Es Digital: May 2020

Friday, May 22, 2020

APT Calypso RAT, Flying Dutchman Samples

Reference

2019-10-31 Calypso APT: new group attacking state institutions

Attackers exploit Windows SMB vulnerability CVE-2017-0143 or use stolen credentials to gain access, deploy the custom Calypso RAT and use it to upload other tools such as Mimikatz, EternalBlue and EternalRomance. They move laterally and steal data.

Download

Other malware

Download. Email me if you need the password (see in my profile)

Hashes

MD5	SHA256	SHA1	Filename	File Tyee	Stage
aa1cf5791a60d56f7ae6da9bb1e7f01e	d5afa3bfd423ba060207ad025467feaa56ac53d13616ac8782a7f63c9fc0fdb4	bdd8b9115d1ae536d0ea1e62052485e5ad10761f	MPSSVC.dll	pe dll	Calypso RAT Payload
1e765fed294a7ad082169819c95d2c85	f6a09372156a8aef96576627a1ed9e57f194b008bb77e32ca29ac89505f933f0	60dda7ccd9ae00701046923b619a1b9c33c8e2ac	Wscntfy.exe	pe exe	Calypso RAT Dropper
17e05041730dcd0732e5b296db16d757	b6c21c26aef75ad709f6c9cfa84bfa15b7ee709588382ce4bc3544a04bceb661	f3301405d8ad5b160747241d6b2a8d88bf6292e8		pe exe	Calypso RAT Dropper
1ed72c14c4aab3b66e830e16ef90b37b	eebff21def49af4e85c26523af2ad659125a07a09db50ac06bd3746483c89f9d	dc0d0a34f107d140d9e47582e17a7fec945403ea	coal.exe	pe exe	Calypso RAT Dropper
e24a62d9826869bc4817366800a8805c	c407c3dde18c9b56ed24492ca257d77a570616074356b8c7854a080823f7ee17	53791c9e7c41931a6becb999fee4eb7daf9b1a11	data01.bin	pe dll	Calypso RAT Dropper
c9c39045fa14e94618dd631044053824	ab39301d45045172ad41c9a89210fdc6f0d3f9dccb567fd733b0dbffbfcfbcc3	1cda28bc307c09508dbb1f3495a967bbcc29326e		pe exe	Calypso RAT Dropper
69322703b8ef9d490a20033684c28493	e6a3b43acdaa824f3280095b10798ea341839f7d43f0460df8989f13c98fa6e0	f203680d97705d99f92fe9797691be6177f5fd41	RasCon.dll	pe dll	Calypso RAT Dropper
85ce60b365edf4beebbdd85cc971e84d	5dfdee5dd680948d19ab4d16df534cf10aca5fa0b157c59659d6517fe897c62f	d9c14f7b6de8e26ae33e41a72ae8e35bb1af4434		pe exe	Calypso RAT Dropper
6347e42f49a86aff2dea7c8bf455a52a	281583aca23f8fd8745dd88a600cbfc578d819859a13957ec022b86c3c1c99f4	8b2a81af85590e0e36efc1c05aa4f0600ea21545	HIDMgr.dll	pe dll	Calypso RAT Dropper
cb914fc73c67b325f948dd1bf97f5733	0031c7b63c1e1cd36d55f585d97e2b21a13a19858d5a1aa5455e5cc64b41e6e9	37ce4d0a3168e3b2f80b3fae38082e68a454aee0		pe exe	Calypso RAT Dropper
c84df4b2cd0d3e7729210f15112da7ac	4e8351ddaff18f7df6fcc27a3c75598e0c56d3b406818d45effb4e78616092c2	41a0c5a1aad36f405c8755613c732591e3300f97	mscorsvw.dll	pe dll	Calypso RAT Dropper
5199ef9d086c97732d97eddef56591ec	511683c8ee62478c2b45be1f782ce678bbe03c4349a1778651414803010b3ee9	d19a786adc09dff84642f2c2e0386193fa2a914b	dnscache.dll	pe dll	FlyingDutchman
06c1d7bf234ce99bb14639c194b3b318	a9a82099aa812d0c4025bee2b34f3b34c1d102773e36f1d50648815913dbe03d	464ab9e11d371bf24de46c98c295d4afe7e957c1	fromResource.exe	pedll	FlyingDutchman
617d588eccd942f243ffa8cb13679d9c	0664b09a86ec2df7dfe01a93e184a1fa23df66ea82cab39000944e418ec1f7b2	1b043fdcb582ed13cbf7dabcef6527762b5be93c		pe dll	Hussar
2807236c2d905a0675878e530ed8b1f8	314e438198f8cc2ee393c75f8e9f2ebd2b5133fd6f2b7deb1178f82782fc6330	2f6fe857632a67e87f4f3631bfa93713ccdf168a	AeLookupMgr.dll	pe dll	Calypso RAT Payload
cce8c8ee42feaed68e9623185c3f7fe4	38cc404437b936660066b71cc87a28af1995248d6d4c471706eb1dd347129b4b	9d2235c911b86bb6ad55d953a2f56ea78c5478e5	AppCert.dll.crt		Calypso RAT Payload
e1a578a069b1910a25c95e2d9450c710	413622ded5d344a5a78de4fea22cfdabdeb4cdccf69e9a1f58f668096c324738	36087a5b0809dc3f9dc5a77355a88e99af491a88	RasCfgMan.dll.crt		Calypso RAT Payload
0d532484193b8b098d7eb14319cefcd3	f8043d6bfc3e63d8561f7f74e65cb7ff1731577ecf6c7559795d9de21298f0fc	31f4c6dc6ce78b4e0439b30c830dfd5d9a3fc4fe	RasCfgMan.dll	pe dll	Calypso RAT Payload
974298eb7e2adfa019cae4d1a927ab07	0461710e681fd6dc9f1c83b57f94a88cd6df9e6432174cbfdd70dfd24577a0f8	41bc37679ce3caeecc176d10b4f8259918e25807	VirtualUMP.dll.crt		Calypso RAT Payload
05f472a9d926f4c8a0a372e1a7193998	8017923cd8169bf951106f053408b425f1eb310a9421685638ead55bb3823db3	8d909bd3450ebe0cffd0cb17b91bc28d23ef5083	EFSProvider.dll.crt		Calypso RAT Payload
d1a1166bec950c75b65fdc7361dcdc63	f3f38c097b0cc5337b7d2dbec098bf6d0a3bb4a3e0336e7b1c8af75268a0a49d	5731350f68a74fb4762c4ea878ecff635588a825	RasCon.dll	pe dll 64bits assembly	Calypso RAT Payload
e3e61f30f8a39cd7aa25149d0f8af5ef	c4dc7519bccc24c53794bf9178e4a4d0823875c34479d01cedbb3e9b10f5c730	1b75ea494c3ac171c5177bdcc263b89a3f24f207	MPSSVC.dll	pe dll	Calypso RAT Payload

