Clicky

Pages

Thursday, October 14, 2010

Oct 08 CVE-2010-2883 PDF Nuclear Challenges and Responses in the Century from JUN.Bong-Geun@ifans.go.kr

CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.3.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information. 


Download Conference Information_2010 IFANS Conference on Global Affairs (1001)  as a password protected archive (contact me if you need the password)


----Original Message-----
From: JUN.Bong-Geun@ifans.go.kr [mailto:JUN.Bong-Geun@ifans.go.kr]
Sent: Friday, October 08, 2010 1:43 PM
Subject: Nuclear Challenges and Responses in the Century

Dear all

We inform you of an event and expect your kindly opinions.
On October 4th-5th 2010, the  IFANS Conference on Global Affairs in 2010, "Nuclear Challenges and Responses in the  Century" is hosted by the Institute of Foreign Affairs and National Security (IFANS) and the Presidential Council for Future and Vision (PCFV), and is organized by the Institute of Foreign Affairs and National Security (IFANS),ROK.

At the conference,in-depth discussion is expected among international and Korean experts and turn-out policy recommendations in terms of three subjects.
The sessions and programs were attached to a file "Conference Information.pdf".


Headers
Received: (qmail 13720 invoked from network); 8 Oct 2010 01:43:34 -0000
Received: from mail.tekkan.com (HELO mail.tekkan.com) (164.46.125.50)
  by XXXXXXXXXXXXXXXXX; 8 Oct 2010 01:43:34 -0000
Received: from mofat-p6463dmel ([221.9.247.17])
    by mail.tekkan.com (8.12.11.20060829/8.11.3) with SMTP id o981guo7022508;
    Fri, 8 Oct 2010 10:42:59 +0900
Message-ID: <201010080142.o981guo7022508@mail.tekkan.com>
From: JUN.Bong-Geun@ifans.go.kr
To:
Subject: Nuclear Challenges and Responses in the  Century
Date: Fri, 8 Oct 2010 10:43:08 -0700
X-Mailer: CSMTPConnection v2.17
MIME-Version: 1.0
Content-Type: multipart/mixed;
    boundary="ad7e60eb-fca5-415b-9c56-9d74439519e2"
Content-Transfer-Encoding: quoted-printable

Hostname:    221.9.247.17
ISP:    China Unicom Jilin province network
Organization:    China Unicom Jilin province network
Assignment:    Static IP
 Country:    China 
State/Region:    Jilin
City:    Changchun



 Virustotal
http://www.virustotal.com/file-scan/report.html?id=0c8f17b2130addebcb2ca75bd7a982e37ddcc49d49e79fe60e3fda767f2ec972-1287057726
File name:Conference Information_2010 IFANS Conference on Global Af[...].pdf
Submission date:2010-10-14 12:02:06 (UTC)
Current status:
14/ 43 (32.6%)
Avast    4.8.1351.0    2010.10.14    PDF:CVE-2010-2883
Avast5    5.0.594.0    2010.10.14    PDF:CVE-2010-2883
AVG    9.0.0.851    2010.10.14    Exploit_c.LMW
BitDefender    7.2    2010.10.14    Exploit.PDF-TTF.Gen
Comodo    6388    2010.10.14    UnclassifiedMalware
F-Secure    9.0.16160.0    2010.10.14    Exploit.PDF-TTF.Gen
GData    21    2010.10.14    Exploit.PDF-TTF.Gen
Kaspersky    7.0.0.125    2010.10.14    Exploit.Win32.CVE-2010-2883.a
NOD32    5530    2010.10.14    JS/Exploit.Shellcode.A.gen
Norman    6.06.07    2010.10.14    HTML/Shellcode.Q
nProtect    2010-10-14.01    2010.10.14    Exploit.PDF-JS.Gen
PCTools    7.0.3.5    2010.10.14    Trojan.Pidief
Sophos    4.58.0    2010.10.14    Mal/JSShell-B
Symantec    20101.2.0.161    2010.10.14    Trojan.Pidief
Additional information
Show all
MD5   : 3abfe5fd78ffddebf23bd46edf4e4eb7



Created files

C:\windows\system32\syschk.ocx
File name: syschk.ocx
MD5   : 16ba21c1eac48eb20c04ac91ef9c2bd1
Submission date: 2010-10-16 04:33:16 (UTC)
Result: 0/ 43 (0.0%)

Strings (yes, C:\Documents and Settings\Mila\Desktop\Conference Information_2010 IFANS Conference on Global Affairs (1001).pdf" is not a accidental paste, it is in the file = inserted path from the original location of the pdf.


C:\windows\system32\form.ocx  = same string as it tried to download = see the pcap screenshot below


 File: form.ocx
MD5:  279b3b44fa1ac9e72d030ff42b1b77c6
Size: 15

Ascii Strings:
---------------------------------------------------------------------------
02510c

Unicode Strings:
---------------------------------------------------------------------------



66.220.9.57
Hostname:    www.mbizgroup.biz
ISP:    Hurricane Electric
Organization:    LaFrance Internet Services
Proxy:    None detected
Type:    Corporate
Assignment:    Static IP
Country:    United States
State/Region:    California
City:    Fremont


Sunday, September 26, 2010

Crimepack 3.1.3 Exploit kit info


Download Crimepack 3.1.3 Deny IP list CrimepackDenyiplist.txt

Download deny ip list as is, without whois info



Please note that I am not the owner of the exploit pack and will not post any files for the download. Thank you ~ Mila
Update 2 Sept 29
The cryptor.php, which is the pdf builder, indeed contains enough code to build malicious pdf for the last Adobe zero day CVE-2010-2883. However, it appears to be work in progress and not a fully implemented feature. Will post more information as it becomes available.

Update 1 sept 27 Percy Sabourin @Garlandors pointed out that one piece of code was taken from the Metasploit exploit for the "Cooltype" Adobe 0 day CVE-2010-2883, which became public on Sept. 9, 2010. See the last screenshot and below this paragraph. The code indeed looks the same, we first thought it was only for the content part of the pdf but at this time it is not clear whether the pdf generator would actually generate a working pdf exploit using this vulnerability CVE-2010-2883. There are no corresponding ini or php files in the pack too. Also, nearly all php files in the pack are encrypted with ionCube encoder.

Also, it means the pack or at least crypter.php was produced during the period Sept 9-21, 2010

        $PDFFile .= self::rndSeparators("<>",0);
        $PDFFile .= self::rndSeparators("endobj",0);
        $PDFFile .= self::rndSeparators("8 0 obj ",0);
        $PDFFile .= self::rndSeparators("<>",0);
        $PDFFile .= self::rndSeparators("stream",0);
        $PDFFile .= self::rndSeparators("0 g BT /F7 32 Tf 32 Tc 1 0 0 1 32 773.872 Tm (Hello World!) Tj   ET",0);
        $PDFFile .= self::rndSeparators("endstream",0);
        $PDFFile .= self::rndSeparators("endobj",0);
        $PDFFile .= self::rndSeparators("9 0 obj ",0);
        $PDFFile .= self::rndSeparators("<>",0);
        $PDFFile .= self::rndSeparators("endobj",0);

Crimepack 3.1.3 Java exploit analysis is available at InReverse.net by Donato 'ratsoul' Ferrante
Crimepack 3.1.3 – checking vital signs

 Crimpack 3.1.3 Deny IP list
(to prevent analysis and detection by security companies and ISP providers) 




Crimepack 3.1.3 includes 15 exploits listed below. 

001
name="mdac"
desc="IE6 COM CreateObject Code Execution"
CVE-2006-0003 -MS06-014 for lE6/Microsoft Data Access Components (MDAC) Remote Code Execution

002
name="msiemc"
desc="IE7 Uninitialized Memory Corruption"
CVE-2009-0075/0076 - MS09-002 - lE7 Memory Corruption

003
name="javagetval"
desc="Java getValue Remote Code Execution"
CVE-2010-0840 Java Trusted Method Chaining

004
name="javanew"
desc="JRE 'WebStart' RCE"
CVE-2010-1423 - Java Deployment Toolkit Remote Argument Injection Vulnerability

005
name="javaold"
desc="Java Deserialize"
CVE-2008-5353 - Javad0—JRECalendar  Java Deserialize

006
name="hcp"
desc="Microsoft Help & Support Centre"
CVE-2010-1885 - Help Center URL Validation Vulnerability

007
name="iepeers"
desc="IEPeers Remote Code Execution"
CVE-2010-0806 - IEPeers Remote Code Execution

008
name="pdfexpl"
desc="PDF Exploits (collectEmailInfo, getIcon, util.printf)"
CVE-2008-2992 - PDF Exploit• util.printf     
CVE-2009-0927 - PDF Exploit- collab.getlcon      
CVE-2007-5659/2008-0655 - PDF Exploit -collab, collectEmaillnfo

009
name="opera"
desc="Opera TN3270"
CVE-2009-3269 - Telnet for Opera Th3270 

010
name="aol"
desc="AOL Radio AmpX Buffer Overflow"
CVE-2007-5755 - AOL Radio AmpX Buffer Overflow 

011
name="iexml"
desc="Internet Explorer 7 XML Exploit"
CVE-2008-4844 - Internet Explorer 7 XML Exploit 

012
name="firefoxdiffer"
desc="Firefox 3.5/1.4/1.5 exploits"
CVE-2009-0355 - Firefox - Components/sessionstore/src/nsSessionStore.js 

013
name="spreadsheet"
desc="OWC Spreadsheet Memory Corruption"
CVE-2009-1136 - MSO9-043 - lE OWC Spreadsheet ActiveX control Memory Corruption
 

The following exploits that were present in the previous versions were removed:
CVE-2008-2463 - M508-041 - MS Access Snapshot Viewer
CVE-2009-3867 - Java Runtime Env. getSoundBank Stack BOF  
CVE-2010-0188    PDF Exploit - LibTiff Integer Overflow  

PDF Generator
This version of exploit pack does not include many pdf exploits - only three older ones using the following vulnerabilities. 
CVE-2008-2992 - PDF Exploit• util.printf     
CVE-2009-0927 - PDF Exploit- collab.getlcon      
CVE-2007-5659/2008-0655 - PDF Exploit -collab, collectEmaillnfo


However, it includes a pdf exploit builder - generator cryptor.php, which will generate malicious pdfs on the fly with various MD5 hash values for each victim.
Please read a bit more at InReverse.net