Full transcript
0:00A new botn net emerges from the shadows. Nightshade C2. Now, this is an article and write up from Eentire shared just last month in September. And I'll leave a link, of course, to this in the video description if you're interested. This is a threat report from some of the hacker activity and tradecraft that they have been seeing. And I'm not going to
0:21go through this entire article, but I will pick out kind of some of the interesting parts and pieces that I want to highlight and play with. Looks like the initial infection started with ClickFix, of course, and they're also seeing some backdoored or Trojanized versions of other software like Advanced IP Scanner, ExpressVPN, Hypers SecureVPN, CE Cleaner, and a lot of
0:43other stuff. But when they get to the actual malware, the payload here, it's a little neat. Or at least there's one cutesy and clever trick that I did want to harp on. In a lot of other videos, when I showcase some tricks or some tradecraftraft that requires admin privileges, usually the YouTube comment section is a little poo poo whiny. It's
1:02like, "Oh, well, how's the mauer going to get admin privileges?" Of course, if you were admin, you could do whatever you want. Which is all true, but I think it is easier than you realize to become an administrator or elevate privileges, especially in the Windows world, because sometimes you may as well just ask. And what's to stop you from asking over and
1:22over and over and over again? Every time the user were to say, "No, I won't run this program or run this application with administrator privileges in the UAC or user account control little banner popup question dialogue." If you just keep popping up that UAC prompt over and over and over again until they click yes
1:44because they can't do anything else. They're locked up in their computer. They can't use it. Then we know what payload will fire as admin. So eent entire saw the activity where the payload or the command that was trying to be ran and executed by this malware sample wanted to set an exclusion in your antivirus Windows Defender to
2:03finally execute and invoke the last payload. So the malware would check if the exit code of the PowerShell process prompting the user account control question will you let this run as admin? If the exit code is zero indicating success, then the next stage or night shade C2 is delivered. Sometimes they've seen this using Llama Stealer, another
2:24info stealer malware. But if it were to return any exit code other than zero, like the user clicked no, then it keeps looping over and over and over again, forcing the user to approve the UAC prompt or they just can't use their computer. So, they called this UAC prompt bombing. You hear that, YouTube?
2:46They called it that, not me. I'm just trying to use industry terms here. Please don't like take down this video or my channel. So, I started to wonder and got a little curious. How could we create our own little UAC prompt bombing trick? Could we recreate this? And what if we had a couple constraints here? Maybe we did this all entirely in
3:08PowerShell, so it's easy. You could pull it down. and you could run the payload and you could obuscate the heck out of it if you wanted to. And could it be tiny, teeny weeny? Can it fit all in one line? So that's what we're doing in today's video. We will make our own bomb. So I am inside of my Windows 11
3:25virtual machine and I will open up a Windows terminal which will default to PowerShell in my setup and we can start playing around with this idea. We know that this is all kind of toggled by the exit code or like the last error code of some process that tries to run. Like if we were running a payload and we were
3:44checking whether or not it actually executed, did it run? Well, you could actually see that with the dollar sign to denote a variable and the question mark symbol within PowerShell. That lets you see the last status or exit code of a PowerShell commandlet that ran. And let's say we wanted to start a process.
4:04Let's start with simple cmd.exe. We can do that easily enough in PowerShell. But this will be running with regular user low privilege permissions. Right? So we want to run that with admin privileges. We could use a verb as another argument to our commandlet here with run as and that will prompt for the user account control
4:26permissions. If I say yes, that will go ahead and open the administrator prompt. You can see that in the title bar. And I could run who am I/priv. If I could type to see all the privileges that we have. We are in fact admin. Obviously, that differs from me trying to run that here in this low privilege shell. Right? But if I were to
4:47run the cmd.exe and verb here, but click no, this will error. Of course, now changing our dollar sign question mark exit and error code to the value false. That did not succeed. But let me try it again. Run as with the user account control prompt. Administrator prompt
5:08fires. And of course that is true. So that's the condition that we need to meet. But we want to invert that because every time there's an error or when they click no, we want to prompt the exact same thing again or execute the same command. Now, you probably noticed they used a while loop in their code. And