Thursday, May 21, 2020

Wirelurker For OSX, iOS (Part I) And Windows (Part II) Samples

PART II

Wirelurker for Windows (WinLurker)

Research: Palo Alto Claud Xiao: Wirelurker for Windows

Sample credit: Claud Xiao

PART I

Research: Palo Alto Claud Xiao WIRELURKER: A New Era in iOS and OS X Malware

Palo Alto |Claud Xiao - blog post Wirelurker

Wirelurker Detector https://github.com/PaloAltoNetworks-BD/WireLurkerDetector

Sample credit: Claud Xiao

Download

Download Part I
Download Part II

Email me if you need the password

List of files

List of hashes

Part II

s+«sìÜ 3.4.1.dmg 925cc497f207ec4dbcf8198a1b785dbd

apps.ipa 54d27da968c05d463ad3168285ec6097
WhatsAppMessenger 2.11.7.exe eca91fa7e7350a4d2880d341866adf35
使用说明.txt 3506a0c0199ed747b699ade765c0d0f8
libxml2.dll c86bebc3d50d7964378c15b27b1c2caa
libiconv-2_.dll 9c8170dc4a33631881120a467dc3e8f7
msvcr100.dll bf38660a9125935658cfa3e53fdc7d65
libz_.dll bd3d1f0a3eff8c4dd1e993f57185be75
mfc100u.dll f841f32ad816dbf130f10d86fab99b1a

zlib1.dll c7d4d685a0af2a09cbc21cb474358595

│ apps.ipa
│ σ╛«σìÜ 3.4.1.dmg
│
└───WhatsAppMessenger 2.11.7
libiconv-2_.dll
libxml2.dll
libz_.dll
mfc100u.dll
msvcr100.dll
WhatsAppMessenger 2.11.7.exe
zlib1.dll
使用说明.txt

