# Exploit Author: TOUHAMI KASBAOUI
\n# Vendor Homepage: https:\/\/blog.cyble.com\/2022\/08\/19\/evilcoder-project-selling-multiple-dangerous-tools-online\/
\n# Software Link: N\/A# Version: 2.1# Tested on: Windows 10
\n# CVE : N\/A<\/p>\n
==================================================================
\nTHE BUG : NULL pointer dereference -> DOS crash
\n==================================================================
\nThe sophisticated XWorm Trojan is well exploited by EvilCoder, where they collect different features such as ransomware and keylogger TAs to make it more risky for victims. The Trojan assigned to victims suffers from a NULL pointer deference vulnerability, which could lead to a denial of service for the server builder of the threat actor by getting his IP address and port of command and control.
\n==================================================================
\nWINDBG ANALYSIS AFTER SENDING 1000 ‘A’ BYTES
\n==================================================================
\n(160.b98): Access violation – code c0000005 (first chance)
\nFirst chance exceptions are reported before any exception handling.
\nThis exception may be expected and handled.
\neax=0330c234 ebx=0113e8d4 ecx=00000000 edx=018c0000 esi=0330c234 edi=0113e55c
\neip=078f5a59 esp=0113e4f8 ebp=0113e568 iopl=0 nv up ei pl zr na pe nc
\ncs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
\nbuilder!XWorm.Client.isDisconnected+0xa9:
\n078f5a59 8b01 mov eax,dword ptr [ecx] ds:002b:00000000=????????
\n*******************************************************************************
\n* *
\n* Exception Analysis *
\n* *
\n*******************************************************************************<\/p>\n
MethodDesc: 055a86b4
\nMethod Name: XWorm.Client.isDisconnected()
\nClass: 09fe9634
\nMethodTable: 055a86d8
\nmdToken: 06000730
\nModule: 01464044
\nIsJitted: yes
\nCodeAddr: 078f59b0
\nTransparency: Critical
\nMethodDesc: 055a86b4
\nMethod Name: XWorm.Client.isDisconnected()
\nClass: 09fe9634
\nMethodTable: 055a86d8
\nmdToken: 06000730
\nModule: 01464044
\nIsJitted: yes
\nCodeAddr: 078f59b0
\nTransparency: Critical
\nFailed to request MethodData, not in JIT code range<\/p>\n
KEY_VALUES_STRING: 1<\/p>\n
Key : AV.Dereference
\nValue: NullPtr<\/p>\n
Key : AV.Fault
\nValue: Read<\/p>\n
Key : Analysis.CPU.mSec
\nValue: 6406<\/p>\n
Key : Analysis.DebugAnalysisManager
\nValue: Create<\/p>\n
Key : Analysis.Elapsed.mSec
\nValue: 12344<\/p>\n
Key : Analysis.IO.Other.Mb
\nValue: 152<\/p>\n
Key : Analysis.IO.Read.Mb
\nValue: 3<\/p>\n
Key : Analysis.IO.Write.Mb
\nValue: 181<\/p>\n
Key : Analysis.Init.CPU.mSec
\nValue: 48905<\/p>\n
Key : Analysis.Init.Elapsed.mSec
\nValue: 6346579<\/p>\n
Key : Analysis.Memory.CommitPeak.Mb
\nValue: 200<\/p>\n
Key : CLR.BuiltBy
\nValue: NET48REL1LAST_C<\/p>\n
Key : CLR.Engine
\nValue: CLR<\/p>\n
Key : CLR.Version
\nValue: 4.8.4515.0<\/p>\n
Key : Timeline.OS.Boot.DeltaSec
\nValue: 7496<\/p>\n
Key : Timeline.Process.Start.DeltaSec
\nValue: 6371<\/p>\n
Key : WER.OS.Branch
\nValue: vb_release<\/p>\n
Key : WER.OS.Timestamp
\nValue: 2019-12-06T14:06:00Z<\/p>\n
Key : WER.OS.Version
\nValue: 10.0.19041.1<\/p>\n
Key : WER.Process.Version
