Cobaltstrike —— shellcode分析（一）

前言

搞iot搞久了，換個方向看看，改改口味。所以決定分析一下Cobaltstrike —— shellcode，順便還可以提高一下逆向能力。

windows 常見結構體

在分析Cobaltstrike-shellcode之前我們得先了解一下windows下一些常見的結構體。

X86

Thread Environment Block 環境執行緒塊 —— TEB

位於fs[0]的位置，結構如下：

typedef struct _NT_TEB
{
    NT_TIB Tib;                         // 00h
    PVOID EnvironmentPointer;           // 1Ch
    CLIENT_ID Cid;                      // 20h
    PVOID ActiveRpcInfo;                // 28h
    PVOID ThreadLocalStoragePointer;    // 2Ch
    PPEB Peb;                           // 30h          <--注意這裡 Process Environment Block
    ULONG LastErrorValue;               // 34h
    ULONG CountOfOwnedCriticalSections; // 38h
    PVOID CsrClientThread;              // 3Ch
    PVOID Win32ThreadInfo;              // 40h
    ULONG Win32ClientInfo[0x1F];        // 44h
    PVOID WOW32Reserved;                // C0h
    ULONG CurrentLocale;                // C4h
    ULONG FpSoftwareStatusRegister;     // C8h
    PVOID SystemReserved1[0x36];        // CCh
    PVOID Spare1;                       // 1A4h
    LONG ExceptionCode;                 // 1A8h
    ULONG SpareBytes1[0x28];            // 1ACh
    PVOID SystemReserved2[0xA];         // 1D4h
    GDI_TEB_BATCH GdiTebBatch;          // 1FCh
    ...
    PVOID ReservedForOle;               // F80h
    ULONG WaitingOnLoaderLock;          // F84h
    PVOID StackCommit;                  // F88h
    PVOID StackCommitMax;               // F8Ch
    PVOID StackReserve;                 // F90h
    PVOID MessageQueue;                 // ???
}

Process Environment Block 執行緒資訊塊 —— PEB

位於TEB[0x30]的位置，結構如下：

typedef struct _PEB
{
    UCHAR InheritedAddressSpace;                     // 00h
    UCHAR ReadImageFileExecOptions;                  // 01h
    UCHAR BeingDebugged;                             // 02h
    UCHAR Spare;                                     // 03h
    PVOID Mutant;                                    // 04h
    PVOID ImageBaseAddress;                          // 08h
    PPEB_LDR_DATA Ldr;                               // 0Ch          <--注意這裡 DllList 成員，此成員指向 _PEB_LDR_DATA(程序載入模組連結串列)
    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;  // 10h
    PVOID SubSystemData;                             // 14h
    PVOID ProcessHeap;                               // 18h
    PVOID FastPebLock;                               // 1Ch
    PPEBLOCKROUTINE FastPebLockRoutine;              // 20h
    PPEBLOCKROUTINE FastPebUnlockRoutine;            // 24h
    ULONG EnvironmentUpdateCount;                    // 28h
    PVOID* KernelCallbackTable;                      // 2Ch
    PVOID EventLogSection;                           // 30h
    PVOID EventLog;                                  // 34h
    PPEB_FREE_BLOCK FreeList;                        // 38h
    ULONG TlsExpansionCounter;                       // 3Ch
    PVOID TlsBitmap;                                 // 40h
    ULONG TlsBitmapBits[0x2];                        // 44h
    PVOID ReadOnlySharedMemoryBase;                  // 4Ch
    PVOID ReadOnlySharedMemoryHeap;                  // 50h
    PVOID* ReadOnlyStaticServerData;                 // 54h
    PVOID AnsiCodePageData;                          // 58h
    PVOID OemCodePageData;                           // 5Ch
    PVOID UnicodeCaseTableData;                      // 60h
    ULONG NumberOfProcessors;                        // 64h
    ULONG NtGlobalFlag;                              // 68h
    UCHAR Spare2[0x4];                               // 6Ch
    LARGE_INTEGER CriticalSectionTimeout;            // 70h
    ULONG HeapSegmentReserve;                        // 78h
    ULONG HeapSegmentCommit;                         // 7Ch
    ULONG HeapDeCommitTotalFreeThreshold;            // 80h
    ULONG HeapDeCommitFreeBlockThreshold;            // 84h
    ULONG NumberOfHeaps;                             // 88h
    ULONG MaximumNumberOfHeaps;                      // 8Ch
    PVOID** ProcessHeaps;                            // 90h
    PVOID GdiSharedHandleTable;                      // 94h
    PVOID ProcessStarterHelper;                      // 98h
    PVOID GdiDCAttributeList;                        // 9Ch
    PVOID LoaderLock;                                // A0h
    ULONG OSMajorVersion;                            // A4h
    ULONG OSMinorVersion;                            // A8h
    ULONG OSBuildNumber;                             // ACh
    ULONG OSPlatformId;                              // B0h
    ULONG ImageSubSystem;                            // B4h
    ULONG ImageSubSystemMajorVersion;                // B8h
    ULONG ImageSubSystemMinorVersion;                // C0h
    ULONG GdiHandleBuffer[0x22];                     // C4h
    PVOID ProcessWindowStation;                      // ???
}