Part I

BikeBaron 15e8728b410bfffde8d54651a6efd162
CleanApp c9841e34da270d94b35ae3f724160d5e
com.apple.MailServiceAgentHelper dca13b4ff64bcd6876c13bbb4a22f450
com.apple.appstore.PluginHelper c4264b9607a68de8b9bbbe30436f5f28
com.apple.appstore.plughelper.plist 94a933c449948514a3ce634663f9ccf8
com.apple.globalupdate.plist f92640bed6078075b508c9ffaa7f0a78
com.apple.globalupdate.plist f92640bed6078075b508c9ffaa7f0a78
com.apple.itunesupdate.plist 83317c311caa225b17ac14d3d504387d
com.apple.machook_damon.plist 6507f0c41663f6d08f497ab41893d8d9
com.apple.machook_damon.plist 6507f0c41663f6d08f497ab41893d8d9
com.apple.MailServiceAgentHelper.plist e6e6a7845b4e00806da7d5e264eed72b
com.apple.periodic-dd-mm-yy.plist bda470f4568dae8cb12344a346a181d9
com.apple.systemkeychain-helper.plist fd7b1215f03ed1221065ee4508d41de3
com.apple.watchproc.plist af772d9cca45a13ca323f90e7d874c2c
FontMap1.cfg 204b4836a9944d0f19d6df8af3c009d5
foundation 0ff51cd5fe0f88f02213d6612b007a45
globalupdate 9037cf29ed485dae11e22955724a00e7
globalupdate 9037cf29ed485dae11e22955724a00e7
itunesupdate a8dfbd54da805d3c52afc521ab7b354b
libcrypto.1.0.0.dylib 4c5384d667215098badb4e850890127b
libcrypto.1.0.0.dylib 3b533eeb80ee14191893e9a73c017445
libiconv.2.dylib 94f9882f5db1883e7295b44c440eb44c
libiconv.2.dylib fac8ef9dabdb92806ea9b1fde43ad746
libimobiledevice.4.dylib c596adb32c143430240abbf5aff02bc0
libimobiledevice.4.dylib 5b0412e19ec0af5ce375b8ab5a0bc5db
libiodb.dylib bc3aa0142fb15ea65de7833d65a70e36
liblzma.5.dylib 5bdfd2a20123e0893ef59bd813b24105
liblzma.5.dylib 9ebf9c0d25e418c8d0bed2a335aac8bf
libplist.2.dylib 903cbde833c91b197283698b2400fc9b
libplist.2.dylib 109a09389abef9a9388de08f7021b4cf
libssl.1.0.0.dylib 49b937c9ff30a68a0f663828be7ea704
libssl.1.0.0.dylib ab09435c0358b102a5d08f34aae3c244
libusbmuxd.2.dylib e8e0663c7c9d843e0030b15e59eb6f52
libusbmuxd.2.dylib 9efb552097cf4a408ea3bab4aa2bc957
libxml2.2.dylib 34f14463f28d11bd0299f0d7a3985718
libxml2.2.dylib 95506f9240efb416443fcd6d82a024b9
libz.1.dylib 28ef588ba7919f751ae40719cf5cffc6
libz.1.dylib f2b19c7a58e303f0a159a44d08c6df63
libzip.2.dylib 2a42736c8eae3a4915bced2c6df50397
machook 5b43df4fac4cac52412126a6c604853c
machook ecb429951985837513fdf854e49d0682
periodicdate aa6fe189baa355a65e6aafac1e765f41
pphelper 2b79534f22a89f73d4bb45848659b59b
sfbase.dylib bc3aa0142fb15ea65de7833d65a70e36

sfbase.dylib bc3aa0142fb15ea65de7833d65a70e36
sfbase_v4000.dylib 582fcd682f0f520e95af1d0713639864
sfbase_v4001.dylib e40de392c613cd2f9e1e93c6ffd05246
start e3a61139735301b866d8d109d715f102
start e3a61139735301b866d8d109d715f102
start.sh 3fa4e5fec53dfc9fc88ced651aa858c6
stty5.11.pl dea26a823839b1b3a810d5e731d76aa2
stty5.11.pl dea26a823839b1b3a810d5e731d76aa2
systemkeychain-helper e03402006332a6e17c36e569178d2097
watch.sh 358c48414219fdbbbbcff90c97295dff
WatchProc a72fdbacfd5be14631437d0ab21ff960
7b9e685e89b8c7e11f554b05cdd6819a 7b9e685e89b8c7e11f554b05cdd6819a
update 93658b52b0f538c4f3e17fdf3860778c
start.sh 9adfd4344092826ca39bbc441a9eb96f

