Exploitalert - Database of Exploits

XWorm Trojan 2.1 Null Pointer Derefernce DoS

CVE	Category	Price	Severity
N/A	CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer	Not specified	High

Author	Risk	Exploitation Type	Date
Unknown	High	Remote	2023-04-05

CVSS	EPSS	EPSSP
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	0.02192	0.50148

CVSS vector description

Metric	Value	Metric Description	Value Description
Attack vector	Local	AV	The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
Attack Complexity	Low	AC	The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements	Present	AT	The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack. These include: A race condition must be won to successfully exploit the vulnerability. The successfulness of the attack is conditioned on execution conditions that are not under full control of the attacker. The attack may need to be launched multiple times against a single target before being successful. Network injection. The attacker must inject themselves into the logical network path between the target and the resource requested by the victim (e.g. vulnerabilities requiring an on-path attacker).
Privileges Required	Low	PR	The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
User Interaction	None	UI	The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Confidentiality Impact to the Vulnerable System	High	VC	There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
Availability Impact to the Vulnerable System	High	VI	There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Vulnerable System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Vulnerable System.
Availability Impact to the Vulnerable System	High	VA	There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Vulnerable System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Vulnerable System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Subsequent System Confidentiality Impact	Negligible	SC	There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Integrity Impact to the Subsequent System	None	SI	There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Availability Impact to the Subsequent System	None	SA	There is no loss of availibility within the Subsequent System or all availibility impact is constrained to the Vulnerable System.

