warzonerat/warzonerat_config_extraction.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "ref:\n",
    "https://kienmanowar.wordpress.com/2023/03/25/quicknote-decrypting-the-c2-configuration-of-warzone-rat/\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Refs: https://stackoverflow.com/questions/9433541/movsx-in-python\n",
    "\n",
    "def SIGNEXT(x, b):\n",
    "    m = (1 << (b -1))\n",
    "    x = x & ((1 << b) -1)\n",
    "    return ((x ^ m) - m)\n",
    " \n",
    "# This routine is responsible for decrypting the stored C2.\n",
    "def rc4_customized_decryptor(data, key):\n",
    "    idx = 0\n",
    "    counter1 = 0\n",
    "    counter2 = 0\n",
    "     \n",
    "    # Initialize RC4 S-box\n",
    "    rc4Sbox = list(range(256))\n",
    "     \n",
    "    # Modify RC4 S-box\n",
    "    for i in range(256):\n",
    "        counter2 += (rc4Sbox[i] + key[i%250])\n",
    "        counter2 = counter2 & 0x000000FF\n",
    "        rc4Sbox[i] ^= rc4Sbox[counter2]\n",
    "        rc4Sbox[counter2 & 0xFF] ^= rc4Sbox[counter1 & 0xFF]\n",
    "        rc4Sbox[counter1 & 0xFF] ^= rc4Sbox[counter2 & 0xFF]\n",
    "        counter1 = i+1       \n",
    "     \n",
    "    # Decrypt data\n",
    "    counter1 = 0\n",
    "    counter2 = 0\n",
    "    j = 0\n",
    "    decrypted = []\n",
    "    while(idx < len(data)):\n",
    "        counter1 = j + 1\n",
    "        k = (j+1)\n",
    "        rc4Sbox_value1 = rc4Sbox[k]\n",
    "        counter2 += (SIGNEXT(rc4Sbox_value1, 8) & 0xFFFFFFFF)\n",
    "        rc4Sbox_value1_ = (SIGNEXT(rc4Sbox_value1, 8) & 0xFFFFFFFF)\n",
    "        rc4Sbox_value2 = rc4Sbox[counter2 & 0x000000FF]\n",
    "        rc4Sbox[k] = rc4Sbox_value2\n",
    "        rc4Sbox[(counter2 & 0x000000FF)] = rc4Sbox_value1\n",
    "        tmp1 = rc4Sbox[((0x20 * counter1) ^ (counter2 >> 3)) & 0x000000FF]\n",
    "        tmp2 = rc4Sbox[((0x20 * counter2) ^ (counter1 >> 3)) & 0x000000FF]\n",
    "        tmp3 = rc4Sbox[((tmp1 + tmp2) & 0x000000FF) ^ 0xAA]\n",
    "        tmp4 = rc4Sbox[(rc4Sbox_value2 + rc4Sbox_value1_) & 0x000000FF]\n",
    "        tmp5 = (tmp3 + tmp4) & 0x000000FF\n",
    "        tmp6 = rc4Sbox[(counter2 + rc4Sbox_value2) & 0x000000FF]\n",
    "        decrypted.append(data[idx] ^ (tmp5 ^ tmp6))\n",
    "         \n",
    "        counter1 += 1\n",
    "        j = counter1\n",
    "        idx += 1\n",
    "     \n",
    "    return bytes(decrypted)\n",
    "\n",
    "import binascii\n",
    "data = binascii.unhexlify(b'')\n",
    "key = binascii.unhexlify(b'')\n",
    "\n",
    "def unicode_strings(buf, n=4):\n",
    "    import re\n",
    "    ASCII_BYTE = b' !\\\"#\\$%&\\'\\(\\)\\*\\+,-\\./0123456789:;<=>\\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\\[\\]\\^_`abcdefghijklmnopqrstuvwxyz\\{\\|\\}\\\\\\~\\t'\n",
    "    if type(buf) == str:\n",
    "        buf = buf.encode('utf-8')\n",
    "    reg = b'((?:[%s]\\x00){%d,})' % (ASCII_BYTE, n)\n",
    "    uni_re = re.compile(reg)\n",
    "    out = []\n",
    "    for match in uni_re.finditer(buf):\n",
    "        try:\n",
    "            out.append(match.group().decode(\"utf-16\"))\n",
    "        except UnicodeDecodeError:\n",
    "            continue\n",
    "    return out\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "C2 host: 89.117.76.41, port: 4422\n"
     ]
    }
   ],
   "source": [
    "import pefile\n",
    "import struct\n",
    "\n",
    "# Load the PE file using pefile\n",
    "pe = pefile.PE(r\"D:\\samples\\danger\\f65a8af1100b56f2ebe014caeaa5bb2fbbca2da76cb99f3142354e31fbba5c8c\") # Put your file path\n",
    "\n",
    "# Initialize variable to store .bss section data\n",
    "bss_section_data = None\n",
    "\n",
    "# Iterate through sections to find the .bss section\n",
    "for section in pe.sections:\n",
    "    section_name = section.Name\n",
    "    if section_name.startswith(b'.bss'):\n",
    "        bss_section_data = section.get_data()\n",
    "\n",
    "# Extract the key size and key from the .bss section\n",
    "key_size = struct.unpack('<I', bss_section_data[:4])[0]\n",
    "key = bss_section_data[4:4 + key_size]\n",
    "\n",
    "# because the key is 250 bytes. We extracted 50 bytes from bss section and fill the rest with zeros\n",
    "key = key + b'\\x00' * (250 - len(key))\n",
    "\n",
    "# Extract encrypted data from the .bss section\n",
    "enc_data = bss_section_data[4 + key_size:]\n",
    "enc_data = enc_data.split(b'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00')[0]\n",
    "\n",
    "# Decrypt the encrypted data using a custom RC4 decryptor\n",
    "dec_data = rc4_customized_decryptor(enc_data, key)\n",
    "\n",
    "# Extract C2 host length and host string\n",
    "host_len = struct.unpack('<I', dec_data[:4])[0]\n",
    "host_wide = dec_data[4:host_len+4]\n",
    "c2_host = unicode_strings(host_wide)[0]\n",
    "\n",
    "# Extract C2 port\n",
    "c2_port = struct.unpack('<H', dec_data[host_len+4:host_len+4+2])[0]\n",
    "\n",
    "# Print the extracted C2 host and port\n",
    "print(\"C2 host: %s, port: %d\" % (c2_host, c2_port))\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  },
  "orig_nbformat": 4
 },
 "nbformat": 4,
 "nbformat_minor": 2
}