magic_mz_x86 and magic_mz_x64

Background

We'll this is going to be a very short blog post. magic_mz_x86 and magic_mz_x64 are two malleable profile values one can set in since cobalt strike 2.4.3 . I haven't seen anyone talk about it and what are the possible values. I have searched internet to find anyone using different set of values. No one has ever published this. So here, I'll publish some details about it.

Why Change these values?

magic_mz_x86 and magic_mz_x64 malleable options are available in "Stage" block of Cobaltstrike malleable profile. They are responsible to change the MZ PE header in the shellcode you generate from CobaltStrike (staged or stageless). There is basic information provided on cobaltstrike blog post on how to change these values. One can change these values by providing a set of 2 (for x64) or 4(for x86) assembly instructions. The condition for the assembly instructions is that the resultant should be a no operation. For eg
1
inc eax
2
dec eax
Copied!
Above instructions combined together result in a no operation

How to change values?

Default values as provided in the blog from cobalt strike are as follows
https://www.cobaltstrike.com/help-malleable-postex
To change these values here is a generic approach

For x86 - magic_mz_x86

For x86 we have to write 4 instructions (resulting to NOP) to fill up MZRE space. You can use any 4 x86 instructions which can fill 4 byte space and result in a resultant NO-OPERATION . This is how MZRE is created
x86-orig.asm
1
bits 32
2
section .text
3
global _start
4
_start:
5
dec abp
6
pop edx
7
push edx
8
inc ebp
Copied!
So if you'll compile the above asm, and do a hexdump of this you'll see MZRE.
now to modify, change these 4 instructions to any instructions of 4 byte total length. For example
x86-modif.asm
1
bits 32
2
section .text
3
global _start
4
_start:
5
dec eax
6
inc eax
7
dec ebx
8
inc ebx
Copied!
As mentioned above , now you can change magic_mz_x86 to "[email protected]"

For x64 - magic_mz_x64

Similarly, for x64, now you need two instructions to fill up the 4 byte space. You can use something
x64-modif.asm
1
bits 64
2
section .text
3
global _start
4
_start:
5
pop r9
6
push r9
Copied!
Compiling the same will result as following
Now AYAQ can be used as a value in magic_mz_x64

What is the actual difference now

The difference is actually seen when you dump the stageless raw shellcode . You can see you MZ header change which helps evade EDR
With Default profile as below
Profile with default magic_mz values
Following is the dump of stageless payload
Exporting Raw shellcode of unmodified profile
Hexdump of Deafult stageless x86 shellcode
Hexdump of Deafult stageless x64 shellcode
​
Now if we change profile values to custom values you can see the difference
Changing default values of magic_mz
Exporting Raw Shellcode after modifying the profile
Hexdump of Modified stageless x64 shellcode
Hexdump of Modified stageless x86 shellcode
​

Thanks

Thanks to @vysecurity for guidance and motivation

References

Last modified 3mo ago