PE to Shellcode – Transforming PE Files into Shellcode

You now have a solid foundation of knowledge on how to design a minimalist application loader. We can move on to how to convert any executable directly into shellcode without having to write the shellcode. In this chapter, we will introduce how to write a lightweight loader in x86 assembly that can be used to convert any EXE file to shellcode.

In this chapter, we’re going to cover the following main topics:

• Parsing Kernel32’s export table in x86 assembly
• Getting API addresses in x86 assembly
• File mapping and repairing the import table in x86
• Handling relocation in x86
• An example of PE to shellcode

The open source project pe_to_shellcode analysis

Polish researcher Aleksandra Doniec (@hasherezade on Twitter) at Malwarebytes has released the open source pe_to_shellcode project (github.com/hasherezade/pe_to_shellcode), which is a set of stubs written in x86 assembly language. A stub is actually shellcode, except that the payload usually used for loading is referred to as a stub. This open source project is a complete implementation of the lightweight application loader.

In this chapter, we will use the 32-bit version of this project.

In the previous chapter, we detailed that a lightweight application loader would require at least three tasks:

1. Allocate new memory to mount the target EXE file by file mapping.
2. Fix the IAT.
3. Relocate addresses according to the relocation table.

The first task uses VirtualAlloc to request a block of memory; the second task uses LoadLibraryA to mount the DLL into dynamic memory and GetProcAddress to search for the correct address...

Summary

Writing shellcode by hand is too costly for complex attack action. Modern attackers prefer to develop their malware in C/C++ and convert the EXE files to shellcode for use. There are two main reasons for this: one is that handwritten shellcode is costly and time-consuming and it is difficult to develop complex backdoor designs, elevated privileges, or lateral movement features; the second is that shellcode is often used as code to hijack the execution in only a first-stage exploit.

In practice, due to both buffer overflow and heap exploits, there is often not enough space under the attacker’s control to store the whole shellcode, so it is usually split into two pieces of shellcode: the small shellcode (called the stub) is responsible for the first stage of the exploit; when successful, the larger shellcode is loaded into memory for execution, whether by network connection, file reading, or egg-hunting techniques.

In this chapter, we introduced the principle and...