尾道国際ホテル法要パンフ...Title 尾道国際ホテル法要パンフ.indd Created Date 6/29/2016 1:16:14 PM
JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019...
Transcript of JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019...
![Page 1: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/1.jpg)
JiuWei(九尾)
HITCON, August 2019
Cross Platform Multi Arch Shellcode Executor
NGUYEN Anh Quynh, aquynh -at- gmail.com
KaiJern LAU, kj -at- qiling.io
TianZe DING, dliv3 -at- gmail.com
BoWen SUN, w1tcher.bupt -at- gmail.com
huitao, CHEN null -at- qiling.io
![Page 2: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/2.jpg)
Congrats HITCON for the DEFCON CTF!
Pwnie Award Too
![Page 3: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/3.jpg)
About kaijern.xwings.L
Electronic fan boy, making
toys from hacker to hacker
Badge Maker
> Reversing Binary
> Reversing IoT Devices
> Part Time CtF player
Crew since 2008, from Kuala
Lumpur till now AMS, SG,
BEIJING and DXB
Broker
> 2006 (ctf) till end of time
> Core Crew
> Review Board
> 2005, HITB CTF, Malaysia, First Place /w 20+ Intl. Team
> 2010, Hack In The Box, Malaysia, Speaker
> 2012, Codegate, Korean, Speaker
> 2015, VXRL, Hong Kong, Speaker
> 2015, HITCON Pre Qual, Taiwan, Top 10 /w 4K+ Intl. Team
> 2016, Codegate PreQual, Korean, Top 5 /w 3K+ Intl. Team
> 2016, Qcon, Beijing, Speaker
> 2016, Kcon, Beijing, Speaker
> 2016, Intl. Antivirus Conference, Tianjin, Speaker
> 2019, Defcon 27 Demolabs
Working hour is 007 and not
996. Hoping making the
world a better place
Director/Founder
> IoT Research
> Blockchain Research
> Fun Security Research
> 2017, Kcon, Beijing, Trainer
> 2017, DC852, Hong Kong, Speaker
> 2018, KCON, Beijing, Trainer
> 2018, DC010, Beijing, Speaker
> 2018, Brucon, Brussel, Speaker
> 2018, H2HC, San Paolo, Brazil, Speaker
> 2018, HITB, Beijing/Dubai, Speaker
> 2018, beVX, Hong Kong, Speaker
> 2019, VxCON, Hong Kong, Speaker
> MacOS SMC, Buffer Overflow, suid
> GDB, PE File Parser Buffer Overflow
> Metasploit Module, Snort Back Oriffice
> Linux ASLR bypass, Return to EDX
![Page 4: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/4.jpg)
About NGUYEN Anh Quynh
> Nanyang Technological University, Singapore
> PhD in Computer Science
> Operating System, Virtual Machine, Binary analysis, etc
> Usenix, ACM, IEEE, LNCS, etc
> Blackhat USA/EU/Asia, DEFCON, Recon, HackInTheBox,
Syscan, etc
> Capstone disassembler: http://capstone-engine.org
> Unicorn emulator: http://unicorn-engine.org
> Keystone assembler: http://keystone-engine.org
![Page 5: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/5.jpg)
About Dliv3
![Page 6: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/6.jpg)
All About Exploitation and Shellcoding
Agenda
Challenges
Solutions
JiuWei
Why JiuWei
DEMO
![Page 7: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/7.jpg)
Exploitation
![Page 8: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/8.jpg)
Vulnerability Exploitation Flow
Smash Input
Program Crash
Craft Payload
Control Execution Flow
Shellcode Execution
Full Control
FullControl
ShellcodeExploitationMemory
Corruption
![Page 9: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/9.jpg)
Shellcode
![Page 10: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/10.jpg)
Traditional Shellcode vs Modern Shellcode
More Complex
Harder to detect
Designed to bypass detection
Detection can be
Network
System/OS level
![Page 11: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/11.jpg)
Why Modern Shellcode
2nd Level Firewall
URL Filtering
Bandwidth Management& Prioritization
1st Level Firewall
Antivirus
IPS/IDS
Internet
IPS/IPS or maybe a smarter idea now
Fire What
Log Analysis or SIEM
Content Filtering or Busy Body Second Layer IPS
Antivirus, Anti Malware, Anti APT and Anti PC
Antivirus
Antivirus
Log Analysis
Antivirus
![Page 12: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/12.jpg)
Why Shellcode Analysis
![Page 13: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/13.jpg)
Hunting Shellcode
Locate Shellcode
Network Traffic
Email Traffic
Daily Received File
Identify Shellcode
Extract Shellcode from Mess
Break Shellcode
Read and Analyze Shellcode
Extract Shellcode Reading Shellcode
IT Security Department
Security Appliance Vendor
Anti Malware Vendor
Government Official
Who Needs To Analyze Shellcode
Detecting shellcode is easier compare to 0 day
Post exploitation behavior
How to go deeper
How to bypass current security measurement
Why Needs To Analyze Shellcode
![Page 14: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/14.jpg)
Where to Start
![Page 15: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/15.jpg)
Disassembler
GDB, IDA, R2 and the list goes on, staticIDA, GBD, WinDBG and the List Goes On
![Page 16: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/16.jpg)
Dynamic Analysis
![Page 17: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/17.jpg)
Full ARCH Emulator
MIPS ARM AARCH64
X86_32, X86_64 and not limited to
![Page 18: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/18.jpg)
Full OS Emulator
*BSD Linux OSX
X86_32, X86_64 and not limited toWindows Workstation, Windows Server and not limited toWindows Server and Windows Workstation
![Page 19: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/19.jpg)
Expectation
![Page 20: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/20.jpg)
Shellcode Analysis Is Not Easy
Current Method
A New HOPE
AFTER obtain suspicious shellcode
Manually check if this is a shellcode
Manually study the shellcode
Manually prepare verdict
AFTER obtain suspicious shellcode
Automated check if this is a shellcode
Automated shellcode execution
Automated generate disassembler and execution report
![Page 21: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/21.jpg)
What is Required
![Page 22: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/22.jpg)
CPU Emulator
System Emulator != CPU Emulator
Over
Emulate
![Page 23: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/23.jpg)
User Mode Emulation
qemu-usermode
Over Emulate
Limited OS Support, Very Limited
No Multi OS Support
No Instrumentation
usercorn
Very good project !
