herpaderping - Process Herpaderping proof of concept, tool, and t

项目说明

Process Herpaderping

[<img align="left" style="margin: 0px 15px 15px 0px;" src="res/HerpaderpIcon.png" width="150"/>][png.HerpaderpIcon]
Process Herpaderping is a method of obscuring the intentions of a process by
modifying the content on disk after the image has been mapped. This results
in curious behavior by security products and the OS itself.

![][png.mimioogle]

![][gif.SurivDemo]

Summary

Generally, a security product takes action on process creation by registering a
callback in the Windows Kernel
([PsSetCreateProcessNotifyRoutineEx][msdn.PsSetCreateProcessNotifyRoutineEx]).
At this point, a security product may inspect the file that was used to map
the executable and determine if this process should be allowed to execute. This
kernel callback is invoked when the initial thread is inserted, not when the
process object is created.

Because of this, an actor can create and map a process, modify the content of
the file, then create the initial thread. A product that does inspection at the
creation callback would see the modified content. Additionally, some products
use an on-write scanning approach which consists of monitoring for file writes.
A familiar optimization here is recording the file has been written to and
defer the actual inspection until [IRP_MJ_CLEANUP][msdn.IRP_MJ_CLEANUP]
occurs (e.g. the file handle is closed). Thus, an actor using a
write -> map -> modify -> execute -> close workflow will subvert on-write scanning
that solely relies on inspection at [IRP_MJ_CLEANUP][msdn.IRP_MJ_CLEANUP].

To abuse this con, we first write a binary to a target file on disk.
Then, we map an image of the target file and provide it to the OS to use for
process creation. The OS kindly maps the original binary for us. Using
the existing file handle, and before creating the initial thread, we modify the
target file content to obscure or fake the file backing the image. Some time later,
we create the initial thread to begin execution of the original binary. Finally, we
will close the target file handle. Let's walk through this step-by-step:
1. Write target binary to disk, keeping the handle open. This is what will
execute in memory.
2. Map the file as an image section ([NtCreateSection][msdn.NtCreateSection],
[SEC_IMAGE][msdn.SEC_IMAGE]).
3. Create the process object using the section handle (NtCreateProcessEx).
4. Using the same target file handle, obscure the file on disk.
5. Create the initial thread in the process (NtCreateThreadEx).
- At this point the process creation callback in the kernel will fire. The
contents on disk do not match what was mapped. Inspection of the file at
this point will result in incorrect attribution.
6. Close the handle. [IRP_MJ_CLEANUP][msdn.IRP_MJ_CLEANUP] will occur here.
- Since we' the contents of what is executing, inspection at this
point will result in incorrect attribution.

![][s]
<details>
<summary>plantuml</summary>
<p>

</p>
</details>

Behavior

You'll see in the demo below, CMD.exe is used as the execution target. The
first run o the bytes on disk with a pattern. The second run o
CMD.exe with ProcessHacker.exe. The Herpaderping tool fixes up the binary to
look as close to ProcessHacker.exe as possible, e the original
signature. Note the multiple executions of the same binary and how the process
looks to the user compared to what is in the file on disk.

![][gif.ProcessHerpaderp]

![][png.procmon]

Diving Deeper <a name="tag-di"></a>

We' the behavior and some of this may be surprising. Let's try to
explain this behavior.

[Technical Deep Dive][md.Di]

Background and Moti

When designing products for securing Windows platforms, many engineers in
this field (myself included) ha on preconcei with respect
to how the OS will handle data. In this scenario, some might expect the file on
disk to remain "locked" when the process is created. You can't delete the file.
You can't write to it. But you can rename it. Seen here, under the right
conditions, you can in fact write to it. Remain on your assumptions,
always question them, and do your research.

The moti for this research came about when disco how to do analysis
when a file is written. With prior background researching process Hollowing and
Doppelganging, I had theorized this might be possible. The goal is to provide
better security. You cannot create a better lock without first understanding
how to break the old one.

Similar Techniques

Herpaderping is similar to Hollowing and Doppelganging howe are some
key differences:

#### Process Hollowing
Process Hollowing in modifying the mapped section before execution
begins, which abstractly this looks like: map -> modify section -> execute. This workflow
results in the intended execution flow of the Hollowed process di into
unintended code. Doppelganging might be considered a form of Hollowing.
However, Hollowing, in my opinion, is closer to injection in that Hollowing
usually in an explicit write to the already mapped code. This differs
from Herpaderping where there are no modified sections.

#### Process Doppelganging
Process Doppelganging is closer to Herpaderping. Doppelganging abuses
transacted file operations and generally in these steps:
transact -> write -> map -> rollback -> execute.
In this workflow, the OS will create the image section and account for
transactions, so the cached image section ends up being what you wrote to the
transaction. The OS has patched this technique. Well, they patched the crash it caused.
Maybe they consider this a "legal" use of a transaction. Thankfully, Windows
Defender does catch the Doppelganging technique. Doppelganging differs from
Herpaderping in that Herpaderping does not rely on transacted file operations.
And Defender doesn't catch Herpaderping.

#### Comparison
For reference, the generalized techniques:

| Type | Technique |
| :------------ | :------------------------------------------------ |
| Hollowing | map -> modify section -> execute |
| Doppelganging | transact -> write -> map -> rollback -> execute |
| Herpaderping | write -> map -> modify -> execute -> close |

We can see the differences laid out here. While Herpaderping is arguably
noisier than Doppelganging, in that the malicious bits do hit the disk, we've
seen that security products are still incapable of detecting Herpaderping.

Possible Solution

There is not a clear fix here. It seems reasonable that pre an image
section from being mapped/cached when there is write access to the file
should close the hole. However, that may or may not be a practical solution.

Another option might be to flush the changes to the file through to the cached
image section if it hasn't yet been mapped into a process. However, since the
map into the new process occurs at NtCreateProcess that is probably not a
solution.

From a detection standpoint, there is not a great way to identify the actual
bits that got mapped, inspection at [IRP_MJ_CLEANUP][msdn.IRP_MJ_CLEANUP] or
a callback registered at
[PsSetCreateProcessNotifyRoutineEx][msdn.PsSetCreateProcessNotifyRoutineEx]
results in incorrect attribution since the bits on disk have been changed, you
would have to rebuild the file from the section that got created. It's worth
pointing out here there is a new callback in Windows 10 you may register for
[PsSetCreateProcessNotifyRoutineEx2][msdn.PsSetCreateProcessNotifyRoutineEx2]
however this suffers from the same problem as the previous callback, it's
called out when the initial thread is executed, not when the process object is
created. Microsoft did add
[PsSetCreateThreadNotifyRoutineEx][msdn.PsSetCreateThreadNotifyRoutineEx] which
is called out when the initial thread is inserted if registered with
[PsCreateThreadNotifyNonSystem][msdn.PSCREATETHREADNOTIFYTYPE], opposed to when
it is about to begin execution (as the old callback did). Extending
[PSCREATEPROCESSNOTIFYTYPE][msdn.PSCREATEPROCESSNOTIFYTYPE] to be called out
when the process object is created won't help either, we've seen in the
Diving Deeper section that the image section object is
cached on the [NtCreateSection][msdn.NtCreateSection] call not
NtCreateProcess.

We can't easily identify what got executed. We're left with trying to detect
the exploiti by the actor, I'll lea of the behavior
indicators as an exercise for the reader.

