Hacking Articles Tips Tricks Videos Tutorials
he context, stack and prepares everything for the obfuscation and restoration) As we can see, every function has three parts: * Shadow space: this is a 32 bytes space, allocated by the caller, but used by the callee. As far as I know and I could see, its…
so the new captured address will be the starting point where we will be placing our saved stack, but this raises a problem, any call to a function after we placed our old stack would modify it and break it, and doing the cleanup here is really convenient, specially freeing the heap used to hold our stack backup. This means that we need to move our current Rsp and also the parts of the stack that we are currently using to a place outside where we will place our restored stack. Trying to make it clearer here is the problem Restoring the contextAfter we did all the hard work, the last thing to do is using NtContinue, this function allows us to change the current context with our previously captured and modified context, setting the RIP right after the call to DeathSleep, all the register should have the same values as they had when calling DeathSleep, and RSP should be pointing at the top of the stack. Scheduling the restoration process: Using thread pool APIOkay, we know the basics of what we need to do to store and restore the current thread, but we need somehow be able to run all of this even when we have no threads. Here is where we meet our lovely Thread Pool API, a tool given by Windows, that will allow us to queue tasks (functions with one argument max) to a group of threads (a pool) that will be fully managed by the operating system. If you have seen Ekko, you can see that it uses this API, so… let’s implement it the same way.
Everything worked fine, but there was one problem, a worker was still up even after ending the execution of its queued tasks. This was a problem, since I wanted to destroy all the threads our program could generate, so this was not the way to go.
After digging a little, I discovered that the thread pool API, used in Ekko, was an old version, and there was a new one with some more capabilities, and, between them, a function that will effectively solve our problem: CloseThreadPool(). This new API allows us to create our own pool, and destroy them after using them, terminating all the used workers. It gives another two advantages: setting a maximum number of threads and cleaning groups. Setting a maximum number of threads would allow us to execute all our tasks sequentially, as long as they are queued with any time difference. The cleaning groups are useful to make the cleanup easier after everything is done.
So… it’s everything done? Well, at this point the thread is terminated, and we are queuing the rebirth function which creates the new thread with awake as its entry point, restores the previous state and closes the pool, so far so good! Changing memory permissions, redirecting executionWhen I ended with everything that we discussed before, I thought the hard part was solved, since this part was already solved by previous techniques, but ooh boi, I didn’t know what was coming.
The main problem is that we need to offload it outside of our code, since we are changing the memory protection to RW (read-write), if we call VirtualProtect(), when the function returns, our process will crash (we can’t execute instructions in RW pages), so we need to find a way to execute this from somewhere else, and make it return also to some RX(read-execute) pages (and the same thing happens when coming back). Obviously, we will be using the thread pool API for this too, but there is a problem, we can only give one argument to our tasks, and VirtualProtect() takes 4.
For this we will be using NtContinue() again, the first time I saw this use for this function was on Foliage, but it is also used in Ekko. NtContinue(), as we saw before, allows us to set some context to the thread that calls it, and with some clever tweaking, it can “call” a function with multiple arguments, by using only one (very convenient for the thread pool API). The main idea is to set the RIP to the start address of the function, and, since the windows x64 calling convention passes the first four arguments in registers (rcx, rdx, r8, r9, in that order), just put[...]
Everything worked fine, but there was one problem, a worker was still up even after ending the execution of its queued tasks. This was a problem, since I wanted to destroy all the threads our program could generate, so this was not the way to go.
After digging a little, I discovered that the thread pool API, used in Ekko, was an old version, and there was a new one with some more capabilities, and, between them, a function that will effectively solve our problem: CloseThreadPool(). This new API allows us to create our own pool, and destroy them after using them, terminating all the used workers. It gives another two advantages: setting a maximum number of threads and cleaning groups. Setting a maximum number of threads would allow us to execute all our tasks sequentially, as long as they are queued with any time difference. The cleaning groups are useful to make the cleanup easier after everything is done.
So… it’s everything done? Well, at this point the thread is terminated, and we are queuing the rebirth function which creates the new thread with awake as its entry point, restores the previous state and closes the pool, so far so good! Changing memory permissions, redirecting executionWhen I ended with everything that we discussed before, I thought the hard part was solved, since this part was already solved by previous techniques, but ooh boi, I didn’t know what was coming.
