From 5dc7c0dc1ad55f6d7d096f84bb7e6a2b32fdd710 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Fri, 11 Jul 2025 12:44:12 +0000 Subject: [PATCH] Add content from: Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced ... --- .../malware-analysis.md | 93 ++++++++++++++++++- .../reversing-native-libraries.md | 8 +- .../ios-pentesting-without-jailbreak.md | 2 +- .../sql-injection/ms-access-sql-injection.md | 4 +- 4 files changed, 99 insertions(+), 8 deletions(-) diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md index 034701f47..c42a193fb 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md @@ -169,7 +169,98 @@ If the files of a folder **shouldn't have been modified**, you can calculate the When the information is saved in logs you can **check statistics like how many times each file of a web server was accessed as a web shell might be one of the most**. -{{#include ../../banners/hacktricks-training.md}} +--- +## Deobfuscating Dynamic Control-Flow (JMP/CALL RAX Dispatchers) +Modern malware families heavily abuse Control-Flow Graph (CFG) obfuscation: instead of a direct jump/call they compute the destination at run-time and execute a `jmp rax` or `call rax`. A small *dispatcher* (typically nine instructions) sets the final target depending on the CPU `ZF`/`CF` flags, completely breaking static CFG recovery. +The technique – showcased by the SLOW#TEMPEST loader – can be defeated with a three-step workflow that only relies on IDAPython and the Unicorn CPU emulator. + +### 1. Locate every indirect jump / call + +```python +import idautils, idc + +for ea in idautils.FunctionItems(idc.here()): + mnem = idc.print_insn_mnem(ea) + if mnem in ("jmp", "call") and idc.print_operand(ea, 0) == "rax": + print(f"[+] Dispatcher found @ {ea:X}") +``` + +### 2. Extract the dispatcher byte-code + +```python +import idc + +def get_dispatcher_start(jmp_ea, count=9): + s = jmp_ea + for _ in range(count): + s = idc.prev_head(s, 0) + return s + +start = get_dispatcher_start(jmp_ea) +size = jmp_ea + idc.get_item_size(jmp_ea) - start +code = idc.get_bytes(start, size) +open(f"{start:X}.bin", "wb").write(code) +``` + +### 3. Emulate it twice with Unicorn + +```python +from unicorn import * +from unicorn.x86_const import * +import struct + +def run(code, zf=0, cf=0): + BASE = 0x1000 + mu = Uc(UC_ARCH_X86, UC_MODE_64) + mu.mem_map(BASE, 0x1000) + mu.mem_write(BASE, code) + mu.reg_write(UC_X86_REG_RFLAGS, (zf << 6) | cf) + mu.reg_write(UC_X86_REG_RAX, 0) + mu.emu_start(BASE, BASE+len(code)) + return mu.reg_read(UC_X86_REG_RAX) +``` + +Run `run(code,0,0)` and `run(code,1,1)` to obtain the *false* and *true* branch targets. + +### 4. Patch back a direct jump / call + +```python +import struct, ida_bytes + +def patch_direct(ea, target, is_call=False): + op = 0xE8 if is_call else 0xE9 # CALL rel32 or JMP rel32 + disp = target - (ea + 5) & 0xFFFFFFFF + ida_bytes.patch_bytes(ea, bytes([op]) + struct.pack('=16) automatically handle pointer authentication and oth ### Automated dynamic analysis with MobSF (no jailbreak) -[MobSF](https://mobsf.github.io/Mobile-Security-Framework-MobSF/) can instrument a dev-signed IPA on a real device using the same technique (`get_task_allow`) and provides a web UI with filesystem browser, traffic capture and Frida console【turn6view0†L2-L3】. The quickest way is to run MobSF in Docker and then plug your iPhone via USB: +[MobSF](https://mobsf.github.io/Mobile-Security-Framework-MobSF/) can instrument a dev-signed IPA on a real device using the same technique (`get_task_allow`) and provides a web UI with filesystem browser, traffic capture and Frida console【†L2-L3】. The quickest way is to run MobSF in Docker and then plug your iPhone via USB: ```bash docker pull opensecurity/mobile-security-framework-mobsf:latest diff --git a/src/pentesting-web/sql-injection/ms-access-sql-injection.md b/src/pentesting-web/sql-injection/ms-access-sql-injection.md index 913a7a03f..5b9778a7a 100644 --- a/src/pentesting-web/sql-injection/ms-access-sql-injection.md +++ b/src/pentesting-web/sql-injection/ms-access-sql-injection.md @@ -141,7 +141,7 @@ Point the UNC path to: * a host that drops the TCP handshake after `SYN-ACK` * a firewall sinkhole -The extra seconds introduced by the remote lookup can be used as an **out-of-band timing oracle** for boolean conditions (e.g. pick a slow path only when the injected predicate is true). Microsoft documents the remote database behaviour and the associated registry kill-switch in KB5002984. citeturn1search0 +The extra seconds introduced by the remote lookup can be used as an **out-of-band timing oracle** for boolean conditions (e.g. pick a slow path only when the injected predicate is true). Microsoft documents the remote database behaviour and the associated registry kill-switch in KB5002984. ### Other Interesting functions @@ -229,7 +229,7 @@ Mitigations (recommended even for legacy Classic ASP apps): * Block outbound SMB/WebDAV at the network boundary. * Sanitize / parameterise any part of a query that may end up inside an `IN` clause. -The forced-authentication vector was revisited by Check Point Research in 2023, proving it is still exploitable on fully patched Windows Server when the registry key is absent. citeturn0search0 +The forced-authentication vector was revisited by Check Point Research in 2023, proving it is still exploitable on fully patched Windows Server when the registry key is absent. ### .mdb Password Cracker