recon 2017 Brussels

### Overview In this presentation at Recon 2017 Brussels, the speaker examines techniques for evolving Windows shellcode beyond the standard Metasploit hash API originally authored by Stephen Fewer. While the 4-byte hash API has been widely used to resolve Windows APIs dynamically by parsing the export address table (EAT), modern defensive mitigations like Microsoft's Enhanced Mitigation Experience Toolkit (EMET)—specifically Export Address Filtering (EAF/EAF+) and Caller checks—readily detect and block these export table walks and indirect jumps. The speaker introduces an automated tool and approach called Fido, which converts standard Metasploit payloads into position-independent shellcode that resolves APIs through Import Address Table (IAT) parsing and offset tables, reliably bypassing EMET mitigations.

### Key Topics - **Mechanisms and Weaknesses of the Hash API**: How the 2009 Stephen Fewer hash API works by walking the EAT and jumping into Windows APIs, and why defenses such as EMET EAF/Caller and DARPA-funded tools like HAVOC (which injects colliding DLLs) disrupt it. - **Evolution of IAT Parsing in Shellcode**: Prior work and inspiration from SkyLined, Piotr Bania, Jared DeMott, and Matt Miller (skape), leading to custom IAT parsing stubs incorporated into the Backdoor Factory (BDF). - **Collaboration and Extension**: Collaboration with Casey Smith to locate DLLs in loaded module lists using 4-byte hashes, identifying that having `GetProcAddress` alone allows retrieving `LoadLibraryA` via `kernel32`. - **Fido Architecture and API Mangling**: Automating the rewriting of Metasploit x86 payloads via Capstone disassembly, stripping the traditional hash API stub, building a deduplicated string table with an offset lookup table, and mangling hash values to defeat static antivirus signatures. - **Windows 7–10 API Sets**: Leveraging `api-ms-win-core-*` DLLs (specifically `api-ms-win-core-libraryloader`) present in the import tables of core system libraries like `kernel32.dll` to find `GetProcAddress` across processes.

### Technical Details Rather than manually rewriting dozens of Metasploit payloads or emulating complex conditional logic, the speaker built Fido to transform payload binaries automatically. Fido disassembles x86 shellcode with Capstone, captures the invoked API hashes, constructs a unique string table containing the required DLL and function names, and prepends an IAT lookup stub alongside an offset table. The offset table uses structured 4-byte hashes mapped to relative byte offsets referencing ASCII/ANSI function strings.

During execution, the shellcode jumps over the lookup table, loops through to find the matching hash, retrieves the target function address using `GetProcAddress` and `LoadLibraryA`, and invokes the API via a call instruction instead of a direct jump (bypassing EMET Caller checks). Furthermore, because the hashes are only referenced against the internal lookup table, Fido can "mangle" them arbitrarily, defeating antivirus solutions (such as Windows Defender) that rely on static signatures of Fewer's original hashes. The speaker demonstrates this in a Tor Browser exploit scenario on Windows 7, where querying `kernel32.dll`'s import table for `api-ms-win-core-libraryloader` successfully bypasses EAF and Caller mitigations.

### Takeaways - Bypassing EMET's EAF and Caller protections has been viable since Windows 7 by targeting `GetProcAddress` in the IAT of `kernel32.dll` or related API set DLLs. - Hash mangling renders static hash-based AV detection ineffective without requiring full payload recoding. - Fully supporting these stubs across Metasploit requires tooling updates to handle staged payloads (e.g., Meterpreter stages) that still pull down Stephen Fewer's default hash API stub. - Future work noted includes porting the approach to x86_64 architecture and assessing the impact of Control Flow Guard (CFG) and Return Flow Guard (RFG).