5:31there are a couple other things that we could do to try and get us in the perfect state to start the loop to invoke and pop up all these UAC prompts. Even when if we were to start a shell or anytime we try to run it, you might have already noticed, okay, by default that dollar sign question mark is going to
5:51return true. So we need to get it in the state of it being false first. So we could keep looping and start that bomb. I hate saying that. Funny thing though, this dollar sign question mark is a like readonly variable. You can't really change this. Let me show you. This is actually kind of funny. If I were to set
6:12this to false, then it will not be happy and actually like stop and kill and break PowerShell. [laughter] Close the terminal with control D or press enter. So that that's that if that's helpful for you ever for whatever reason. So, we can't as easily use that as the condition inside of our while
6:34loop to run our payload, at least not toggling it beforehand with that being set to false. Right? So, we got to think up some smart ways to intentionally cause an error or have a command lit fail. But before we do, I do want to talk a little bit about some of this. If you're in the security operations center
6:53or you're doing detection engineering work to see and stop this hacker activity, let me tell you about the sponsor of today's video, Panther. Panther is an intelligent security operation center platform that unifies security information and event management and AI automation to deliver realtime detection and response at an [music] enterprise scale. Panther's not
7:15some legacy seam solution. It's security for the modern age running directly on your Snowflake or datab bricks data lake. So there's unlimited scale, no ingestion lockin and fast performance on your own infrastructure. And you've got an always sock analyst with Panther AI agents. It triages and investigates
7:36alerts in real time, correlating data across identities and services and bubbling up just what's relevant. Each and every AI decision comes with the reasoning why an alert was escalated, which detection rules fired, and the [music] full context, so there's no black box. Your sock analysts always have complete control. Panther is a big
7:58believer in detection as code. Detection engineering is coddriven, even with rules in simple Python, so your teams can write, test, and tune detectors. And an AI assistant helps draft and improve rules so you can speed up coverage and cut down on engineering overhead. With Panther, you shift from reactive alert
8:19triage to autonomous security operations. Panther AI helps handle the tedious repetitive investigation loops so your team can focus on the bigger incidents and higher value analysis. And they've proved it. Companies like Sneak reduced alert volume by 70% and Docker cut false positives by 85% after moving
8:41to Panther. So check out Panther. It's not just another dashboard. It's an AIdriven autonomous and [music] engineer first sock platform and solution so your team can get away from the manual toilet and focus on the incidents that matter. You can see it in action and try it for yourself with my link below in the video description. jh.live live/panther.
9:04Huge thanks to Panther for sponsoring this video. All right, let's get back to it. Playing with PowerShell, building our UAC prompt bombing technique. [laughter] We need to intentionally cause an error. Now, if you're coming from some programming background, you're probably already familiar with a lot of exception handling. Like, if you were to use a try and catch statement or try and
9:24accept and finally, whatever other keywords are associated with that depending on the language. But we could throw an error, right? Throw is a keyword and command that works well with us within PowerShell and that will intentionally cause an error. But there is a little bit of a gimmick with that one. Throw will raise a terminating error. That means the script will just
9:45straight up exit unless it's handled by an exception handler. So we could use like our try and our catch blocks and do whatever if we wanted to do that. We could enforce following and jumping down to the catch command here. And that way this block ensures it fires. And actually that might be the best move because then we could always take a look
10:08at what our dollar sign question mark return exit status is and that will be false every single time even from a new window. Let me copy and paste this and we could see that in action. That way, this command, no matter what, while it would by default, as you've seen, start with the dollar sign question mark as a
10:29true value, this will return false no matter what. And we are falling in to our catch block here. Now, we could basically use that as the place to put our while loop. And we could reliably use the condition of the dollar sign question mark exit code. But remember the while condition will be executing
10:50while it is true. But we are intentionally zooming in on the fact that we need this to be not true like it failed. They clicked no on the UAC prompt. So we actually want to invert this as we were alluding to earlier while not succeeding. Then we can start a process like cmd.exe. And I think
11:12we're going to get a little bit hectic here. Maybe we do this in like PowerShell is or a bit of an editor so you could properly see the syntax. So inside of I will just paste this. And I think for the moment like for us building this out and trying to make sense of it, we can make this verbose.