The main problem is that we need to offload it outside of our code, since we are changing the memory protection to RW (read-write), if we call VirtualProtect(), when the function returns, our process will crash (we can’t execute instructions in RW pages), so we need to find a way to execute this from somewhere else, and make it return also to some RX(read-execute) pages (and the same thing happens when coming back). Obviously, we will be using the thread pool API for this too, but there is a problem, we can only give one argument to our tasks, and VirtualProtect() takes 4.
For this we will be using NtContinue() again, the first time I saw this use for this function was on Foliage, but it is also used in Ekko. NtContinue(), as we saw before, allows us to set some context to the thread that calls it, and with some clever tweaking, it can “call” a function with multiple arguments, by using only one (very convenient for the thread pool API). The main idea is to set the RIP to the start address of the function, and, since the windows x64 calling convention passes the first four arguments in registers (rcx, rdx, r8, r9, in that order), just put[...]
Hacking Articles Tips Tricks Videos Tutorials
so the new captured address will be the starting point where we will be placing our saved stack, but this raises a problem, any call to a function after we placed our old stack would modify it and break it, and doing the cleanup here is really convenient,…
your arguments on the context structure you will pass to NtContinue and, and it will effectively simulate a call to a function. The last thing we have to take care when using NtContinue is the Rsp, since, as we saw before, this address should hold the return address when a function is called.
So the first thing we need for NtContinue to work is to get a context, we could craft it manually, but we would find a problem, finding the value for Rsp, that when passed to our function, will point to the address that will be used by RET to return. Our tasks will work in a different thread, so we don’t know where its stack will be placed. The solution (carefully stolen from Ekko, thank you very much :P) is taking a copy of the context inside a worker with RtlCaptureContext(), and increase the stack pointer of the context obtained by 8, so it will point to the address introduced in the stack by CALL RtlCaptureContext(), and which is the return address of this last function, and we can use it as the return address of all our functions.
Okay this is nice, but what happens when we can not do this modification to the Rsp? That’s what happens when we deobfuscate, we will be in a new thread, so the old context’s Rsp is useless. We need a new context, taken from the new thread, but we can’t use the old trick of modifying the Rsp to point to the correct address. Rop ChainsSo we can not modify the context obtained, but that doesn’t mean it is useless, in reality we will be using it, but in a different way. If we just restore that context with NtContinue(), without modifying its Rip, it will just redirect the execution to the next instruction after the call to RtlCaptureContext(), and with a correct Rsp, so we can use it after our calls to NtContinue() with modified contexts, to be able to correctly end the execution of our tasks. For doing this we will be using a Rop chain, by setting the Rsp of our first context to point to a manually crafted stack, that will hold everything we need to redirect execution until the second NtContinue() call that will set the correct context to end.
We are making use of 2 rop gadgets, one for fixing or “jumping” over the shadow space of our function, and the second one is in charge of placing the argument for NtContinue in rcx, and then returning to it.
Finding this 2 rop gadget is quite easy, the one for fixing the shadow space is just the epilogue of almost any function (i found more than 500 hits only in Ntdll), since as we saw before, epilogues are designed mainly to reduce the Rsp, and the second one is just a pop rcx; ret; which is 2 bytes, and also found a couple ones between Ntdll and Kernel32 dlls. A little reversing to the thread pool ApiAs we saw, using NtContinue only needs to have its first argument filled to work, and this is perfect with the old thread pool API, but in the new thread pool API, the arguments are passed in the second position, so yeah, this alone wont work.
After some hours without knowing how to solve this last problem, it came to my mind that both apis used the same functions in some cases, and that made me think that they could be more similar than they could appear, so I decided to investigate what were the relation between them.
For the old api we are using CreateTimerQueueTimer() to queue our tasks, and in the new one, we need two functions to do the same: CreateThreadpoolTimer(), that will take the callback function and the argument to pass to it, and will return a pointer to a TP_TIMER structure that describes the task, and a second function to queue the task: SetThreadpoolTimer(), that will take the previous pointer and a pointer FILETIME structure that describes when the task will be executed.
