[Music]
welcome to the second talk in a row
about
malware pretty excited to be here second
year uh at Cipher con presenting if you
guys were at my last talk hit me up
afterwards and make fun of it this one
too my name is Robert Lerner I am a
manager of a bunch of really cool
security guys over at rapid 7 um doing
some cool stuff visiting from Texas
nobody cares about this part of this but
uh grew up in Chicago so I got the sport
in the Chicago wear um yeah warmer
weather not as not as crazy
there so what am I doing here back in
2021 I had somebody post on Reddit
everybody's favorite website a piece of
code and there sass word fence and
detected some malicious code that was
inside of somewhere inside their uh
WordPress directory massive shock uh
so they wanted to know exactly what this
code was
doing they want got the typical Reddit
uh Reddit replies where you get the
downvote they just keep on scrolling
it's off fiscated so it must be bad
which is a really bad premise to go off
of because there are a lot of things in
non-comp languages like PHP which is
what this talks about sorry uh that try
to hide what a script does to make it
harder to reverse
engineer it looks dangerous so don't
double click it a lot of that stuff
going on and they get the atypical
redditor responses which is why I have
like 14 or 15 banned accounts in the
past month you contact the original
poster you spend a weeks figuring out
exactly what that code actually
did so what is command and control it's
basically software which allows a
command and control do of a server so
you could list file system uh run file
system commands list directories WG or
curl down additional files so if there's
a constraint to an upload form where you
can fit a small piece of code you could
use that to allow a pull down of
something else from another site pbin
raw is a great place to upload things or
GitHub raw where we could pull those
files down to a local directory and then
execute those um rmrf everybody makes
that joke at security conferences and
I'm no different than those people so
here it is also allow you to create read
update and delete files on disk like
databases SSH Keys um furpa Hippa not
hippo um as well as access intellectual
property like uh Bill materials Trade
Secrets staff in a guust in the
Wisconsin Center will the owner of a
pensy truck with an Indiana plate
286
[Music]
3443 again a pensy truck with an Indiana
plate
2863
443
your truck needs to be moved immediately
off that played again is 15
minutes all right so Pro tip I told a
few people here that if my talk sucked
pull the fire alarm I thought that's
what was
happening
um so anyway we'll keep we'll keep on
going so what we'll do first is we'll go
ahead and WR right uh right we shell
right I'm going give you heads up you
don't have to take pictures of every
Slide the bad thing about doing that is
I would be in them and I'm not that
handsome but you can otherwise I'll have
a GitHub Link at the end which is
already public so you guys can get to it
you don't have to wait till I like
release secret source code it's not mine
anyway minimum viable product of a
webshell is last 10 question mark exec
in a request all you're doing is saying
PHP execute this at at the Shell level
any request that comes across now
there's a few differences between what
request is you got your get you got your
post bad thing about doing get is say
you're one of those people who runs your
own web server at home this is really
cool right if I want to get a malicious
script from my own host I might send a
request to my hack. PHP question mark
hacks equals my website W get there
that's going to be in their access logs
they're going to know exactly who you
are and what you're pulling down from
their git logs right if you send as a
post a little bit more abstraction there
that's not going to be in an access log
it's going to be
nowhere so this is a pretty great script
from a perspective of it's very small
and it does everything you pretty much
need a webshell to do but if you were to
look at that whether you wrote this
language or not it's probably pretty
obvious I mean it says hacks directly in
it
so how you would leverage this is you
would take it and put a question mark at
the end hex and then command line
parameter now if you are running your uh
running your applications through a d
Dynamic application security test tool
it's going to find that because it's
going to throw an LS in there or
something similar and see a directory
listing come back if you're using a sast
it's going to see exact which isn't bad
it's probably bad it's not necessarily
bad but it's going to flag that as like
hey go look at
this so again you can dump source code
um gather API Keys credentials and Never
Going To Give You Up never going to let
you down never going to turn around and
desert you for anybody who missed a
rickle on this side here okay all right
I thought that was really funny when I
did it and I actually just ran out of