File listing

├───databases

│ foundation

│

├───dropped

│ ├───version_A

│ │ │ com.apple.globalupdate.plist

│ │ │ com.apple.machook_damon.plist

│ │ │ globalupdate

│ │ │ machook

│ │ │ sfbase.dylib

│ │ │ watch.sh

│ │ │

│ │ ├───dylib

│ │ │ libcrypto.1.0.0.dylib

│ │ │ libiconv.2.dylib

│ │ │ libimobiledevice.4.dylib

│ │ │ liblzma.5.dylib

│ │ │ libplist.2.dylib

│ │ │ libssl.1.0.0.dylib

│ │ │ libusbmuxd.2.dylib

│ │ │ libxml2.2.dylib

│ │ │ libz.1.dylib

│ │ │

│ │ ├───log

│ │ └───update

│ ├───version_B

│ │ com.apple.globalupdate.plist

│ │ com.apple.itunesupdate.plist

│ │ com.apple.machook_damon.plist

│ │ com.apple.watchproc.plist

│ │ globalupdate

│ │ itunesupdate

│ │ machook

│ │ start

│ │ WatchProc

│ │

│ └───version_C

│ │ com.apple.appstore.plughelper.plist

│ │ com.apple.appstore.PluginHelper

│ │ com.apple.MailServiceAgentHelper

│ │ com.apple.MailServiceAgentHelper.plist

│ │ com.apple.periodic-dd-mm-yy.plist

│ │ com.apple.systemkeychain-helper.plist

│ │ periodicdate

│ │ stty5.11.pl

│ │ systemkeychain-helper

│ │

│ └───manpath.d

│ libcrypto.1.0.0.dylib

│ libiconv.2.dylib

│ libimobiledevice.4.dylib

│ libiodb.dylib

│ liblzma.5.dylib

│ libplist.2.dylib

│ libssl.1.0.0.dylib

│ libusbmuxd.2.dylib

│ libxml2.2.dylib

│ libz.1.dylib

│ libzip.2.dylib

│

├───iOS

│ sfbase.dylib

│ sfbase_v4000.dylib

│ sfbase_v4001.dylib

│ start

│ stty5.11.pl

│

├───IPAs

│ 7b9e685e89b8c7e11f554b05cdd6819a

│ pphelper

│

├───original

│ BikeBaron

│ CleanApp

│ FontMap1.cfg

│ start.sh

│

└───update

start.sh

update

Evolving Logic Until Pass Tests Automatically

Automating the automation is still a challenge, but in some cases it's possible under certain situations.

In 2017 I created logic-evolver, one of my experiments for creating logic automatically or better said evolving logic automatically.

In some way, the computer create its own program that satisfies a set of tests defined by a human.

https://github.com/sha0coder/logic-evolver

This implementation in rust, contains a fast cpu emulator than can execute one million instructions in less than two seconds. And a simple genetic algorithm to do the evolution.

Here we create the genetic algorithm, and configure a population of 1000 individuals, and the top 5 to crossover. We run the genetic algorithm with 500 cycles maximum.
Note that in this case the population are programs initially random until take the correct shape.

An evaluation function is provided in the run method as well, and looks like this:

The evaluation function receives a CPU object, to compute a test you need to set the initial parameters, run the program and set a scoring regarding the return value.

Related word

Wednesday, May 20, 2020

Blockchain Exploitation Labs - Part 2 Hacking Blockchain Authorization

Bypassing Blockchain Authorization via Unsecured Functions

Note: Since the first part of this series I have also uploaded some further videos on remediation of reentrancy and dealing with compiler versions when working with this hacking blockchain series. Head to the console cowboys YouTube account to check those out. Haha as mentioned before I always forget to post blogs when I get excited making videos and just move on to my next project… So make sure to subscribe to the YouTube if you are waiting for any continuation of a video series.. It may show up there way before here.

