{"id":7053,"date":"2020-03-29T00:38:56","date_gmt":"2020-03-29T00:38:56","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=7053"},"modified":"2020-03-29T00:38:58","modified_gmt":"2020-03-29T00:38:58","slug":"hiding-process-creation-and-cmd-line-with-a-long-com","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/03\/29\/hiding-process-creation-and-cmd-line-with-a-long-com\/","title":{"rendered":"Hiding process creation and cmd line with a long com&#8230;"},"content":{"rendered":"\n<p>How long is the command line buffer?<\/p>\n\n\n\n<p>Depends on a program&#8230;<\/p>\n\n\n\n<p>How much of command line do Sysmon, 4688 events log?<\/p>\n\n\n\n<p>A finite amount.<\/p>\n\n\n\n<p>&#8216;Depends&#8217; minus &#8216;finite&#8217; == opportunity.<\/p>\n\n\n\n<p>Re-visiting my old <a href=\"https:\/\/www.hexacorn.com\/blog\/2018\/06\/29\/sysmon-doing-lines-part-3\/\">Sysmon demo <\/a>where I&#8217;ve shown how to hide long command lines I thought that it would be interesting to check a different idea:<\/p>\n\n\n\n<ul><li>Write a program A that launches program B<\/li><li>Program A passes a very long command line to program B<\/li><li>Program B retrieves the command line and prints out last 5 characters only<\/li><\/ul>\n\n\n\n<p>The idea was to check if we can use the end of that long buffer as a covert channel for two processes to exchange some data (lame IPC)&#8230;<\/p>\n\n\n\n<p>After testing it with 4688 and Sysmon enabled I spotted two things:<\/p>\n\n\n\n<ul><li>4688 completely missed the process B creation<\/li><li>Sysmon log truncated the last bits of the command line (these 5 characters!!!) with ellipsis.<\/li><\/ul>\n\n\n\n<p>The pic below shows how 4688 log looks like:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_1.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_1.png\" alt=\"\" class=\"wp-image-7054\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_1.png 592w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_1-300x80.png 300w\" sizes=\"(max-width: 592px) 100vw, 592px\" \/><\/a><\/figure><\/div>\n\n\n\n<ul><li>We can see the invocation of the program A (first event 4688), followed by conhost.exe and then Program B is not logged at all. <\/li><li>Then we see program termination &#8211; Program A, Program B, and conhost.exe.<\/li><\/ul>\n\n\n\n<p>Sysmon logged a long command line, but the last bits are truncated and replaced by the ellipsis:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_2.png\"><img decoding=\"async\" loading=\"lazy\" width=\"340\" height=\"180\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_2.png\" alt=\"\" class=\"wp-image-7055\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_2.png 340w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_2-300x159.png 300w\" sizes=\"(max-width: 340px) 100vw, 340px\" \/><\/a><\/figure><\/div>\n\n\n\n<p>This is the invocation of ProgramB that I used (via CreateProcess):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code> buffer dw 'p','r','o','g','r','a','m','B',' '\n dw 32698 dup(0FABEh)\n dw 'h','e','l','l','o'\n dw 0<\/code><\/pre>\n\n\n\n<p>and this is what ProgramB shows:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_3.png\"><img decoding=\"async\" loading=\"lazy\" width=\"119\" height=\"128\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/03\/event_log_3.png\" alt=\"\" class=\"wp-image-7057\"\/><\/a><\/figure><\/div>\n","protected":false},"excerpt":{"rendered":"<p>How long is the command line buffer? Depends on a program&#8230; How much of command line do Sysmon, 4688 events log? A finite amount. &#8216;Depends&#8217; minus &#8216;finite&#8217; == opportunity. Re-visiting my old Sysmon demo where I&#8217;ve shown how to hide &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/03\/29\/hiding-process-creation-and-cmd-line-with-a-long-com\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,15,52],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7053"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7053"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7053\/revisions"}],"predecessor-version":[{"id":7058,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7053\/revisions\/7058"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}