Shellcode Technique – Exported Function Parsing

In this chapter, we will learn how to get the desired API address from loaded dynamic link library (DLL) modules so that we can master the knowledge necessary to write shellcode to execute in Windows memory. To do so, we will first learn about the export address table (EAT) structure in PE, build our own DLL parser, and write new Windows shellcode from scratch in x86. Once we have finished this chapter, we will be able to develop a Windows shellcode generator in Python, which we can later call to use to achieve the desired functionality.

In this chapter, we’re going to cover the following main topics:

• EATs in PE
• Examples of a DLL file analyzer
• Examples of writing shellcode in x86
• A shellcode generator in Python

Sample programs

The sample programs mentioned in this chapter are available on the GitHub website. Readers can download the exercises at the following URL: https://github.com/PacktPublishing/Windows-APT-Warfare/tree/main/chapter%2304.

EATs in PE

In Chapter 3, Dynamic API Calling – Thread, Process, and Environment Information, we successfully explored dynamic memory to get to the image base of the desired system module. These loaded PE modules are also loaded into dynamic memory through file mapping. Once we get the address of a DLL, then we can use the API’s GetProcAddress to get the address of the specific function it exports.

So, here a new question comes to mind: is there any difference in the binary structure between PE programs with export functions (DLL) and PE programs without export functions?

Figure 4.1 is dllToTest.c, an example of streamlined DLL module source code under the Chapter#4 folder of the GitHub project:

Figure 4.1 – Sample of simple DLL code

On line 16 of the code is a standard DLL entry function. When this DLL module is first mounted to the process, the global string variable, sz_Message, is modified to Hello Hackers!.

Back to lines...

Examples of a DLL file analyzer

The following examples are from the peExportParser project in the Chapter#4 folder of the GitHub project. In order to save space, this book only extracts the highlighted code; please refer to the full source code to see the full project, which is publicly available in this book's repository.

Let’s put what we have learned in practice and try to scan the entire DLL module for named functions in a purely static situation. As the analysis will be done in a purely static state, the first challenge will be that the entire EAT contains all its data as RVAs (i.e., dynamic file-mapped offsets). Therefore, we need to construct a function to help us automate the conversion of RVAs back into offsets relative to the current static file contents to capture the data correctly. Figure 4.10 shows a simple function, rvaToOffset, that helps us with this process:

Figure 4.10 – The code of the rvaToOffset function

In Chapter...

Examples of writing shellcode in x86

Now that we have covered the Windows PE implementation for static memory distribution and dynamic memory arrangement, and how to successfully call the system function pointer, we will begin this section with a further discussion on using what we have learned to develop 32-bit shellcode with x86 commands on our own.

The following example is the 32b_shellcode.asm source code in the Chapter#4 folder of the GitHub project. In order to save space, this book only extracts the highlighted code; please refer to the full project for the complete source code.

As this is a demonstration of 32-bit shellcode development, we need to use a compiler to help us translate the x86 script into machine code that the chip can read. It is recommended that readers practice this section by downloading the open source x86 assembler Moska (github.com/aaaddress1/moska) written by the author of this book, which can compile any x86 script based on the Keystone engine and...

A shellcode generator in Python

We have now attempted to write minimalist 32-bit shellcode ourselves, and readers will recognize the large number of structural offsets that need to be remembered in the process. In practice, this can make the development process difficult if there are complex task requirements. For this reason, many free community tools have been designed to automate shellcode generation – for example, Metasploit. In this section, we will try to develop a more convenient tool that can generate shellcode directly from C/C++ code.

The following example is the shellDev.py source code from the Chapter#4 folder of the GitHub project. In order to save space, this book only extracts the highlighted code; please refer to the full source code to see all the details of the project:

Figure 4.20 – Usage of shellDev.py

We mentioned in Chapter 1, From Source to Binaries – The Journey of a C Program, that there are at least three...

Summary

In this chapter, we learned about the details of export functions and how to build our own DLL parser without relying on the Windows GetProcAddress function, crawl through dynamic memory for export functions, and write our own Windows shellcode. Finally, we can even develop a shellcode generator via Python. With this knowledge and these skills, we will be able to develop our own testing tools for penetration testing in the future, rather than being limited to the tools already developed.