Mostly *nix based only
Limited OS Support (No Windows)
Go and Lua is not hacker’s friendly
WINE
Limited ARCH Support
Limited OS Support, only Windows
Not Sandbox Designed
No Instrumentation
WSL/2
Limited ARCH Support
Only Linux and run in Windows
Not Sandboxed, It linked to /mnt/c
No Instrumentation (maybe)
Binee
Very good project too
Only X86 (32 and 64)
Limited OS Support (No *NIX)
Again, is GO
![Page 24: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/24.jpg)
To Make A Good “Hackable Emulator”
You Need to Be a ASSEMBLER
Each Good for Different ARCH
Each Good for Different Platform
Only Able to Use in Limited Platform
Steep Leaving Curve
Too Complicated To Choose From
Each Good for Different ARCH
Each Good for Different Platform
Only Able to Use in Limited Platform
Steep Leaving Curve
Too Complicated to Pick One
Too Debugger Oriented
Limited Option have with Assembler and Debugger
Normally only a Helping Script / IDAPython
Limited Function
![Page 25: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/25.jpg)
JiuWei
![Page 26: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/26.jpg)
What Is JiuWei
Support Different OSes
Linux Shellcode
Windows Shellcode
BSD Shellcode
OSX Shellcode
Cross Platform
Support Architecture
X86_32, X86_64
MIPSel
ARM
AARCH64
Multi Architecture
CROSS Platform
Multi ARCH
Written in Python
Support Multiple File Input
Support Various Output
![Page 27: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/27.jpg)
Based On The Industrial Standard RE Framework
Dr Quynh
Disassembler
Industry Standard
Strip from LLVM
Capstone Engine Unicorn Engine Keystone Engine
Dr Quynh
CPU Emulator
Industry Standard
Strip From QEMU
Dr Quynh
Assembler
Industry Standard
Strip from LLVM
![Page 28: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/28.jpg)
Building Blocks
RE Frame Work Emulate Syscall and API Proven Hackers Language
![Page 29: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/29.jpg)
How It Works
![Page 30: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/30.jpg)
Support Various Input Format
Able to take in different format
asm
binary
Direct hex input
hex as file
Input Method
Check Input Data
Input Conversion
“compile” if input file is a asm
Check invalid hex char if input is hex
Pre-Processing
pre-processing
binary
asm
hex as file
hex as argv
INJECT
INJECT
arm/x86/mips
Linux/OSX/Windows
![Page 31: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/31.jpg)
Support Various Input Format – In Action
hex/binary asm
direct
4 Different Input
binary
![Page 32: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/32.jpg)
Syscall and API Emulator
Emulate Linux, *BSD and OSX
Return or Emulate Syscall
Syscall support different architecture
Support conversion such as binary to ascii
Syscall Emulation
Emulate Windows Base System
Windows 10 with DLL – 64bit
Windows 7 with DLL – 32bit
Emulate as many function as possible, eg, network
API Emulation
arm/x86/mips
Linux/OSX/Windows
emu
emu
Execution /w
Kernel emulation
![Page 33: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/33.jpg)
Syscall and API Emulator – In Action
– In Action
*Nix Based Syscall and Windows Function Call
![Page 34: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/34.jpg)
Support Various Output Format
Complete Execution Dump
Long and way too long
Every detailed is being reported
Hackers style
Short
Only Human Readable Report
Limited Report, not for analysis
Report for the Boss
executive
Execution /w
Kernel emulation
dump
emu
emu
![Page 35: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/35.jpg)
Support Various Output Format – In Action
Executive Summary and Hackers Dump
![Page 36: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/36.jpg)
How Does JiuWei Helps
![Page 37: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/37.jpg)
Analyze Shellcode At Large Scale
pre-processing
binary
asm
hex as file
hex as argv INJECT
INJECT
executiveemu
emu
dump
arm/x86/mips
Linux/OSX/Windows
Execution /w
Kernel emulation
Automated and Highly Performance and Scalable Platform
![Page 38: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/38.jpg)
How Deep Did We Dig
