Hypervisor-Phantom

Hypervisor-Phantom copied to clipboard

BrowserLock

• System Requirements Link

• Exam Content & Special Configurations (SDS)

https://securedelivery-hs-prd-1.pearsonvue.com/SecureDeliveryService

• Application location:

%APPDATA%\OnVUE\BrowserLock.exe

• Log file location:

%LOCALAPPDATA%\BrowserLock\log

• Commands it runs

# Obtains NetConnectionID
wmic nic where "NetConnectionStatus = 2" get NetConnectionID /value

# Obtains USB FriendlyName
powershell.exe Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match '^USB' }

# Obtains Display/Monitor FriendlyName
powershell.exe -Command "Get-WmiObject -Namespace 'root\WMI' -Class 'WMIMonitorID' | ForEach-Object -Process { if($_.UserFriendlyName) { ([System.Text.Encoding]::ASCII.GetString($_.UserFriendlyName)).Replace('$([char]0x0000)','') } }"

# Obtains running processes
powershell.exe /c Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath

# Obtains MachineGUID
powershell (Get-ItemProperty registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\ -Name MachineGuid).MachineGUID

# Obtains system hostname
C:\Windows\system32\cmd.exe /c hostname

• Hypervisor System Checks (in log file):

# LOG:
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] VM Allowed flag value from forensics is vmAllowedForensic=false
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Multiple Monitor Allowed flag value from forensics is multiMonitorAllowedForensic=false
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] VPN Allowed flag value from forensics is vpnAllowedForensic=true
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Shutdown file monitor started
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] VM configuration received from SDS will be applied for validation
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] VM detection value is: vmDetectConfig=true
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Multiple monitor configuration received from SDS will be applied for validation
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Multiple monitor detection value is: multipleMonitorDetectConfig=true
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] VPN configuration received from forensics will be applied for validation
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] VPN detection value is: vpnDetectConfig=false
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] USB mass storage detection value is: usbDetectConfig=false
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Minimum browserlock version required: 2304 
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Current browserlock version: 2402.1.1 
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Check if Browserlock running on VM: {DMI type 1 (System Information) - Product Name}, {DMI type 2 (Base Board Information) - Serial Number}, runningOnVM=false
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] VM check: diskSize=499 GB
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Browserlock is not running on virtual machine
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Display HDCP supported check: hdcpSupported=true
XXXX-XX-XX XX:XX:XX.XXX-XXXX [BROWSER LOCK] [INFO] Number of display devices connected: AWT=1, Physical=1, Physical/Virtual=1, Duplicate=1

# BrowserLock Booleon Variables
- hdcpSupported
- multiMonitorAllowedForensic
- multipleMonitorDetectConfig
- runningOnVM
- usbDetectConfig
- vmAllowedForensic
- vmDetectConfig
- vpnAllowedForensic
- vpnDetectConfig

Virtual Box - VBoxManage Tool Location:

Linux: /usr/bin/VBoxManage
Mac OS X: /Applications/VirtualBox.app/Contents/MacOS/VBoxManage
Oracle Solaris: /opt/VirtualBox/bin/VBoxManage
Windows: C:\Program Files\Oracle\VirtualBox\VBoxManage.exe

Run these scripts:

• Configure the VM: VM-External-Modifer.ps1
• Spoof Windows: VM-Internal-Modifier.ps1

ExecutionPolicy Modifier:

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force

Building a Custom Version

• Vbox Source Code
• Vbox Build Instructions

Dependencies

sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y && sudo apt install -y acpica-tools chrpath doxygen g++-multilib libasound2-dev libcap-dev libcurl4-openssl-dev libdevmapper-dev libidl-dev libopus-dev libpam0g-dev libpulse-dev libqt5opengl5-dev libqt5x11extras5-dev qttools5-dev libsdl1.2-dev libsdl-ttf2.0-dev libssl-dev libvpx-dev libxcursor-dev libxinerama-dev libxml2-dev libxml2-utils libxmu-dev libxrandr-dev make nasm python3-dev python-dev qttools5-dev-tools texlive texlive-fonts-extra texlive-latex-extra unzip xsltproc default-jdk libstdc++5 libxslt1-dev linux-kernel-headers makeself mesa-common-dev subversion yasm zlib1g-dev glslang-tools ia32-libs libc6-dev-i386 lib32gcc1 lib32stdc++6

Building VirtualBox

./configure --disable-hardening && source ./env.sh && kmk all && 

VMware PRO License Key:

MC60H-DWHD5-H80U9-6V85M-8280D

Patching BIOS ROM

1. Locate file BIOS.440.ROM within %PROGRAMFILES(X86)%\VMware\VMware Workstation\x64.
2. Utilize Phoenix BIOS Editor to modify compromising DMI Strings, like VMware or Virtual Platform.
3. Once completed, go to File then Build BIOS and save the patched BIOS somewhere. Don't overwrite the original file!
4. Now within the *.vmx config file, make sure to add the new patched BIOS location for the bios440.filename argument line.

Set Custom CPUID (optional)

Add the following into your *.vmx

bios440.filename = "C:\<path_to_your_bios_file>\BIOS.440.PATCH.ROM"
hypervisor.cpuid.v0 = "FALSE"
smbios.reflectHost = "TRUE"
ethernet0.address = "00:C0:CA:A7:2B:9E"
isolation.tools.getPtrLocation.disable = "TRUE"
isolation.tools.setPtrLocation.disable = "TRUE"
isolation.tools.setVersion.disable = "TRUE"
isolation.tools.getVersion.disable = "TRUE"
monitor_control.restrict_backdoor = "TRUE"
monitor_control.virtual_rdtsc = "FALSE"

IMPORTANT

• smbios.reflectHost will NOT fully function properly if UEFI firmware is used without the BIOS ROM patch. If you use BIOS firmware instead, you don't have to worry about doing the BIOS ROM patch (you can still do it if you want though).

Run these scripts:

• Spoof Windows: VM-Internal-Modifier.ps1

ExecutionPolicy Modifier:

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force

QEMU + Virt-Manager Setup

sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y && sudo apt clean -y
sudo apt install qemu-system-x86 libvirt-clients libvirt-daemon-system libvirt-daemon-config-network bridge-utils virt-manager ovmf
sudo usermod -a -G kvm,libvirt $(whoami)
sudo systemctl enable libvirtd && sudo systemctl start libvirtd && sudo groups $(whoami)
sudo virsh net-autostart default && sudo virsh net-start default
virt-manager

QEMU Strings Patch [smbios, ACPI Tables, USB, etc...]

• qemu-patch-bypass

Dependencies

sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y && sudo apt install -y binutils-mingw-w64 binutils-mingw-w64-i686 binutils-mingw-w64-x86-64 build-essential clang g++-mingw-w64 g++-mingw-w64-i686 g++-mingw-w64-x86-64 gcc-mingw-w64 gcc-mingw-w64-i686 gcc-mingw-w64-x86-64 git git-email gnutls-bin libaio-dev libbluetooth-dev libbrlapi-dev libbz2-dev libcacard-dev libcap-dev libcap-ng-dev libcurl4-gnutls-dev libfdt-dev libglib2.0-dev libgtk-3-dev libibverbs-dev libiscsi-dev libjpeg8-dev liblzo2-dev libncurses5-dev libncursesw5-dev libnfs-dev libnuma-dev libpam0g-dev libpixman-1-dev librbd-dev librdmacm-dev libseccomp-dev libsnappy-dev libsasl2-dev libsdl1.2-dev libsdl2-dev libsdl2-image-dev libspice-protocol-dev libspice-server-dev libusb-1.0-0-dev libusb-dev libusbredirparser-dev libusbredirparser1 libvde-dev libvdeplug-dev libvirglrenderer-dev libvte-2.91-dev libxen-dev libxml2-dev libz-mingw-w64-dev libzstd-dev ninja-build valgrind win-iconv-mingw-w64-dev xfslibs-dev zlib1g-dev

Make custom QEMU .patch file

cd $HOME/Downloads && git clone --depth 1 --branch v8.2.2 --recursive https://gitlab.com/qemu-project/qemu.git && cd qemu/

