SWF Exploit - CVE-2007-0071 Part 1

Last week there were a lot of malware cases that included exploited SWF files.

> Vulnerability

Related blogs written by

> Dancho Danchev
> my former colleague in Trend Micro, Gerald Carsula, who now works in F-secure
> my colleague in PC Tools, Sergei Shevchenko

So here's a guide on how I did it ...

First you have to understand Mark Dowd's research paper on this vulnerability

(I will skip the negative number that will make memory allocation malfunction)

Based from this research the shellcode will be in the DEFINEBITS section.

Excerpt from Mark Dowd's research paper
------------------------------------------------------------
So, the completed SWF file would look something like this:
[ SWF Header ]
[ Corrupt DefineSceneAndFrameLabelData tag ]
[ DefineBits tag with shellcode ] <--------- here it is
[ DoABC tag with malicious bytecode ]
[ ShowFrame tag ]
------------------------------------------------------------

So what I did, is used the swfdump tool to give me the DEFINEBITS section.

You can get it here ... and its free ... yeah you read it right ... its free.



from there I got this result
(you need to use the pipe > to redirect the output to a file)

swfdump -atpdu [filename] > logfile



continuation ....



now just one more to show the SHOWFRAME, it needs to be 1

Again excerpt from Mark Dowd's research document
-------------------------------------------------------------------
Notice the last tag in this file is a “ShowFrame” tag (tag 0x01).
This is required for the methods in the DoABC tag to be executed.
-------------------------------------------------------------------



from there we will know which offsets we are going start extracting the DEFINEBITS section...

so in this one it is in offset 1C to 41B, you can use your favorite hex editor to do this part, in my case I prefer to use the ever powerful hiew (well thats just my opinion).

From there we can save it to a file



Now, the extracted file can now be loaded in your IDA Pro.
Do not forget, it should be disassembled in 32-bit mode.



Well thats just the decryptor code.


I will do the decryption tomorrow ... see yah ...

de0bfuscating ne0spl01t manually ...

This advance exploit framework contains obfuscated script to make analysis harder.

Here is a way to bypass its obfuscation technique without tools.
(I am not providing the original script in here, I'm sure there are a lot of compromised websites out there ... ehheheh ... and this example is applicable just to this one I am working on)

VirusTotal result
http://www.virustotal.com/analisis/20c0debb36bd8d75f33b15c0ab077931

Below is the screenshot of the script, in word wrap.



The script is dependent on arguments.callee.toString() and to the location.href. This means we need to have the original script function and the correct location.href (Referrer).

So how are we going to deobfuscate this script?

First, we need to check the original code. In my case I changed the format so I can understand what the program does.



I keep on highlighting "arguments.callee.toString() + location.href" because the program will depend on the value of these instructions. Another dependency is the parameter passed to the function.


Below is a screenshot of the script's original format, I highlighted the parameter used.



Based from my analysis of the script code, the parameter is the string we need to decrypt.


Below shows the part of the decryption process.




Ok ... now lets get to the part where we will deobfuscate the script.

What the program needs to execute properly?
1. The parameter passed to the function.
2. The calling function's code, untampered.
3. The location.href value
4. Our drop file or document.write.

Just a quick background
reference: http://www.comptechdoc.org/independent/web/cgi/javamanual/javalocation.html

JavaScript Location Object
The JavaScript location object is a property of the window object. It can be used to control the web page displayed by the browser.

Properties
href - The entire URL.

Now ... it will look like this




We can get a copy of the code by adding the following at the end of the decryption process.

var fso = new ActiveXObject("Scripting.FileSystemObject");
var a = fso.CreateTextFile("c:\\testfile.txt", true);
a.WriteLine(T5ctkgA8R);
a.Close();

or you can just add the instructioon below.

document.write()

after this we will get the second obfuscated code, we just have to apply what we did here to the second code. Then from there you can get the deobfuscated code.

Hope this help ...