bullet
points
so cool that
one it's commonly disabled exact is it
literally says hacks it contains exact
which is a SAS Discovery issue um the
request will let you do das discovery of
the script uh there's no effort to hide
actually what the script is doing and
it's noisy and logs PHP being the
language that it is has the at sign that
use side of emails and what that does is
this if this function or this method
creates an error just ignore it it's
fine which is just wonderful it also has
a scream operator which over overrides
the air suppression operator to allow
that to kick things to
logs so yeah so now we got a little bit
more Opus skated here we want ahead and
we reverse the string so C exe backwards
is exec you could also take that secret
towards the bottom where the cursor is
floating that's my laser pointer for the
day and that is basically exec and then
request hex so what's cool about that is
you're basically using a variable with
whatever level of abstraction you want
ahead of it to execute a function that's
a little bit harder to
find and there's a lot of different
methods that you could use to get that
done so I mean b64d code is pretty
universally used across malware I don't
know why it is but it's not a bad
function especially if you're trying to
parse and PHP email which I don't know
why you're doing that but you'll need
b64 dcode for the bind bodies uh gz
inflate and deflate turns it into binary
blobs makes a little bit harder to
understand exactly what it's doing uh
string reverse just showed you that one
but then you have string concatenation
so you can see I have an exe down here
which if you're just parsing things
you're doing a grap across your entire
web directory looking for Dangerous
functions it's going to miss that
because there's things breaking that
string
apart you use esy encoding anybody who
built one of those logic analyzers uh
downstairs really cool uh really cool
they're using ASI to transmit over the
Arduino for your logic analyzer to pick
up and that's basically all that is one
uh 101 is e so you got two of those 120
and 99 you could also just tokenize it
you make it so it's a little bit harder
to understand what the function is doing
this function here is just reversing a
string it's not doing anything crazy but
it's pretty damn
confusing so cool now we have some
effort to hide what it's doing from its
true
purpose and this is the last one if you
guys are like dude like I get it you
you're a web developer dude have fun
this is the last one I'm going to do so
now all I did here was add a little note
at the top that this is part of a
WordPress uh parser package this is a
WordPress site it's reasonable that if
you saw that you'd be like oh that
sounds important leave it on
there that's a little fear uncertainty
and
doubt so cool we're dissuading
modification so now what we'll do is
we'll go ahead and tear down an actual
script that was live on the
interwebs so a few tips and tricks to
doing this uh I did it during Co
initially while I was Happ helping this
guy out in 2021 and then uh Michael hit
me up and was like hey are you g to come
back and do another talk and I'm sure so
I had to do it again because I forgot
everything I did the first time so first
biggest tip if you want to do this is
use cool bullets in your presentation
squares are cool they're cooler than
circles but they're not Stars okay will
you peel back to your files yes you
could use GitHub branches you store it
in different methods I I like different
files and the reason I did that is so
when yall decide to pull this GitHub
repo down you could look at the files
with notes and say okay cool here's the
original and here is how it gets peeled
back into the state that it is um you'll
you'll definitely wreck it a few
times you also want to keep a current
text file about what you're doing if you
go on a bender or if you like me you
have three kids and you're away for days
at a time like diapers and stuff like
that you're going to forget what you
were working
on run m in an isolated test bed uh
environment if at all possible or don't
if you don't really want to uh you never
know what these scripts are going to do
and they could pull down more malicious
stuff than what you've seen they could
send up things to other
sites and while you're doing this it's
good idea to run link test which is just
a syntax check of the actual code or you
go through and run the script and see if
it looks the same because every time you
go and dfus skate something if you fat
finger something you're going to break
it people are W people are walking out F
fire alarm
somebody sadness all right so I don't
know if anybody seen this movie mild
spoilers it's like 40-year-old movie
shouldn't be too you know you should
have seen it by now uh Christmas Story
kid gets a letter in the mail and he uh
it's got some ausc inside there it's got
a replacement
Cipher so that was me getting that
script I'm like cool let's figure out
what this does so from a high level I
