←

Beacon Payloads

C2 agents are written as a DLL paired with a loader to load it from memory

There are multiple types of loaders

Stomped Loader

  • originally implemented as reflective DLL based on Stephen Fewer's work
  • exports a function, ReflectiveLoader ,which when called, walks back over its own image, maps a new copy of itself into memory, and calls its entry point
  • Because the DLL is exported as shellcode, a small shellcode stub must be written over the PE's DOS header
  • The shellcode is responsible for jumping the code execution to the exported ReflectiveLoader , which lives in the PE's .text section

Prepended Loader

  • a new style of loader as of CS 4.11 used by DoublePulsar
  • loader is prepended to the front of a PE instead of being part of it
  • more stealthy and flexible than stomped loader
  • does not require shellcode stub as it can reflectively load any PE
  • doesnt require PE to export any functions necessary for the reflective loading process
  • gives more options to obfuscae the PE
  • PE can be encoded,encrypted,compressed,etc and it will still work as long as the loader knows how to handle those obfuscations

Staged vs stageless payloads

payload staging became popular as a solution to the restrictions in teh size of payloads. An example includes the notorious MS08-067 RCE vulnerability in Windows which required a limit of 400 bytes

  • 'stager' is a small program that when executed, reaches out to fetch the full payload , 'the stage' over a different channel from the exploit, inject it into a new region of memory and pass execution to it
  • good for getting around payload restrictions but has drawbacks
    • Security: due to the small size of the stager, there is no security nor validation that its talking to the team server. This makes them susceptible to hijacking when first executed
    • OPSEC: stageless payloads avoid the use of RWX (read, write, execute) memory because it stands out as anomalous in most Windows processes. Instead, they allocate memory as RW first and then flip it to RX prior to execution. Payload stagers dont do this because its an extra API call which means extra code, aka larger size.

Generating Payloads

Beacon payloads are generated from the Payloads menu

HTML application

generates a payload in .hta format

Options:

  • Executable: drop an executable stager to disk and run it
  • PowerShell: uses powershell.exe to run a stager in memory
  • VBA : uses a VBA macro to run a stager in memory. The macro is executed by using VBScript to instantiate an instance of Excel.Application and creating a workbook instance. Requires MS Office to be installed on target

MS Office macro

produces a VBA macro that you can paste into an Office document and always delivers an x86 beacon payload

Stager payload generator

produce source code files for a variety of languages equivalent to Metasploit's msfvenom utility. Useful when you want a byte array that you can drop into your own shellcode runners

outputting a stager in C produces the following:

/* length: 888 bytes */
unsigned char buf[] = "\xfc\x48\x83\xe4[...snip...]\x12\x1d\x9b\x09";

Stageless payload generator

practically identical to stager payload generation but offers more options

  • Exit Function: controls the API that gets called when Beacon's exit command is executed
    • Process: calls ExitProcess (xprocess) which will terminate the whole process
    • Thread : calls ExitThread (xthread) which termates tehe thread running
    • if Beacon is injected into a process that is already running, then use xthread
    • if Beacon is injected into a process executed by yourself, then use xprocess
  • System Call: tells the beacon to use system calls instead of regular Win32 APIs
    • Direct : uses the Nt* version of the function
    • Indirect : jumps to the appropriate instruction within the Nt* version of the function

Windows stager/stageless payload

similar to stager/stageless payload generators but instead of outputting raw source files they provide pre-built executables. Options:

  • Windows EXE : a standard Windows executable
  • Windows Service EXE: A Windows executable specifically designed to interact with the Service Control Manager
  • Windows DLL : A DLL that contains several exports that can be called via utilities such as rundll32 and regsvr32

Windows Stageless Generate All Payloads

generates all possible stageless payload variants for every available listener in both x86 and x64 architecture

Payload Flow

  1. CS takes original Beacon DLL and patches info from selected listener into it
  2. DLL prepended with default loader (which can be customized)
  3. This produces the beacon shellcode .bin (or customized output format)
  4. Each output format has a different hook that can be used to customize that build step