Vault7: CIA Hacking Tools Revealed
Navigation: » Directory » User #71477 » User #71477’s Home
Owner: User #71477
XYLOPHAGE Research
Modifying/expanding PEPrivilege Escalation section to fit payloads
This does not seem like it's going to work. You can modify the data in the section, but (at least for 64 bit) the references from the .text code section are using pointers that are the distance from the end of the instruction to the variable data, in memory (after load). I cannot find any pointers to this offset, so we won't be able to find it at runtime. For example, the load of the 0xaaaaaaaa padding is done with a movsxd r13, <offset> instruction.
4c 63 2d 5a 19 00 00
where 0x0000195a is the offset from the end of the movsxd 7-byte instruction to the beginning of the pad of 0xaaaaaaaa.
To make this work, we would need a list of every place this type of offset is used, and then modify each offset to reflect where we moved the padding. I assumed this would be a relocation section, but I can't find the relocations. I think this is because I am compiling not as an executable DLL, but as a resource DLL (without an ENTRY).
Instead, I think I will create several pre-compiled sizes of payload padding DLLs. Inefficient, but it should work.
Creating many padding-sizes of pre-compiled binaries
The embedding process places an operator-controlled payload and a FLEA into a SILVERFISH. The SILVERFISH should accept two binaries. The FLEA will be embedded with the PAYLOAD by SILVERFISH at runtime on target.
Lets work with the PAYLOAD being 1MB at most.
PAYLOAD padding should be sized as:
- 5k
- 10k
- 20k
- 50k
- 100k
- 300k
- 600k
- 1 MB
The FLEA will contain the PAYLOAD, so we'll need to account for around 50k plus the max of 1MB:
- 10k
- 20k
- 50k
- 100k
- 300k
- 600k
- 1 MB
This will require building a FLEA for each potential PAYLOAD size, and a SILVERFISH for each possible combination of PAYLOAD and FLEA. However, since your FLEA will have to contain the PAYLOAD, a SILVERFISH with larger PAYLOAD padding than FLEA padding will be invalid. So, for the above sizes, we would need:
- 7 FLEA builds (named as flea.<PAYLOAD>.dll, flea.10.dll)
- 28 SILVERFISH builds (named as silverfish.<FLEA>-<PAYLOAD>.dll; e.g. silverfish.10-5.dll:
- 10-5
- 20-10
- 20-5
- 50-20
- 50-10
- 50-5
- 100-50
- 100-20
- 100-10
- 100-5
- 300-100
- 300-50
- 300-20
- 300-10
- 300-5
- 600-300
- 600-100
- 600-50
- 600-20
- 600-10
- 600-5
- 1000-600
- 1000-300
- 1000-100
- 1000-50
- 1000-20
- 1000-10
- 1000-5
For generating these, we'll want a Python script to create the header files for
- "blankspace2.h" and "blankspace.h" in SILVERFISH
- "blankspace.h" in FLEA
Other Notes
Dumping assembly with objdump
Commands for dumping binary from DLLDynamic Link Library and using objdump (linux) to display Intel assembly
dd if=SilverFish.dll of=out.dll skip=3840 bs=1 count=256
objdump -D -S -l -b binary -M intel -m i386:x86-64 out.dll