don't expect anybody to understand what
this means cuz it doesn't mean
anything but the point is is the methods
the functions inside or the methods the
properties inside of this object that we
on the server had things that were scary
x64 debug uh what else we got TX library
right a bunch of different components in
there where a casual Observer would see
that and think okay yeah don't touch it
it was pretty
clever so first thing I did is I pulled
this up and I looked at I'm like cool
this uh this file is part of the patchy
software foundation and it's an MIT
license real quick does anybody know
what the problem is
already Apache literally has their own
licensing framework they don't use MIT
for their software they have the Apache
software licenses which if you use
Apache you've dealt with that
license um but that's creative that
sounds scary so they left it
alone so they have that inside there
plus you have obviously the functions
that concern you what is x86 what is
claster if somebody knows what that is I
still don't um and then we have the
error control operator buried inside of
maybe it's a screenshot maybe it's a
different
one before I jump further I will mention
that fatal error on the bottom if
anybody is trying to run this code pull
it down from GitHub uh PHP 8 removes a
function that this script needs to run
PHP 7 deprecates the PHP 6 doesn't exist
uh languages and PHP five runs are just
fine so if you're actually looking to
run any of this and play with it that's
what you'll
need so first level of dation I pull
this back and figure out what it's doing
is you see all these different arrays
your check x64 stable and so on all
those are just randomly sorted
directories of the words in fact that
word fence report that we saw at the
beginning was actually pulling up this
create function right one right here x64
it saw that which I was thoroughly
impressed with it wasn't just a simple
string match so went through fixed all
these functions inside of the code got
rid of unnecessary code and so this
second started to look more like down
here where we have okay cool create
function with that at sign at the
beginning air suppression operator got
your gz inflate air suppression operator
once
again and that is just in case you
disable those functions it makes it
harder to find that script so it can
maybe hobble itself
together it's like limp mode on your
cars cool second second step is removing
functions that simply wrap the other
functions so this MV block here was
separate from a very large base 64 blob
that was called Library somebody can
figure out what that is by just looking
at it I'll be impressed but it's base 64
and you can usually tell it by the
equals the pluses and the slashes in
there that pad and shift the base of the
character
set round three is okay cool let's peel
back these functions until I can see
what MV is MV was simply that right
there if anybody does uh HTML coding
trigger a few people with that you'll
see you got a little block inside here
where it's kicking out a body it's
pulling down your HTTP host it's doing
some operations on it and it's looking
for something uncore wi I promise you
that's not a play on Wisconsin I know
we're in Wisconsin that's what it was
called um which I thought was pretty
great and so we're pulling down a
substring of a sha one hash of that
string and we're grabbing the first 16
digits of it okay so do I just have a
command and control side like a server
side of the script that I'm sending
things to this I don't know at this
point but this is kind of interesting
you get down here text and name you got
your name isore wi okay so there's
something going on with this uh this
page there's a form
somewhere screw it let's throw it in the
browser and see what happens says 404
not found now this is actually a lot
trickier than you'd think because as a
human you see that you're like cool 404
there's nothing there typo two problems
exist one is it was putting out a 200 on
the on the actual headers that's
actually really clever because if
they're scanning for 404s with a site
mat maker or something similar it's not
going to detect a 404 on their site
they're not going to go and find that
the other thing is is it didn't match
the serers 404 page so you knew that
there was something going on something
else was responding for that server at
that page if you hit control and mouse
click it pulls up this box here that at
first I'm like cool LS Di in case it's
Windows machine whatever else go through
and see if I can run shell level
commands through that command through
that input
box but there was no good way of
figuring out what it could do because
nothing worked everything I tried inside
of there just would not execute a
command it wouldn't do anything tricky
was just white page of death which if
you've done PHP Dev work it's pretty
common
stuff so I ran every single wordless
word list and password list I could find
did about 10 million attempts against it
