Saturday, May 27, 2023

Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu



In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204


target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204



In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.


Let's see the stack in this moment:


The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.


SCEMU also identify all the Linux  syscalls for 32bits shellcodes:



The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:


We can see where is connecting and which headers is using, so right now we can replicate the communications.



In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.


target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j


target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l


The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi


target/release/scemu -f shellcodes/shikata.bin --reg esi 


In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs





Related links
  1. Hacking Tools Github
  2. Easy Hack Tools
  3. Hacking Tools Name
  4. Pentest Tools List
  5. What Is Hacking Tools
  6. Hack Tools
  7. Pentest Tools Tcp Port Scanner
  8. Hack Tools For Games
  9. Nsa Hack Tools
  10. Hacking Tools 2020
  11. Android Hack Tools Github
  12. Computer Hacker
  13. Kik Hack Tools
  14. Pentest Tools Online
  15. Pentest Tools
  16. Free Pentest Tools For Windows
  17. Hacker Tools For Mac
  18. Pentest Tools For Mac
  19. Pentest Tools Tcp Port Scanner
  20. Pentest Tools Windows
  21. Pentest Automation Tools
  22. Kik Hack Tools
  23. Hack Tools Github
  24. Best Hacking Tools 2020
  25. Pentest Tools Find Subdomains
  26. Best Pentesting Tools 2018
  27. Hack Tools For Mac
  28. Game Hacking
  29. Nsa Hack Tools Download
  30. Hackrf Tools
  31. Usb Pentest Tools
  32. Hack Rom Tools
  33. Pentest Tools Bluekeep
  34. Nsa Hack Tools Download
  35. Pentest Tools For Mac
  36. Underground Hacker Sites
  37. New Hacker Tools
  38. Tools 4 Hack
  39. Pentest Tools For Android
  40. Hack Rom Tools
  41. Hacker Tools Hardware
  42. Hack Tools For Ubuntu
  43. Nsa Hack Tools
  44. Pentest Tools Subdomain
  45. Tools For Hacker
  46. Hacking Tools Kit
  47. Hack Tools 2019
  48. Hak5 Tools
  49. Hacking Tools For Mac
  50. Pentest Tools Alternative
  51. Hacker Tools For Pc
  52. Hack Tools For Pc
  53. Hacking App
  54. Hack App
  55. Top Pentest Tools
  56. Hack Tool Apk
  57. World No 1 Hacker Software
  58. Hacker Tools For Ios
  59. Pentest Tools Website Vulnerability
  60. Hacker Tools Linux
  61. Hacking Tools Online
  62. Hacker Tools Software
  63. Physical Pentest Tools
  64. Hacker Tools For Pc
  65. Hackrf Tools
  66. Hacking Tools
  67. Hacker Tools 2020
  68. Hacker Tools Apk Download
  69. Hacker Tools 2020
  70. Blackhat Hacker Tools
  71. Hacker
  72. Hacking Tools For Windows Free Download
  73. Hackers Toolbox
  74. Pentest Tools Open Source
  75. Hacker Tools 2019
  76. Hacker Techniques Tools And Incident Handling
  77. Free Pentest Tools For Windows
  78. Hacking Tools For Pc
  79. Hacking Tools For Windows Free Download
  80. Hacker Security Tools
  81. Hack Tools Pc
  82. Tools 4 Hack
  83. Pentest Box Tools Download
  84. New Hacker Tools
  85. Pentest Tools Linux
  86. Hack App
  87. Hack Tool Apk
  88. Hacking Tools Mac
  89. Hacking Tools For Mac
  90. Hack Tools For Windows
  91. Pentest Tools For Mac
  92. Hacking Tools Mac
  93. Hack And Tools
  94. Hack Tools 2019
  95. Hack Tools
  96. Tools For Hacker
  97. Hack Rom Tools
  98. Hacking Tools For Kali Linux
  99. Hacking Tools Windows
  100. Pentest Tools Subdomain
  101. Hacker Tools Apk Download
  102. Nsa Hack Tools
  103. Hack Tools

No comments:

Post a Comment