So as we can see CreateThreadpoolTimer() is just a fancy wrapper for TpAllocTimer(), and SetThreadpoolTimer() is just a forwarder to TpSetTimer().
Now let’s check the insides of CreateTimerQueueTimer(). At first, it is just another fancy wrapper to a function in Ntdll, RtlCreateTimer(), and here i[...]
So the first thing we need for NtContinue to work is to get a context, we could craft it manually, but we would find a problem, finding the value for Rsp, that when passed to our function, will point to the address that will be used by RET to return. Our tasks will work in a different thread, so we don’t know where its stack will be placed. The solution (carefully stolen from Ekko, thank you very much :P) is taking a copy of the context inside a worker with RtlCaptureContext(), and increase the stack pointer of the context obtained by 8, so it will point to the address introduced in the stack by CALL RtlCaptureContext(), and which is the return address of this last function, and we can use it as the return address of all our functions.
Okay this is nice, but what happens when we can not do this modification to the Rsp? That’s what happens when we deobfuscate, we will be in a new thread, so the old context’s Rsp is useless. We need a new context, taken from the new thread, but we can’t use the old trick of modifying the Rsp to point to the correct address. Rop ChainsSo we can not modify the context obtained, but that doesn’t mean it is useless, in reality we will be using it, but in a different way. If we just restore that context with NtContinue(), without modifying its Rip, it will just redirect the execution to the next instruction after the call to RtlCaptureContext(), and with a correct Rsp, so we can use it after our calls to NtContinue() with modified contexts, to be able to correctly end the execution of our tasks. For doing this we will be using a Rop chain, by setting the Rsp of our first context to point to a manually crafted stack, that will hold everything we need to redirect execution until the second NtContinue() call that will set the correct context to end.
We are making use of 2 rop gadgets, one for fixing or “jumping” over the shadow space of our function, and the second one is in charge of placing the argument for NtContinue in rcx, and then returning to it.
Finding this 2 rop gadget is quite easy, the one for fixing the shadow space is just the epilogue of almost any function (i found more than 500 hits only in Ntdll), since as we saw before, epilogues are designed mainly to reduce the Rsp, and the second one is just a pop rcx; ret; which is 2 bytes, and also found a couple ones between Ntdll and Kernel32 dlls. A little reversing to the thread pool ApiAs we saw, using NtContinue only needs to have its first argument filled to work, and this is perfect with the old thread pool API, but in the new thread pool API, the arguments are passed in the second position, so yeah, this alone wont work.
After some hours without knowing how to solve this last problem, it came to my mind that both apis used the same functions in some cases, and that made me think that they could be more similar than they could appear, so I decided to investigate what were the relation between them.
For the old api we are using CreateTimerQueueTimer() to queue our tasks, and in the new one, we need two functions to do the same: CreateThreadpoolTimer(), that will take the callback function and the argument to pass to it, and will return a pointer to a TP_TIMER structure that describes the task, and a second function to queue the task: SetThreadpoolTimer(), that will take the previous pointer and a pointer FILETIME structure that describes when the task will be executed.
So as we can see CreateThreadpoolTimer() is just a fancy wrapper for TpAllocTimer(), and SetThreadpoolTimer() is just a forwarder to TpSetTimer().
Now let’s check the insides of CreateTimerQueueTimer(). At first, it is just another fancy wrapper to a function in Ntdll, RtlCreateTimer(), and here i[...]
Hacking Articles Tips Tricks Videos Tutorials
your arguments on the context structure you will pass to NtContinue and, and it will effectively simulate a call to a function. The last thing we have to take care when using NtContinue is the Rsp, since, as we saw before, this address should hold the return…
s where the magic happens.
As you can see, inside this function there is effectively a call to TpAllocTimer() and to TpSetTimer(), which is similar to saying that it is calling CreateThreadpoolTimer() and SetThreadpoolTimer() inside it. As we can see the function that we are queuing is not directly the callback we have given to the function, it is setting RtlpTpTimerCallback() as the callback. If you didn’t realize yet what all of this means, is that we are using CreateThreadpoolTimer() to queue a function that receives its arguments in the second position, RtlpTpTimerCallback(), that will execute another function with its arguments in the first position.
