Pest Control - Taming the RATS.pdf

(548 KB) Pobierz
RESEARCH
pest control: taming the rats
Authors
Shawn Denbow
Twitter:
@sdenbow_
Email:
denbos@rpi.edu
Jesse Hertz
Twitter:
@hectohertz
Email:
jhertz@brown.edu
Remote Administration Tools (RATs) allow a
remote attacker to control and access the
system. In this paper, we present our analysis of
their protocols, explain how to decrypt their
traffic, as well as present vulnerabilities we have
found.
Introduction
As 2012 Matasano summer interns, we were tasked with running a research
project with a couple criteria:
• It should be something we are both interested in.
• We should be able to present our research for the company at the end of
our internship. However, on completion, we decided that it would be best if
we made our findings public.
With John Villamil, our advisor, we decided that given our interest in low-level
analysis, we should analyze Remote Administration Tools (RATs). RATs have
recent seen media attention RATs due to their use by oppressive governments
in spying on activists and other “dissidents”. We felt this to be a perfect
project.
Remote Administration Tools are pieces of software which, once installed on a
victim’s computer allow a remote user to control and access the system. RATs
can be used legitimately by system administrators, or they can be used
maliciously.
There are a variety of methods by which they are installed on a computer:
Various social engineering tactics can be employed to get a user to open the
executable, they can be bundled with other pieces of software, they can be
installed as the payload of a virus or worm, or they can be installed after an
attacker gains access to a system through an exploit. Most of the commonly
available RATs are at least able to perform keylogging, screen and camera
capture, file management, code and script execution, power control, registry
management, and password sniffing. Wikipedia has a more complete list of
common RAT functionality [1].
Our research focused on analyzing several publicly available RATs: DarkComet,
Bandook, CyberGate and Xtreme RAT. Interestingly, all of the RATs we
analyzed were coded either in part or entirely in Delphi. They all featured a
reverse connecting architecture, as well as some form of cryptography or
obfuscation of their communications. In this paper, we present our analysis of
their protocols, explain how to decrypt their traffic, as well as present
vulnerabilities we have found. The appendices to this paper contain MITM
tools for decrypting traffic, as well as proof of concept exploits for the
vulnerabilities we’ve found.
Basic RAT Architecture
Most RATs employ a “reverse-connecting” architecture.
The “client” program, resides on the attacker’s machine and is used to control
a compromised system. If often features a full UI designed for ease of use.
In contrast, the “server” program is a much smaller stub which is installed on
the compromised computer. These servers feature no UI, and take measures
to disguise their presence.
On execution, the sever initiates a connection back to the client computer,
and remote control is then possible. The client program typically has the
ability to generate server stubs, which have the IP address of the client (the
command and control center) hard coded into them.
Some free versions of the RATs we investigated were feature limited to
producing server stubs that were not stealthy or could only connect to
localhost, with the ability to generate “full” stubs only available on purchasing
the paid version. Some servers had measures to defeat or disable antivirus
and firewall software on the compromised machine.
The DarkComet RAT
DarkComet is one of the most popular RATs in use today, gaining recent
notoriety after its use by the Syrian government [13]. The encryption method
used in DarkComet has already been extensively analyzed by various
researchers [2] [3], so we will not reiterate here.
We reverse engineered the DarkComet protocol and analyzed it for
vulnerabilities.
After a quick look at its protocol, it is easy to see that it uses a “|” as it’s
delimiter between string parameters. Although, there is no delimiter between
the command and the first parameter.
The DarkComet client stores information about servers in a SQLite database,
which is kept in the directory from which the client runs. This database also
holds usernames and passwords for FTP servers to which the client has been
configured to connect. When a new connection is established, a handshake
occurs which looks like this:
Notation
C->S indicates a message from the Client to the Server
S->C indicates a message from the Server to the Client
(U)
indicates the message is unencrypted
DarkComet Handshake
C->S:
IDTYPE
S->C:
SERVER
C->S:
 