\nValue: 2.1.0.0<\/p>\n
NTGLOBALFLAG: 0<\/p>\n
PROCESS_BAM_CURRENT_THROTTLED: 0<\/p>\n
PROCESS_BAM_PREVIOUS_THROTTLED: 0<\/p>\n
APPLICATION_VERIFIER_FLAGS: 0<\/p>\n
EXCEPTION_RECORD: (.exr -1)
\nExceptionAddress: 078f5a59 (builder!XWorm.Client.isDisconnected+0x000000a9)
\nExceptionCode: c0000005 (Access violation)
\nExceptionFlags: 00000000
\nNumberParameters: 2
\nParameter[0]: 00000000
\nParameter[1]: 00000000
\nAttempt to read from address 00000000<\/p>\n
FAULTING_THREAD: 00000b98<\/p>\n
PROCESS_NAME: builder.exe<\/p>\n
READ_ADDRESS: 00000000<\/p>\n
ERROR_CODE: (NTSTATUS) 0xc0000005 – The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.<\/p>\n
EXCEPTION_CODE_STR: c0000005<\/p>\n
EXCEPTION_PARAMETER1: 00000000<\/p>\n
EXCEPTION_PARAMETER2: 00000000<\/p>\n
IP_ON_HEAP: 078f5a59
\nThe fault address in not in any loaded module, please check your build’s rebase
\nlog at <releasedir>\\bin\\build_logs\\timebuild\\ntrebase.log for module which may
\ncontain the address if it were loaded.<\/p>\n
STACK_TEXT:
\n0113e568 73140556 00000000 00000000 00000000 builder!XWorm.Client.isDisconnected+0xa9
\n0113e574 7314373a 0113e8d4 0113e5b8 732dd3f0 clr!CallDescrWorkerInternal+0x34
\n0113e5c8 7321f0d1 c887551e 00000000 0335b7dc clr!CallDescrWorkerWithHandler+0x6b
\n0113e608 7321f1d6 731d7104 0335b7dc 055ab280 clr!CallDescrWorkerReflectionWrapper+0x55
\n0113e90c 7212853c 00000000 0330a1dc 00000000 clr!RuntimeMethodHandle::InvokeMethod+0x838
\n0113e930 72114a9d 00000000 00000000 00000000 mscorlib_ni!
\n0113e94c 6e14bf55 00000000 00000000 00000000 mscorlib_ni!
\n0113e968 6e14be68 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113e990 72118604 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113e9f4 72118537 00000000 00000000 00000000 mscorlib_ni!
\n0113ea08 721184f4 00000000 00000000 00000000 mscorlib_ni!
\n0113ea24 6e14bdfa 00000000 00000000 00000000 mscorlib_ni!
\n0113ea40 6e14bb9a 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113ea80 6e13b07f 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113eacc 6e144931 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113ead8 6e1445f7 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113eaec 6e13af53 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113eaf4 6e13aee5 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113eb08 6e13a820 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113eb58 0146d08e 00000000 00000000 00000000 System_Windows_Forms_ni!
\nWARNING: Frame IP not in any known module. Following frames may be wrong.
\n0113eb8c 7650148b 000606f4 0000c250 00000000 0x146d08e
\n0113ebb8 764f844a 05823e56 000606f4 0000c250 USER32!_InternalCallWinProc+0x2b
\n0113ec9c 764f61ba 05823e56 00000000 0000c250 USER32!UserCallWinProcCheckWow+0x33a
\n0113ed10 764f5f80 0113ed98 0113ed58 6e19e5ed USER32!DispatchMessageWorker+0x22a
\n0113ed1c 6e19e5ed 0113ed98 c9b28348 731410fc USER32!DispatchMessageW+0x10
\n0113ed58 6e14b44f 00000000 00000000 00000000 System_Windows_Forms_ni+0x22e5ed
\n0113eddc 6e14b03d 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113ee30 6e14ae93 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113ee5c 014b2694 00000000 00000000 00000000 System_Windows_Forms_ni!
