WinDBG Hung on Shellcode Execution

Question

I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = register } and saved the address in the pseudo register $t0. Later I copied the shellcode with eb @$t0 FC 48 83 E4...[REDACTED]. Then changed the rip value to point to the start address of the shellcode buffer by doing r @$ip=@$t0 and then simply resumed the program execution with g.

The problem is the shellcode gets hung up on the wininet!HttpSendRequestA API call everytime.

The stack trace after manually breaking from the execution:

00 000000e0f0efea28 00007ffc24811e93 ntdll!NtWaitForSingleObject+0x14
01 000000e0f0efea30 00007ffc11ba4f64 KERNELBASE!WaitForSingleObjectEx+0x93
02 000000e0f0efead0 00007ffc11b9fba7 wininet!CPendingSyncCall::HandlePendingSync_AppHangIsAppBugForCallingWinInetSyncOnUIThread+0xe0
03 000000e0f0efeb00 00007ffc11b47af6 wininet!INTERNET_HANDLE_OBJECT::HandlePendingSync+0x33
04 000000e0f0efeb30 00007ffc11b023a5 wininet!HttpWrapSendRequest+0x9a256
05 000000e0f0efecd0 00007ffc11b02318 wininet!InternalHttpSendRequestA+0x5d
06 000000e0f0efed40 000002a7d873018c wininet!HttpSendRequestA+0x58
07 000000e0f0efede0 000002a7d87301f9 0x000002a7d873018c
08 000000e0f0efede8 000002a7d873000a 0x000002a7d87301f9
09 000000e0f0efedf0 0000000000cc000c 0x000002a7d873000a

NOTE: The weird part is the shellcode actually works as it supposed to whenever I debug it in the windbg plugin in IDA PRO 7.5 (I do everything exactly the same in the plugin console as I did in the windbg binary console).

As for the shellcode it's a simple off-the-shelf cobaltstrike http beacon (The same error occurs with any type of reverse shell shellcodes).

It traverses InMemoryOrderModuleList structure from PEB, resolves the api names from hashes and simply executes them in order.

I've never debugged a cobaltstrike beacon directly in windbg before.

NOTE: I don't get any hangs or errors when I try to debug a simple x64 calculator shellcode the same way

Answer 1

can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ?

if that is the case then it means you allocate memory etc just after windbg/cdb broke on System Breakpoint

if you are doing .dvalloc when you are on System Breakpoint then HttpRequestA might cause the block

go to the entrypoint of your dummy using say g @$exentry and then execute the shellcode

use dp @rsp to find the return address and set a breakpoint on the return with bp poi(@rsp) before you hit g on HttpSendRequestA

it should break properly and not hang

0:000> ? poi(@rsp)
Evaluate expression: 140696425381209 = 00007ff6`7074bd59
0:000> bp poi(@rsp)
0:000> bl
 0 e 00007ff6`7074bcb4     0001 (0001)  0:**** cdb+0xbcb4
 1 e 00007ff6`7074bd59     0001 (0001)  0:**** cdb+0xbd59
0:000> r rcx,rdx,r8,r9
rcx=0000000000cc000c rdx=00007ff67074bdc6 r8=ffffffffffffffff r9=0000000000000000
0:000> da @rdx
00007ff6`7074bdc6  "User-Agent: Mozilla/4.0 (compati"
00007ff6`7074bde6  "ble; MSIE 8.0; Windows NT 5.1; T"
00007ff6`7074be06  "rident/4.0; GTB7.4; InfoPath.2)."
00007ff6`7074be26  "."
0:000> g
ModLoad: 00007ffa`96760000 00007ffa`96776000   C:\Windows\SYSTEM32\dhcpcsvc6.DLL
ModLoad: 00007ffa`96c20000 00007ffa`96c3c000   C:\Windows\SYSTEM32\dhcpcsvc.DLL
ModLoad: 00007ffa`939a0000 00007ffa`93b76000   C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 00007ffa`9c800000 00007ffa`9c80c000   C:\Windows\SYSTEM32\CRYPTBASE.DLL
Breakpoint 1 hit
cdb+0xbd59:
00007ff6`7074bd59 85c0            test    eax,eax
0:000> u .
cdb+0xbd59:
00007ff6`7074bd59 85c0            test    eax,eax
00007ff6`7074bd5b 0f859d010000    jne     cdb+0xbefe (00007ff6`7074befe)
00007ff6`7074bd61 48ffcf          dec     rdi
00007ff6`7074bd64 0f848c010000    je      cdb+0xbef6 (00007ff6`7074bef6)
00007ff6`7074bd6a ebd3            jmp     cdb+0xbd3f (00007ff6`7074bd3f)
00007ff6`7074bd6c e9e4010000      jmp     cdb+0xbf55 (00007ff6`7074bf55)
00007ff6`7074bd71 e8a2ffffff      call    cdb+0xbd18 (00007ff6`7074bd18)
00007ff6`7074bd76 2f              ???
0:000>

btw no need for .dvalloc when you are in user code simply use .readmem

0:000> .readmem cobabyte.bin . l?377

Reading 377 bytes.

0:000> u .
cdb+0xbbf0:
00007ff6`7074bbf0 fc              cld
00007ff6`7074bbf1 4883e4f0        and     rsp,0FFFFFFFFFFFFFFF0h
00007ff6`7074bbf5 e8c8000000      call    cdb+0xbcc2 (00007ff6`7074bcc2)
00007ff6`7074bbfa 4151            push    r9
00007ff6`7074bbfc 4150            push    r8
00007ff6`7074bbfe 52              push    rdx
00007ff6`7074bbff 51              push    rcx
00007ff6`7074bc00 56              push    rsi
0:000> u