Clicky

Pages

Sunday, September 26, 2010

Crimepack 3.1.3 Exploit kit info


Download Crimepack 3.1.3 Deny IP list CrimepackDenyiplist.txt

Download deny ip list as is, without whois info



Please note that I am not the owner of the exploit pack and will not post any files for the download. Thank you ~ Mila
Update 2 Sept 29
The cryptor.php, which is the pdf builder, indeed contains enough code to build malicious pdf for the last Adobe zero day CVE-2010-2883. However, it appears to be work in progress and not a fully implemented feature. Will post more information as it becomes available.

Update 1 sept 27 Percy Sabourin @Garlandors pointed out that one piece of code was taken from the Metasploit exploit for the "Cooltype" Adobe 0 day CVE-2010-2883, which became public on Sept. 9, 2010. See the last screenshot and below this paragraph. The code indeed looks the same, we first thought it was only for the content part of the pdf but at this time it is not clear whether the pdf generator would actually generate a working pdf exploit using this vulnerability CVE-2010-2883. There are no corresponding ini or php files in the pack too. Also, nearly all php files in the pack are encrypted with ionCube encoder.

Also, it means the pack or at least crypter.php was produced during the period Sept 9-21, 2010

        $PDFFile .= self::rndSeparators("<>",0);
        $PDFFile .= self::rndSeparators("endobj",0);
        $PDFFile .= self::rndSeparators("8 0 obj ",0);
        $PDFFile .= self::rndSeparators("<>",0);
        $PDFFile .= self::rndSeparators("stream",0);
        $PDFFile .= self::rndSeparators("0 g BT /F7 32 Tf 32 Tc 1 0 0 1 32 773.872 Tm (Hello World!) Tj   ET",0);
        $PDFFile .= self::rndSeparators("endstream",0);
        $PDFFile .= self::rndSeparators("endobj",0);
        $PDFFile .= self::rndSeparators("9 0 obj ",0);
        $PDFFile .= self::rndSeparators("<>",0);
        $PDFFile .= self::rndSeparators("endobj",0);

Crimepack 3.1.3 Java exploit analysis is available at InReverse.net by Donato 'ratsoul' Ferrante
Crimepack 3.1.3 – checking vital signs

 Crimpack 3.1.3 Deny IP list
(to prevent analysis and detection by security companies and ISP providers) 




Crimepack 3.1.3 includes 15 exploits listed below. 

001
name="mdac"
desc="IE6 COM CreateObject Code Execution"
CVE-2006-0003 -MS06-014 for lE6/Microsoft Data Access Components (MDAC) Remote Code Execution

002
name="msiemc"
desc="IE7 Uninitialized Memory Corruption"
CVE-2009-0075/0076 - MS09-002 - lE7 Memory Corruption

003
name="javagetval"
desc="Java getValue Remote Code Execution"
CVE-2010-0840 Java Trusted Method Chaining

004
name="javanew"
desc="JRE 'WebStart' RCE"
CVE-2010-1423 - Java Deployment Toolkit Remote Argument Injection Vulnerability

005
name="javaold"
desc="Java Deserialize"
CVE-2008-5353 - Javad0—JRECalendar  Java Deserialize

006
name="hcp"
desc="Microsoft Help & Support Centre"
CVE-2010-1885 - Help Center URL Validation Vulnerability

007
name="iepeers"
desc="IEPeers Remote Code Execution"
CVE-2010-0806 - IEPeers Remote Code Execution

008
name="pdfexpl"
desc="PDF Exploits (collectEmailInfo, getIcon, util.printf)"
CVE-2008-2992 - PDF Exploit• util.printf     
CVE-2009-0927 - PDF Exploit- collab.getlcon      
CVE-2007-5659/2008-0655 - PDF Exploit -collab, collectEmaillnfo

009
name="opera"
desc="Opera TN3270"
CVE-2009-3269 - Telnet for Opera Th3270 

010
name="aol"
desc="AOL Radio AmpX Buffer Overflow"
CVE-2007-5755 - AOL Radio AmpX Buffer Overflow 

011
name="iexml"
desc="Internet Explorer 7 XML Exploit"
CVE-2008-4844 - Internet Explorer 7 XML Exploit 

012
name="firefoxdiffer"
desc="Firefox 3.5/1.4/1.5 exploits"
CVE-2009-0355 - Firefox - Components/sessionstore/src/nsSessionStore.js 

013
name="spreadsheet"
desc="OWC Spreadsheet Memory Corruption"
CVE-2009-1136 - MSO9-043 - lE OWC Spreadsheet ActiveX control Memory Corruption
 

