it it doesn't contain

50
00:01:58,880 --> 00:02:00,079
anything

51
00:02:00,079 --> 00:02:01,840
currently

52
00:02:01,840 --> 00:02:03,280
after we

53
00:02:03,280 --> 00:02:06,640
copy the the bytes

54
00:02:07,280 --> 00:02:09,840
the payload is here so to speak payload

55
00:02:09,840 --> 00:02:11,200
of course

56
00:02:11,200 --> 00:02:12,239
and then

57
00:02:12,239 --> 00:02:14,160
i do unmapping

58
00:02:14,160 --> 00:02:17,200
so now if i try to re-read the memory i

59
00:02:17,200 --> 00:02:20,160
get uh it is failing

60
00:02:20,160 --> 00:02:22,000
because

61
00:02:22,000 --> 00:02:25,360
this memory uh region is gone okay

62
00:02:25,360 --> 00:02:27,280
uh and actually

63
00:02:27,280 --> 00:02:28,720
it is

64
00:02:28,720 --> 00:02:32,160
uh it's five six eight five six eight

65
00:02:32,160 --> 00:02:35,680
it's here it's uh marked as free

66
00:02:35,680 --> 00:02:37,440
so

67
00:02:37,440 --> 00:02:41,680
let's see what happens when if i remap

68
00:02:41,680 --> 00:02:44,480
this view again

69
00:02:45,360 --> 00:02:47,599
and as you can see the payload is still

70
00:02:47,599 --> 00:02:48,840
there all

71
00:02:48,840 --> 00:02:50,879
right so

72
00:02:50,879 --> 00:02:53,440
how can we weaponize it

73
00:02:53,440 --> 00:02:56,840
let's do that

74
00:03:06,640 --> 00:03:08,720
so for that

75
00:03:08,720 --> 00:03:10,400
i'm going to

76
00:03:10,400 --> 00:03:14,080
uh use another example which is ninja

77
00:03:14,080 --> 00:03:15,440
split

78
00:03:15,440 --> 00:03:17,280
which was about

79
00:03:17,280 --> 00:03:20,400
hiding your payload

80
00:03:20,400 --> 00:03:23,200
against windows defender which is doing

81
00:03:23,200 --> 00:03:24,319
some

82
00:03:24,319 --> 00:03:26,400
memory like live

83
00:03:26,400 --> 00:03:29,120
process memory scans which are triggered

84
00:03:29,120 --> 00:03:31,760
by specific functions for example create

85
00:03:31,760 --> 00:03:33,120
process

86
00:03:33,120 --> 00:03:35,760
so in this example i'm going to use

87
00:03:35,760 --> 00:03:38,400
really simple shell calc shell code so

88
00:03:38,400 --> 00:03:41,360
this payload is going to call

89
00:03:41,360 --> 00:03:44,400
create process which will then pop up

90
00:03:44,400 --> 00:03:48,640
our calc and in original

91
00:03:48,640 --> 00:03:50,720
technique and

92
00:03:50,720 --> 00:03:53,920
ninja exploit was actually hooking

93
00:03:53,920 --> 00:03:54,959
uh

94
00:03:54,959 --> 00:03:57,760
process create process internal function

95
00:03:57,760 --> 00:04:00,319
which is called by process create

96
00:04:00,319 --> 00:04:02,720
process

97
00:04:03,120 --> 00:04:05,599
the hook the hooking technique i'm using

98
00:04:05,599 --> 00:04:09,920
here is utilizing page guards it has its

99
00:04:09,920 --> 00:04:12,319
drawbacks but just for this example i'm

100
00:04:12,319 --> 00:04:14,799
going to use that one so for for the

101
00:04:14,799 --> 00:04:17,519
purge guy page guard i'm

102
00:04:17,519 --> 00:04:20,720
registering my my own handler for for

103
00:04:20,720 --> 00:04:22,960
these these exceptions

104
00:04:22,960 --> 00:04:25,040
uh set up

105
00:04:25,040 --> 00:04:25,759
the

106
00:04:25,759 --> 00:04:27,280
um

107
00:04:27,280 --> 00:04:30,080
the whole memory page to be

108
00:04:30,080 --> 00:04:31,040
uh

109
00:04:31,040 --> 00:04:35,040
so to speak secured by uh guard pay a

110
00:04:35,040 --> 00:04:36,800
page guard all right

111
00:04:36,800 --> 00:04:38,160
and then

112
00:04:38,160 --> 00:04:40,400
i i call

113
00:04:40,400 --> 00:04:44,400
and go function which

114
00:04:44,800 --> 00:04:46,800
creates the mapping

115
00:04:46,800 --> 00:04:49,520
maps the view on that mapping

116
00:04:49,520 --> 00:04:52,639
then i decrypt my original payload uh

117
00:04:52,639 --> 00:04:54,639
the clock one

118
00:04:54,639 --> 00:04:57,759
copy that into this

119
00:04:57,759 --> 00:04:59,280
memory region

120
00:04:59,280 --> 00:05:02,479
uh i clear the original payload from the

121
00:05:02,479 --> 00:05:03,680
memory

122
00:05:03,680 --> 00:05:06,400
and then i create a thread with my

123
00:05:06,400 --> 00:05:08,880
payload so from that point the payload

124
00:05:08,880 --> 00:05:10,720
takes control and

125
00:05:10,720 --> 00:05:13,280
tries to create a new pro process by

126
00:05:13,280 --> 00:05:16,479
calling create process okay

127
00:05:16,479 --> 00:05:19,440
and if that happens

128
00:05:19,440 --> 00:05:20,400
the

129
00:05:20,400 --> 00:05:23,039
exception occurs because of the

130
00:05:23,039 --> 00:05:26,080
page guard and my handler will take over

131
00:05:26,080 --> 00:05:26,960
that

132
00:05:26,960 --> 00:05:29,120
uh we'll take care of that and

133
00:05:29,120 --> 00:05:32,160
er ways basically it will call my my own

134
00:05:32,160 --> 00:05:34,720
create process internal function

135
00:05:34,720 --> 00:05:35,840
which

136
00:05:35,840 --> 00:05:39,440
unmaps the view so at this point

137
00:05:39,440 --> 00:05:42,479
the payload will be not

138
00:05:42,479 --> 00:05:45,199
present in so to speak in the process

139
00:05:45,199 --> 00:05:46,240
memory

140
00:05:46,240 --> 00:05:48,880
i call it the original create process

141
00:05:48,880 --> 00:05:50,840
internal

142
00:05:50,840 --> 00:05:53,840
function takes some

143
00:05:53,840 --> 00:05:56,800
some time just for us to view what

144
00:05:56,800 --> 00:05:59,199
happens inside the process hacker

145
00:05:59,199 --> 00:06:00,479
and then

146
00:06:00,479 --> 00:06:03,680
remap the memory again so we can see it

147
00:06:03,680 --> 00:06:05,280
if it's there

148
00:06:05,280 --> 00:06:07,039
still right

149
00:06:07,039 --> 00:06:09,440
and that's basically

150
00:06:09,440 --> 00:06:11,680
everything so

151
00:06:11,680 --> 00:06:14,080
let's go to

152
00:06:14,080 --> 00:06:16,080
compile it

153
00:06:16,080 --> 00:06:19,880
and let's run it

154
00:06:25,520 --> 00:06:28,479
so we have so popped up

155
00:06:28,479 --> 00:06:29,840
that's good

156
00:06:29,840 --> 00:06:32,240
so let's see we have this remember

157
00:06:32,240 --> 00:06:34,720
region two one

158
00:06:34,720 --> 00:06:38,080
three e zeros

159
00:06:38,080 --> 00:06:40,160
and it's not here

160
00:06:40,160 --> 00:06:43,440
okay it should be somewhere in here

161
00:06:43,440 --> 00:06:46,720
uh yep it's here

162
00:06:46,720 --> 00:06:49,199
and let's wait for

163
00:06:49,199 --> 00:06:53,120
the memory region to get back

164
00:06:54,800 --> 00:06:56,319
and

165
00:06:56,319 --> 00:06:58,960
yep it's back and as you can see our

166
00:06:58,960 --> 00:07:00,639
original payload

167
00:07:00,639 --> 00:07:01,680
is there

168
00:07:01,680 --> 00:07:02,720
right

169
00:07:02,720 --> 00:07:05,120
so that's it

170
00:07:05,120 --> 00:07:07,280
thank you for watching and enjoy the

171
00:07:07,280 --> 00:07:10,280
conference

172
00:07:11,030 --> 00:07:16,770
[Music]