Learning Malware

Overview

This repo is meant to be my notes to learning languages used for malware creation during red team emulation. While useful scripts and code blocks will absolutely be featured here, custom tooling used for practical security purposes will makes it way to the custom security tools repo.

Additionally, this will most likely follow a combination of projects to learn ideas, notably, Kurogai’s 100 Red Team Projects. Which boils down to the ability to communicate on the network, interact with the host OS, use network services, interacting with application layer services, creating basic droppers, encrypting, and process injection.

• TCP or UDP Server (specified in the arguments) just to receive message, along with client
• File Transfers server /client
• XOR encrypted communication chat that sends the server back data (encrypted) to be unencrypted
• Simple ping sweep with OS fingerprint using TTL
• Dropper that uses XOR encryption
• Process injection
• if I make it this far, I’ll have an idea of where further to go

Languages Tackled

Nim

Just Learning, people in the field recommend this, has low level functionality with python-like syntax

Reverse Shell Status

-[x] Copy and rename the files, no long TCP messages but reverse shell -[x] change client to executing the command and sending -[x] sanitize command send (added exceptions) -[ } handle multiline outputs on server -[x] encrypt command and response sending -[ ] future (send shellcode, allocate for it, execute it in another thread, send back response or exitcode) -[ ] Add arguments to server & client at compile time for port

Compiling Nim

Since we are interested in Nim first, the command to compile is below (with lib being dll in a windows environment) nim compile --app:console|gui|lib|staticlib projectfile

Reference: https://nim-lang.org/docs/nimc.html

Org-babel with Nim

Potentially using the ob-nim nim orb-babel integration to begin literate programming with nim, then will tangle the output into a nim file as needed.

Python

Intermediate level, learning here will focus around chaining exploits to emulate weaponization aspect of a cyber attack chain

C

Beginner level, learning around memory manipulation and execution

C#

Haven’t started learning, but allows for deep windows integration and great for running .NET assemblies from a beacon in memory

Notes from Courses & Resources

Courses and resources that are useful for me in this learning endeavor.

• PMAT (TCM Academy)
• Python201 (TCM Academy)
• Sektor7 (Malware Beginners)
• Offesnive Nim (github repo)