Known Affected Platforms

Below is a list of products and Windows OSes that have been tested as of
(8/31/2020). Tests were carried out with a known malicious binary.

| Operating System | | |
| :---------------------------------- | :-------------- | :--------: |
| Windows 7 Enterprise x86 | 6.1.7601 | Yes |
| Windows 10 Pro x64 | 10.0.18363.900 | Yes |
| Windows 10 Pro Insider Preview x64 | 10.0.20170.1000 | Yes |
| Windows 10 Pro Insider Preview x64 | 10.0.20201.1000 | Yes |

| Security Product | | |
| :---------------------------------- | :------------ | :--------: |
| Windows Defender AntiMalware Client | 4.18.2006.10 | Yes |
| Windows Defender Engine | 1.1.17200.2 | Yes |
| Windows Defender Antivirus | 1.319.1127.0 | Yes |
| Windows Defender Antispyware | 1.319.1127.0 | Yes |
| Windows Defender AntiMalware Client | 4.18.2007.6 | Yes |
| Windows Defender Engine | 1.1.17300.2 | Yes |
| Windows Defender Antivirus | 1.319.1676.0 | Yes |
| Windows Defender Antispyware | 1.319.1676.0 | Yes |
| Windows Defender AntiMalware Client | 4.18.2007.8 | Yes |
| Windows Defender Engine | 1.1.17400.5 | Yes |
| Windows Defender Antivirus | 1.323.267.0 | Yes |
| Windows Defender Antispyware | 1.323.267.0 | Yes |

Responsible Disclosure

This was disclosed to the Microsoft Security Response Center
(MSRC) on 7/17/2020 and a case was opened by MSRC on 7/22/2020. MSRC concluded
their in on 8/25/2020 and determined the findings are valid but do
not meet their bar for immediate ser. At this time their case is closed,
without resolution, and is marked for future review, with no timeline.

We disagree on the se of this bug; this was communicated to MSRC on
8/27/2020.
1. There are similar in this class (Hollowing and
Doppelganging).
1. The is shown to defeat security features inherent to the
OS (Windows Defender).
1. The allows an actor to gain execution of arbitrary code.
1. The user is not notified of the execution of unintended code.
1. The process information presented to the user does not accurately reflect
what is executing.
1. Facilities to accurately identify the process are not intuitive or
incorrect, even from the kernel.

Source

This repo contains a tool for exercising the Herpaderping method of process
obfuscation. Usage is as follows:

Cloning and Building

The repo uses submodules, after cloning be sure to init and update the
submodules. Projects files are targeted to Studio 2019.

Credits

The following are used without modification. Credits to their authors.

[Windows Implementation Libraries (WIL)][github.wil]

A header-only C++ library created to make life easier for de on Windows
through readable type-safe C++ interfaces for common Windows coding patterns.

[Process Hacker Native API Headers][github.phnt]

Collection of Native API header files. Gathered from Microsoft header files and
symbol files, as well as a lot of reverse engineering and guessing.

[//]: # (Hyperlink IDs)
[github.wil]:
[github.phnt]:
[msdn.PsSetCreateProcessNotifyRoutineEx]:
[msdn.PsSetCreateProcessNotifyRoutineEx2]:
[msdn.PsSetCreateThreadNotifyRoutineEx]:
[msdn.PSCREATETHREADNOTIFYTYPE]:
[msdn.PSCREATEPROCESSNOTIFYTYPE]:
[msdn.IRP_MJ_CLEANUP]:
[msdn.NtCreateSection]:
[msdn.SEC_IMAGE]:
[msdn.IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION]:
[msdn.IRP_MJ_WRITE]:
[msdn.FILE_OBJECT]:
[msdn.SECTION_OBJECT_POINTERS]:
[msdn.PS_CREATE_NOTIFY_INFO]:

[//]: # (Relative Path IDs)
[gif.ProcessHerpaderp]: res/ProcessHerpaderp.gif
[gif.SurivDemo]: res/SurivDemo.gif
[png.procmon]: res/procmon.png
[png.mimioogle]: res/mimioogle.png
[s]: res/StateDiagram.svg
[png.HerpaderpIcon]: res/HerpaderpIcon.png
[md.Di]: res/Di.md

项目信息

开发语言：C++

Star 数：1209

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。