+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Code Signing Woes (And a potential workaround) (/showthread.php?tid=5955770)
Code Signing Woes (And a potential workaround) - Faith Connors - Apr 1, 2019
As I play around more with malware dev and the likes, I've been running into issues with AV detection based on the sole factor of having unsigned code. And this isn't limited to actual malware, but even random small projects I make that may have some weird behaviour. After spending around an hour looking around for free ways to sign code, I've found two decent services:
http://www.cacert.org/ --> Free code signing for Open Source Developers
https://www.certum.eu/en/ --> 25 Euro for an Open Source Dev Code Signing Cert/year
Unfortunately, like with most security-related services, they strongly prohibit any sort of malicious code signing, and they do ask for quite a bit of info. So if malware dev is your ambition, there isn't much you can do.
That being said, the idea of spoofing certs also crossed my mind. It doesn't seem easily plausible, since you'll be greeted with hash mismatch after trying to verify any file.
But on Windows, the hash validation functions are called from registry. So theoretically, if those values were modified, the hash verification could return true.
And that's the case in a practical scenario:
https://pentestlab.blog/2017/11/06/hijacking-digital-signatures/
So although this wouldn't necessarily get past AV in every case, it could certainly fool someone based on human-error, ie. a blue-team.
This blog post also covers the use of SigThief and SigPirate briefly to steal a cert and sign another executable with it.
But the script to change registry values is in there, and it's all in powershell format. Meaning you could throw it in your PowershellEmpire payload quite easily, or at least the code is easily portable to anything that will be running on a Windows OS. Or, if you find a Windows Server that heavily relies on PS for automation and cronjobs, throw the code snippet in there. Bam. Now your attack surface is expanded.
You can read the full whitepaper on the subject here: https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
The next part is where things get interesting. Code Signing generally uses the x.509 cryptographic standard. You know what else uses x.509? SSL. That shouldn't be some huge revelation if you know anything about signing, but what if you could just use any SSL cert, even the super-trusted ones like Microsoft, Antivirus sites, GlobalSign, Comodo, etc.
Turns out, you can do just that. All with one utility.
https://github.com/paranoidninja/CarbonCopy
It's a python script, but it actually does just take the SSL cert from any SSL-using site, like Microsoft or the others listed above. So you don't need to poke around your computer to find signed executables, just spoof from here.
Of course, once again, this won't pass any actual signature verification. But using all of this in combination can drastically decrease the detection ratio (at least by human error, haven't personally tested it yet with any major AV provider, still just writing this up as I find more information on the subject.
If anyone has any other options, or literature on the subject, drop it here.
RE: Code Signing Woes (And a potential workaround) - CyberStrike - Apr 1, 2019
I did a thread on it a while back, using netbus just to show that there are a few different options at least during scantime, some AVs do check and all that jazz. That said good thread code signing certs are going to be the ticket during engagements for sure.