Styxy Cool Exploit Kit: One Applet to Exploit All Vulnerabilities

Styxy Cool Exploit Kit is a particular kit because it is a "merge" between Cool and Styxy Exploit Kit. Here we are going to cover only Java related exploits so, if you want to know what vulnerabilities it has and why its called Styxy Cool go check Kafeine's post here.

Between the eight and nine of July two interesting things happened:
  1. Jar size increased from 5Kb to 28 Kb
  2. Payload (Reveton) disappeared from fiddler 










Let's take a step back and analyze the exploit chain from the eight of July.

The first page /abortion-success_conductor.php displays a bounch of phrases about Yahoo France, but what really does is checking if you have some vulnerable Java plugin installed in your browser.


The page contains an instance of PluginDetect version 0.8 plus an obfuscated JavaScript code.



What does this code do ?

It takes the content of the textarea from /objection_confident_sulphur.html since in the middle of the first page there is an iframe pointing to that one.


Then converts two chars per time into an integer base 30 and converts the result into a character with the help of String.fromCharCode.

Once deobfuscated.


If you are vulnerable the next and last page executes the malicious applet. In this case i was using Java SE 7 update 17 so /test_membrane.html contains CVE-2013-2423.


Jar size

The size of the applet is increased by 25 Kb because now it contains four Java vulnerabilities and not one as usual.

If we open the malicious jar with JD-GUI we can see an if/else statement inside the Main.class where it tries several exploits.



If one these successfully set the SecurityManager to null (disabled it), it runs some code inside MainAdd2 class, which is supposed to download and execute Reveton. This new way of using Java vulnerabilities, has certainly an advantage when it comes to obfuscate the code, because you don't have to FUD all four jar but just one.

Missing Reveton

The other interesting thing is the disappearance of Reveton from fiddler. Below is part of the image from the nine of July posted at the beginning.







As you can see Reveton is never downloaded but you still get infected. 

Therefore, how the payload is downloaded ?

My first thought was that it was embedded into the jar, but after a deep search i haven't found any trace. Looking better after the infection, i've noticed an uncommon V.class file inside the Temp folder.

Part of disassembled V file.


Mistery solved, this java compiled class is responsible of downloading and executing Reveton.

How this class is executed ?

At the beginning of the init function useInner variable takes the value of usein applet parameter, but since there isn't any parameter called usein, its value will be null.

The following line calls dgsdgDG from MainAdd2.



Once again there isn't any parameter called val, so getUrls it's executed.



After obtained the URL of the applet and substituted the extension jar with exe?e=15, a last function called run is executed. Its purpose is to write V.class into Temp folder and call it through the command "javaw -cp <path_tmp_folder> V <reveton_url>".
















There isn't a lot of code to deobfuscate, but you can find whole V.class here. Jar file is available on Kernelmode previous registration: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=1819&start=60#p20209

Maybe a better title for this post is: One exploit to rule them all, one exploit to exploit them, one exploit to infect them all and in a botnet bind them.

# Edit 1
Balck Dragon and Blackhole 2.1 have the same behaviour.


Related post:

Comments

  1. AnonymousAugust 1, 2013 at 3:52 PM

    One Ring to rule them All, Eh ???

    ReplyDelete
    Replies
    1. Security ObscurityAugust 1, 2013 at 11:31 PM

      One Ring to find them, One Ring to bring them all, And in the darkness bind them :)

      Delete
  2. UnknownAugust 2, 2013 at 11:56 PM

    how i can get this kit

    ReplyDelete

Post a Comment

Popular posts from this blog

Java Exploit Code Obfuscation and Antivirus Bypass/Evasion (CVE-2012-4681)

Image
Why not play a game where we try to make the latest (at time of writing) public java exploit ( CVE-2012-4681 ) undetected by all antivirus and see who will be the last to detect it ?. I think it will be a funny "challenge" because evading antivirus has always his charm. I will not use software obfuscators like proGuard, Allatori, Zelix KlassMaster etc... This because will not be funny. This is not intended to be an analysis or explanation because there are already great post here: http://immunityproducts.blogspot.com.ar/2012/08/java-0day-analysis-cve-2012-4681.html http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html http://www.h-online.com/security/features/The-new-Java-0day-examined-1677789.html Before we start we need to make two considerations: From The Current Web-Delivered Java 0Day :  So while you may see a few links to Virustotal with the inevitable complaining that a scanner is missing a specific chunk of altered code along wi...
Read more

The Latest Java Exploit with Security Prompt/Warning Bypass (CVE-2013-2423)

Image
From Java SE 7 update 11 oracle has introduced a new security features called  security warning that prompts a window every time an applet request for execution. For example, if we want to execute latest Java SE 7 update 17 exploit we get this warning. Yesterday Immunity has published a blog post explaining a new vulnerability they have found into the java validating mechanism which allow to execute an untrusted applet without showing the warning. For in-dept details read their blog post here . Briefly, to bypass the above prompt you must call the applet with the parameter __applet_ssv_validated set to true. The only way to manipulate this parameter is to use a java Network Launch Protocol file. Regarding to oracle there are two ways to use JNLP in a page: With the applet tag  With javascript only Let's try first the example with the tag applet. The code we're going to run is the latest publicly available java exploit CVE-2013-2423 .  import java.a...
Read more

Deobfuscating Java 7u11 Exploit from Cool Exploit Kit (CVE-2013-0431)

Image
At the beginning of the past week @EKWatcher  has spotted Cool Exploit Kit using Java 7 update 11 vulnerability (CVE-2013-0431). This vulnerability was already reported by Security Explorations on seclist few days after Oracle issued update 11. I decided take a look at it. I found a website infected by Cool EK that after a successfull exploitation dropped Reveton into " C:\Documents and Settings\<usarname>\Application Data " folder on Windows XP. The applet used by Cool EK was named would-blood.jar and once opened with JD-GUI the result was this. As you can see it's obfuscated, not heavily but obfuscated. The first thing to do when you want to start deobfuscating an applet is to find the init() function which is the "starting point" and cannot be changed. Remember that for serialized applets the starting point is a function called start() instead of init(). The init function is inside  hw class. It's immediately evident that al...
Read more