and the way I checked it is I took that
function I looked for the library really
large one I talked about a bit ago to be
decoded for things like PHP or uh exit
or print or echo or any of the common
PHP functions to see cool did I get this
actually broken through one of these 10
million
iterations I didn't got nothing I tried
password one I tried putting a uh
exclamation point I did you know spring
2021 i' I've tried all those
things still that's my password don't
just whatever don't try it uh but yeah
so we we got the authentication
mechanism we'll call it pretty
simplified I understand what it's
supposed to do and this is why I thought
this would be a cool talk is because
most malware that you see that's web
level doesn't actually have this level
of abstraction too or this level of
obfuscation a lot of it is pretty
obvious or a few layers of B 64 and gzip
they're not using a password to pad
strings inside of
there so there's another method inside
called income which I do love income
very much it didn't generate any of that
for me so looped over every character in
this large Library blob this B 64 one
converting the asky to decimal so like
you know lowercase a is 65 or uppercase
it's uppercase um died against a hash
version of that sha one 16 character
password earlier iterated over that and
appended a decimal character after being
module 256 back to ASI somebody here is
going to be a lot smart smarter than me
and could tell me why they were doing
that all I know is like that's pretty
confusing and I'm impressed so they were
just doing that to basically bury the
true source of the code and a way I
figured that out was like does this
iterate over this thousands of times one
time the first time I did it I kicked it
out and I got this over here and that's
not necessarily G gz inflated but
probably but that in that the character
lengths lined up perfectly cool there's
one iteration over this hashing function
in order to get that text
back so then I went a little bit further
with it to make a little bit clearer for
this Con so if any of yall wanted to
look at that code and be a little bit
clear what you're actually doing with it
um not for efficiency but readability I
also removed some objectoriented
programming abstraction that was inside
there it was a procedural script it
threw and through they just put it in
there to confuse you uh it was infected
with class
itis I thought I took part of this slide
out but I'm going to read it now um
unnecessary abstraction through
objectoriented principles applied to
software unlikely receive updates
maintenance or shared across
teams I'm not I'm not talking down doing
things object oriented but when it's a
script that you're putting on somebody's
server to like host a Bitcoin minor
effort you can make it really Slim um I
threw a little line here about the Atari
2600 because there is a lot of vintage
computer things going on here where they
actually had to make code so efficient
at that time where during the refresh
cycle your vertical refresh rate of the
screen that had that time to execute
code before it painted the next screen
if you took too many or too few computer
Cycles or compute Cycles to do that your
screen is being drawn incorrectly it so
throwing abstraction on top of something
like that you're adding needless padding
to it a bunch of knops in effect um that
doesn't apply a lot to PHP but it's an
interesting fact and it kind of ties
into
abstraction so yeah this wasn't
abstracted either way it was there uh
for any of those purposes it was there
to confuse you and make you have to dig
a little bit further fud
yeah so never give up never surrender I
did spend a lot of time pulling it back
to that point going through this code
talking to this guy who I mean the
reditor who's is going to take code and
send it to me from his server is pretty
impressive to start with and there's a
lot of effort to figure out what that
does and I still have no idea now
everybody in here knows because you know
what my talk is called because you're
here and we already called the command
control but I'm not going to tell the
guy the same thing either that it's a
scary script it looks confusing I can't
figure figured out I don't know what it
did so what can you do with
that not that way that way it's time to
fish right we have a script that some
attacker expects is going to be up on
their web domain or on the website that
they could use to access his person's
machine so cool we got our Dakota ring
in the mail for the folks who are
keeping up with the uh Christmas Story
references it didn't take very long at
all for this to actually work this is a
legit fishing script that I built and
the legit request log that I got back
from it that's a real password that's
the guy's real IP somebody works for
that ISP can be like bro like you got
fished um so all I did was take the HTML
body that we used on that first half
throw that up on the server and anything
that got sent to it whether it was a
