Covenant Task 101 - PPID Spoof Example

Covenant is a great C2 tool for red teaming. I use it on most engagements as its in C# and easily extensible. This post was inspired by Rasta Mouse's Covenant 101 where he nicely described how to modify Covenant source to add a task. The purpose of this post is to leverage Rasta's post to further simplify the process especially for those new to Covenant.

Ryan Cobbr, the main author of Covenant has already done a great job by adding a "Tasks" menu where an admin user can lists all tasks and modify their configurations. I will be be showing how I leveraged this in a recent engagement to bypass certain EDRs and AV behavioural signatures.

Story Time

Once upon a time, I was contracted to do a red teaming engagement for one of the World's leading pharmaceutical firms. Fast forward to when I crafted and had sent a neat phishing mail (embedded with a link to a malicious Word doc). Within 10 mins, about 9 users had clicked, and I had 9 grunts, however, the grunts were running as Word doc processes.

I knew they had a spectacular EDR that logged everything and alerted on anything that was an anomaly. So issuing commands like "shellcmd whoami" or "powershell whoami" will definitely get me caught as these commands executes by spawning the command prompt from the WINWORD process which will definitely trigger. There were two options that came to mind (there might be better ones):

  1. Injection into another process
  2. Spoof the parent process Id (PPID) of any spawned command prompt.
I couldn't do (1) as I know that EDR enforces Attack Surface Rules (ASR) and doesn't allow injection from Office applications to other processes. However, in my lab testing with same EDR, it allows injection from Word to Excel and some other office applications, but doing that doesn't improve my situation.

Covenant by default doesn't not have any existing task that could enable me do (2). I already had a working code (C sharp file) that could do Parent PID spoofing, all I needed to do was modify to be compatible with Covenant. I used Visual Studio (cos of its great features). I always try to make all code fit into one .cs file.

Like Rasta's points out and also looking at existing tasks' configuration, you would notice that a Task need to have a Task class, an Execute method which should always return a String. Lets take ListDirectory task as an example.


For our PPID spoofing, I decided I need two parameters, (1) the ID to spoof, (2) the command to run. Click on "+ Create" at the bottom to start the task creation process.


As long as my task did not depend on external libraries, I lazily select all ReferenceAssemblies, I don't actually need all, just wanted to be quick with it. These defined parameters need to be embedded into the code as shown below, then the Program class and Main method modified to Task and Execute respectively. The parameter names defined graphically should also be same within the Execute method.


Modify other return values within UnmanagedExecute Class (CreateProcess method) to ensure they are String values.

The final code (ppid.cs) along with other tasks in yaml format is here, you just can just paste (or import the yaml) this within your task code. Make sure you click on "Edit" to save.

This is an example showing powershell execution for ipconfig under another powershell process.





There are certain tasks you might want to add that depend on external libraries. I haven't personally tried it, but I guess you can add them under "Embedded Resources" just like it was done for SafetyKatz task. There is also an article here that talks about it using SharpHound as example.

I hope this is helpful to someone.

References:




Comments

  1. simfront19 November 2020 at 18:02

    Awesome blog very impressive idea on this topic, Looking forward for more update soon. NFFI

    ReplyDelete

Post a Comment

Popular posts from this blog

Pentesting Android applications

Image
Hi all, I would like to talk about the coolness of android applications. So if you want to perform a security review an android app, how will you go about it? There are so many ways to go about this, i will highlight some of the ways I use. 1) Most android applications work just like Web applications, they send out HTTP requests using POST and GET methods. So a cool thing to do is to intercept and capture these requests, make modifications and monitor responses (which can also be intercepted and modified). So how can this be done? A sweet way to achieve this is by proxying all traffic from the application on your phone through a proxy tool such as Burp Suite (coolest tool for me). Now how can you direct that phone traffic to your Burp Suite which is probably running on a laptop or system? Well, you can use a great android tool called "Proxy Droid" to direct the traffic to the IP address and port on which the burp suite is listening. You can connect them to the same wire...
Read more

Global Cyberlympics Finals 2015 Write-up - Tracker.7z

Image
Hi all , It has been a while since I updated this blog. Just want to share one of the challenges my team solved at the Cyberlympics finals held in Washington DC, USA. Tools used : wireshark, chaosreader, vncviewer, tightVNC, online QR code scanner. We were given a zipped pcap file - tracker.7z and asked to analyse it as it contains some information about a meeting location for a suspect in the whole storyline. We were to get the location of the meeting. Well, we loaded the pcap into wireshark to have a first look at it. Screenshot below: From the screenshot above, one can notice the VNC protocol being used during the capture, probably the suspect communicated with a remote person via VNC. So we need to reassemble the VNC session and see if that gives us any valuable information. A tool of choice, or probably the only tool I know that can do this is Chaosreader  by Brendan G. Gregg.   An index.html file is generated after run with chaosreader. Th...
Read more

Red Teaming with Covenant and Donut

Image
Red Teaming has rapidly transitioned from Living off the Land (LotL) to Bringing Your Own Land (BYOL). It is now possible to execute .NET assemblies entirely within memory. By developing custom C#-based assemblies, attackers no longer need to rely on the tools present on the target system; they can instead write and deliver their own tools, a technique called Bring Your Own Land (BYOL).  This has led to transitions from PowerShell tools (e.g. PowerShell Empire) to frameworks targeted for .NET assemblies. {shamelessly copied from  https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html } About Covenant Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. Covenant is an ASP.NET Core, cross-platform application that includes a web-based ...
Read more