-: Malware exploitation.
In this lesson,
we're going to talk about malware exploitation techniques.
And so, we have to first define what is an exploit technique.
Well, an exploit technique describes the specific method
by which malware code infects a targeted host.
Now, there is lots of different ways that this can be done.
In the old days, we used to have malware
that would go and rewrite or modify the code
within an executable or a macro file on a target disk.
That way, whenever that file was run, the virus was loaded,
it could execute its payload and go out and do bad things.
Now, if we had worm malware,
it would actually go out and try to infect only the memory,
and then go through a process
of going through remote procedure calls over the network
trying to infect as many other hosts as it could.
Now, modern malware on the other hand though,
uses fileless techniques
to avoid detection by signature-based security systems
like any virus and host-based intrusion detection systems.
By being fileless, this means that the malware is executed
directly as a script or a small piece of shellcode
that creates a process in the system memory
without having to use the local file system.
Now, some of these things will actually get installed
to a temporary directory first and then be run,
and then they'll delete themselves.
But we'll still consider those relatively fileless,
because there's not a lot of evidence on the drive
for people to find you.
Now, this is one of the things that a lot of APTs will use.
And so we have to ask the question,
"How does an APT use this modern malware to operate?"
Well, first, it's going to use a dropper or a downloader.
The first step is the malware has to get on your computer,
and it's going to do that in a fileless manner.
And the way they're going to do this
is by running lightweight shellcode on your system.
By doing this,
this becomes what we call a dropper or a stage one dropper.
And it's then going go out
and download the rest of the code.
And so that dropper is just a very small file
and can run very easily from memory.
Now, the whole point here is to try to trick the user
into clicking on something or running the code,
and that way, they are infecting their own machine.
At that point, the APT then tries to maintain access.
The malware is now on the system,
and it's going to install that second stage downloader.
That downloader can download
something like a remote access Trojan.
And this will give the adversary C2
over that victim machine.
After that, they're going to start strengthening their access.
And to do that,
they're going to use that remote access tool they have
from the maintaining access phase,
and they're going to start looking around
and identifying and infecting other systems.
As they're doing this,
they're trying to find systems of higher values,
like servers or domain controllers.
But even if not,
they want to compromise other workstations too
and do this lateral movement
so they can gain additional privileges
and an additional footprint.
So, if you find them on one machine,
hopefully you can find them on the other machine
and they get to stay there.
After this, they move into step four,
which is actions on objectives.
Now, with actions on objectives,
the attacker now has enough permissions
and they've identified enough things that are of interest
that they can start doing what they want to do,
which is usually going to be copying or stealing files,
encrypting files or doing something else,
whatever their motive was.
And then finally we have our fifth step
which is concealment.
The attacker, at this point,
is going to maintain their tool access,
but they might just go ahead and start hiding themselves.
And they're going to start covering their tracks
by deleting log files and things like that.
They want to make sure they're eradicating
any sign that they were there
and that they infected your system.
Because this way,
they can stay there longer if they need to,
and they can always go back in later on
if they need to get something else from the machine.
All right, so that is the basic five steps of an attack.
And I mentioned a couple of terms
that I think we need to go back
and define a little bit deeper.
I talked about things like
droppers and downloaders and shellcodes
and lots of other things.
So, let's take a look at those.
First, we have a dropper.
Now, a dropper is a specialized type of malware
that's designed to install or run other types of malware
embedded in a payload on an infected host.
Usually, this will be a stage one dropper,
it's that code you first got.
And once you get that code and run it,
it's then going to go out and get some other code,
and it uses a downloader do that.
Now, a downloader is a piece of code
that connects to the Internet
to retrieve additional tools
after the initial infection happens by a dropper.
Now, in my explanation of that process,
I also mentioned the word shellcode.
Now, shellcode is any lightweight code
that's designed to run an exploit on a target.
This can include any type of code format,
it can be scripting languages,
all the way down to a compiled binary.
Now, for the exam, I want you to remember,
especially if you have some experience in the field,
shellcode originally referred to malware code
that would give the attacker a shell or a command prompt
on the target system.
If you take the PenTest+ exam,
that's how they're going to use that term.
For this exam, they want you to use the definition
of the more generic shellcode that I just provided,
which is any lightweight code
designed to run an exploit on a target.
It doesn't have to give you a command prompt,
it just has to be something that's going to give you
some kind of an exploit that's going to be run.
Now, once the shellcode is created
as a process on the target system,
all this bad stuff
has to start happening to your system, right?
How does that happen?
Well, one way is through code injection.
Code injection is an exploit technique
that runs malicious code
with the identification number of a legit process.
So, when I go to install this code,
you're going to notice that every process
has a unique ID number with it.
And so, if I have something that is allowed to run
like the Explorer for Windows,
and I decide to run malware
and make you think I'm running it
as the Explorer for Windows,
I can hide that malware by injecting the code into that.
That's the idea of code injection.
Now, there's a lot of other techniques we can do
as far as different types of code injection.
This includes things like masquerading,
where your dropper is going to replace
a genuine executable with a malicious one.
You can use DLL injection,
where the dropper starts forcing a process to load
as part of the DLL.
So, it's going to load the DLL in the executable malicious code.
You also can do DLL sideloading.
This is where the dropper is going to exploit a vulnerability
in a legitimate program's manifest
to load a malicious DLL at runtime,
and essentially you sideload
by making it load this malicious thing.
Or we can do process hollowing,
this is when a dropper
starts a process in a suspended state,
and then rewrites the memory locations
containing the process code with the malware code.
So, essentially, we're taking over someplace in memory
and putting our malicious code in there.
Now, droppers are likely to implement
a lot of these different techniques.
In addition to that,
they also use some anti-forensic techniques
to help prevent detection and analysis.
When we talk about anti-forensic techniques,
this is things like encrypting their payloads,
or compressing their payloads,
or obfuscating their payloads.
Now, when they do this,
it makes our job as reverse engineers a lot harder,
but we still find ways to find these people.
And so, one of the things that a lot of pentesters
and a lot of attackers are starting to do now
is a concept called living off the land.
Because when they live off the land,
it's really hard for us to find them.
When I talk about living off the land,
this is an exploit technique
that uses standard system tools and packages
to perform their intrusions.
For instance, they might use something like this,
which is PowerShell.
PowerShell can be used to do
all sorts of malicious activities.
And so, what we can do is,
when we break into a system
as a pentester or as an attacker,
we can actually use your own PowerShell against you.
If I'm on a Linux system, I can't use PowerShell,
but I can use Bash scripting.
And so, again,
if I use the tools that are native to your operating system,
I am now using tools
that were already installed for your administrators.
And I'm using them in a malicious way.
But it's going to be really hard for you to detect that
because I'm living off the land.
So, if you fall victim to an attacker
who is used to living off the land,
the detection of that adversary
is going to be much more difficult
because they're executing malware code
within those standard tools and processes.
And that makes it really hard to detect,
and it's going to allow them
to stay on your system a lot longer.