Sliver-Sideload!

In this lab, I will learn to investigate and detect different code injection techniques used by threat actors to evade detection and maintain persistence on a compromised system.

Overview

sideload enables the execution of native Portable Executable (PE) files, including DLLs and EXEs, on the target machine.

It works by using Donut, creating a process from a PE file in memory, to convert the payload into shellcode. This is then injected into a target process! Unlike other execution methods, sideload always spawns a new, sacrificial process to receive the injection. It cannot inject into the inject's own process.

Lab Setup and Getting Ready

First, I ensured that I have my beacon ready and running from the previous lab. After this is verified, I downloaded the DLL used as the DLL injection for this lab on my Sliver server aka Kali. I saved it to /home/kali/Desktop:

DLL Injection Investigation

On my Sliver client, I ran the following command:

The below screenshot shows the result of running the command, as seen on my Windows 11 VM:

The sideload command loads and executes a shared object, such as a DLL, in a remote process. The --entry-point flag used gives the entry point for the DLL. The 2 within the command tells to only prompt for the user credentials twice before quitting.

Now, I navigated to the Applications and Services Logs -> Microsoft -> Windows -> Sysmon -> Operational. I specifically looked at the Event ID 8, 10, 3, and 13 to try and understand what the execution did.

Event ID 8 pertains to a Remote Thread being detected (CreateRemoteThread detected). This is used when malware injects code and hides in other processes. I am able to find the source and target processes, which can be seen in the event below. From this, I can see that implant.exe is creating a thread within Notepad.exe:

Event ID 10 pertains to process access (ProcessAccess). This event logs when a process opens another process. This can potentially mean the presence of hacking tools which read memory contents of processes, such as Local Security Authority (lsass.exe) for credential stealing. Here, I can see that procexp64.exe accessed CredentialUIBroker.exe:

Event ID 3 is network connection detection (NetworkConnect). This logs TCP/UDP connections on the workstation, showing the ProcessID and ProcessGUID. I am also able to see source and destination IP addresses and port numbers. Below is the event I have in my Event Viewer:

Lastly, Event ID 13 represents registry value modifications (RegistryEvent). It records the written value for DWORD and QWORD. Below are the modifications made on my VM that I found most interesting:

As it can be seen, the DLL was injected into Notepad.exe. As well as this, the source and destination IP addresses are also listed, although there is a solid chance that these are just from the Chrome process that is running. Below is the output seen on the Sliver client after the command is executed:

for some reason, the default prompt did not show the passwords typed. when I added different options, I could then see the password attempts:

Below shows injecting the process into msedge.exe with the command used:

Lastly, I will check the sideload options to inject the DLL into a different process, as well as spoof its parent PID. At the current moment, I am unable to spoof the PPID visibly on the Event Viewer. Going to ask about this to professor. Here is the command I used and the output from the execution:

Run an executable using sideload

Now, I will set up chisel to set up a SOCKS proxy into the target network. A SOCKS proxy is a proxy server that routes network traffic using the Socket Secure (SOCKS) protocol. It has the ability of hiding your IP address and has the ability to handle traffic from almost any protocol. Chisel is a TCP/UDP tunnel over HTTP and secured by SSH. They will work together by Chisel creating a tunnel between the client and server. Using the SOCKS mode, the server will listen on a port and forwards the traffic accordingly to the host. A client will connect and open a SOCKS proxy, routing traffic through the tunnel.

On my Kali machine, I downloaded the Linux Chisel and Windows Chisel. From there, I launched the chisel Linux binary on my C2 server:

I also made sure that my Windows chisel is a PE executable file and not a DLL:

And lastly, I ran the following code on my Sliver client:

I am able to see a proper connection from the client!

I am now going to investigate Sysmon for the process injection. From Sysmon, I analyzed the same four Event IDs. Below show my findings.

Event ID 3: I am able to see my network connection from chisel via my Kali IP on port 8000!

As well as this, I can see network connections via port 443 from my Windows 11 VM:

Unfortunately, this appears to be all I could find of interest through the logs.

I believe the process where the executable was injected is the Notepad, as seen here:

Reflection

This lab was pretty interesting. It started out very well, as I was able to complete the first DLL section quite easily, with mild troubleshooting. It was really amazing to be able to watch my systems interact with one another, especially being able to prompt something on my Windows VM and be able to steal credentials with ease. I also really enjoyed being able to analyze this in Sysmon through the events that were logged. However, the event logs were very hard to parse through, especially with the Event ID 10 having tens of thousands of results. Chisel was also very hard to use for me, and I am not sure of my result with it. To improve, I want to find a better way to parse through my logs (especially Event ID 10....) so I am not stuck looking for specific events for hours. Overall though, this lab was really cool and I enjoyed picking up some new tools!