Instructor: Malware exploitation. 2 2
In this lesson, we're going to talk 3 3
about malware exploitation techniques, 4 4
and so we have to first define what is an exploit technique? 5 5
Well, an exploit technique describes the specific method 6 6
by which malware code infects a targeted host. 7 7
Now, there is lots of different ways that this can be done. 8 8
In the old days, we used to have malware that would go 9 9
and rewrite or modify the code 10 10
within an executable or a macro file on a target disk. 11 11
That way, whenever that file was run, the virus was loaded, 12 12
it could execute its payload and go out and do bad things. 13 13
Now, if you had worm malware, 14 14
it would actually go out and try to infect only the memory, 15 15
and then go through a process 16 16
of going through remote procedure calls 17 17
over the network, trying to infect as many other hosts 18 18
as it could. 19 19
Now, modern malware, on the other hand though, 20 20
uses fileless techniques to avoid detection 21 21
by signature-based security systems 22 22
like antivirus and host-based intrusion detection systems. 23 23
By being fileless, 24 24
this means that the malware is executed directly as a script 25 25
or a small piece of shell code that creates a process 26 26
in the system memory without having to use 27 27
the local file system. 28 28
Now, some of these things will actually get installed 29 29
to a temporary directory first, and then be run, 30 30
and then they'll delete themselves. 31 31
But we'll still consider those relatively fileless 32 32
because there's not a lot of evidence on the drive 33 33
for people to find you. 34 34
Now, this is one of the things that a lot of APTs will use, 35 35
and so we have to ask the question is how does an APT 36 36
use this modern malware to operate? 37 37
Well, first, it's going to use a dropper or a downloader. 38 38
The first step is the malware has to get on your computer, 39 39
and it's going to do that in a fileless manner. 40 40
And the way they're going to do this 41 41
is by running lightweight shell code on your system. 42 42
By doing this, this becomes what we call a dropper 43 43
or a stage one dropper, 44 44
and it's then going to go out and download the rest 45 45
of the code. 46 46
And so that dropper is just a very small file, 47 47
and can run very easily from memory. 48 48
Now, the whole point here is to try to trick the user 49 49
into clicking on something or running the code, 50 50
and that way, they are infecting their own machine. 51 51
At that point, the APT then tries to maintain access. 52 52
The malware is now on the system, 53 53
and it's going to install that second stage downloader. 54 54
That downloader can download something 55 55
like a remote access Trojan, 56 56
and this will give the adversary C2 57 57
over that victim machine. 58 58
After that, they're going to start strengthening their access. 59 59
And to do that, they're going to use that remote access tool 60 60
they have from the maintaining access phase, 61 61
and they're going to start looking around 62 62
and identifying and infecting other systems. 63 63
As they're doing this, they're trying to find systems 64 64
of higher values like servers or domain controllers. 65 65
But even if not, 66 66
they want to compromise other workstations too 67 67
and do this lateral movement 68 68
so they can gain additional privileges 69 69
and an additional footprint. 70 70
So if you find them on one machine, 71 71
hopefully, you wouldn't find 'em on the other machine 72 72
and they get to stay there. 73 73
After this, they move into step four, 74 74
which is actions on objectives. 75 75
Now with actions on objectives, 76 76
the attacker now has enough permissions, 77 77
and they've identified enough things that are of interest 78 78
that they can start doing what they want to do, 79 79
which is usually going to be copying or stealing files, 80 80
encrypting files, or doing something else, 81 81
whatever their motive was. 82 82
And then finally, we have our fifth step, 83 83
which is concealment. 84 84
The attacker at this point is going to maintain 85 85
their tool access, but they might just go ahead 86 86
and start hiding themself, 87 87
and they're going to start covering their tracks 88 88
by deleting log files and things like that. 89 89
They want to make sure they're eradicating any sign 90 90
that they were there, and that they infected your system. 91 91
Because this way, they can stay there longer 92 92
if they need to, and they can always go back in later on 93 93
if they need to get something else from the machine. 94 94
All right, so that is the basic five steps of an attack. 95 95
And I mentioned a couple of terms there 96 96
that I think we need to go back and define 97 97
a little bit deeper. 98 98
I talked about things like droppers and downloaders 99 99
and shell codes and lots of other things. 100 100
So let's take a look at those. 101 101
First, we have a dropper. 102 102
Now a dropper is a specialized type of malware 103 103
that's designed to install or run other types of malware 104 104
embedded in a payload on an infected host. 105 105
Usually, this will be a stage one dropper 106 106
as that code you first got. 107 107
And once you get that code and run it, 108 108
it's then going to go out and get some other code, 109 109
and it uses a downloader to do that. 110 110
Now, a downloader is a piece of code that connects 111 111
