Cobalt Strike shellcode seems to be recognized as PE

[zanemendoza123]

I installed PEZor by following the guide. To test PEzor, I generated a payload using the following:

And when I used PEzor on the generated payload, I got the following error:

# bash ../tools/PEzor/PEzor.sh beacon.bin            
 ________________
< PEzor!! v2.1.0 >
 ----------------
[...snip...]
[?] Processing beacon.bin
[?] PE detected: beacon.bin: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
[?] Building executable
[?] Executing donut

  [ Donut shellcode generator v0.9.3
  [ Copyright (c) 2019 TheWover, Odzhan

  [ Error : File is invalid.
cat: /tmp/shellcode.cpp.donut: No such file or directory

If I used Payload Generator just like below:

PEzor works fine and I don't see any error

# bash ../tools/PEzor/PEzor.sh payload.bin 
 ________________
< PEzor!! v2.1.0 >
 ----------------
[...snip...]
---------------------------------------------------------------------------
[?] Processing payload.bin
[?] Shellcode detected
[?] Building executable
[!] Done! Check payload.bin.packed.exe: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows

Any one here can shed some light on why I'm getting the error?

[zanemendoza123]

Managed to make it work by setting the IS_SHELLCODE variable to true. I'm not sure if this is the right fixed for my issue though. I'm not knowledgeable enough to debug all codes. I might I have broke something.

[phra]

[?] PE detected: beacon.bin: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

it seems that file, used by PEzor, recognizes your input as a PE file instead of raw shellcode. can you check why file believes that?

[zanemendoza123]

Here's the output of file command on the raw shellcode

# file beacon.bin    
beacon.bin: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

[phra]

based on https://malware.news/t/cobaltstrike-beacon-dll-your-no-ordinary-mz-header/34458 it seems that cobalt strike generates a shellcode that starts with a specially crafted DOS header and file reports it as a full PE based on that header. (https://github.com/phra/PEzor/blob/master/PEzor.sh#L222)

if confirmed, a solution would be to add a new command-line option to force the payload to be treated as raw shellcode despite the file output. anyway this issue doesn't appear when using hooks to customize generated artifacts.

[c14dd49h]

I have the same issue... any update of this topic?

[phra]

a workaround was posted by @zanemendoza123 above and a long-term solution was suggested by me. unfortunately i haven't worked on it, does someone mind to send a PR with the proposed fix? (i.e. add -shellcode command line option)

[zanemendoza123]

Would like to close this issue since the CLI option -shellcode fixed it.