Message-ID: <CAAHK0WSGB9K+b=s8ObhKj9oBKqYnkmcNwpLArChoxKaWbq0n-A@mail.gmail.com>
Date: Fri, 22 Mar 2024 20:18:47 -0400
From: malvuln <malvuln13@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Win32.STOP.Ransomware (smokeloader) / Remote Code Execution
	(MITM)

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024
Original source:
https://malvuln.com/advisory/3b9e9e130d52fe95c8be82aa4b8feb74.txt
Contact: malvuln13@...il.com
Media: twitter.com/malvuln

Threat: Win32.STOP.Ransomware (smokeloader)
Vulnerability: Remote Code Execution (MITM)
Family: Stop
Type: PE32
MD5 3b9e9e130d52fe95c8be82aa4b8feb74
Vuln ID: MVID-2024-0676
Disclosure: 03/22/2024
Description:
There are two roads to exploitation for this particular ransomware, network
"man-in-the-middle" or localized code execution, this advisory explores the
network route.
Stop ransomware makes several HTTP GET requests over an insecure protocol
TCP port 80 to download secondary PE files "build2.exe" and "build3.exe"
Moreover, no integrity checks are made on these files, well positioned
third-party attackers who can intercept traffic can send back arbitrary
exploit PE files.

[Domains contacted]
api.2ip.ua
sajdfue.com
sdfjhuz.com

[URLs]
/test2/get.php?pid=A41BF90C9233CFB5AAFE279642C3793D&first=true
/dl/build2.exe
/files/1/build3.exe

Stop ransomware actions.
1) Creates two directories under AppData\Local, named with unique ID e.g.
"2197cd80-6ccb-4fe1-97c0-57d05945fac6"
2) Sets deny permissions on the directory for everyone Everyone
(OI)(CI)(DENY)(D,DC)
3) Creates Windows registry Run key "SysHelper" for persistence, that
points to a directory in AppData\Local
     e.g.
\Users\Victim\AppData\Local\407868e1-6d5a-44f2-81ba-a8fedd9ea8db\StopCrypt.exe
4) Copies downloaded malware to a second created directory under
AppData\Local

Exploit PE file executes as a child of the parent process malware and does
following on our behalf.

1) Kill the parent process leveraging WIN32 API
     GetCurrentProcessId()
     Get parent process ID using CreateToolhelp32Snapshot()
     Call OpenProcess(PROCESS_TERMINATE, FALSE,  ppid)

2) Delete registry persistence Run key "SysHelper"
3) Modify permissions on Stops backup directory to full access for everyone
user group "/grant Everyone (OI)(CI)F"
4) Deletes the malware backup directory under AppData\Local

[PoC/Video URL]
https://www.youtube.com/watch?v=S6E62YIOczo

[Sample]
https://bazaar.abuse.ch/sample/caeecccfee0962fbe3d4fb4ab336bf3d1230b12ad0821ff66f7a2cabc289c954/

By the way, "urlmon.dll" DLL file exported by "RansomLord v2" can be used
against this sample for local exploitation.
Download: https://github.com/malvuln/RansomLord

All tests conducted successfully in a virtual machine environment using DNS
and traffic redirection techniques.

Network Exploit/PoC
1) Compile the below "StopExploit.c" code as "build2.exe" and "build3.exe"
2) Create directory "dl" and save build2.exe here
3) Create directories "files/1" and save build3.exe here
     Note, In my tests exploitation worked with just the "build2.exe" saved
in the "dl" directory.
4) Start web server on TCP port 80
     python -m http.server 80
5) Intercept the Stop Ransomware traffic and DNS to server we control, send
back exploit files.

"StopExploit.c"

#include "windows.h"
#include "stdio.h"
#include "tlhelp32.h"
#include "psapi.h"
#define BUFFER 512

