EternalBlue: Exploit Analysis and Beyond WHO AM I? Emma McCall - - PowerPoint PPT Presentation

▶
eternalblue
SMART_READER_LITE
LIVE PREVIEW

EternalBlue: Exploit Analysis and Beyond WHO AM I? Emma McCall - - PowerPoint PPT Presentation

Nov 05, 2023 94 likes •468 views

EternalBlue: Exploit Analysis and Beyond WHO AM I? Emma McCall Cyber Security Analyst @ Riot Games @RiotNymia on Twitter JUST A LITTLE HISTORY Black Market Intelligence Auc1on Approx. August 2016 No bites April 14 th 2017 Group

slide-1
SLIDE 1

Exploit Analysis and Beyond

EternalBlue:

slide-2
SLIDE 2

WHO AM I?

Cyber Security Analyst @ Riot Games @RiotNymia on Twitter Emma McCall

slide-3
SLIDE 3
slide-4
SLIDE 4

JUST A LITTLE HISTORY

  • Black Market Intelligence Auc1on Approx. August 2016

▾ No bites

  • April 14th 2017

▾ Group calling themselves ‘Shadowbrokers’ ▾ Equa1on Group (NSA) Tools and Exploits dumped onto

GitHub

slide-5
SLIDE 5

THE DUMP

Overall ~35 Exploits and tools

  • SMB
  • SendMail
  • Kerberos
  • IIS
  • Windows XP -> 10
slide-6
SLIDE 6

THE DUMP

Of particular note were:

  • Fuzzbunch – Exploita1on Framework
  • DanderSpritz – Command and Control Solu1on
  • DoublePulsar – Backdoor Trojan
  • EternalBlue – SMB Exploit
slide-7
SLIDE 7

ETERNALBLUE

  • Where has EternalBlue been seen?

▾ WannaCry Ransomware ▾ Adylkuzz Viral Crypto Miner ▾ Zealot - Apache Struts

  • Lateral movement in ALL cases
slide-8
SLIDE 8

JUST SOMETHING THAT POPPED UP

Slight segue to look at this one:

  • Exploit for MDaemon pre v9.5.6

▾ v9.5.6 was Released in October 2006

  • Shodan check on 16th April 2017… Lets have a closer

look at that number….

slide-9
SLIDE 9

HOW

WHAT

THEN WHAT

ETERNALBLUE

  • Exploit for Windows Server Message Block (SMB)

▾ Affected both versions v1 and v2 ▾ Remote Code Execu1on on vic1m machine

  • Exploita1on targeted the following services

▾ TCP 445 (Microsof Domain Service) ▾ TCP 139 (NetBIOS Session Service)

slide-10
SLIDE 10

HOW

THEN WHAT WHAT

ETERNALBLUE

  • First things first: How does SMB data transfer work?
slide-11
SLIDE 11

HOW

THEN WHAT WHAT

ETERNALBLUE

  • First things first: How does SMB data transfer work?

▾ Data larger than SMB MaxBufferSize in Trans2

slide-12
SLIDE 12

HOW

THEN WHAT WHAT

ETERNALBLUE

  • Exploits Non-Paged Pool Overflow in srv2.sys

▾ Fills NT Trans with Zeros ▾ Malformed Trans2 packet containing shellcode and Encrypted Payload

slide-13
SLIDE 13

THEN WHAT

WHAT HOW

ETERNALBLUE

  • Ini1al Payload: DoublePulsar

▾ Non-Persistent ▾ Customisable Process Name / Command Line ▾ Code Execu1on via .DLL or raw shellcode upload

  • Ini1ally Uploaded DLLs came from 2 sources

▾ Created via ‘Danderspritz’ ▾ Via Metasploit (Meterpreter)

slide-14
SLIDE 14

Victim

Attacker Attacker

slide-15
SLIDE 15

ETERNALBLUE

  • TCP 445 On the internet?

… what about on your LAN?

slide-16
SLIDE 16

WHAT CAN I DO?

NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS

slide-17
SLIDE 17

WHAT CAN I DO?

NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS

slide-18
SLIDE 18

NETWORK ANALYSIS

  • Run it.

