iworkstation Version 9.3.2.1.4 dll hijacking exploit

http://inj3ct0r.com/exploits/14286

Quick Player 1.3 Unicode SEH Exploit.

http://www.exploit-db.com/exploits/15156

http://inj3ct0r.com/exploits/14339

http://packetstormsecurity.org/1009-exploits/quickplayer-sehoverwrite.txt

Digital Music Pad Version 8.2.3.3.4 SEH overflow Metasploit Module

http://www.metasploit.com/svn/framework3/trunk/modules/exploits/windows/fileformat/digital_music_pad_pls.rb

http://www.exploit-db.com/exploits/15134

http://inj3ct0r.com/exploits/14339

http://packetstormsecurity.org/1009-exploits/digital_music_pad_pls.rb.txt

DJ Studio Pro Version 8.1.3.2.1 SEH Exploit!

http://www.exploit-db.com/exploits/15031

http://inj3ct0r.com/exploits/14098

Audiotran 1.4.2.4 SEH Overflow Exploit!

http://www.exploit-db.com/exploits/14961

http://inj3ct0r.com/exploits/14059

http://packetstormsecurity.org/1009-exploits/audiotran1424-overflow.txt

Virtual DJ Trial 6.1.2 SEH Buffer Overflow Crash Proof of Concept!

http://www.exploit-db.com/exploits/14909

http://inj3ct0r.com/exploits/13990

http://packetstormsecurity.org/1009-exploits/virtualdjtrial-overflow.txt

Recreating exploits from malware samples found in the Wild!!!

This time we are releasing analysis of a malicious OLE document. This Malware exploits vulnerability in MS Word 2003. CVE-2006-6456


The malware sample for analysis is available at Mila’s blog (Greets Mila :)
http://contagiodump.blogspot.com/2010/09/cve-2009-4324-pdf-cmsisixthannualconfer.html


When we analyze with Offviz we see that there in invalid value for sprm.sgc

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
When we parse the document with OfficeMalScanner from http://www.reconstructer.org/code.html we find embedded OLE file at offset 0xdc00 and embedded executable at 0x4c00 encoded with XOR key 0x95
 
 
 

 
 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
We remove the malicious executable and the OLE file from the exploits file. Now we are left with the exploit file along with shellcode. We analyze the remaining (clean.doc) exploit file in Hex Workshop we find another XOR’ed section encoded with same key 0x95. This might be the encoded shellcode.
 
 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
So we extract this section and convert it into exe from http://sandsprite.com/shellcode_2_exe.php to analyze it in debugger. Here we see the shellcode IS actually XOR’ed with 0x95 key
 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
We Decode the shellcode and analyze in HEX again. We see that shellcode writes the exe to disk as SUCHOST.EXE.
 
 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
So now we got the location of shellcode also. Here we can remove the shellcode of malware and replace it with our shellcode.




The original malware, extracted executable, extracted OLE document, shellcode, decoded shellcode and a reconstructed POC file which calc.exe can be downloaded from::: http://www.mediafire.com/download.php?u55xgb1jpasp8na



There are 2 POC files one executes CMD.exe and other one executed CLAC.exe. Tested on XP SP 2 Office 2003.....



Greetz:: Mila, Villy, Puneet Jain, WEBDevil, ASL IT Sec Team



References::
http://contagiodump.blogspot.com/


http://www.reconstructer.org/


http://sandsprite.com/products.html