11:31But ultimately we do kind of want this inside of its own single line like minified because then we could do whatever damage we want with it, right? And we could obuscate it, replace with a boatload of like environment variables, format strings, anything. But if I run this, notice that popped up our command prompt and ended. It finished executing
11:50and is no longer in that while loop. Right now, start process cmd.exe is still just using the low privileges that we started with. But if we add that verb run as F5 to run this script. Now we have our UAC prompt. If I click no though, we get an error which doesn't make sense. I thought we were in this
12:11loop, right? while not not succeeding that question mark should still be false after we clicked no but there's another gimmick here this catch statement has evaluated properly and because that whole block is going to be continuing onward even in the loop this won't continue it won't keep prompting our UAC
12:32prompt so maybe we start to get clever and say all right let's just do this in like another try catch block right but then We're duplicating the payload that we would run and it's not super pretty. And if we were to do that, then we'd only be running that a second time, but not over and over and over again. If we
12:54were to use even another while loop inside here, as stupid and as dumb as this looks, we're going to run into the exact same problem. If I click no, if I click no again, we error because the catch block sees it. it succeeded and will no longer follow through with that condition nor while loop. So we got
13:15another wall to run up against. So maybe we rearrange this a little bit rather than having this catch block and the try block kind of outside of our while loop. I know that was already nested in the original big try catch loop. What if we had a try catch inside of our while
13:35loop? We know that this will error and then it will catch again. Let's build that out. Let's have a try statement here. Let's have that close and then another catch statement down below. And just to sanity check, let's review our dollar sign question mark. Let's try and run this. UAC prompt pops up. I click no. And it says that it's false, but
13:56it's no longer continuing the while loop. Again, this is exactly because the catch block succeeded. The echo statement here successfully executed which means the catch block successfully executed which means the while loop does not continue because the question mark is now not the value true which is false. It exits cleanly. Let's try to
14:18execute the program. If they were to click no in the UAC prompt then we will catch that and then I mean like a throw command loop again. trying this, I think we're going to have the exact same issue because then that is a terminating like fatal error. So, we need a little bit of a softer error. Now, we could do a
14:40couple of these and I'll get back into my terminal. What we could try to do is experiment. If we were to get some location or some item that like obviously doesn't exist, that throws an error. So, let's try that one. Can we get item on something that we know just isn't going to exist? nonsense garbage. Opportunity for more obfuscation if I
15:02run this. No, no, no, no. All right, we've got a little bit of a of a UAC promp bomb here going on, right? That will fire eventually once you click yes. And there is our administrator. We could do the very same with some other like write error, something that isn't throw but will
15:22still intentionally cause an error. Like if we had write error with nothing. You can see though there is a lot of output of this thing going wrong. So what we should do whether we use get item for something that doesn't exist and then you kind of have to just trust that it doesn't exist if you know whatever case
15:38that might be we could use write error with nothing and that could be a little bit more soft and we could supply an error action so it won't even display all of that noise and nonsense down below in our terminal. Let me show you that. Let me get to the very bottom of this. Once I click run, F5. No, no,
16:00it's working. We We've got our UAZ prompt. [laughter] Take a look. Payload fired and no extra output. No other noise or bloody errors here. So, what's now to stop us with our functioning and working UAC prompt bomb? [gasps] We could kind of minify this and make it all one little line. That way we
16:22just copy and paste this little thing no matter what or where we are running in PowerShell context. It works. There's our UAC prompt to fire off whatever payload we might like. And now that we have that all on one line, well, we certainly could just like base 64 encode that so that we'll have like a
16:44readily armed quick little oneliner from no matter where we execute this, whether it's command prompt, whether it's the run dialogue box or anything, it should still fire off. Uh, forgive me for using Cybershift for just like regular B 64 encoding. Like, uh, I know that's super easy on the Linux command line, but I always forget the syntax because it's so
17:05like long and verbose uh, in the Windows and PowerShell world. And then getting the right like UTF-16 little Indian crap I always get wrong. But now we've got a payload that is all bundled up, tucked and hidden into a little base 64 string. So I could anywhere run PowerShell E. honestly doesn't even need the whole
17:25ENC thing. And if you wanted to make it all non-interactive or hidden window tag no profile, you could make it spooky wookie. You've got a UAC bomb [laughter] and it's always requiring you to click yes to execute some payload as admin. Now, uh I know the next quibble and
17:48whine about this point is that like, well, that still looks kind of sketch because it's going to the end user. Even if we were to play with a different payload, like obviously it's one thing to oh have uh cmd.exe pop up wanting to make changes to your device. Granted, it's a Microsoft Windows publisher. Say we use the
18:08calculator as just a proof of concept. I mean, that's stupid. who whoever's going to run the calculator as administrator. So, could we make this look even more convincing or have some of the social engineering lure to this and still run any arbitrary payload? Now, that is where I of course always bring us to our Lolass resource living off the land