to the internet to retrieve additional tools 112 112
after the initial infection happens by a dropper. 113 113
So often, we'll call this stage one for the dropper, 114 114
stage two for the downloader. 115 115
Now in my explanation of that process, 116 116
I also mentioned the word shell code. 117 117
Now, shell code is any lightweight code 118 118
that's designed to run an exploit on a target. 119 119
This can include any type of code format. 120 120
It can be scripting languages, 121 121
all the way down to a compiled binary. 122 122
Now for the exam, I want you to remember, 123 123
especially if you have some experience in the field, 124 124
shell code originally referred to malware code. 125 125
It would give the attacker a shell or a command prompt 126 126
on the target system. 127 127
And if you take the PenTest+ exam, 128 128
that's how they're going to use that term. 129 129
But here in CYSA for this exam, 130 130
they want you to use the definition 131 131
of the more generic shell code that I just provided, 132 132
which is any lightweight code designed 133 133
to run an exploit on a target. 134 134
It doesn't have to give you a command prompt, 135 135
it just has to be something that's going to give you 136 136
some kind of an exploit that's going to be run. 137 137
Now, once the shell code is created as a process 138 138
on the target system, all this bad stuff 139 139
has to start happening to your system, right? 140 140
How does that happen? 141 141
Well, one way is through code injection. 142 142
Code injection is an exploit technique 143 143
that runs malicious code with the identification number 144 144
of a legitimate process. 145 145
So when I go to install this code, 146 146
and we're going to talk more about process exploring 147 147
and how we can identify this type of behavior later on, 148 148
you're going to notice that every process 149 149
has a unique ID number with it. 150 150
And so if I have something that is allowed to run 151 151
like the Explorer for Windows, and I decide to run malware 152 152
and make you think I'm running it 153 153
as the Explorer for Windows, 154 154
I can hide that malware by injecting the code into that. 155 155
That's the idea of code injection. 156 156
Now, there's a lot of other techniques we can do 157 157
as far as different types of code injection. 158 158
This includes things like masquerading where your dropper 159 159
is going to replace a genuine executable with a malicious one. 160 160
You can use DLL injection, 161 161
where the dropper starts forcing a process to load 162 162
as part of the DLL. 163 163
So it's going to load the DLL 164 164
and the executable malicious code. 165 165
You also can do DLL sideloading. 166 166
This is where the dropper is going to exploit a vulnerability 167 167
in a legitimate program to manifest 168 168
to load a malicious DLL at runtime. 169 169
And essentially, use sideload 170 170
by making it load this malicious thing. 171 171
Or we can do process hollowing. 172 172
This is when a dropper starts a process 173 173
in a suspended state, 174 174
and then rewrites the memory locations containing 175 175
the process code with the malware code. 176 176
So essentially, we're taking over someplace in memory 177 177
and putting our malicious code in there. 178 178
Now droppers are likely to implement 179 179
a lot of these different techniques. 180 180
In addition to that, 181 181
they also use some anti-forensic techniques 182 182
to help prevent detection and analysis. 183 183
When we talk about anti-forensic techniques, 184 184
this is things like encrypting their payloads, 185 185
or compressing their payloads or obfuscating their payloads. 186 186
Now, when they do this, 187 187
it makes our job as reverse engineers a lot harder, 188 188
but we still find ways to find these people. 189 189
And so one of the things that a lot of pen testers 190 190
and a lot of attackers are starting to do now 191 191
is a concept called living off the land. 192 192
Because when they live off the land, 193 193
it's really hard for us to find them. 194 194
When I talk about living off the land, 195 195
this is an exploit technique that uses standard system tools 196 196
and packages to perform their intrusions. 197 197
For instance, they might use something like this, 198 198
which is PowerShell. 199 199
PowerShell can be used to do 200 200
all sorts of malicious activities. 201 201
And so what we can do is when we break into a system 202 202
as a pen tester or as an attacker, 203 203
we can actually use your own PowerShell against you. 204 204
If I'm on a Linux system, I can't use PowerShell, 205 205
but I can use Bash scripting. 206 206
And so again, if I use the tools that are native 207 207
to your operating system, 208 208
I am now using tools that were already installed 209 209
for your administrators, 210 210
and I'm using them in a malicious way, 211 211
but it's going to be really hard for you to detect that 212 212
because I'm living off the land. 213 213
So if you fall victim to an attacker who is used 214 214
to living off the land, 215 215
the detection of that adversary 216 216
is going to be much more difficult 217 217
because they're executing malware code 218 218
within those standard tools and processes, 219 219
and that makes it really hard to detect, 220 220
and it's going to allow them to stay 221 221
on your system a lot longer.