I have developed a fast emulator for modern shellcodes, that perform huge loops of millions of instructions emulated for resolving API or for other stuff.
The emulator is in Rust and all the few dependencies as well, so the rust safety is good for emulating malware.
There are shellcodes that can be emulated from the beginning to the end, but when this is not possible the tool has many features that can be used like a console, a memory tracing, register tracing, and so on.
https://github.com/sha0coder/scemu
In less than two seconds we have emulated 7 millions of instructions arriving to the recv.
At this point we have some IOC like the ip:port where it's connecting and other details.
Lets see what happens after the recv() spawning a console at position: 7,012,204
target/release/scemu -f shellcodes/shikata.bin -vv -c 7012204
The "ret" instruction is going to jump to the buffer read with recv() so is a kind of stager.
The option "-e" or "--endpoint" is not ready for now, but it will allow to proxy the calls to get the next stage automatically, but for now we have the details to get the stage.
SCEMU also identify all the Linux syscalls for 32bits shellcodes:
The encoder used in shellgen is also supported https://github.com/MarioVilas/shellgen
Let's check with cobalt-strike:
In verbose mode we could do several greps to see the calls and correlate with ghidra/ida/radare or for example grep the branches to study the emulation flow.
target/release/scemu -f shellcodes/rshell_sgn.bin -vv | grep j
target/release/scemu -f shellcodes/rshell_sgn.bin -vv -c 44000 -l
Related links
- How To Install Pentest Tools In Ubuntu
- Pentest Automation Tools
- Hacking Tools Usb
- Pentest Tools
- Black Hat Hacker Tools
- Pentest Tools List
- Hacker Tools 2019
- Hacker Tools For Windows
- Tools 4 Hack
- Hacker Techniques Tools And Incident Handling
- Wifi Hacker Tools For Windows
- Hacking Tools For Mac
- Hacker Tools
- Hack Tools Github
- Pentest Tools Open Source
- Pentest Tools Bluekeep
- Hacker Tools
- Beginner Hacker Tools
- Hacker Tools Online
- Beginner Hacker Tools
- Hacking Tools 2020
- Hack And Tools
- Android Hack Tools Github
- Hacker Tool Kit
- Beginner Hacker Tools
- Hacker Tools Windows
- Hacker Tools Online
- Hack Tools Mac
- Underground Hacker Sites
- Hack Tools For Pc
- Hackrf Tools
- Hacking Tools Mac
- Hacking Tools 2020
- Easy Hack Tools
- Beginner Hacker Tools
- Hack Tools For Ubuntu
- New Hack Tools
- Pentest Tools
- Hacker Tools Apk Download
- Hacking Tools Online
- Hacker Tools 2020
- Hacker Tools For Ios
- Hacker Tools Mac
- Hack Tools 2019
- Hacking Tools Usb
- Pentest Tools Url Fuzzer
- Hacker Tools 2020
- Hacking Tools Download
- Hacker Tools Hardware
- Hacker Tools Free Download
- Hacking Tools Software
- Hacking Tools Online
- Top Pentest Tools
- Growth Hacker Tools
- Beginner Hacker Tools
- Pentest Box Tools Download
- Hacker Tool Kit
- Hacking Tools 2020
- Github Hacking Tools
- Hack Tools Pc
- Pentest Tools For Ubuntu
- Blackhat Hacker Tools
- Hacking Tools Windows 10
- Hack Tools Pc
- Pentest Tools Github
- Hacker Tools Windows
- Hacker Tools Software
- Pentest Recon Tools
- Pentest Tools For Mac
- Hack Tools Download
- Easy Hack Tools
- Hack And Tools
- Hack Tools For Ubuntu
- Pentest Tools Tcp Port Scanner
- Hack Tools Online
- Hacking Tools Windows 10
- Pentest Tools Bluekeep
- Pentest Tools Tcp Port Scanner
- Hacking Tools 2020
- Hacking Tools 2019
- Kik Hack Tools
- Beginner Hacker Tools
- Hack Tools For Mac
- Pentest Tools Tcp Port Scanner
- Hacks And Tools
- Hacker Tools Linux
- Hack Tools Pc
- Best Hacking Tools 2020
- Pentest Tools
- Hacker Techniques Tools And Incident Handling
- Pentest Tools Online
- Tools 4 Hack
- Hacker Techniques Tools And Incident Handling
- Hacking Tools Name
- Hacking Tools For Games
- Hackrf Tools
- Hacking Tools
- Hacking Apps
- Hacker Tools Windows
- Hacking Tools
No comments:
Post a Comment