https://cxsecurity.com/ascii/WLB-2023040018

XWorm Trojan 2.1 Null Pointer Derefernce DoS

#Exploit Author: XWorm Trojan 2.1 - Null Pointer Derefernce DoS # Exploit Author: TOUHAMI KASBAOUI # Vendor Homepage: https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ # Software Link: N/A# Version: 2.1# Tested on: Windows 10 # CVE : N/A ================================================================== THE BUG : NULL pointer dereference -> DOS crash ================================================================== The sophisticated XWorm Trojan is well exploited by EvilCoder, where they collect different features such as ransomware and keylogger TAs to make it more risky for victims. The Trojan assigned to victims suffers from a NULL pointer deference vulnerability, which could lead to a denial of service for the server builder of the threat actor by getting his IP address and port of command and control. ================================================================== WINDBG ANALYSIS AFTER SENDING 1000 'A' BYTES ================================================================== (160.b98): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=0330c234 ebx=0113e8d4 ecx=00000000 edx=018c0000 esi=0330c234 edi=0113e55c eip=078f5a59 esp=0113e4f8 ebp=0113e568 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 builder!XWorm.Client.isDisconnected+0xa9: 078f5a59 8b01 mov eax,dword ptr [ecx] ds:002b:00000000=???????? ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* MethodDesc: 055a86b4 Method Name: XWorm.Client.isDisconnected() Class: 09fe9634 MethodTable: 055a86d8 mdToken: 06000730 Module: 01464044 IsJitted: yes CodeAddr: 078f59b0 Transparency: Critical MethodDesc: 055a86b4 Method Name: XWorm.Client.isDisconnected() Class: 09fe9634 MethodTable: 055a86d8 mdToken: 06000730 Module: 01464044 IsJitted: yes CodeAddr: 078f59b0 Transparency: Critical Failed to request MethodData, not in JIT code range KEY_VALUES_STRING: 1 Key : AV.Dereference Value: NullPtr Key : AV.Fault Value: Read Key : Analysis.CPU.mSec Value: 6406 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 12344 Key : Analysis.IO.Other.Mb Value: 152 Key : Analysis.IO.Read.Mb Value: 3 Key : Analysis.IO.Write.Mb Value: 181 Key : Analysis.Init.CPU.mSec Value: 48905 Key : Analysis.Init.Elapsed.mSec Value: 6346579 Key : Analysis.Memory.CommitPeak.Mb Value: 200 Key : CLR.BuiltBy Value: NET48REL1LAST_C Key : CLR.Engine Value: CLR Key : CLR.Version Value: 4.8.4515.0 Key : Timeline.OS.Boot.DeltaSec Value: 7496 Key : Timeline.Process.Start.DeltaSec Value: 6371 Key : WER.OS.Branch Value: vb_release Key : WER.OS.Timestamp Value: 2019-12-06T14:06:00Z Key : WER.OS.Version Value: 10.0.19041.1 Key : WER.Process.Version Value: 2.1.0.0 NTGLOBALFLAG: 0 PROCESS_BAM_CURRENT_THROTTLED: 0 PROCESS_BAM_PREVIOUS_THROTTLED: 0 APPLICATION_VERIFIER_FLAGS: 0 EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 078f5a59 (builder!XWorm.Client.isDisconnected+0x000000a9) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 00000000 Attempt to read from address 00000000 FAULTING_THREAD: 00000b98 PROCESS_NAME: builder.exe READ_ADDRESS: 00000000 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE_STR: c0000005 EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 00000000 IP_ON_HEAP: 078f5a59 The fault address in not in any loaded module, please check your build's rebase log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may contain the address if it were loaded. STACK_TEXT: 0113e568 73140556 00000000 00000000 00000000 builder!XWorm.Client.isDisconnected+0xa9 0113e574 7314373a 0113e8d4 0113e5b8 732dd3f0 clr!CallDescrWorkerInternal+0x34 0113e5c8 7321f0d1 c887551e 00000000 0335b7dc clr!CallDescrWorkerWithHandler+0x6b 0113e608 7321f1d6 731d7104 0335b7dc 055ab280 clr!CallDescrWorkerReflectionWrapper+0x55 0113e90c 7212853c 00000000 0330a1dc 00000000 clr!RuntimeMethodHandle::InvokeMethod+0x838 0113e930 72114a9d 00000000 00000000 00000000 mscorlib_ni! 0113e94c 6e14bf55 00000000 00000000 00000000 mscorlib_ni! 0113e968 6e14be68 00000000 00000000 00000000 System_Windows_Forms_ni! 0113e990 72118604 00000000 00000000 00000000 System_Windows_Forms_ni! 0113e9f4 72118537 00000000 00000000 00000000 mscorlib_ni! 0113ea08 721184f4 00000000 00000000 00000000 mscorlib_ni! 0113ea24 6e14bdfa 00000000 00000000 00000000 mscorlib_ni! 0113ea40 6e14bb9a 00000000 00000000 00000000 System_Windows_Forms_ni! 0113ea80 6e13b07f 00000000 00000000 00000000 System_Windows_Forms_ni! 0113eacc 6e144931 00000000 00000000 00000000 System_Windows_Forms_ni! 0113ead8 6e1445f7 00000000 00000000 00000000 System_Windows_Forms_ni! 0113eaec 6e13af53 00000000 00000000 00000000 System_Windows_Forms_ni! 0113eaf4 6e13aee5 00000000 00000000 00000000 System_Windows_Forms_ni! 0113eb08 6e13a820 00000000 00000000 00000000 System_Windows_Forms_ni! 0113eb58 0146d08e 00000000 00000000 00000000 System_Windows_Forms_ni! WARNING: Frame IP not in any known module. Following frames may be wrong. 0113eb8c 7650148b 000606f4 0000c250 00000000 0x146d08e 0113ebb8 764f844a 05823e56 000606f4 0000c250 USER32!_InternalCallWinProc+0x2b 0113ec9c 764f61ba 05823e56 00000000 0000c250 USER32!UserCallWinProcCheckWow+0x33a 0113ed10 764f5f80 0113ed98 0113ed58 6e19e5ed USER32!DispatchMessageWorker+0x22a 0113ed1c 6e19e5ed 0113ed98 c9b28348 731410fc USER32!DispatchMessageW+0x10 0113ed58 6e14b44f 00000000 00000000 00000000 System_Windows_Forms_ni+0x22e5ed 0113eddc 6e14b03d 00000000 00000000 00000000 System_Windows_Forms_ni! 0113ee30 6e14ae93 00000000 00000000 00000000 System_Windows_Forms_ni! 0113ee5c 014b2694 00000000 00000000 00000000 System_Windows_Forms_ni! 0113ee84 014b2211 00000000 00000000 00000000 0x14b2694 0113eeac 014b1871 00000000 00000000 00000000 0x14b2211 0113eef8 014b08b7 00000000 00000000 00000000 0x14b1871 0113ef28 73140556 00000000 00000000 00000000 builder!XWorm.My.MyApplication.Main+0x6f 0113ef34 7314373a 0113efc4 0113ef78 732dd3f0 clr!CallDescrWorkerInternal+0x34 0113ef88 73149adb 00000000 030622ec 73171e90 clr!CallDescrWorkerWithHandler+0x6b 0113eff0 732bff7b 0113f0cc c8874202 01466f94 clr!MethodDescCallSite::CallTargetWorker+0x16a 0113f114 732c065a 0113f158 00000000 c8874096 clr!RunMain+0x1b3 0113f380 732c0587 00000000 c8874b72 00700000 clr!Assembly::ExecuteMainMethod+0xf7 0113f864 732c0708 c8874baa 00000000 00000000 clr!SystemDomain::ExecuteMainMethod+0x5ef 0113f8bc 732c082e c8874bea 00000000 732bc210 clr!ExecuteEXE+0x4c 0113f8fc 732bc235 c8874a2e 00000000 732bc210 clr!_CorExeMainInternal+0xdc 0113f938 7398fa84 84112dff 73a24330 7398fa20 clr!_CorExeMain+0x4d 0113f970 73a1e81e 73a24330 73980000 0113f998 mscoreei!_CorExeMain+0xd6 0113f980 73a24338 73a24330 76b600f9 00f94000 MSCOREE!ShellShim__CorExeMain+0x9e 0113f998 76b600f9 00f94000 76b600e0 0113f9f4 MSCOREE!_CorExeMain_Exported+0x8 0113f998 77997bbe 00f94000 3d39c64a 00000000 KERNEL32!BaseThreadInitThunk+0x19 0113f9f4 77997b8e ffffffff 779b8d3f 00000000 ntdll!__RtlUserThreadStart+0x2f 0113fa04 00000000 00000000 00000000 00000000 ntdll!_RtlUserThreadStart+0x1b STACK_COMMAND: ~0s ; .cxr ; kb SYMBOL_NAME: builder!XWorm.Client.isDisconnected+a9 MODULE_NAME: builder IMAGE_NAME: builder.exe FAILURE_BUCKET_ID: NULL_POINTER_READ_c0000005_builder.exe!XWorm.Client.isDisconnected OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x86 OSNAME: Windows 10 IMAGE_VERSION: 2.1.0.0 FAILURE_ID_HASH: {ab0d02c5-881b-c628-2858-a241c5c41b1f} Followup: MachineOwner --------- TS: Exploitable - Data from Faulting Address controls Code Flow starting at builder!XWorm.Client.isDisconnected+0x00000000000000a9 (Hash=0xc8c3bc2d.0x7badd95a)

Impressum