_PEB_LDR_DATA 結構體

位於PEB[0xc]的位置，結構如下：

typedef struct _PEB_LDR_DATA
{
　ULONG Length;                                // +0x00
　BOOLEAN Initialized;                         // +0x04
　PVOID SsHandle;                              // +0x08
　LIST_ENTRY InLoadOrderModuleList;            // +0x0c 模組載入順序
　LIST_ENTRY InMemoryOrderModuleList;          // +0x14 模組在記憶體中的順序
　LIST_ENTRY InInitializationOrderModuleList;  // +0x1c 模組初始化時的順序
} PEB_LDR_DATA,*PPEB_LDR_DATA;                 // +0x24

_LIST_ENTRY 結構體如下

typedef struct _LIST_ENTRY { 
 struct _LIST_ENTRY *Flink; 
 struct _LIST_ENTRY *Blink; 
} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;

三個雙向連結串列(LIST_ENTRY)分別指向_LDR_DATA_TABLE_ENTRY結構體（但並不是都指向開始位置）。如InMemoryOrderList對應第一個模組的結構體，指向_LDR_DATA_TABLE_ENTRY[0x8]。

_LDR_DATA_TABLE_ENTRY 結構體

結構如下：

typedef struct _LDR_DATA_TABLE_ENTRY
{
	LIST_ENTRY64	InLoadOrderLinks;           // 0x0
	LIST_ENTRY64	InMemoryOrderLinks;         // 0x8
	LIST_ENTRY64	InInitializationOrderLinks; // 0x10
	PVOID			DllBase;            // 0x18
	PVOID			EntryPoint;         // 0x20
	ULONG			SizeOfImage;        // 0x28
	UNICODE_STRING	FullDllName;                // 0x30
	UNICODE_STRING	BaseDllName;
	ULONG			Flags;
	USHORT			LoadCount;
	USHORT			TlsIndex;
	PVOID			SectionPointer;
	ULONG			CheckSum;
	PVOID			LoadeImports;
	PVOID			EntryPointActivationContext;
	PVOID			PatchInformation;
	LIST_ENTRY64	ForwarderLinks;
	LIST_ENTRY64	ServiceTagLinks;
	LIST_ENTRY64	StaticLinks;
	PVOID			ContextInformation;
	ULONG			OriginalBase;
	LARGE_INTEGER	LoadTime;
}LDR_DATA_TABLE_ENTRY,*PLDR_DATA_TABLE_ENYRY;

X86-64

X86-64和X86大同小異，由於我們之後分析的是32位元的程式，這裡X86-64結構體我就先不介紹，等以後有機會碰到再補充。