So the only thing that we still need to understand is how the callback information is passed to RtlpTpTimerCallback(), and after some reversing I ended with the following structure, that surprise surprise, IT WORKS!
Now we can call functions that receive their arguments in the first position and at the same time we are able to close our pools, and leave no threads running, win win. Is important to note that this function is not exported in Ntdll, so I decided to find it by its byte form inside the dll.
So this is the end, and with everything reviewed, I think I gave the core ideas that came throw my mind while developing this POC, and why everything was done in the way I did it. Download
As you can see, inside this function there is effectively a call to TpAllocTimer() and to TpSetTimer(), which is similar to saying that it is calling CreateThreadpoolTimer() and SetThreadpoolTimer() inside it. As we can see the function that we are queuing is not directly the callback we have given to the function, it is setting RtlpTpTimerCallback() as the callback. If you didn’t realize yet what all of this means, is that we are using CreateThreadpoolTimer() to queue a function that receives its arguments in the second position, RtlpTpTimerCallback(), that will execute another function with its arguments in the first position.
So the only thing that we still need to understand is how the callback information is passed to RtlpTpTimerCallback(), and after some reversing I ended with the following structure, that surprise surprise, IT WORKS!
Now we can call functions that receive their arguments in the first position and at the same time we are able to close our pools, and leave no threads running, win win. Is important to note that this function is not exported in Ntdll, so I decided to find it by its byte form inside the dll.
So this is the end, and with everything reviewed, I think I gave the core ideas that came throw my mind while developing this POC, and why everything was done in the way I did it. Download
The Beautiful Art Of Finding Subdomains
A plethora of subdomain finding tools is available on the web, leaving bounty hunters with options to choose from. But before we dive any…Continue reading on Medium »
Read more...
A plethora of subdomain finding tools is available on the web, leaving bounty hunters with options to choose from. But before we dive any…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Same actor from the Uber hack may have hacked Rockstar Games to exfiltrate GTA 5 and 6 source code
https://external-preview.redd.it/YQocgsdyy8ZxfybAqc_oULTTkXYHNRia9SFSpQbD_kY.jpg?width=108&crop=smart&auto=webp&s=f60f3b9489716424e1727bb2b3cfe0d16eeb4504 submitted by /u/florilsk
[link] [comments]
Same actor from the Uber hack may have hacked Rockstar Games to exfiltrate GTA 5 and 6 source code
https://external-preview.redd.it/YQocgsdyy8ZxfybAqc_oULTTkXYHNRia9SFSpQbD_kY.jpg?width=108&crop=smart&auto=webp&s=f60f3b9489716424e1727bb2b3cfe0d16eeb4504 submitted by /u/florilsk
[link] [comments]
hacking: security in practice
Open source password manager
What is the best open source password manager from your point of view?
Ive seen Keepass and Bitwarden, dont know if there are others..
Preferably one that could be synced across all devices and accept Mac + windows + mobile.
submitted by /u/Plokeer_
[link] [comments]
Open source password manager
What is the best open source password manager from your point of view?
Ive seen Keepass and Bitwarden, dont know if there are others..
Preferably one that could be synced across all devices and accept Mac + windows + mobile.
submitted by /u/Plokeer_
[link] [comments]
Reddit
r/hacking on Reddit: Open source password manager
Posted by u/Plokeer_ - 22 votes and 27 comments
hacking: security in practice
GTA 6 Leaker And Supposed Hacker
So recently as of 11 or 10 hours ago from this post, a hacker on the GTA forums website had leaked what appears to be a pre alpha build of GTA6. At first the community was happy to see some footage of the new game, however, the hacker is now threatening to leak to source code of GTA6 and other rockstar titles unless he negotiates with the company. This could delay or cancel the release of a game the community has already waited 9 years for. This hacker also claims to have hacked Uber recently. Considering this hacker has probably already committed a felony and breached cybersecurity laws, is there anything we can do to somehow give his location to authorities. Below is a link to his profile with posts talking about hacking Uber and also posts of him leaking the game and asking to negotiate for money, thanks.
