shellcode analysis - basic and concept
TRANSCRIPT
[email protected] 鄭毓芹 成大電通所
Page § 2
Vulnerability, exploit code, shellcode
§ Vulnerability is a weakness which allows an attacker to reduce a system's Information Assurance
§ Vulnerability is also known as the attack surface, an attacker must have at least one applicable tool or technique that can connect to a system weakness.
§ An exploit is a piece of software, a chunk of data, or sequence of commands in order to cause unintended or unanticipated behavior to gain control according to vulnerabilities.
§ a shellcode is a small piece of code used as the payload in the exploit code. "shellcode” starts a command shell from which the attacker can control the compromised machine.
Page § 3
MS09002 Internet Explorer Remote Code Execution Vulnerability
§ Published Day: 2009-02-10 § CVE(CAN) ID: CVE-2009-0075
§ Classification: Critical (Windows XP Service Pack 2 and Windows XP Service Pack 3 + IE7)
§ Patch: Cumulative Security Update for Internet Explorer (kb961260) § Description: 已成為最受歡迎的網頁掛馬所使用的弱點。IE7與IE8的CFunctionPoint函數沒有正確的檢查DOM所夾帶的參數內容,進而可以使用特殊的字串迫壞記憶體保護機制,導致攻擊者能夠用當時使用者登入的權限執行”任何程式”,MS09002 Exploit code 使用JavaScripts Heap Spray,導致使用者無法正常瀏覽網頁,執行惡意程式碼。
Page § 4
Web Page
HTML Content
MS09002 Exploit
ShellCode
HTML Content . . .
0C 0C 0C 0C 0C 0C 0C
HTML Content
0C0C0C1C
0B1B0270 0C 0C 0C 0C 0C 0C 0C
0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C
Shellcode content
0C0C0C2C 0C0C0C3C
……
HTML Content
0B1B0280 (Heap Spray)
Browsing Exploit Code Attack IE
Execute Shell Code
Page § 7
Shellcode Encode 2: Base64
§ Step 1: 將每個字元先行轉成2進位表示的碼表, § Step 2: 以四個~六個字元為單位加以切割成區段,
§ Step 3: 每個區段補位成為8位, § Step 4: 對應碼表轉換
0 -------------------------- --------25 26--------------------------51 52 -----------------------61 62 63
ABCDEFG------------XYZ abcd ---------------xyz 0 1 2 3 4 5 6 7 8 9 + /
01100001 01100010 01100011
011000 | 010110 | 001001 | 100011
00011000 | 00010110 | 00001001 | 00100011
分成四個
碼表轉換
補足位數
24 (Y) 22(W) 9(J) 35(j) 編碼結果
a b c
Page § 10
Shellcode Encode 4: US-ASCII 編碼
§ 特徵:類似中國文字,並且含有 <meta http-equiv=“Content-Type” content=“text/html; charset=US-ASCII” />
[email protected] 鄭毓芹 成大電通所
Page § 12
PDF Introduction
§ PDF : Portable Document Format (可攜式文件)
§ PDF 特性: • 跨平台 (Cross Platform)
• 保留原始文件格式 ( Page Layout) • 開放標準 (Open Standard)
§ 2007年12月,PDF format成為標準
§ PDF Reader : Adobe Reader, Foxit Reader, Sumatra PDF
§ ASCII – based document
Page § 13
PDF Format
PDF Start (Version)
PDF Object Cross Reference Table Trailer
End of File
obj
endobj
/JS
• Object (obj … endobj) : stream data element • JavaScript object starts with /JS
Understand more PDF format: http://www.4xpdf.com/2008/10/download-iso-32000-1-document-for-free-from-adobecom/
Page § 14
PDF Format -- PDF Objects
Object Name: Description: /OpenAction /AA (Additional Action) Run automatically the scripts or actions
/Names /AcroForm /Action
Run and launch scripts or actions
/JavaScript /JS Run Javascripts
/GoTo* Change view to a specified destination within PDF or another PDF /Launch Launch a program or open a document /URI Access URL /SubmitForm /GoToR Send data to URL
/RichMedia Embed Flash in PDF
/Filter Compression or Encoding format for binary stream
/ObjStm Hide objects inside an Object stream
Page § 15
Malicious PDF attacking: How it works!!!
Hackers crafted malicious PDF
Distribute via email attachments
Embed into malicious web page
other means: upload,usb,p2p
Open the file with vulnerable pdf reader or browser PDF plugin
Payloads
Execute malicious payloads
Page § 16
Malicious PDF attacking: why PDF is targeted
§ PDF is widely used in the IT
§ Popular PDF readers and creators have bugs (Acrobat Reader 8.1.1 has several vulnerabilities)
§ Easy to combine with spam mails.
§ Easy to combine with client-side attack (PDF plungin on web browsers)
Page § 17
Malicious PDF Analysis Methodology
Observe PDF structure
Extract code segments
Disassemble malicious code
Find next steps
Decrypt, locate and extract suspicious embedded code segments
Observe PDF structure and content such as shellcode, VBA macros, or JavaScript.