18:30binary scripts and libraries project GitHub. Uh, look, could we track down something that could execute another payload, whether it's some other file on disk, whether it's some command that we could easily include as part of the arguments, whether it's something that could be hosted remotely. So, there's no sketchy concerns of uh-oh, they maybe
18:52see it and wonder what is this program actually doing. You could of course search through a lot of these uh maybe change the function to execute and that way you'll actually be looking at the things that have that capability. Now of course clicking into each and every one of these you got to check look is this a
19:08binary that is actually probably reliably on a Windows system. Uh is it going to be in any other like libraries or tools that might be installed like thenet framework cy internals utils etc. But I was scrolling through this and I found a couple good candidates that I really like. And of course, I'm encouraging you. You should be the one
19:26to go kind of go look at this and see, are there any things that would work well in your own tooling? Oh, this one's from Kyle. Hey, he's my boss. Kyle Hansovven, CEO over at Huntress. That's my job. I work there. Oh, this one is from 2017. Oh, old but gold. I like the program compatibility assistant because
19:46you can proxy execution of another program that you want to run. And you might also have the opportunity to do some remote stuff like if you were to host the payload on an SMB share or some other forwardfacing network share out to public and external. But let's just use the quick example of PCA Lua to use the Microsoft
20:07program compatibility assistant which should look a little bit more convincing inside of the UAC prompt. So now we want to run PCA Lua.exe exe and we'll actually provide an argument list here because we will be giving a tac a as you saw in the syntax that's been used here
20:28and a program that we actually want to run like cmd.exe calc.exe your malware or payload whatever.exe exe. Let's just keep it easy with the simple test bed harness for our local experimentation. But now our UAC prompt gives us a little bit more of a hidden trick. Program compatibility assistant. H not really
20:50the best icon, but then you need to click to show more details to see what's actually running. And then you still aren't really hiding what it ends up being. cmd.exe is still visible there. So if Oh, sorry. I'm I'm stuck in my UAC prompt bomb. Great. No. [laughter] All right. There's our command prompt.
21:12If you were to use a network share here or some external website like HTTP, whatever, then you could make this as spooky scary as you want. It could be uh-oh um network profile, corporate account, login version details, whatever. And I was wondering about another one of those that looks a little bit more convincing just because it has
21:32a pretty icon. I was tracking WLRMDR, the Windows Loon reminder executable. Shout out to the folks that were tracking this. Uh, and this has a longer nonsense argument in parameters here, but we'll eventually be able to run whatever we want. Granted, I think that is a local file. Again, you'd have to
21:53look for other candidates if you wanted something that will work remotely uh with served or hosted on an external resource. But let's try this one. So, back in our little uh recipe here, the uh ingredients for our UAC prompt bomb will mdr.exe.
22:13Is that right? Yeah, that's right. Okay. WLRMDR. And the arguments list, we can expand that and change that to now run cmd.exe. But this looks even prettier in our UAC prompt for our UAC prompt bomb because now we have some keys icon and that looks like security, right? That's a
22:33little convincing. Microsoft Windows. You click no. You click no. You click no. It won't leave you alone. You have to click yes and your malware fires. Small cutesy little harness, but I like that trick. Not going to lie to you. Let me slap that into Cybership. So, we get our B 64 syntax. And then from even a
22:53command prompt, can we run PowerShell tack e with that payload here? Yep. So we did it. We made our own little uh UAC prompt bombing technique in pure PowerShell. And they note looking back to the article from EE entire one of the things that they did this malware this threat actor the hacker out and about in the wild because they were disabling
23:13Windows Defender or working with some of the exclusions I think for your antivirus when it is disabled like when when the Windows service Windows Defender service running in the background is disabled within sandboxes like dynamic analysis oh trying to look at malware under a microscope it just gets stuck cuz that's trapped in the
23:35execution loop. And that's kind of neat because then it's not something that's as easily analyzed in a quick easy slap a solution to uh see that and work that doubles as its own sandbox evasion and dynamic analysis evasion method. Take a look at some of the stuff that it was able to do there. And then you can see
23:54like when you're exploring or when we're seeing what their prompt was. Windows PowerShell popping up. Eh, then you click show more details and there's a lot of bloody stuff there that's kind of, you know, a little bit too telling as to what it's doing. So we could get crafty and get clever. But look, they did this originally in.net. I think us
24:13being able to make something similar in a small little setup of PowerShell is neat. Again, the rest of the article here is super cool. If folks are interested, of course, there'll be a link in the video description for everything that I've been discussing. But, uh, I thought that little trick, especially in PowerShell, was Neidato Bonito. Video outro time. Thanks so much
24:33for watching. Hope you enjoyed this. Please do all those YouTube algorithm things. Like, comment, subscribe, and please, pretty please do give some love to our sponsor. Uh, Panther is super cool. They're a new friend, new part of the family, and I'm really grateful for all their support. And I think look, if you're up to this sort of stuff, testing
24:46different thread actor techniques, seeing what it looks like, examining it in the lab, trying to build out what a sock or a seam or what any endpoint detection response solution might do, they're doing some cool stuff. Please do give them some love. link in the video description and I'll see you in the next