\n0113ee84 014b2211 00000000 00000000 00000000 0x14b2694
\n0113eeac 014b1871 00000000 00000000 00000000 0x14b2211
\n0113eef8 014b08b7 00000000 00000000 00000000 0x14b1871
\n0113ef28 73140556 00000000 00000000 00000000 builder!XWorm.My.MyApplication.Main+0x6f
\n0113ef34 7314373a 0113efc4 0113ef78 732dd3f0 clr!CallDescrWorkerInternal+0x34
\n0113ef88 73149adb 00000000 030622ec 73171e90 clr!CallDescrWorkerWithHandler+0x6b
\n0113eff0 732bff7b 0113f0cc c8874202 01466f94 clr!MethodDescCallSite::CallTargetWorker+0x16a
\n0113f114 732c065a 0113f158 00000000 c8874096 clr!RunMain+0x1b3
\n0113f380 732c0587 00000000 c8874b72 00700000 clr!Assembly::ExecuteMainMethod+0xf7
\n0113f864 732c0708 c8874baa 00000000 00000000 clr!SystemDomain::ExecuteMainMethod+0x5ef
\n0113f8bc 732c082e c8874bea 00000000 732bc210 clr!ExecuteEXE+0x4c
\n0113f8fc 732bc235 c8874a2e 00000000 732bc210 clr!_CorExeMainInternal+0xdc
\n0113f938 7398fa84 84112dff 73a24330 7398fa20 clr!_CorExeMain+0x4d
\n0113f970 73a1e81e 73a24330 73980000 0113f998 mscoreei!_CorExeMain+0xd6
\n0113f980 73a24338 73a24330 76b600f9 00f94000 MSCOREE!ShellShim__CorExeMain+0x9e
\n0113f998 76b600f9 00f94000 76b600e0 0113f9f4 MSCOREE!_CorExeMain_Exported+0x8
\n0113f998 77997bbe 00f94000 3d39c64a 00000000 KERNEL32!BaseThreadInitThunk+0x19
\n0113f9f4 77997b8e ffffffff 779b8d3f 00000000 ntdll!__RtlUserThreadStart+0x2f
\n0113fa04 00000000 00000000 00000000 00000000 ntdll!_RtlUserThreadStart+0x1b<\/p>\n
STACK_COMMAND: ~0s ; .cxr ; kb<\/p>\n
SYMBOL_NAME: builder!XWorm.Client.isDisconnected+a9<\/p>\n
MODULE_NAME: builder<\/p>\n
IMAGE_NAME: builder.exe<\/p>\n
FAILURE_BUCKET_ID: NULL_POINTER_READ_c0000005_builder.exe!XWorm.Client.isDisconnected<\/p>\n
OS_VERSION: 10.0.19041.1<\/p>\n
BUILDLAB_STR: vb_release<\/p>\n
OSPLATFORM_TYPE: x86<\/p>\n
OSNAME: Windows 10<\/p>\n
IMAGE_VERSION: 2.1.0.0<\/p>\n
FAILURE_ID_HASH: {ab0d02c5-881b-c628-2858-a241c5c41b1f}<\/p>\n
Followup: MachineOwner
\n———<\/p>\n
TS: Exploitable – Data from Faulting Address controls Code Flow starting at builder!XWorm.Client.isDisconnected+0x00000000000000a9 (Hash=0xc8c3bc2d.0x7badd95a)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Author: TOUHAMI KASBAOUI # Vendor Homepage: https:\/\/blog.cyble.com\/2022\/08\/19\/evilcoder-project-selling-multiple-dangerous-tools-online\/ # Software Link: N\/A# Version: 2.1# Tested on: Windows 10 # CVE : N\/A ================================================================== THE BUG : NULL pointer dereference -> DOS crash ================================================================== The sophisticated XWorm Trojan is well exploited by EvilCoder, where they collect different features such as ransomware and keylogger TAs to …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-37586","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/37586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=37586"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/37586\/revisions"}],"predecessor-version":[{"id":37609,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/37586\/revisions\/37609"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=37586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=37586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=37586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}