Вредоносный процесс power shell с методами обфускации

27 Aug 2023

What is Powershell?

As we mentioned above, there are quite a lot of attack options and techniques, but as you know, powershell is an open source scripting language, since there is no compilation, all the commands of the command or script to be run can be clearly seen. So how can attackers still run malicious powershell commands or scripts on devices?

Parameters Used

ExecutionPolicy: Policy created for security purposes. Used to determine the types of powershell scripts that can be run/installed on the device.

1. Restricted, is the ExecutionPolicy value that is loaded by default. No powershell scripts can be run on the device.
2. AllSigned, Only scripts signed by trusted publishers can be run.
3. RemoteSigned, This is the default policy on Windows Server 2012 R2 devices. Only locally generated script files can be run on the system.
4. Unrestricted, Locally created and signed PowerShell scripts can be run. Command prompt is shown for scripts run remotely.
5. Bypass, All PowerShell scripts can be run on the device.

EncodedCommand: By default, Powershell can decode and run Base64 values. With the “powershell -EncodedCommand ‘Base64’“ command line, you can run commands/scripts that are Base64 encoded in powershell, regardless of the number of lines.

Sta: It stands for Single-Threaded Apartment. The reason why attackers use this parameter is that; some COM (Component Object Model) objects require the Single-Threaded Apartment model. COM objects are used to access system services or other software. Attackers also use this parameter to ensure that some kind of command/script works if they use a COM object in their scripts/commands.

Above are some powershell parameters. To get to all of them “powershell -?” You can run the command.

What is Obfuscation?

Obfuscation can be explained as making something difficult to understand. Generally, script languages are subject to obfuscation when they are used for malicious purposes. See JavaScript obfuscation, etc. So how does this “making it hard to understand” work? To give a simple example;

$value1="Onlyf8"
$value2="Oxxxaaanaaaabbbxlxxxaaaabbbbyfaaaaxxxxbb8"
$value2.Replace("x","").Replace("a","").Replace("b","")

Looking at the example above, when these 3 commands run, the values of $value1 and $value2 are the same. Obfuscation is the writing of commands that can easily be understood as harmful when written in plain in different ways and made their original at the time of execution.

There are quite different and more obfuscation techniques on Powershell. In this article, we’ll show and analyze the techniques that we often come across.

Special Character Obfuscation

${$!-} =+ $( ) ;${;/=} =${$!-};${-}= ++ ${$!-} ;${/} =++${$!-};${(} = ++ ${$!-};${#}= ++${$!-};${.} =++ ${$!-} ;${)@} = ++ ${$!-} ;${!} =++${$!-} ;${;~+}= ++ ${$!-};${@}=++${$!-} ;${[$ } ="["+ "$( @{} )"[ ${!}] +"$(@{})"["${-}"+"${@}"]+"$(@{ }) "["${/}" +"${;/=}" ]+"$?"[${-} ]+"]";${$!-}="".("$(@{} ) "[ "${-}${#}"] + "$( @{ } ) "["${-}${)@}"]+ "$( @{})"[${;/=}]+ "$( @{} )"[ ${#}] + "$?"[ ${-} ] +"$(@{ }) "[${(}]);${$!-}= "$(@{})"["${-}${#}" ]+ "$( @{})"[ ${#}] + "${$!-}"[ "${/}${!}"] ;.${$!-}( "${[$ }${-}${;/=}${@}+ ${[$ }${-}${;/=}${!} +${[$ }${-}${;/=}${;/=} +${[$ }${-}${;/=}${.} +${[$ }${-}${-}${#}+${[$ }${(}${/} + ${[$ }${-}${-}${-}+${[$ }${-}${-}${;/=} + ${[$ }${-}${;/=}${;~+}+${[$ }${-}${/}${-}+${[$ }${-}${;/=}${/}+ ${[$ }${.}${)@}| ${$!-} " )

Above is a powershell script obfuscated with the Special Character technique. Now let’s reverse it step by step.

First of all, this is not a single line in powershell because we can see that it is used to separate the ; character line by line in between. After these characters, we skip the line and make the script available to run line by line.

Now it’s a bit more readable (:D). So what do these lines do? Let’s run it line by line using Powershell ISE.

When we run it step by step, we notice that; In line 1, the first variable created is assigned a value of “0”, and then a different variable is assigned this value. When we come to the 3rd line, you can see that the value ++0 is assigned to the created variable. The variable defined as 0 in this line is incremented by 1 and assigned to the newly created variable. In this way, all digits between 0-9 are stored in a variable. So what are these numbers going to do?

In the next line, it is seen that the insert method is created by using index over the System.Collections.Hashtable variable, which is also one of the native variables (variables boxed in red in the image above). Only the letter r is obtained from the string ”$?” i.e. True.

String Concatenate Obfuscation

You get a sweet powershell script 🙂 A lot of random variable names, string merging, string modification in list format, Base64, Gunzip etc. It’s a mess. Where should we start? First of all, we make the variable names readable. Then we delete the '+' characters in the entire script.

Now some strings are slightly readable/predictable. Now let’s focus on the second line;

$value1_=[Ref].Assembly.GetType((('{4}{0}{9}tem.{3}ana{6}ement.{8}{2}t{7}mati{7}n.{8}m{9}i{5}ti{1}{9}')-f'y','l','u','M','S','U','g','o','A','s'));

$value1_=[Ref].Assembly.GetType(('System.Management.Automation.AmsiUtils'));

This is how the -f structure is resolved. Now let’s make all the lines readable in the same way.

In the next stage, we will get the shellcode and see what I can get. First of all, we decode the Base64 value here using CyberChef and download it using the Download feature.

When we run it, we see APIs that resolve dynamically. Here we detect that the APIs resolved in the jmp rax line are called, and we toggle breakpoint this line and track the APIs called through the RAX register.

First of all, loading the ws2_32 library with the LoadLibrary API, we understand that it will perform socket operations. Then we see that it creates a socket with the WSAStartup API.

It activates the created socket using the bind API. When we look at the parameters, we find that the 4444 port is listening.

Please contact me at my contact addresses for criticism/correction/suggestion. Your comments are valuable to me 🙂