An Encrypted Payload Protocol and Target-Side Scripting Engine Dino A. Dai Zovi [email protected] Abstract into the remote process and then triggering the vulnera- Modern exploit payloads in commercial and open-source bility (the injection vector) in order to cause the remote penetration testing frameworks have grown much more process to execute the injected code (the payload). Tra- advanced than the traditional shellcode they replaced. ditionally, these payloads have been written in processor- These payloads permit interactive access without launch- specific assembly language, assembled, and extracted by ing a shell, network proxying, and many other rich fea- hand into reusable machine code components. These tures. Available payload frameworks have several lim- payloads were typically small and executed an operating itations, however. They make little use of encryption to system shell, causing them to be commonly referred to secure delivery and communications, especially in earlier as shellcode. Common shellcode variants included func- stage payloads. In addition, their richer features require tionality such as restoring dropped privileges, breaking a constant network connection to the penetration tester, out of chroot environments, and attaching the shell to making them unsuitable against mobile clients, such as an inbound or outbound network connection. This style laptops, PDAs, and smart phones. of payload construction was both labor and skill inten- This work introduces a first-stage exploit payload that sive. is able to securely establish an encrypted channel using With the growth of commercial penetration testing ElGamal key agreement and the RC4 stream cipher. The services and especially commercial penetration test- key agreement implementation requires only modular ing products, exploit payloads have gotten considerably exponentiation and RC4 also lends itself to an implemen- more capable and complex. These payloads have facil- tation requiring a very small amount of executable code. itated the construction of products that help less experi- This secure channel is used to send further executable enced penetration testers better demonstrate the risk pre- code and deliver a fully-featured interpreter to execute sented by exploitable security vulnerabilities. In addi- mission logic written in the high-level Lua scripting lan- tion, the increased prevalence of layered host security guage. This scripting environment permits secure code defenses require that payloads be more robust and ca- delivery as well as disconnected operation and execution pable of more complex logic. The Unix chroot sys- of penetration testing mission logic. tem call is typically used to run a network service in a restricted file system environment. Extensions includ- 1 Introduction ing FreeBSD’s jail [1] extend this model to assign a dedicated IP address to a jail. More recent devel- Although much work has gone into detecting, mitigat- opments include the Windows Integrity Mechanism in ing, and preventing their exploitation, remote code ex- Windows Vista. The Windows Integrity Mechanism is ecution vulnerabilities remain one of the most preva- a Biba Integrity Model[2] Mandatory Access Control lent and serious vulnerability classes in software today. security system used to implement Internet Explorer’s While reported remote code execution vulnerabilities in “Protected Mode” and User Account Control (UAC). common server software have gotten more rare, they are Protected Mode Internet Explorer runs as a low-integrity still highly prevalent in web browsers, office suites, me- process that prevents it from writing to anywhere except dia players, anti-virus suites, and other local application designed places on the file system or in the registry, re- software. gardless of the discretionary access control list on the Remote code execution vulnerabilities are exploited objects. Escalating privileges in these restricted permis- by injecting a small amount of executable machine code sion environments, pivoting through networked hosts, or achieving mission objectives from these restricted execu- same or other remote systems. tion environments requires complex payload logic. There are some limitations, however, with the syscall This work addresses two shortcomings of the exist- proxy’s simple server-side logic. For example, it can- ing exploit payloads found in commercial and open- not handle the fork system call. In addition, file or source penetration testing tools. The first is a lack of se- socket input and output with the read or write system cure payload delivery and communication mechanisms. calls requires transferring the buffer twice because allo- Most available systems offer partial solutions to this at cating stack space requires sending unused data in the the present time by either only supporting encryption in marshalled stack buffer. Similarly, a round-trip for each later-stage executable agents or by only supporting sim- system call can add significant latency to input/output in- ple XOR-based traffic encoding. The second area that tensive operations. Finally, all communication with the this work addresses is the applicability of existing pay- syscall proxy server is performed unencrypted. This can loads against mobile clients. Most of the existing frame- be a concern when a remote penetration tester is gaining works require a constant network connection to the com- access to sensitive hosts or files. CORE IMPACT [4], a promised target in order to carry out mission objectives. commercial penetration testing application that employs This paper introduces a target-side scripting environment syscall proxying, addresses these issues by also employ- in order to push mission-objective logic onto the target. ing more complex agents with richer network transports The secure channel established by the earlier stage pay- that perform encryption. The initial syscall proxy server load ensures that mission objective logic is not compro- can be used to deploy a more capable remote agent, but mised in transit to the target. this requires writing an executable to the remote system’s This paper is organized as follows. First, a summary hard drive. of existing advanced payload techniques and frameworks Immunity’s CANVAS [5], a competing penetration- is presented in the next section. Afterwards, Encrypted testing application, uses a custom compiler-based pay- Payload Protocol describes a system for cryptographi- load construction system called MOSDEF [6]. The cally securing exploit payload delivery and communica- MOSDEF compiler takes a subset of the C programming tion. The final stage of this payload system, a lightweight language and generates highly position-independent ma- and powerful remotely scripted agent is introduced in the chine code suitable for dynamic injection into remote section titled Target-Side Scripting. Finally, the paper processes. The remotely executed payload can make use concludes with some discussion of the security and util- of system functions or other locally compiled functions. ity of the described payload system. Loops, conditional execution paths, and function calls are all executed inside the remote compromised process 2 Related Work and only minimal necessary information is transferred to or from the remote process. This allows the payload As mentioned above, the development of commercial author to create complex payloads that can, for exam- penetration testing applications and layered host security ple, transfer an entire remote file if successful, or only a defenses have significantly increased the complexity of smaller error code if an error occurred. exploit payloads. This section describes the exploit pay- A compiler-style approach such as MOSDEF ad- load systems found in the major available commercial dresses many of the limitations of syscall proxying at and open-source penetration testing frameworks. the expense of implementation complexity. A MOS- Syscall proxying[3] is a simple and flexible technique DEF program can create multiple processes and perform for simulating remote execution. Syscall proxying im- a significant amount of work on the client without requir- plements a fat client, thin server remote procedure call ing network round-trips or data transfers. The low-level protocol based on transferring stack frames. To exe- flexibility of C also allows a MOSDEF program to per- cute a remote system call, the syscall proxy client mar- form byte-level memory manipulations easily. This is shalls the required argument register values and mem- an important capability as performing a heap metadata ory buffers into a single buffer. The syscall proxy server exploit typically corrupts the heap to the point of caus- writes this marshalled stack buffer directly to its stack ing any subsequent heap operations to crash the program. segment, pops the general register values from it, and ex- A MOSDEF program can systematically repair the heap ecutes the system call specified. After the system call before executing higher-level functions that may require returns, the server pushes all the general purpose regis- heap memory allocation. MOSDEF, however, does not ters onto the stack and transfers the stack buffer back to encrypt the data in transit or payload code. Immunity the client. This general mechanism requires very little also provides a remote access trojan called Hydrogen that server-side logic, but provides a great deal of flexibility, uses RSA and Twofish to protect communications. The allowing the remote client to open files,