The following exploits that were present in the previous versions were removed:
CVE-2008-2463 - M508-041 - MS Access Snapshot Viewer
CVE-2009-3867 - Java Runtime Env. getSoundBank Stack BOF  
CVE-2010-0188    PDF Exploit - LibTiff Integer Overflow  

PDF Generator
This version of exploit pack does not include many pdf exploits - only three older ones using the following vulnerabilities. 
CVE-2008-2992 - PDF Exploit• util.printf     
CVE-2009-0927 - PDF Exploit- collab.getlcon      
CVE-2007-5659/2008-0655 - PDF Exploit -collab, collectEmaillnfo


However, it includes a pdf exploit builder - generator cryptor.php, which will generate malicious pdfs on the fly with various MD5 hash values for each victim.
Please read a bit more at InReverse.net
read more...
Posted by Mila at 10:58 AM 0 comments Tags:

Friday, September 24, 2010

hello world

The week has been busy and no new updates were done. I am planning to post some this weekend - mostly CVE-2010-2883 and older (i.e. no new cve at the moment). Have a great weekend.


Posted by Mila at 8:24 AM 0 comments

Tuesday, September 21, 2010

Sep 21 CVE-2010-2883 PDF Agenda of the United Nations Criminal Justice Events in October 2010

CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.3.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information. 


Download  ac4a484bb27e08433f822d4120291be4 UNICRI-Agenda-2010.pdf as a password protected archive (contact me if you need the password)


From: Cook Henry [mailto:henry.b.cook@gmail.com]
Sent: Tuesday, September 21, 2010 2:46 PM
To: XXXXXXXXXX
Subject: Agenda of the United Nations Criminal Justice Events in October 2010

 sir,
   In case this is useful for you.


File name:
UNICRI-Agenda-2010.pdf
http://www.virustotal.com/file-scan/report.html?id=b058fcc16446464c0aa94edabbc98cfd87d5d2ac2f9e3009b11a3aff96ed53b7-1286451255
13/ 43 (30.2%)
AntiVir    7.10.12.146    2010.10.07    HTML/Malicious.PDF.Gen
Avast    4.8.1351.0    2010.10.07    PDF:CVE-2010-2883
Avast5    5.0.594.0    2010.10.07    PDF:CVE-2010-2883
AVG    9.0.0.851    2010.10.07    Exploit_c.KLX
BitDefender    7.2    2010.10.07    Exploit.PDF-TTF.Gen
Emsisoft    5.0.0.50    2010.10.07    Exploit.Win32.CVE-2010-2883.a!A2
F-Secure    9.0.15370.0    2010.10.07    Exploit.PDF-TTF.Gen
Fortinet    4.2.249.0    2010.10.07    PDF/CoolType!exploit.CVE20102883
GData    21    2010.10.07    Exploit.PDF-TTF.Gen
Kaspersky    7.0.0.125    2010.10.07    Exploit.Win32.CVE-2010-2883.a
Microsoft    1.6201    2010.10.07    Exploit:Win32/CVE-2010-2883.A
PCTools    7.0.3.5    2010.10.07    HeurEngine.MaliciousExploit
Symantec    20101.2.0.161    2010.10.07    Bloodhound.Exploit.357
Additional information
MD5   : ac4a484bb27e08433f822d4120291be4

Posted by Mila at 7:42 AM 0 comments Tags: ,

Friday, September 17, 2010

CVE-2010-2883 Adobe 0-Day David Leadbetter's One Point Lesson from 193.106.85.61 thomasbennett34@yahoo.com


Technical Analysis and Research links (just a few, in no particular order, send more if you want me to add)
Download  687b8d2112f25e330820143ede7fedce Golf Clinic.pdf as a password protected archive (contact me if you need the password)


Download files





  • golf clinic.pdf - (\Application Data) - 6AF93ED231AEA3B00769FC8283943E75
  • iso88591 - (same location as the original) F7A341ACBB05F6A597EC33ACCB7AD04E
  • wincrng.exe + winhelp32.exe (downloaded from academyhouse.us)  687B8D2112F25E330820143EDE7FEDCE
  • igfxver.exe (%tmp%)   E8CE9CB98C71405F0FB3888235302568 - dropped by the original

Download hlp.cpl signed with the stolen Verisign certificate issued to secure2.ccuu.com


Update 10
Lead Adobe 0-day CVE-2010-2883 Made in Korea  - by villy


Update9

[Unofficial] 0-Day Acrobat SING Table Vulnerability Patch (sent by INT3 CC, thank you)

https://www.rafzar.com/node/22

I did not test but heard it works well. Try it, test it

Update 8
 DEP Bypass in Golf Clinic PDF by Cédric Gilbert, SkyRecon Systems
Cédric Gilbert, from  SkyRecon Systems sent a short and later (per my request, because I wanted to understand it ) , a more detailed explanation for the DEP bypass  - in clear terms, for people who don't already know everything :)
Please comment and correct, if you find mistakes, we will add the corrections. Many thanks!
---------------------------------------------