https://gtaforums.com/profile/1297108-teapotuberhacker/
Another note, I understand the rules prohibit illegal activities but I believe this still abides by guide lines as the location of the individual I want revealed is an illegal hacker who has breached cybersecurity laws. This should be considered a service to the community.
submitted by /u/Prawn_Pizza
[link] [comments]
GTA 6 Leaker And Supposed Hacker
So recently as of 11 or 10 hours ago from this post, a hacker on the GTA forums website had leaked what appears to be a pre alpha build of GTA6. At first the community was happy to see some footage of the new game, however, the hacker is now threatening to leak to source code of GTA6 and other rockstar titles unless he negotiates with the company. This could delay or cancel the release of a game the community has already waited 9 years for. This hacker also claims to have hacked Uber recently. Considering this hacker has probably already committed a felony and breached cybersecurity laws, is there anything we can do to somehow give his location to authorities. Below is a link to his profile with posts talking about hacking Uber and also posts of him leaking the game and asking to negotiate for money, thanks.
https://gtaforums.com/profile/1297108-teapotuberhacker/
Another note, I understand the rules prohibit illegal activities but I believe this still abides by guide lines as the location of the individual I want revealed is an illegal hacker who has breached cybersecurity laws. This should be considered a service to the community.
submitted by /u/Prawn_Pizza
[link] [comments]
reddit
GTA 6 Leaker And Supposed Hacker
So recently as of 11 or 10 hours ago from this post, a hacker on the GTA forums website had leaked what appears to be a pre alpha build of GTA6....
Cool Recon techniques every hacker misses! Episode 2
https://infosecwriteups.com/cool-recon-techniques-every-hacker-misses-episode-2-8024e8338756?source=rss------bug_bounty-5
https://infosecwriteups.com/cool-recon-techniques-every-hacker-misses-episode-2-8024e8338756?source=rss------bug_bounty-5
Welcome to the 2nd Episode of Cool Recon Techniques. We are back with some more cool recon techniques which we think hackers out there…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/cool-recon-techniques-every-hacker-misses-episode-2-8024e8338756?source=rss------bug_bounty-5)
The Beautiful Art Of Finding Subdomains
https://medium.com/@michaelbisuga/the-beautiful-art-of-finding-subdomains-99e178a253bf?source=rss------bug_bounty-5
https://medium.com/@michaelbisuga/the-beautiful-art-of-finding-subdomains-99e178a253bf?source=rss------bug_bounty-5
A plethora of subdomain finding tools is available on the web, leaving bounty hunters with options to choose from. But before we dive any…Continue reading on Medium » (https://medium.com/@michaelbisuga/the-beautiful-art-of-finding-subdomains-99e178a253bf?source=rss------bug_bounty-5)
Screen Broadcasting Possible or Not?
https://www.reddit.com/r/Pentesting/comments/xho6o3/screen_broadcasting_possible_or_not/
https://www.reddit.com/r/Pentesting/comments/xho6o3/screen_broadcasting_possible_or_not/
submitted by /u/Saajaadeen (https://www.reddit.com/user/Saajaadeen)
[link] (https://i.redd.it/jqn5biijuno91.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/xho6o3/screen_broadcasting_possible_or_not/)
[link] (https://i.redd.it/jqn5biijuno91.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/xho6o3/screen_broadcasting_possible_or_not/)
Bug Bounty { How I found an Sensitive Information Disclosure( Reconnaissance ) }
Hello everyone, Welcome Back!Continue reading on Medium »
Read more...
Hello everyone, Welcome Back!Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
VulnHub-Kioptrix: Level 1.1 (#2)
https://cdn-images-1.medium.com/max/600/1*QPGkCrXe0vC8iTg4lnR4Cg.png
Descripción de la máquina: Kioptrix Level 1.1 (#2) es una máquina Linux disponible en VulnHub. Esta máquina virtual es la primera de una…
Continue reading on Medium »
VulnHub-Kioptrix: Level 1.1 (#2)
https://cdn-images-1.medium.com/max/600/1*QPGkCrXe0vC8iTg4lnR4Cg.png
Descripción de la máquina: Kioptrix Level 1.1 (#2) es una máquina Linux disponible en VulnHub. Esta máquina virtual es la primera de una…
Continue reading on Medium »