Another HTML exploit has surfaced and made a scene on the AV industry this November 2013. An exploit that takes advantage of the vulnerability of an ActiveX component of Internet Explorer which allows code execution when a user views a specially crafted webpage. Details on the vulnerability can be found on this Microsoft website.
ThreatTrack's Vipre 2013 detects this as Lookslike.HTML.CVE-2013-3918.a
The exploit uses a technique known as ROP (return-oriented-programming) that allows itself to run in non-executable memory areas. Once successfully exploited, it will intentionally exchange the address of the stack and heap and change the memory protection so that it can execute its shellcode.
ROP in action
In order to for it to execute, it changes the memory protection of the said area using VirtualProtect.
Changes protection level of memory
Once everything is in order, it will pass execution to the part of its shellcode that decrypts and computes for the API's needed to inject itself to another process.
- LoadLibraryA
- Winexec
- CreateThread
- OpenProcess
- CreateProcessA
- VirtualAllocEx
- WriteProcessMemory
- CreateRemoteThread
It uses the said APIs to create a process named "rundll32" under Internet Explorer, writes another section of its shellcode and activates the process using CreateRemoteThread API. It's interesting to note that it covers itself with multiple layers of encryption and employs multiple jumps in memory to avoid easy detection.
An example of decrypting code
Decryption in rundll32
Another interesting feature of this payload is in the way it calls for the APIs it needs. It initially sets up a jump table that points to single function that performs the call (specifically a jmp) varying only in the values it pushes. It is highly possible that it enforces this type of calling method in order to prevent researchers to easily identify the calls it uses and to quickly analyze the contents of its body.
Jump table for calling API
While its previous characteristics are trivial, the main purpose of this payload is to connect to a remote server that can be used or is being used for targeted attacks. It connects and listens to a remote IP address 111.68.9.93
Connects to a remote server
0 comments:
Post a Comment