1.5 KiB
1.5 KiB
Some notes to Escape from Babylon
Well known paths (Windows)
- Python official install path for current user
%APPDATA\Local\Programs\Python\PythonXX - NPM global current user path:
%APPDATA%\Roaming\npm\node_modules\npm\bin - Go bin folder:
C:\Users\YourUsername\go\bin\go.exe - Rust:
C:\Users\YourUsername\.cargo\bin\rustc.exe - Haskel:
C:\Users\YourUsername\AppData\Roaming\local\bin\ghc.exe - FireFox:
C:\Users\<username>\AppData\Local\Mozilla Firefox\firefox.exe - Chrome:
C:\Users\<username>\AppData\Local\Google\Chrome\Application\chrome.exe
Ultimate Packer for Executables (UPX)
- https://www.ired.team/offensive-security/defense-evasion/t1045-software-packing-upx
- https://medium.com/@ankyrockstar26/unpacking-a-upx-malware-dca2cdd1a8de
- https://www.mosse-security.com/2020/09/29/upx-malware-evasion-technique.html?ref=nishtahir.com
- https://www.esecurityplanet.com/threats/upx-compression-detection-evasion/
Persistence and hiding
- Search for existing well known binary paths
- Copy argv[0] to well known binary path
- Register startup by system
- schtasks (cmd) for system or local user
- go-autostart: shortcut in start-menu
- Write state file of persistence to somewhere...
Windows
- Copy to well known current user binary path to semi related filenames
- Run via start menu item for current user, or via
schtasks