▾ ….. In a lab! ▾ hnps://medium.com/@xNymia For all your lab crea1on needs

  • Sysinternals and Wireshark are your best friends
  • Comparison against known good SMB traffic
  • Look for irregulari1es and panerns in mul1ple samples
  • Check protocol docs
slide-19
SLIDE 19

NETWORK ANALYSIS

slide-20
SLIDE 20

NETWORK ANALYSIS

slide-21
SLIDE 21

NETWORK ANALYSIS

  • Interes1ng Mul1plex ID
slide-22
SLIDE 22

WHAT CAN I DO?

NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS

slide-23
SLIDE 23

DETECTION CREATION

  • We have 4 indicators now

▾ Mul1plex ID 64/65 ▾ Mul1plex ID 81/82

  • Lets flex our learnings

▾ Suricata IDS Rules ▾ Snort IDS Rules

alert tcp $HOME_NET any -> any any (msg:"EXPLOIT Possible ETERNALBLUE SMB Exploit Anempt Stage 1/2

  • Tree Connect AndX Mul1plexID = 64 - MS17-010";

flow:to_server,established; content:"|FF|SMB|75 00 00 00 00|"; offset:4; depth:9; content:"|40 00|"; distance:21; within:23; flowbits: set, SMB.v1.AndX.MID.64; classtype:trojan-ac1vity; sid:5000074; rev:1;)

slide-24
SLIDE 24

DETECTION CREATION

SMB Packet

0010 < ........ Frame / TCP / IP Headers .........> 0020 00 00 00 60 FF 53 4D 42 75 00 00 00 00 18 07 C0 0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE 0040 00 08 40 00 04 FF 00 60 00 08 00 01 00 35 00 00 0050 5C 00 5C 00 31 00 39 00 32 00 2E 00 31 00 36 ...

NetBios Header SMB Structure - "|FF|SMB|75 00 00 00 00|" Multiplex ID - "|40 00|" SMB Content

slide-25
SLIDE 25

DETECTION CREATION

alert tcp $HOME_NET any -> any any (msg:"EXPLOIT Possible ETERNALBLUE SMB Exploit Anempt Stage 1/2

  • Tree Connect AndX Mul1plexID = 64 - MS17-010";

flow:to_server,established; content:"|FF|SMB|75 00 00 00 00|"; offset:4; depth:9; content:"|40 00|"; distance:21; within:23; flowbits: set, SMB.v1.AndX.MID.64; classtype:trojan-ac1vity; sid:5000074; rev:1;)

slide-26
SLIDE 26

WHAT CAN I DO?

NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS

slide-27
SLIDE 27

IMPACT IDENTIFICATION

  • What is actually vulnerable?
  • Run it.

▾ In lots of labs!

slide-28
SLIDE 28

IMPACT IDENTIFICATION

  • What has already been compromised?

▾ Scan the internet?

slide-29
SLIDE 29

WHAT CAN I DO?

NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS

slide-30
SLIDE 30

MITIGATION ADVICE

  • How can we help others mi1gate?

▾ Patching can be difficult ▾ What other op1ons can we offer?

  • Disable SMBv1?
  • What did Riot do?

▾ Suricata detec1ons ▾ No external SMB ▾ Firewalled Inbound SMB on worksta1ons

slide-31
SLIDE 31

WHAT CAN I DO?

NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS

slide-32
SLIDE 32

BINARY ANALYSIS

  • Some1mes worthwhile disassembling

…Simplest things right under your nose.

slide-33
SLIDE 33

… AND BEYOND

  • So shits going down, what can I do?

▾ Get a lab setup ▾ Grab a sample ▾ Run it. Don’t be too afraid ▾ What can I do with this data? ▾ Blogging, Twee1ng, IRC / Slack / Discord

  • A few don'ts for good measure:

▾ Don’t work in a silo, talk to people ▾ Don’t run dodgy files on your main machine

Be Heard

slide-34
SLIDE 34

DEY!

@ronindey

Kevin Beaumont Dan Tentler

@Viss @GossiTheDog

THE GANG

Emma McCall

@RiotNymia

slide-35
SLIDE 35