//[+] Win32 STOP (smokeloader) Ransomware
//[+] MD5 3b9e9e130d52fe95c8be82aa4b8feb74
//[+] Remote Code Execution PoC
//[+] By John Page (aka hyp3rlinx) - malvuln
//[+] ApparitionSec
//[+] March 19, 2024
//=========================================================================
//Abuses MITM insecure download over TCP port 80 to serve exploits to kill
"Win32.Stop" malware
//Deletes persistence Run key "SysHelper" and secondary malware backup
directory
//Tested successfully in Virtual Machine environment using DNS and network
traffic redirection.
//=========================================================================
//
//linker -lpsapi (Dev-C++) x32
//
//=========================================================================
/** DISCLAIMER
Author is NOT responsible for any damages whatsoever by using this software
or improper malware
handling. By using this code you assume and accept all risk implied or
otherwise.
**/
//=========================================================================
DWORD getParentPID(DWORD pid);
void Kill_StopCrypt();
void DelSysHelper();
void EvictBackupMalware(char *maldir);

int main(void){
    Sleep(3000);
    DelSysHelper();
    return 666;
}

void Kill_StopCrypt(){
        DWORD pid, ppid;
        pid = GetCurrentProcessId();
        ppid = getParentPID(pid);
        HANDLE handle = OpenProcess(PROCESS_TERMINATE, FALSE,  ppid);
     if (NULL != handle){
        DelSysHelper();
        TerminateProcess(handle, 0);
        CloseHandle(handle);
     }
}

void DelSysHelper(){
  char value[BUFFER];
  DWORD BufferSize = sizeof value;
  LONG rc = RegGetValueA(HKEY_CURRENT_USER,
(LPCSTR)"Software\\Microsoft\\Windows\\CurrentVersion\\Run",
(LPCSTR)"SysHelper", RRF_RT_ANY, NULL, (PVOID)&value, &BufferSize);
  if(rc == ERROR_SUCCESS){
     rc = RegDeleteKey(HKEY_CURRENT_USER,
(LPTSTR)"Software\\Microsoft\\Windows\\CurrentVersion\\Run");
      if(rc == ERROR_SUCCESS){
         Kill_StopCrypt();
      }
      EvictBackupMalware(value);
   }
}

DWORD getParentPID(DWORD pid){
    HANDLE h = NULL;
    PROCESSENTRY32 pe={0};
    DWORD ppid = 0;
    pe.dwSize = sizeof(PROCESSENTRY32);
    h = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if(Process32First(h, &pe)){
        do {
          if (pe.th32ProcessID==pid){
            ppid = pe.th32ParentProcessID;
            break;
         }
        } while(Process32Next(h, &pe));
    }
    CloseHandle(h);
    return (ppid);
}

char* concat(const char *s1, const char *s2){
   char *result = malloc(strlen(s1) + strlen(s2) + 1);
   strcpy(result, s1);
   strcat(result, s2);
   return result;
}

void EvictBackupMalware(char *maldir){
  char *infected_dir_path;
  int j = 0;
  int cnt = 0;
  int i;
  char array[255][255];
  for (i=0; i <= (strlen(maldir)); i++){
    if (maldir[i] == '\\' || maldir[i]=='\0'){
        array[cnt][j]='\0';
        cnt++;
        j=0;
    }else{
      array[cnt][j]=maldir[i];
      j++;
      }
   }
    char result[256]="C:\\Users\\";
    char *r1;
    char *r2;
    for (i = 0; i < cnt; i++) {
        //printf(" %s %d\n", array[i],i);
        r1 = concat(result, array[2]);
        r2 = concat(r1, "\\AppData\\Local\\");
        //reg run key path points to this infected directory
        infected_dir_path = concat(r2, array[5]);
    }

    //printf("target: %s", infected_dir_path);
    char perm[256]="icacls ";
    char *r3;
    char *perm_cmd;
    r3 = concat(perm, infected_dir_path);

    //reset permissions on dir created by Stop ransomware
    perm_cmd = concat(r3, " /grant Everyone:(OI)(CI)F");

    system(perm_cmd);

    //evict backed up malware and dir
    char del_cmd[256]="RD ";
    char *force_del = concat(del_cmd, infected_dir_path);
    char *bye_bye_douche = concat(force_del, " /S /Q");

    system(bye_bye_douche);
}

//malvuln circa 2024

Disclaimer: The information contained within this advisory is supplied
"as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility for any damage caused by the
use or misuse of this information. The author prohibits any malicious use
of security related information or exploits by the author or elsewhere. Do
not attempt to download Malware samples. The author of this website takes
no responsibility for any kind of damages occurring from improper Malware
handling or the downloading of ANY Malware mentioned on this website or
elsewhere. All content Copyright (c) Malvuln.com (TM).
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists