Auteur Sujet: [MMPC]Analysis of the Eleonore exploit pack shellcode (Lu 4260 fois)

igor51 · « **le:** juin 29, 2012, 15:04:22 »

Analysis of the Eleonore exploit pack shellcode

'?Eleonore' is a malware package that contains a collection of exploits used to compromise web pages. When the compromised web pages are viewed via vulnerable systems, the exploit payload is run. Eleonore is purchased by an attacker from an underground website. The attacker then gains access to Internet web servers and installs the exploit by modifying webpages, which are then served to the public. The malware pack also contains functionality for the tracking and management of compromised computers.
<a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/0005.Exploit_2D00_pack_5F00_sm.jpg"><img style="border: 0px currentColor;" alt="Remote attacker purchases the exploit pack, installs Eleonore (courtesy of MMPC)" src="http://blogs.technet.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/0005.Exploit_2D00_pack_5F00_sm.jpg" width="609" height="434" /></a>
Image 1 - Remote attacker purchases the exploit pack, retrieves web pages from Internet servers and installs Eleonore Eleonore is developed and released as version updates. This blog post focuses on the shellcode exploit from one of the releases, version 1.2. At a high level, the Eleonore shellcode locates kernel32.dll in an exploited process space. It uses the spatially efficient hash lookup to find the absolute address of key Kernel32 APIs:
<a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/3731.BID072_2D00_001B.png"><img border="0" alt="" src="http://blogs.technet.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/3731.BID072_2D00_001B.png" /></a> <a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/3286.BID072_2D00_002B.png"><img border="0" alt="" src="http://blogs.technet.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/3286.BID072_2D00_002B.png" /></a>
Image 2 - FindFuncHash routine
 With access to these functions, the shellcode creates a file in the temporary files folder (%TEMP%) and calls URLDownloadToFile with a URL that is 0x67 bytes after the shellcode. The shellcode then executes that file.
The exact URL is dependent on bytes included in the exploit payload and is beyond the scope of this analysis. The exploit then decrypts bytes right after the shellcode for another URL and calls URLDownloadToFile for a second time, copying the file from a URL such as the following:
<website domain with Eleonore installation>/path/getexe.php
This URL was obtained by looking at the entire exploit payload from an Eleonore installation - that data is not included in this article. The "getexe.php" file creates a server-side response that returns a file named "load.exe". The contents of this file are put into a secondary file, decrypted in memory, written back to the file and finally executed.
<a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/2555.decrypt.jpg"><img style="border: 0px currentColor;" alt="Decrypt routine" src="http://blogs.technet.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/2555.decrypt.jpg" width="200" /></a>
Image 3 - DecryptBytes routine
 
The shellcode ends here as "load.exe" begins, with the affected computer now compromised.
Eleonore v1.2 contained numerous exploits and attack code that targets several programs including:
<div class="ExternalClass9A1D0A33F81A4039BDBFDEF058E7847C">
<ul>
<li>DirectX 9, affecting certain versions of Windows operating system</li>
<ul>
<li>Vulnerability discussed in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0015">CVE-2008-0015</a> and fixed with Microsoft Security Bulletin <a href="http://technet.microsoft.com/en-us/security/bulletin/ms09-032">MS09-032</a></li>
<li>Malware detected as Exploit:JS/CVE-2008-0015 and Exploit:HTML/CVE-2008-0015</li>
</ul>
<li>Microsoft Internet Explorer 7 memory corruption</li>
<ul>
<li>Vulnerability discussed in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0075">CVE-2009-0075</a> and fixed with Microsoft Security Bulletin <a href="http://technet.microsoft.com/en-us/security/bulletin/ms09-002">MS09-002</a></li>
<li>Malware detected as Exploit:JS/CVE-2009-0075</li>
</ul>
<li>Microsoft Internet Explorer ActiveX control "snpvw.Snapshot viewer Control.1"</li>
<ul>
<li>Vulnerability discussed in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2463">CVE-2008-2463</a> and fixed with Microsoft Security Bulletin <a href="http://technet.microsoft.com/en-us/security/bulletin/ms08-041">MS08-041</a></li>
<li>Malware detected as Exploit:JS/Objsnapt.E, Exploit:JS/Objsnapt.F and Exploit:HTML/Snavic.gen!D</li>
</ul>
<li>Microsoft Internet Explorer 6 MDAC</li>
<ul>
<li>Multiple vulnerabilities, discussed in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0549">CVE-2004-0549</a> and <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0003">CVE-2006-0003</a>, and fixed with Microsoft Security Bulletin <a href="http://technet.microsoft.com/en-us/security/bulletin/ms04-025">MS04-025</a> and <a href="http://technet.microsoft.com/en-us/security/bulletin/ms06-014">MS06-014</a></li>
<li>Malware detected as TrojanDownloader:VBS.Psyme.X, TrojanDownloader:JS/Adodb (and other names)</li>
</ul>
<li>Opera telnet 9.25</li>
<ul>
<li>Vulnerability discussed in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0473">CVE-2004-0473</a> and fixed with an update of the <a href="http://www.opera.com/download/">Opera components</a></li>
</ul>
<li>Certain versions of Mozilla Firefox</li>
<ul>
<li>Multiple vulnerabilities, discussed in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677">CVE-2006-3677</a> and <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2478">CVE-2009-2478</a>, and fixed by updating to a version of <a href="http://www.mozilla.org/">Mozilla Firefox</a> newer than 3.5.0</li>
</ul>
<li>Certain versions of Adobe Reader</li>
<ul>
<li>Multiple vulnerabilities, discussed in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2992">CVE-2008-2992</a>, and fixed by updating to the latest version of <a href="http://www.adobe.com/">Adobe Reader</a></li>
</ul>
</ul>
</div>
 To protect against Eleonore and other threats, the MMPC recommends maintaining security updates across all products, not only those serviced by Microsoft Windows updates, and using security software with active scanning enabled.
 
-- Nik Livic & Patrick Nolan, MMPC
 <div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3493524" width="1" height="1">
Source: Analysis of the Eleonore exploit pack shellcode

Auteur Sujet: [MMPC]Analysis of the Eleonore exploit pack shellcode (Lu 4260 fois)

igor51

[MMPC]Analysis of the Eleonore exploit pack shellcode