# Edit all compromised strings within the source code...
grep -Rn '"QEMU ' "$HOME/Downloads/qemu"
grep -Rn '"QEMU' "$HOME/Downloads/qemu"
grep -Rn 'Virtual Machine"' "$HOME/Downloads/qemu"
grep -Rn 'Virtual CPU version "' "$HOME/Downloads/qemu"
grep -Rn '"KVM/Linux       "' "$HOME/Downloads/qemu"
grep -Rn '"KVMKVMKVM\\0\\0\\0"' "$HOME/Downloads/qemu"
grep -Rn 'ACPI_BUILD_APPNAME6 "BOCHS "' "$HOME/Downloads/qemu"
grep -Rn 'ACPI_BUILD_APPNAME8 "BXPC    "' "$HOME/Downloads/qemu"
grep -Rn '\[STR_SERIALNUMBER\]' "$HOME/Downloads/qemu"
grep -Rn '"QM%05d"' "$HOME/Downloads/qemu"

git diff > v8.2.2.patch

• ACPI_BUILD_APPNAME6 "ALASKA"

• ACPI_BUILD_APPNAME8 "A M I "

• ACPI_BUILD_APPNAME6 "DELL "

• ACPI_BUILD_APPNAME8 "Dell Inc"

Downloading & Building QEMU w/patch

cd $HOME/Downloads && git clone --depth 1 --branch v8.2.2 --recursive https://gitlab.com/qemu-project/qemu.git

cd qemu/ && git apply v8.2.2.patch && cd .. && mkdir qemu_build && cd qemu_build && ../qemu/configure --target-list=x86_64-softmmu,x86_64-linux-user --prefix=/usr && make -j $(nproc) && sudo make install

sudo mv -f qemu-system-x86_64 /bin

QEMU RDTSC VM_Exit Kernal Patch

• RDTSC-KVM-Handler

Dependencies

• Arch

sudo pacman -S base-devel bc coreutils cpio gettext initramfs kmod libelf ncurses pahole perl python rsync tar xz

• Debian

sudo apt install bc binutils bison dwarves flex gcc git gnupg2 gzip libelf-dev libncurses5-dev libssl-dev make openssl pahole perl-base rsync tar xz-utils

• Fedora

sudo dnf install binutils ncurses-devel \
    /usr/include/{libelf.h,openssl/pkcs7.h} \
    /usr/bin/{bc,bison,flex,gcc,git,gpg2,gzip,make,openssl,pahole,perl,rsync,tar,xz,zstd}

Download latest Kernal release

• Linux Kernel Website
• Linux Kernal GitHub

Extracting the tarball

tar -xf linux-*.tar && cd linux-*/

PCIe Passthrough (Debian Guide)

• YT Guide #1
• YT Guide #2
• YT Guide #3
• Article Guide
• Amazing Single GPU Passthrough Guide

1. Make sure to enable the following in the host UEFI/BIOS

Requirements

• Virtualization Check

LC_ALL=C lscpu | grep Virtualization && egrep -c '(vmx|svm)' /proc/cpuinfo

• List PCI Devices

lspci -nn | grep "NVIDIA"

or

• List IOMMU Groups

#!/bin/bash
shopt -s nullglob
for g in /sys/kernel/iommu_groups/*; do
    echo "IOMMU Group ${g##*/}:"
    for d in $g/devices/*; do
        echo -e "\t$(lspci -nns ${d##*/})"
    done;
done;

Modify grub.cfg

• GRUB_CMDLINE_LINUX_DEFAULT="amd_iommu=on iommu=pt vfio-pci.ids=XXXX:XXXX,XXXX:XXXX,XXXX:XXXX,XXXX:XXXX"

sudo nano /etc/default/grub

Update grub.cfg & reboot

sudo update-grub && sudo reboot now

Modify vfio.conf (isolate GPU)

• options vfio-pci ids=XXXX:XXXX,XXXX:XXXX,XXXX:XXXX,XXXX:XXXX
• softdep nvidia pre: vfio-pci

sudo nano /etc/modprobe.d/vfio.conf

Update initramfs

sudo update-initramfs -c -k $(uname -r) && sudo reboot now

Check kernal driver in use for the isolated GPU (should be vfio-pci)

lspci -k | grep -E "vfio-pci|NVIDIA"

QEMU Virt-Manager Setup

1. Create a new virtual machine
2. Local install media (ISO image or CDROM)
3. Select a Windows ISO and enter the OS you're using
4. Set a realistic amount of RAM (make sure its half of the full amount)

5. Set 1 less of the maximum amount of CPUs available
6. Set a virtual disk size of above 250GB+
7. Select "Customize configuration before install" and finish
8. Select UEFI x86_64:/usr/share/OVMF/OVMF_CODE_4M.ms.fd for the Firmware, then apply 8a. If you want to use Windows 11 you need to use UEFI x86_64:/usr/share/qemu/edk2-x86_64-secure-code.fd instead
9. Under CPUs, check Copy host CPU configuration (host-passthrough) 9a. Drop down Topology and check Manually set CPU topology then input whatever works with your system, then apply

