From 01aaa9173c783c88f5910960c1e82cc9ab1a4885 Mon Sep 17 00:00:00 2001 From: Hardy-Cooper Date: Mon, 16 Nov 2020 11:19:11 -0500 Subject: [PATCH 1/5] Added aux module that elevates permissions for certain directories such that SYSTEM is the only principal that can write --- .../windows/modules/auxiliary/permissions.py | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py diff --git a/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py new file mode 100644 index 0000000000..8d3cef56fe --- /dev/null +++ b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py @@ -0,0 +1,32 @@ +import logging +from subprocess import call, STARTUPINFO, STARTF_USESHOWWINDOW + +from lib.common.abstracts import Auxiliary + +log = logging.getLogger(__name__) + + +class Permissions(Auxiliary): + """ + Change permissions for injected directory and Python interpreter + to prevent malware from messing with analysis + """ + def start(self): + locations = ["C:\\Python27", self.analyzer.path, "C:\\WindowsAzure"] + log.debug("Adjusting permissions for %s", locations) + for location in locations: + + # First add a non-inherited permission for Admin Read+Execute + # icacls /remove:g "BUILTIN\Users" "CREATOR OWNER" /grant:r "BUILTIN\Administrators:(OI)(CI)(RX)" "BUILTIN\\Administrators:(RX)" /t /c /q + modify_admin_params = ["icacls", location, "/grant:r", "BUILTIN\\Administrators:(OI)(CI)(RX)", "BUILTIN\\Administrators:(RX)", "/t", "/c", "/q"] + call(modify_admin_params, startupinfo=self.startupinfo) + + # Then remove all inherited permissions so that only SYSTEM has Write access + # icacls /inheritancelevel:d /t /c /q + inheritance_params = ["icacls", location, "/inheritancelevel:r", "/t", "/c", "/q"] + call(inheritance_params, startupinfo=self.startupinfo) + + def __init__(self, options={}, analyzer=None): + Auxiliary.__init__(self, options, analyzer) + self.startupinfo = STARTUPINFO() + self.startupinfo.dwFlags |= STARTF_USESHOWWINDOW From e7e0d079d1123c16907cc63db402d66cbd71b018 Mon Sep 17 00:00:00 2001 From: Hardy-Cooper Date: Mon, 16 Nov 2020 11:20:08 -0500 Subject: [PATCH 2/5] Tweaking comments to reflect commands run --- cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py index 8d3cef56fe..7e497846ee 100644 --- a/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py +++ b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py @@ -17,12 +17,12 @@ def start(self): for location in locations: # First add a non-inherited permission for Admin Read+Execute - # icacls /remove:g "BUILTIN\Users" "CREATOR OWNER" /grant:r "BUILTIN\Administrators:(OI)(CI)(RX)" "BUILTIN\\Administrators:(RX)" /t /c /q + # icacls /grant:r "BUILTIN\Administrators:(OI)(CI)(RX)" "BUILTIN\\Administrators:(RX)" /t /c /q modify_admin_params = ["icacls", location, "/grant:r", "BUILTIN\\Administrators:(OI)(CI)(RX)", "BUILTIN\\Administrators:(RX)", "/t", "/c", "/q"] call(modify_admin_params, startupinfo=self.startupinfo) # Then remove all inherited permissions so that only SYSTEM has Write access - # icacls /inheritancelevel:d /t /c /q + # icacls /inheritancelevel:r /t /c /q inheritance_params = ["icacls", location, "/inheritancelevel:r", "/t", "/c", "/q"] call(inheritance_params, startupinfo=self.startupinfo) From c55d7710febe61be265c64261a0de518f770f3e9 Mon Sep 17 00:00:00 2001 From: Hardy-Cooper Date: Mon, 15 Mar 2021 13:34:19 -0400 Subject: [PATCH 3/5] Adding switch option --- cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py index 7e497846ee..16e35f0c24 100644 --- a/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py +++ b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py @@ -12,6 +12,10 @@ class Permissions(Auxiliary): to prevent malware from messing with analysis """ def start(self): + if "permissions" in self.options: + if not int(self.options["permissions"]): + return + locations = ["C:\\Python27", self.analyzer.path, "C:\\WindowsAzure"] log.debug("Adjusting permissions for %s", locations) for location in locations: From 84a833389f9296825b1fed64393894da88710e7e Mon Sep 17 00:00:00 2001 From: cccs-kevin <59843993+cccs-kevin@users.noreply.github.com> Date: Tue, 22 Mar 2022 11:07:03 -0400 Subject: [PATCH 4/5] Adding 30 seconds worth of timeouts to aux setup --- cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py index 16e35f0c24..2df79cca54 100644 --- a/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py +++ b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py @@ -23,12 +23,12 @@ def start(self): # First add a non-inherited permission for Admin Read+Execute # icacls /grant:r "BUILTIN\Administrators:(OI)(CI)(RX)" "BUILTIN\\Administrators:(RX)" /t /c /q modify_admin_params = ["icacls", location, "/grant:r", "BUILTIN\\Administrators:(OI)(CI)(RX)", "BUILTIN\\Administrators:(RX)", "/t", "/c", "/q"] - call(modify_admin_params, startupinfo=self.startupinfo) + call(modify_admin_params, startupinfo=self.startupinfo, timeout=15) # Then remove all inherited permissions so that only SYSTEM has Write access # icacls /inheritancelevel:r /t /c /q inheritance_params = ["icacls", location, "/inheritancelevel:r", "/t", "/c", "/q"] - call(inheritance_params, startupinfo=self.startupinfo) + call(inheritance_params, startupinfo=self.startupinfo, timeout=15) def __init__(self, options={}, analyzer=None): Auxiliary.__init__(self, options, analyzer) From 1ec61faaf1083e4d675490dfa5d6f3c1ff6725ea Mon Sep 17 00:00:00 2001 From: cccs-kevin <59843993+cccs-kevin@users.noreply.github.com> Date: Tue, 22 Mar 2022 11:38:03 -0400 Subject: [PATCH 5/5] Fixing usage of timeouts --- .../windows/modules/auxiliary/permissions.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py index 2df79cca54..79ca55bec4 100644 --- a/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py +++ b/cuckoo/data/analyzer/windows/modules/auxiliary/permissions.py @@ -1,5 +1,6 @@ import logging from subprocess import call, STARTUPINFO, STARTF_USESHOWWINDOW +from threading import Thread from lib.common.abstracts import Auxiliary @@ -23,12 +24,20 @@ def start(self): # First add a non-inherited permission for Admin Read+Execute # icacls /grant:r "BUILTIN\Administrators:(OI)(CI)(RX)" "BUILTIN\\Administrators:(RX)" /t /c /q modify_admin_params = ["icacls", location, "/grant:r", "BUILTIN\\Administrators:(OI)(CI)(RX)", "BUILTIN\\Administrators:(RX)", "/t", "/c", "/q"] - call(modify_admin_params, startupinfo=self.startupinfo, timeout=15) + t1 = Thread(target=call, args=(modify_admin_params,), kwargs={"startupinfo": self.startupinfo}) + t1.start() + t1.join(timeout=15) + if t1.is_alive(): + log.warning("'Modify admin' call was unable to complete in 15 seconds") # Then remove all inherited permissions so that only SYSTEM has Write access # icacls /inheritancelevel:r /t /c /q inheritance_params = ["icacls", location, "/inheritancelevel:r", "/t", "/c", "/q"] - call(inheritance_params, startupinfo=self.startupinfo, timeout=15) + t2 = Thread(target=call, args=(,), kwargs={"pinfo}) + t2.start() + t2.join(timeout=15) + if t2.is_alive(): + log.warning("'Inheritance' call was unable to complete in 15 seconds") def __init__(self, options={}, analyzer=None): Auxiliary.__init__(self, options, analyzer)