Offensive Shellcode from Scratch by Rishalin Pillay

Author:Rishalin Pillay
Language: eng
Format: epub
Publisher: Packt Publishing Pvt. Ltd.
Published: 2022-03-10T00:00:00+00:00

Backdooring PE files with shellcode

Portable execution files are often used within many organizations. Examples of these files include archive managers such as 7zip, Sysinternals tools such as bginfo, and more.

Since these files have the ability to execute without being installed, it is a good target for shellcode injection. This technique is called backdooring. In this section, we will focus on backdooring the 7zip file manager portable executable. We will add our shellcode to a new memory section within the PE file. In order to showcase the capability without ASLR interference, I am using version 17.01, which can be downloaded here:

https://sourceforge.net/projects/sevenzip/files/7-Zip/

With the advancements in memory protections, many portable executable files now make use of Address Space Layout Randomization (ASLR). ASLR is a protection mechanism whereby memory addresses are randomized. We will cover ASLR in more detail in Chapter 6, Countermeasures and Bypasses.

You can verify whether ASLR is in use by a particular program by looking at its entry points in a debugger during each launch, or you can utilize tools that check whether ASLR is being used. One such tool is a simple PowerShell utility called PESecurity. This tool can be downloaded from the following GitHub location: https://github.com/NetSPI/PESecurity.

Once you have downloaded the tool and imported the module, all you need to do is run the script using the following command:

Get-PESecurity –f filename

In the following screenshot, I have run this script on the 7zip file manager executable that we will use for the rest of this section:

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.