cookie whether it was a git post we log
that down with the IP and what time it
happened and once we had that was pretty
easy pickings after that point to figure
out what the script actually
does
more Christmas
story more Christmas Story oh it's not
pling uh I had exper as a PDF this this
little kid says an exploitive on on a
80s television show that's pretty
rare so cool we got the
library file this B 64 decoded now now
we can see actually what this is doing
and this is the second time I went
through this and Windows Defender
decided to say hey you got a trojan on
your machine yes allow
it's a work machine anyway so
um so you see on the left there that we
have little screenshot of what that
kicked out now that's not exactly what
it kicked out I don't know how many
folks here you do show hands if you want
do python Dev over like PHP I S one okay
two python loves its line feeds it loves
its line spacing it spaces a tab Tabs
are better um it loves indentation for
control structures PHP could just like
spray it on the on the P it doesn't care
it's like yeah it's fine so I ran that
through a code beautifier which I feel
like I say in a few slides somewhere
maybe maybe not maybe maybe I'll just
talk about it now and if I get to that
slide it'll be weird ran through code
beautifier to make it look a little bit
nicer everything's indented everything
has the curly braces hanging just the
way I like
it and I decided let's go ahead and
execute it so that's what I got back is
that right there has anybody seen this
on any of your web
apps there's a few there are a few hands
here
yeah so there's nothing super tricky
about what that is that is actually
doing it's super powerful but there's
nothing crafty they spent a lot of work
to hide basically like a c99 shell
equivalent here so it allows you to do
your upload download touches edits um
view PHP info or your config info so if
you're one of those folks who are like
oh you're not I'm not going to put
inside my GitHub repo my database
connection credentials I'm going to
throw those inside of a constant that is
written to the web server PHP info tends
to puke out every single Global V
variable inside of it so now if I could
kick run that function I have
credentials to your data base where it's
located hopefully internally and things
can go downhill from there you also run
Shell Code so you could you know run moo
or something else and PHP code I didn't
see anything that phones home or says
hey here's where the script is at or any
sort of advanced persistent thread or
anything super
crazy so after the fish
uh yeah we can't we can't know exactly
what the script is doing at this point
unless we go a little bit deeper into
that script so the first thing I had to
do is run through the code beautifier
everybody remembers that nobody's
asleep
okay and then we saw those weird
hexadecimal or octal encoding of
different symbols so you got your single
quote you got your double quote you got
your backslash and that's what you'll
see a lot of times it had like a b CD 1
2 3 4 curly braces I mean it was it was
a complete mess and I was pretty
impressed at how long uh that took if
you're looking to ever back a script
like this off I've learned that these
are three of them that you probably
don't want to because if you back off a
single quote in the middle of two single
quotes syntax error that's why I say
lint
check so you can see inside of here we
have an inii restore with that uh air
suppression operator and you have a
function exist check right there your
inii restore is encoded with both you
got uh heximal and a little bit further
down we have one that there back slash1
151 that's your
octal so it's funny to look at how much
effort went into hiding even this layer
of code when you're already past fishing
the guy after you throw 10 million
attempts against his web server just the
amount of work to get to this and
they're still burying
things so moral Story how did this
actually happen so this guy on Reddit
used a subcontracting subcontractor for
work they installed pay4 plugins that
they
pirated
shock um so
yeah so basically what this comes down
to is I wanted to more or less Inspire
folks who get mware
detections to just go and go dig a
little bit further it's actually pretty
interesting to see what you could find
in this in this stuff um it's probably
something you could find somewhere else
on GitHub but it it's the the the tear B
part of this is pretty
fun so I might be a little early talked
a little quick there yeah very early
Micro Machines guy over here fire fire
alarm um questions comments concerns
want to make fun of me
anything
show nothing all right well that's
that's a GitHub repo if you want to see
what the code looks like um I got a the
list of the SE list is the password repo
and got some PHP shelves inside there
and then a couple self plugs and a few
uh things that make people angry about
Macs and PCs and tabs and
spaces cool well thank you all for
coming