Note 2: You WILL run into issues when dealing with Ethereum hacking, and you will have to google them as versions and functionality changes often... Be cognizant of versions used hopefully you will not run into to many hard to fix issues.

In the second part of this lab series we are going to take a look at privacy issues on the blockchain which can result in a vulnerably a traditional system may not face. Since typically blockchain projects are open source and also sometimes viewable within blockchain explorers but traditional application business logic is not usually available to us. With traditional applications we might not find these issues due to lack of knowledge of internal functionality or inability to read private values on a remote server side script. After we review some issues we are going to exploit an authorization issues by writing web3.js code to directly bypass vertical authorization restrictions.

Blockchain projects are usually open source projects which allow you to browse their code and see what's going on under the hood. This is fantastic for a lot of reasons but a developer can run into trouble with this if bad business logic decisions are deployed to the immutable blockchain. In the first part of this series I mentioned that all uploaded code on the blockchain is immutable. Meaning that if you find a vulnerability it cannot be patched. So let's think about things that can go wrong..

A few things that can go wrong:

Randomization functions that use values we can predict if we know the algorithm
Hard-coded values such as passwords and private variables you can't change.
Publicly called functions which offer hidden functionality
Race conditions based on how requirements are calculated

Since this will be rather technical, require some setup and a lot of moving parts we will follow this blog via the video series below posting videos for relevant sections with a brief description of each. I posted these a little bit ago but have not gotten a chance to post the blog associated with it. Also note this series is turning into a full lab based blockchain exploitation course so keep a lookout for that.

In this first video you will see how data about your project is readily available on the blockchain in multiple formats for example:

ABI data that allows you to interact with methods.
Actual application code.
Byte code and assembly code.
Contract addresses and other data.

Lab Video Part 1: Blockchain OSINT:

Once you have the data you need to interact with a contract on the blockchain via some OSINT how do you actually interface with it? That's the question we are going to answer in this second video. We will take the ABI contract array and use it to interact with methods on the blockchain via Web3.js and then show how this correlates to its usage in an HTML file

Lab Video Part 2: Connecting to a Smart Contract:

Time to Exploit an Application:

Exploit lab time, I created an vulnerable application you can use to follow along in the next video. Lab files can be downloaded from the same location as the last blog located below. Grab the AuthorizationLab.zip file:

Lab file downloads:

https://github.com/cclabsInc/BlockChainExploitation

Ok so you can see what's running on the blockchain, you can connect to it, now what? Now we need to find a vulnerability and show how to exploit it. Since we are talking about privacy in this blog and using it to bypass issues. Lets take a look at a simple authorization bypass we can exploit by viewing an authorization coding error and taking advantage of it to bypass restrictions set in the Smart Contract. You will also learn how to setup a local blockchain for testing purposes and you can download a hackable application to follow along with the exercises in the video..

Lab Video Part 3: Finding and hacking a Smart Contract Authorization Issue:

Summary:

In this part of the series you learned a lot, you learned how to transfer your OSINT skills to the blockchain. Leverage the information found to connect to that Smart Contract. You also learned how to interact with methods and search for issues that you can exploit. Finally you used your browsers developer console as a means to attack the blockchain application for privilege escalation.

More info

RECONNAISSANCE IN ETHICAL HACKING

What is reconnaissance in ethical hacking?
This is the primary phase of hacking where the hacker tries to collect as much information as possible about the target.It includes identifying the target ip address range,network,domain,mail server records etc.

They are of two types-
Active Reconnaissance
Passive Reconnaissance

1-Active Reconnaissance-It the process from which we directly interact with the computer system to gain information. This information can be relevant and accurate but there is a risk of getting detected if you are planning active reconnaissance without permission.if you are detected then the administration will take the severe action action against you it may be jail!

Passive Reconnaissance-In this process you will not be directly connected to a computer system.This process is used to gather essential information without ever interacting with the target system.

Airpwn: A Wireless Packet Injector

"Airpwn is a framework for 802.11 (wireless) packet injection. Airpwn listens to incoming wireless packets, and if the data matches a pattern specified in the config files, custom content is injected "spoofed" from the wireless access point. From the perspective of the wireless client, airpwn becomes the server." read more...

Website: http://airpwn.sourceforge.net

Es Digital