![Page 39: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/39.jpg)
CPU Emulator
Write Directly Into Register and Memory
Write Into Memory
Write Into Register
![Page 40: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/40.jpg)
*nix Emulator
Almost the same for OSX/Linux/*BSD
Handle Interript Ourself
Emulate Syscall
Print or Emulate Code
Prepare Execution Report
Sample Code on How To Execute X86_32Bit Linux Shellcode
![Page 41: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/41.jpg)
Windows Emulator 0x1
Setup TEB Structure
Setup PEB Structure
Setup PEB_LDR_DATA Structure
Setup segment register fs/gs
x86_32 : Setup GDT/GDTR
x86_64 : Use wrmsr to setup gs
![Page 42: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/42.jpg)
Windows Emulator 0x2
Sample Code on How To Execute X86_32/64bit Windows Shellcode
Parse DLL & Get All Export Functions
Hook Windows API
Setup LDR_DATA_TABLE_ENTRY for Loaded Modules
InMemoryOrderModuleList
InLoadOrderModuleList
InInitializationOrderList
Setup Three Double Linked Lists
![Page 43: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/43.jpg)
X86 32/64 Series
X86 32bit GDT For Windows
X86 32/64bit GDT For Linux
It took us sometime to fix the GDT and Set Threat Area
![Page 44: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/44.jpg)
ARM/64 Series
ARM and Thumb
Making Sure Loader is compatable
ARM MCR instruction for Set TLS
ARM Kernel Initialization
ARM and ARM64 Enable VFP
![Page 45: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/45.jpg)
MIPS32EL Series
MIPS Comes with CO Processor
Some Config Sits in CO Processor
Unicorn Does Not Support Floating Point
Patch Unicorn to Support Co Processors
Custom ASM for Set Thread Area
![Page 46: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/46.jpg)
Work In Progress
![Page 47: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/47.jpg)
OSX/FreeBSD
Still WIP, will be ready before Alpha Test
![Page 48: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/48.jpg)
DEMO
![Page 49: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/49.jpg)
Demo Setup
XPS + VM + Ubuntu 64Bit
![Page 50: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/50.jpg)
Linux AARCH 64
AARCH64 Reverse TCP Shellcode
![Page 51: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/51.jpg)
Linux x86_32 input as ASM
Debug and Quiet Mode with HEX, Binary and ASM Input
![Page 52: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/52.jpg)
Running a Windows Shellcode
Calling calc.exe
![Page 53: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/53.jpg)
One Step A Head
and
The ACTUAL DEMO
![Page 54: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/54.jpg)
How Does It Work
Setup
PE
elf
macho
PE32+ Loader
Loader
post processemu
emu
result
API / Syscall
Linux/OSX/Windows
CPU Hook
Base OS can be Windows/Linux/BSD or OSX
And not limited to ARCH
![Page 55: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/55.jpg)
Demo Setup
VMware with Ubuntu 64Bit on XPS, with ACTUAL AD-HOC DEMO
![Page 56: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/56.jpg)
Some Hello World Demo
VMware with Ubuntu 64Bit on XPS
Helloworld
For Different ARCH
Helloworld
For Different OSqiling
Walk Thru
![Page 57: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/57.jpg)
Linux Demo
X86
Reversing.kr Challenge ARM64 Debug Mode
VMware with Ubuntu 64Bit on XPS
ARM
WiFi Router Firmware
![Page 58: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/58.jpg)
Windows Demo
Real CTF Challenge Half “Cooked” Wannacry
Emulating Windows DialogBox within Qiling
Patching a
CrackMe Challenge
![Page 59: JiuWei(九尾 - HITCONhitcon.org/2019/CMT/slide-files/d1_s4_r1.pdfJiuWei(九尾)HITCON, August 2019 Cross Platform Multi Arch Shellcode Executor NGUYEN Anh Quynh, aquynh -at- gmail.com](https://reader033.fdocuments.in/reader033/viewer/2022051913/6003da3f39e99241fd0b67ae/html5/thumbnails/59.jpg)
Call for Alpha Tester
NGUYEN Anh Quynh, aquynh -at- gmail.com
KaiJern LAU, kj -at- qiling.io
TianZe DING, dliv3 -at- gmail.com
BoWen SUN, w1tcher.bupt -at- gmail.com
huitao, CHEN null -at- qiling.io
Subject: Qiling/Jiuwei Alpha
Content: Your Github or Gitlab