Disassemble, deobfuscate and examine JavaScript, ActionScript or VB macro code
Understand the next infected step
Observe PDF structure
Page § 18
Malicious PDF Analysis -- Tool Requirements
§ Analysis Platform: Linux-based (Ubuntu recommend)
§ Text Editors: – McAfee FileInsight:
http://download.nai.com/products/mcafee-avert/fileinsight.zip
– Pyew: http://code.google.com/p/pyew/ – Others: vim, geditor, emeditor
Page § 19
Malicious PDF Analysis -- Tools
§ Wepawet: Analysis web-based malware – http://wepawet.iseclab.org/
§ Jsunpack: A Generic JavaScript Unpacker – http://jsunpack.jeek.org/dec/go
§ PDFTK : PDF stream decoder
§ SpiderMokey: JavaScript Emulator
§ Sctest of Libemu: shellcode analysis
§ PDF StructAzer: displays structure and raw contents of the PDF file
§ PDFiD: identify strings with scripts and actions in PDF files
§ PDF-parser: identify key elements of PDF file without rendering it
Page § 20
Malicious PDF Analysis -- Tools (Cont.)
§ Origami Walker: examine the structure of PDF files.
§ Origami pdfscan: identify strings with scripts and actions
§ Origami extractjs: extract JavaScript from PDF files
§ Jsunpack-n’s pdf.py: extract JavaScript from PDF files.
§ Malzilla: help deobfuscate JavaScript
Page § 21
Buildup PDF Analysis Lab
§ Step 1: choose text editor, vim.tiny or gedit § Step 2: apt-get install python
§ Step 3: apt-get install pdftk § Step 4: Install libemu
– wget http://ncu.dl.sourceforge.net/project/nepenthes/libemu%20development/0.2.0/libemu-0.2.0.tar.gz
– tar zxvf libemu*.tar.gz – cd libemu-0.2.0 – ./configure –prefix=/opt/libemu/ – make && make install
Page § 22
Buildup PDF Analysis Lab (Cont.)
§ Step 5: – wget http://www.didierstevens.com/files/software/js-1.7.0-mod.tar.gz
– tar zxvf js-1.7.0-mod.tar.gz – cd js/src – export CFLAGS=“-DJS_C_STRINGS_ARE_UTF8” – make –f Makefile.ref – JS_DIST=/opt/js make –f Makefile.ref export
Page § 23
Before we start …..
1. 打開文件觀察,找出 /JS or /Javascripts 2. 確認是否有壓縮,利用PDFTK解壓縮 3. 觀察是否為 obfuscated javascript,利用JS (SpiderMonkey)
4. 分析Shellcode,利用 Sctest (Libemu)
Page § 24
Analysis Sample 1 : Observe /JS
§ $vim.tiny sample1.pdf To find /JS or /Javascripts
§ Look Object 7 (including heap spray code)
§ util.printf ( ) trigger malicious exploit code
§ This is Adobe Reader 'util.printf()' JavaScript Function Stack Buffer Overflow Vulnerability ( http://www.securityfocus.com/bid/30035)
Page § 26
Analysis Sample1 : Shellcode Inspection
§ This is a malicious PDF file
§ Copy the var payload to the end and save into shellcode.txt
§ Remove chars using vim.tiny – 移除+符號 : %s/[\”+\.]//g
– 移除段行符號: %j
§ Reform uniform using perl code to format – cat shellcode.txt | perl –pe ‘s/\%u(..)(..)/chr(hex($2)).chr(hex($1))/ge’ |
hexdump –C
– cat shellcode.txt | perl –pe ‘s/\%u(..)(..)/chr(hex($2)).chr(hex($1))/ge’ > shellcode.bin
Page § 27
Analysis Sample1: Shellcode Analysis
§ Feed the shellcode.bin to sctest – /opt/libemu/bin/sctest -Ss 100000 < shellcode.bin
A reverse shell to ip 202.190.85.36 to port 7777
Page § 28
Analysis Sample2: Observe /JS
§ $vim.tiny sample2.pdf To find /JS or /Javascripts § Look Object 1 and search ‘Z0pEA5PLzPyyw()’ function
§ Found /Filter : This PDF is decompressed.
FilterDecode + ASCIIHexDeCode Stream Length
Stream Objects
• FlateDecode : use standard zlib compression • ASCIIHexDeCode :hex chars conversion
Page § 29
Analysis Sample2: Decompression
§ Decompression: use PDFTK – pdftk sample2.pdf output dc-sample2.pdf uncompres
§ Observe /JS again in decompressed PDF
Page § 30
Analysis Sample3: Obfuscated JavaScript Analysis
§ PDF readers have their own javascript engine and bugs
§ Malicious PDF could execute javascript to trigger exploit codes to attack bugs
§ Use JS emulator to analyze javascript
Page § 31
Analysis Sample3: Observe and decompress
§ Decompress – pdftk sample3.pdf output dc-sample3.pdf uncompress
§ Look for /JS and find Object 13
§ Object 13 contains JavaScript code
§ Copy the JavaScript to sample3.js
§ Remove (^M) that generated by PDFTK
%s/\^M//g using vi
Page § 32
Analysis Sample3: JavaScript Analysis
§ JavaScript Emulator – /opt/js/bin/js sample3.js
§ Analysis on the eval.001.log file
Page § 33
Analysis Sample3: Shellcode Reform and Analysis
§ Unicode reform: – cat shellcode.txt | perl –pe ‘s/\%u(..)(..)/chr(hex($2)).chr(hex($1))/ge’ |
hexdump –C – cat shellcode.txt | perl –pe ‘s/\%u(..)(..)/chr(hex($2)).chr(hex($1))/ge’ >
shellcode.bin
§ Shellcode Analysis – /opt/libemu/bin/sctest –Ss 100000 < shellcode.bin
Page § 35
Analyze sample 4 : PDF syntax ObfuscaMon
§ PDF use syntax for document handling – This.Info.Title – getPageNum
Analysis Steps: – Observe and decompress – Extract Javascript – JS analysis – Shellcode execute and analysis
How many exploits ? List the downloading URL and malware
Julia Cheng [email protected]