There are 4 settings for DEP :
-          AlwaysOff
-          Opt-in
-          Opt-out
-          Always On


‘Opt-in’ is the one used by default on every Desktop Edition of Windows, while ‘opt-out’ is the default for Server Editions.
‘Opt-in’ only protects software that is fully compatible with DEP (those software programs are marked at compilation with the flag ‘/NXCOMPAT’).
‘Opt-out’ protects every software program (even the ones without /NXCOMPAT) except the ones explicitly added by the administrator to a white list.

“AcroRd32.exe” is not /NXCOMPAT, thus if an execution occurs in a page in memory marked as ‘not executable’ (the heap for instance), DEP in ‘opt-in’ mode will ignore the fault and silently change the rights of the page to ‘EXECUTE’. On the other hand, if DEP is set to ‘opt-out’, it will immediately kill the faulting process. This is why most exploits using heap spraying actually do work. Because even though execution occurs on the heap (NO EXEC) when the execution flow is redirected into the ‘nop’ slide, DEP in opt-in mode will not block the attack.

Now the writers of the exploit used in this case obviously wanted to go a step further by bypassing DEP even in its ‘opt-out’ or ‘always-on’ mode.

Which means that they had to find a way to execute their payload without triggering any ‘page fault’ in NO EXECUTE memory.

The best way to do so is to use some kind of ‘ret into libc’ technique (in this case a ROP technique). Instead of redirecting the execution flow into the heap, they redirect it to a CODE section in a DLL (which got EXECUTE rights) by overwriting saved eip on the stack. Of course no DLL exactly have the code that the attacker would like to execute, so the idea is to chain calls into this DLL on small code portions using return addresses smartly placed on the stack before the vulnerability is triggered. The problem with this technique is that it requires the attacker to use ‘hardcoded’ addresses pointing at each code portion that he wishes to execute. 

Starting with Windows Vista, Microsoft introduced a new protection called ‘ASLR’ for Address Space Layout Randomization. This protection, among other things, randomize the base address of each DLL when they get loaded into a process address space (the random base address changes at each boot). This protection was meant to defeat attacks, which used hardcoded addresses, since a randomized DLL place in memory is changing at each boot.

So to defeat both DEP and ASLR, the attacker got AcroRd32.exe to load a DLL not compatible with ASLR into its address space (I do not know how they managed to do so at the moment).
The DLL used is “icucnv34.dll”, the fact that it is not compatible with ASLR means that it will always get loaded at the same address in memory, thus allowing the attacker to use ‘hardcoded’ addresses pointing to this DLL.

The thing is, it’s very complicated to build a whole shellcode using this kind chained call into a DLL. So the attacker used it only to get a place in memory allocated with exec rights, copy his shellcode on it and, eventually, jump on it and do whatever he wants without caring about DEP anymore.

In this exploit, the attacker manages to do so by chaining 4 API call in “icucnv34.dll”.

1)      CreateFileA:
IN      LPCTSTR lpFileName                       = 4a8254e0                 = « iso88591 »
IN      DWORD dwDesiredAccess              = 0x 10000000           = GENERIC_ALL
IN      DWORD dwShareMode                   = 0                               = not shared
IN      lpSecurityAttributes (OPTIONAL)   = 0
IN      DWORD dwCreationDisposition      = 2                              = CREATE_ALWAYS
IN      DWORD dwFlagsAndAttributes      = 0x102                      = FILE_ATTRIBUTE_TEMPORARY | FILE_ATTRIBUTE_HIDDEN
Here the attacker creates an empty file called “iso88591” at the location where the pdf was opened.

2)      CreateFileMappingA
IN           HANDLE               hFile                                       = 0x1c4                = handle on « iso88591 » 
IN OPT  lpAttributes                                                            = NULL
IN           DWORD               flProtect                                  = 0x40                  = PAGE_EXECUTE_READWRITE
IN           DWORD               dwMaximumSizeHigh            = 0
IN           DWORD               dwMaximumSizeLow            = 0x10000
IN OPT  LPCTSTR              lpName                                    = NULL
Since the file is empty, the attacker has to specify an arbitrary size for the file mapping.
At this point the attacker is ready to map the file into memory.

