漏洞利用与Shellcode分析

---
name: exploit-analysis
description: >
  Analyze exploits and shellcode extracted from malicious documents, binaries,
  and network captures. Covers shellcode extraction and emulation (unicorn,
  speakeasy, scdbg), ROP chain identification, heap spray detection, exploit
  kit fingerprinting, browser exploit analysis, and kernel exploit assessment.
  Use when investigating vulnerability exploitation in malware delivery or
  privilege escalation.
---

# Exploit Analysis

Extract, analyze, and understand exploits and shellcode used in malware
delivery and post-exploitation. Determine the targeted vulnerability,
assess the sophistication, and extract IOCs.

## Prerequisites

- **Python 3.10+**: `capstone`, `unicorn`, `pefile`, `struct`
- **Tools**: scdbg, speakeasy (Mandiant), Ghidra/IDA Pro, x64dbg
- **Optional**: ROPgadget, ropper, binwalk, js-beautify
- **Environment**: Isolated VM — exploits may trigger unintended execution

## Step-by-Step Instructions

### Step 1: Extract Shellcode from the Delivery Vehicle

Locate and extract the exploit payload from its container.

**From Office documents:**
```bash
# Extract macros and embedded objects
olevba malicious.doc
oleobj malicious.doc -d extracted/

# Extract shellcode from macro VBA
python3 scripts/exploit_analyzer.py --input malicious.doc --mode extract --output shellcode.bin
```

**From PDF files:**
```bash
# Analyze PDF structure for JavaScript/embedded streams
pdf-parser.py -f malicious.pdf
peepdf -f malicious.pdf

# Extract suspicious streams
pdf-parser.py -o 5 -d stream5.bin malicious.pdf
```

**From network captures:**
```bash
# Extract payloads from HTTP responses
tshark -r capture.pcap -Y "http.response" -T fields -e http.file_data > payload_hex.txt

# Extract from specific TCP stream
tshark -r capture.pcap -z "follow,tcp,raw,0" -q > stream0.hex
```

**From PE binaries:**
```bash
# Check for embedded shellcode in resources/overlay
python3 scripts/exploit_analyzer.py --input suspicious.exe --mode extract --output extracted/
```

### Step 2: Identify the Shellcode Architecture and Type

Determine the target architecture and shellcode category.

**Quick identification:**
```bash
python3 scripts/exploit_analyzer.py --input shellcode.bin --mode identify --output id_results.json
```

**Manual analysis with capstone:**
```python
from capstone import *

with open("shellcode.bin", "rb") as f:
    code = f.read()

# Try x86 first
md = Cs(CS_ARCH_X86, CS_MODE_32)
instructions = list(md.disasm(code, 0x0))
if len(instructions) > 10:
    print(f"x86 32-bit shellcode ({len(instructions)} instructions)")
else:
    # Try x64
    md = Cs(CS_ARCH_X86, CS_MODE_64)
    instructions = list(md.disasm(code, 0x0))
    print(f"x86-64 shellcode ({len(instructions)} instructions)")

for i in instructions[:20]:
    print(f"  0x{i.address:x}: {i.mnemonic} {i.op_str}")
```

**Shellcode types:**
| Type | Indicators | Purpose |
|------|-----------|---------|
| Downloader | URLDownloadToFile, InternetOpen | Fetch next stage |
| Reverse shell | WSASocket, connect, cmd.exe | Remote access |
| Egg hunter | Memory scanning loop, tag comparison | Locate larger payload |
| Staged | Small stub + socket recv loop | Load larger payload from network |
| Reflective loader | PE parsing, manual mapping | Load DLL from memory |

### Step 3: Emulate Shellcode Execution

Run shellcode in an emulator to observe behavior without risk.

**Using speakeasy (Mandiant):**
```bash
speakeasy -t shellcode.bin -r -a x86 -o speakeasy_report.json
```

**Using scdbg:**
```bash
scdbg -f shellcode.bin -s -1
# With API hooks and memory dump
scdbg -f shellcode.bin -hooks -dump
```

**Using the analyzer script with unicorn engine:**
```bash
python3 scripts/exploit_analyzer.py --input shellcode.bin --mode emulate --arch x86 --output emulation.json
```

**Key observations during emulation:**
- API calls made (WinExec, CreateProcess, VirtualAlloc, LoadLibrary)
- URLs or IPs contacted
- Files dropped to disk
- Registry modifications
- Decoded strings or second-stage payloads

### Step 4: Analyze ROP Chains

Identify Return-Oriented Programming chains used to bypass DEP/ASLR.

**Extract ROP gadgets from the exploit:**
```bash
# Find ROP gadgets in the target binary
ROPgadget --binary vulnerable.dll --ropchain

# Use ropper for specific gadget search
ropper -f vulnerable.dll --search "pop eax"
```

**Identify ROP chain in exploit data:**
```bash
python3 scripts/exploit_analyzer.py --input exploit_data.bin --mode rop --target-dll ntdll.dll --output rop_analysis.json
```

**Common ROP patterns:**
| Pattern | Purpose |
|---------|---------|
| `VirtualProtect` chain | Mark memory as RWX to execute shellcode |
| `VirtualAlloc` chain | Allocate executable memory |
| `WriteProcessMemory` chain | Copy shellcode to executable region |
| Stack pivot | Move ESP to attacker-controlled data |
| `NtSetInformationProcess` | Disable DEP for the process |

### Step 5: Detect Heap Spray Patterns

Identify heap spray techniques used to position shellcode at predictable addresses.

