Monday, January 22, 2024

Fast Emulator For Shellcodes In Rust

I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.

The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.  

There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.

https://github.com/sha0coder/scemu



In less than two seconds we have emulated 7 millions of instructions arriving to the recv. 

At this point we have some  IOC like  the ip:port where it's connecting and other details.

Lets see what happens after the recv() spawning a console at position: 7,012,204


target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204



In the console, pressing "enter" several times to emulate  step into several steps and we arrive to a return instruction.


Let's see the stack in this moment:


The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.

The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next  stage automatically, but for now we have the details to get the stage.


SCEMU also identify all the Linux  syscalls for 32bits shellcodes:



The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen

Let's check with cobalt-strike:


We can see where is connecting and which headers is using, so right now we can replicate the communications.



In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or  for example grep the branches to study the emulation flow.


target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j


target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l


The -l --loops options makes the emulation a bit slower but track the number of iterations.

Is possible to print all the registers in every step with  -r or --registers  but also is possible to track  specific register for example with --reg esi


target/release/scemu -f shellcodes/shikata.bin --reg esi 


In this case ESI register points to the API name, if we track EAX or ECX will see that are the counters of the loop. These shellcodes  contains a hard loop to locate the API names.

The flag -i or --inspect allow to monitor memory using expressions like "dword ptr [eax + 0xa]"

target/release/scemu -f shellcodes/shikata.bin -i 'dword ptr [esi]'

And more things to come...  find a demo below:

https://www.youtube.com/watch?v=qTYmMjW3DFs





Related links


  1. How To Install Pentest Tools In Ubuntu
  2. Pentest Automation Tools
  3. Hacking Tools Usb
  4. Pentest Tools
  5. Black Hat Hacker Tools
  6. Pentest Tools List
  7. Hacker Tools 2019
  8. Hacker Tools For Windows
  9. Tools 4 Hack
  10. Hacker Techniques Tools And Incident Handling
  11. Wifi Hacker Tools For Windows
  12. Hacking Tools For Mac
  13. Hacker Tools
  14. Hack Tools Github
  15. Pentest Tools Open Source
  16. Pentest Tools Bluekeep
  17. Hacker Tools
  18. Beginner Hacker Tools
  19. Hacker Tools Online
  20. Beginner Hacker Tools
  21. Hacking Tools 2020
  22. Hack And Tools
  23. Android Hack Tools Github
  24. Hacker Tool Kit
  25. Beginner Hacker Tools
  26. Hacker Tools Windows
  27. Hacker Tools Online
  28. Hack Tools Mac
  29. Underground Hacker Sites
  30. Hack Tools For Pc
  31. Hackrf Tools
  32. Hacking Tools Mac
  33. Hacking Tools 2020
  34. Easy Hack Tools
  35. Beginner Hacker Tools
  36. Hack Tools For Ubuntu
  37. New Hack Tools
  38. Pentest Tools
  39. Hacker Tools Apk Download
  40. Hacking Tools Online
  41. Hacker Tools 2020
  42. Hacker Tools For Ios
  43. Hacker Tools Mac
  44. Hack Tools 2019
  45. Hacking Tools Usb
  46. Pentest Tools Url Fuzzer
  47. Hacker Tools 2020
  48. Hacking Tools Download
  49. Hacker Tools Hardware
  50. Hacker Tools Free Download
  51. Hacking Tools Software
  52. Hacking Tools Online
  53. Top Pentest Tools
  54. Growth Hacker Tools
  55. Beginner Hacker Tools
  56. Pentest Box Tools Download
  57. Hacker Tool Kit
  58. Hacking Tools 2020
  59. Github Hacking Tools
  60. Hack Tools Pc
  61. Pentest Tools For Ubuntu
  62. Blackhat Hacker Tools
  63. Hacking Tools Windows 10
  64. Hack Tools Pc
  65. Pentest Tools Github
  66. Hacker Tools Windows
  67. Hacker Tools Software
  68. Pentest Recon Tools
  69. Pentest Tools For Mac
  70. Hack Tools Download
  71. Easy Hack Tools
  72. Hack And Tools
  73. Hack Tools For Ubuntu
  74. Pentest Tools Tcp Port Scanner
  75. Hack Tools Online
  76. Hacking Tools Windows 10
  77. Pentest Tools Bluekeep
  78. Pentest Tools Tcp Port Scanner
  79. Hacking Tools 2020
  80. Hacking Tools 2019
  81. Kik Hack Tools
  82. Beginner Hacker Tools
  83. Hack Tools For Mac
  84. Pentest Tools Tcp Port Scanner
  85. Hacks And Tools
  86. Hacker Tools Linux
  87. Hack Tools Pc
  88. Best Hacking Tools 2020
  89. Pentest Tools
  90. Hacker Techniques Tools And Incident Handling
  91. Pentest Tools Online
  92. Tools 4 Hack
  93. Hacker Techniques Tools And Incident Handling
  94. Hacking Tools Name
  95. Hacking Tools For Games
  96. Hackrf Tools
  97. Hacking Tools
  98. Hacking Apps
  99. Hacker Tools Windows
  100. Hacking Tools

No comments:

Post a Comment