3)      MapViewOfFile
IN           HANDLE               hFileMappingObject              = 0x2dc          = Handle from CreateFileMappingA
IN           DWORD                dwDesiredAccess                  = 0x22            = FILE_MAP_EXECUTE | FILE_MAP_WRITE
IN           DWORD               dwFileOffsetHigh                  = 0
IN           DWORD               dwFileOffsetLow                   = 0
IN           SIZE_T                  dwNumberOfBytesToMap    = 0x10000
Now the attacker’s got a 0x10000 bytes space with EXECUTE rights allocated into memory. All that he has to do to complete his ‘DEP-evading-technique’ is to copy the shellcode that he wishes to execute in this newly allocated exec space and jump on it.
Which he does by calling :
4)       MSVCR80!memcpy
Dst = 0x05bc0000     // Base Address returned from the MapViewOfFile above
Src = 0885f118          // Not sure whether it is an address from the mapping of the pdf itself or something that he sprayed on the heap before
Len = 0x1000

And here we are, after this call the real payload (at 0x0885f118) is mapped into an ‘EXEC’ memory space (at 0x05bc0000). The jump to the the payload is actually made by the memcpy call itself since the return address set on the stack by the attacker for this call is the destination of the copy (0x05bc0000) ! BAM! Both ASLR and DEP are defeated!

Now one may ask : ”Ok nice, icucnv34.dll is not ASLR-compatible, but kernel32.dll is, so how did the attacker get the required API addresses?”. Well, it is pretty simple actually, he just had to use API imported by icucnv34.dll ! When this DLL got loaded, its import table got fixed by the loader with the addresses of all API required by the DLL.
Since the base address of icucnv34.dll is known by the attacker, he just had to retrieve the needed addresses from icucnv34.dll import table :)
  Cédric Gilbert, SkyRecon Systems

 
Update7    - Aurora?
Here here an interesting observation by Itzhak Avraham (Zuk) @ihackbanme about the fact that this pdf is using a technique similar to one found in Aurora.


DMS.bat mentioned in Update 6, has been observed during analysis of ad_1_.jpg file, which was one of the files recovered during the Aurora investigation (see Aurora US-CERT advisory here)

ad_1_.jpg unpacking/analysis - Aurora by Itzhak Avraham (Zuk)

DFS.bat from ad_1_.jpg (Aurora)



The DMS.bat from CVE-2010-2883 Adobe 0-Day
:Repeat
DEL "C:\DOCUME~1\USER\LOCALS~1\Temp\hlp.cpl"
if exist "C:\DOCUME~1\USER\LOCALS~1\Temp\hlp.cpl" goto Repeat
DEL "C:\DOCUME~1\USER\LOCALS~1\Temp\DMS.bat" 



Update6
Exploit in action:(see a video demo in the end of this post)
According to Sophos researchers (many thanks to Chester Wisniewski) -
  • the shellcode drops hlp.cpl  DLL to  user %tmp% folder and then manually parses to its StartUp export and runs from there. 
  • wincrng .exe gets downloaded using the DLLs's "DownloadFile" export from hxxp://academyhouse .us/from/wincrng exe to user Application Data folder, renames it to winhelp32.exe and runs it. The domain is currently under the control of Shadow Server (http:/internal/tools/whois/?domain=academyhouse.us)
  • The DLL then calls its "MakeAndShowEgg" export, which reads a filename from the original PDF ("Golf Clinic.pdf") and then drops a clean PDF file (golf clinic.pdf 6AF93ED231AEA3B00769FC8283943E75) and launches it in Acrobat Reader so as not to arouse suspicion.  The text of the PDF, however, still arouses a lot of suspicion - see below :)
  • Finally the DLL calls the imaginatively-titled "DeleteMyself" export to drop the file DMS.bat which deletes the DLL and then itself.
  The DMS.bat contents are
:Repeat
DEL "C:\DOCUME~1\USER\LOCALS~1\Temp\hlp.cpl"
if exist "C:\DOCUME~1\USER\LOCALS~1\Temp\hlp.cpl" goto Repeat
DEL "C:\DOCUME~1\USER\LOCALS~1\Temp\DMS.bat"  
 

Update5
 
A few more variants of this message

Variant 2
from 119.247.163.249 MD5 2802c47b48cced7f1f027f3b278d6bb3
From: Thomas Bennett [mailto:Thomas.Bennett@gmx.com]
Sent: Tuesday, September 07, 2010 5:41 AM
To: xxx
Subject: Golf Clinic, David Leadbetter's One Point Lesson
Importance: High

Hi
Want to improve your score?
In these golf tips David Leadbetter shows you some important principles Cause & Effect, which have been helpful to thousands of amateur golfers around world.

Whatever your handicap, Whatever your age or ability, the tips will improve your game!

bye
read more...
Posted by Mila at 3:39 PM 3 comments Tags: , ,
Subscribe to: Posts (Atom)
Home