**Indicators of heap spray:**
```bash
# In JavaScript from documents/browsers
python3 scripts/exploit_analyzer.py --input exploit.html --mode heapspray --output spray_analysis.json
```

**Common heap spray patterns:**
- Large string allocations with NOP sled + shellcode
- Repeated allocation of 0x1000-byte blocks
- Target addresses: `0x0c0c0c0c`, `0x0a0a0a0a`, `0x0d0d0d0d`
- JavaScript `unescape()` or `String.fromCharCode()` for shellcode encoding
- `ArrayBuffer` and `DataView` for modern heap manipulation

**JavaScript deobfuscation:**
```bash
# Beautify obfuscated JavaScript
js-beautify exploit.js > exploit_clean.js

# Look for spray patterns
grep -nE "(unescape|fromCharCode|substr.*repeat|ArrayBuffer|spray|nop)" exploit_clean.js
```

### Step 6: Identify the Target Vulnerability

Determine which CVE the exploit targets.

**Automated CVE identification:**
```bash
python3 scripts/exploit_analyzer.py --input exploit_sample --mode cve-id --output cve_results.json
```

**Manual identification techniques:**
1. Check targeted application/version from exploit metadata
2. Look for version-specific offsets or ROP gadget addresses
3. Compare with known exploit kits and their CVE coverage
4. Check file format anomalies (malformed headers, oversized fields)
5. Search for similar exploit patterns in Exploit-DB or PacketStorm

**Common document exploit CVEs:**
| CVE | Target | Type |
|-----|--------|------|
| CVE-2017-11882 | Equation Editor | Stack overflow |
| CVE-2017-0199 | OLE/HTA handler | Remote code execution |
| CVE-2021-40444 | MSHTML | Remote code execution |
| CVE-2022-30190 | ms-msdt (Follina) | Remote code execution |
| CVE-2023-23397 | Outlook | NTLM relay |

### Step 7: Analyze Browser Exploits

Examine JavaScript-based exploits targeting browser vulnerabilities.

**Deobfuscate exploit JavaScript:**
```bash
# Multi-layer deobfuscation
python3 scripts/exploit_analyzer.py --input exploit.html --mode browser --output browser_analysis.json
```

**Analysis approach:**
1. Extract all `<script>` blocks from the HTML
2. Deobfuscate layer by layer (eval → function body, unescape → raw bytes)
3. Identify the vulnerability trigger (type confusion, use-after-free, buffer overflow)
4. Locate the shellcode or next-stage loader
5. Map the exploit flow: spray → trigger → pivot → execute

**WebAssembly exploits:**
```bash
# Extract and disassemble WASM modules
wasm-decompile exploit.wasm -o exploit_wasm.dcmp
wasm-objdump -d exploit.wasm
```

### Step 8: Assess Exploit Sophistication and Attribution

Evaluate the exploit's quality and potential origin.

**Sophistication indicators:**
| Level | Characteristics |
|-------|----------------|
| Low | Known exploit, public PoC, no obfuscation |
| Medium | Modified public exploit, basic obfuscation, some evasion |
| High | Custom exploit, multi-stage, sandbox detection, novel technique |
| Nation-state | Zero-day, advanced evasion, precise targeting, minimal footprint |

**Attribution signals:**
- Code reuse from known exploit kits (RIG, Magnitude, Fallout)
- Language artifacts in strings or comments
- Targeting specificity (geography, industry, software versions)
- Overlap with known threat actor tooling

## Output Format

```json
{
  "exploit_type": "document",
  "delivery": "RTF with embedded OLE object",
  "cve": "CVE-2017-11882",
  "target_application": "Microsoft Equation Editor",
  "shellcode": {
    "architecture": "x86",
    "size_bytes": 512,
    "type": "downloader",
    "encoding": "XOR with key 0x37",
    "api_calls": ["URLDownloadToFileA", "WinExec"],
    "urls": ["http://evil.example.com/stage2.exe"],
    "dropped_files": []
  },
  "rop_chain": {
    "detected": false
  },
  "heap_spray": {
    "detected": false
  },
  "sophistication": "medium",
  "iocs": {
    "urls": ["http://evil.example.com/stage2.exe"],
    "hashes": {"shellcode_sha256": "abc123..."},
    "file_names": ["stage2.exe"]
  },
  "mitre_attack": ["T1203", "T1059.005", "T1105"]
}
```

## Tips

- Always emulate shellcode before attempting live execution — even in a VM
- Many exploits target specific application versions; check the targeted offsets
- Heap spray NOP sleds often use instruction-safe bytes (e.g., `0x0c0c` = `or al, 0x0c`)
- Browser exploits frequently use multiple stages — deobfuscate iteratively
- Compare shellcode hashes against known payloads in Metasploit/Cobalt Strike
- ROP chains are version-specific; the target DLL version reveals the targeted patch level
- Document exploits often chain multiple CVEs for reliability
- Keep an updated collection of vulnerable application versions for testing