11. Under Boot Options check SATA CDROM 1, then apply
12. Under SATA Disk 1 and SATA CDROM 1 drop down Advanced options and set a random custom serial #, then apply
13. Under NIC:XX:XX:XX select the drop down menu and pick hypervisor default 12a. Set a custom MAC address, make sure the vendor isn't a hypervisor vendor! then apply
14. Select Add Hardware and under PCI Host Device add ALL devices under the isolated GPU IOMMU group you figured out earlier
15. Now select Begin Installation, and enjoy your new undetectable windows system!

QEMU XML Config

• Domain XML format

  <os>
    <smbios mode="host"/>
  </os>
  <features>
    <acpi/>
    <apic/>
    <hyperv mode="custom">
      <relaxed state="on"/>
      <vapic state="on"/>
      <spinlocks state="on" retries="8191"/>
      <vpindex state="on"/>
      <runtime state="on"/>
      <synic state="on"/>
      <stimer state="on"/>
      <reset state="on"/>
      <vendor_id state="on" value="AuthenticAMD"/>
      <frequencies state="on"/>
    </hyperv>
    <kvm>
      <hidden state="on"/>
    </kvm>
    <vmport state="off"/>
  </features>
  <cpu mode="host-passthrough" check="none">
    <topology sockets="1" dies="1" cores="8" threads="2"/>
    <cache mode="passthrough"/>
    <feature policy="disable" name="hypervisor"/>
    <feature policy="require" name="invtsc"/>
    <feature policy="require" name="topoext"/>
    <feature policy="require" name="svm"/>
  </cpu>
  <clock offset="utc">
    <timer name="pit" tickpolicy="delay"/>
    <timer name="rtc" tickpolicy="catchup" track="guest"/>
    <timer name="hpet" present="no"/>
    <timer name="tsc" present="yes" mode="native"/>
    <timer name="hypervclock" present="yes"/>
  </clock>

Looking Glass Setup Guide

• Client usage
• KVM (Kernel-based Virtual Machine) configured for VGA PCI Pass-through without an attached physical monitor, keyboard or mouse.

Add this to your .XML file in the devices section:

    <shmem name='looking-glass'>
      <model type='ivshmem-plain'/>
      <size unit='M'>32</size>
    </shmem>

Dependencies

sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y && sudo apt install -y binutils-dev cmake fonts-dejavu-core libfontconfig-dev gcc g++ pkg-config libegl-dev libgl-dev libgles-dev libspice-protocol-dev nettle-dev libx11-dev libxcursor-dev libxi-dev libxinerama-dev libxpresent-dev libxss-dev libxkbcommon-dev libwayland-dev wayland-protocols libpipewire-0.3-dev libpulse-dev libsamplerate0-dev

Create a new file

sudo nano /etc/tmpfiles.d/10-looking-glass.conf

• Give it the following contents

# Type Path               Mode UID  GID Age Argument

f /dev/shm/looking-glass 0660 user kvm -

Granting Permissions

touch /dev/shm/looking-glass && chown $USER:kvm /dev/shm/looking-glass && chmod 660 /dev/shm/looking-glass

Download/Build/Install LookingGlass

curl -sSL https://looking-glass.io/artifact/stable/source -o latest.tar.gz && tar -zxvf latest.tar.gz && rm -rf latest.tar.gz

cd looking-glass-* && mkdir client/build && cd client/build && cmake ../ && make && sudo make install

./looking-glass-client

Testing it out...

• VFIO - EDID Emulator Review
• DP/HDMI/DVI/VGA Dummy Plug (EDID Emulator)
  • #1 - DP
  • #2 - HDMI
  • #3 - DVI
  • #4 - VGA
• USB Type C to DP Adapter <---> DP/HDMI/DVI/VGA Dummy Plug (EDID Emulator)
  • USB C to DisplayPort Adapter
• Connect an additional DisplayPort or HDMI cable from your spare/isolated GPU to your monitor. Alternatively, you can utilize a DisplayPort or HDMI Bidirectional Switch Splitter for convenience.
  • DP Bidirectional Switch Splitter

QEMU General Patches

• KVM-Spoofing