Malicious word document shellcode extraction

Question

I am playing with some malicious MS Word documents which exploit a vulnerability in Word 2k3/2k7 to launch the shellcode. I am able to run it dynamically and get the drop-bys. However, I am interested in extracting the shellcode statically. I have tried to use Malscanner and some custom scripts for OLE to identify the start of the shellcode, so far no luck. Eventually I wanna do an ancient EB FE patching for easy debugging in Word.

Does anyone have experience playing with malicious docs? Or have a better way of debugging Word?

Answer 1

Carving out the shellcode statically can be a little tricky in the Windows Compound Binary File Format. The first question to store is how is the shellcode stored? Is it binary or hex ascii? The second question to ask is where is it stored? Microsoft documents support many many different formats. The shellcode could be stored in an OLE structure or could be possible found using a hex editor. I'd recommend the hex editor route first. You might get lucky and find a large amount of NOPs. You can use dism-this.py to quickly view if some bytes are valid shellcode or not. Note, download the source from the repo. Disclaimer I wrote the script.

The best way I have found to find where the shellcode is stored is to backtrace through a debugger. First figure out where the shellcode is executed in memory, then figure out where the shellcode is called from, then figure out how the shellcode is loaded into memory and then figure out where that is stored in the file. It's not always the easiest task but it's kind of fun.

Answer 2

This might not be the best way to do this. But as Malicious files don't use the format the way it was indented (as-in they exploit a field) I never use interpret programs for this kind of work.

I would suggest, looking up the format and loading it in 010 Editor (or any other hexeditor). This one supports templates that you can use to determine what they overflowed/exploited.

Answer 3

Given that you can get the exploit code to run dynamically, I'd recommend using an API logger (like http://www.rohitab.com/apimonitor) on the Word process to see what API calls are made by the shellcode. You can then restart Word with a debugger attached, set breakpoints on those API calls that you saw made by the shellcode, and wait until those breakpoints are hit via the shellcode. You'll now have the process suspended in the middle of the shellcode execution and can "look backwards" to find the beginning of the shellcode.

Note that this approach is useful even when the malicious document uses ROP instead of actual shellcode, in which case your debugger would break in the middle of the ROP chain instead of in the middle of the shellcode itself. Either way it would help you find the malicious content in the target file.