GetSIN172.16.1.1|769734
S->C:
infoesGuest16|172.16.1.1 / [172.16.1.128] : 1604|USER-3AA4AD4D2 /
Administrator|769734|0s|Windows XP Service Pack 3 [2600] 32 bit ( C:\ )|x||
US||{HW-ID}|43%|English (United States) US /
 --
|6/13/2012 at 2:45:59 PM|
5.3.0
© Copyright 2012 Matasano Security.
All rights reserved.
For testing purposes, we wrote our own “server” which replied with the
following shorter SIN (Server Info) string:
infoesX|1|S|5|0s|W |x||US|I]|{7}|80%|E|6|5
SQL Injection in DarkComet
By attaching a debugger to the client, we were able to view the SQL strings it
generated by the client to query its database. Upon connection with the
above SIN string, the following SQL statement is executed:
"SELECT * FROM dc_users WHERE UUID="{7}"
If that UUID is not in the database, the following statement is executed:
"INSERT INTO dc_users VALUES( "{7}", "1", "S", "W", "0")"
If that UUID already exists, then the following statement is executed:
"UPDATE dc_users SET userIP="1" WHERE UUID="{7}""
There is no input validation or sanitization, so all of these SQL statements are
injectable with the following caveats:
• Executing multiple commands in one statement with “;”s is disabled,
anything after a “;” will not be executed
• load_extension() is disabled
These can be used to modify data in the database. We did not further
develop these vulnerabilities to get information out of the database, as our
next exploit made doing so unnecessary.
Arbitrary File Read from the Client’s File System in DarkComet
DarkComet uses a protocol that we have termed “QuickUp” in order to do
ad-hoc uploading of files. For instance, the client has a feature which allows
you to edit the compromised computers “hosts” file. This is done by
downloading the hosts file to the client computer, editing it, and then
uploading it back to the server. The last part of that exchange uses the
QuickUp protocol, and looks like this:
DarkComet QuickUpload
C->S:
QUICKUPC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SynHosts.txt|752|HOSTS
A new connection between the client and server is now established to
handle the file transfer. The old connection is not closed first, the existing
socket just has connect() called on it again
C->S:
IDTYPE
S->C:
QUICKUP752|C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SynHosts.txt|HOSTS
C->S (U):
\x41\x00\x43
 
C->S (U):
LENGTH_OF_FILE_IN_BYTES
S->C (U):
A
C->S (U):
RAW_DATA_OF_SPECIFIED_FILE
S->C (U):
A
© Copyright 2012 Matasano Security.
All rights reserved.
Note that the protocol consists of two stages, the QUICKUP command issued
from the client, which establishes a “new” connection, and the QUICKUP
command issued from the server, which begins the file transfer. Most
importantly, after the new connection has been opened, the server requests
the file to be uploaded. Three major weaknesses are present in this
implementation:
• There is no check that the file in the client QUICKUP is the same as the file
in the server QUICKUP
• The client responds to a QUICKUP commands, even if there was no
corresponding QUICKUP from the client
• The client allows the server to specify the absolute path
This flaw allows the retrieval of any file on the filesystem that it has
permissions to read. So for instance, to get a dump of the SQLite database,
we can do the following:
(1) Connect to the server and successfully complete the handshake
(2) Open a new connection over our old one, the client will now reply:
DarkComet SQLite DB Dump
C->S:
IDTYPE
We now send a QUICKUP command unprompted
S->C:
QUICKUP111|comet.db|UPLOADEXEC
C->S (U):
\x41\x00\x43
S->C (U):
A
C->S (U):
LENGTH_OF_FILE
S->C (U):
A
C->S (U):
RAW_DATA_OF_COMET.DB
Any file in the DarkComet directory can be read this way. Alternatively,
absolute paths can be specified, allowing read access to any file on the client’s
filesystem (that DarkComet has permissions to access).
Reading “C:\secret.txt” from Client’s File System
© Copyright 2012 Matasano Security.
All rights reserved.
Reading “C:\secret.txt” from Client’s File SystemOverall, this presents an issue
for anyone using DarkComet. If a server sample is discovered, it is trivial to
retrieve the key from the binary that is used in the network communication.
The key retrieval process can even be automated [4]. Recently, the developer
of the RAT has quit any further development due to its misuse, therefore
leaving this issue unpatched [12].
For a stub server (written in python) that can exploit both of these
vulnerabilities, see Appendix A.
The
Bandook RAT
Bandook is written in a mix of C++ and Delphi [5] [6]. The server is able to use
process injection, API unhooking, and kernel patching to bypass (some
versions) of the Windows firewall. The server itself is fairly limited in
functionality, but has the ability to be extended through a plugin architecture:
the client can upload plugin code to the server. The client comes with several
plugins which need to be installed on the server to enable full functionality. By
default, the server attempts to hide itself by creating a process based on the
default browser settings.
It lacks any real cryptography to protect its traffic. Instead, it obfuscates its
traffic by XORing against the constant 0xE9:
XOR Loop with Constant
Almost all messages are suffixed with “&&&” in cleartext:
Server Keepalive with “&&&”
The client comes bundled with TightVNC 1.2.9.0, which has a publicly
known security vulnerability. More information regarding the vulnerability
and proof of concept code is available online [7].
The latest public release of Bandook is v1.35, while the private version is
at 1.4. The public version was released April 2007, which makes it quite
old and outdated. It only supports up to Windows Vista, while the private
version supports up to Win7.
© Copyright 2012 Matasano Security.
All rights reserved.

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin