퍼플하운드 컨텐츠 개발을 위한 CVE-2022-24990 & CVE-2022-24989 N-Day 분석

#binwalk 펌웨어 추출 설치 sudo apt-get install binwalk #QEMU 설치 sudo apt-get install qemu sudo apt-get install qemu-user-static sudo apt-get install qemu-system #dependencies 설치 sudo apt-get install libglib2.0 libglib2.0-dev sudo apt-get install autoconf automake libtool sudo apt-get install uml-utilities bridge-utils

binwalk -Me TOS_S2.0_Install_JM33_4.2.15_2107221409_2107221412.ins

sudo apt-get update sudo apt-get install git fakeroot build-essential ncurses-dev xz-utils libssl-dev bc flex libelf-dev bison qemu-system-x86

wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.54.tar.xz tar xvf linux-5.10.54.tar.xz cd linux-5.10.54

make defconfig make kvmconfig

vi .config # Coverage collection. CONFIG_KCOV=y # Debug info for symbolization. CONFIG_DEBUG_INFO=y # Memory bug detector CONFIG_KASAN=y CONFIG_KASAN_INLINE=y # Required for Debian Stretch CONFIG_CONFIGFS_FS=y CONFIG_SECURITYFS=y

make olddefconfig

make -j`nproc`

sudo apt-get install debootstrap mkdir image && cd image wget https://raw.githubusercontent.com/google/syzkaller/master/tools/create-image.sh -O create-image.sh chmod +x create-image.sh ./create-image.sh

vi create-image.sh seed = 20480

/*run.sh 파일 작성*/ qemu-system-x86_64 \ -m 2G \ -smp 2 \ -kernel $1/arch/x86/boot/bzImage \ -append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0 nokaslr" \ -drive file=$2/bullseye.img,format=raw \ -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22,hostfwd=tcp:127.0.0.1:8181-:8181,hostfwd=tcp:127.0.0.1:5443-:5443,hostfwd=tcp:127.0.0.1:5050-:5050 \ -net nic,model=e1000 \ -enable-kvm \ -nographic \ -pidfile vm.pid \ 2>&1 | tee vm.log

sudo run.sh . ./image

sudo mount -o bind /dev ./_0.extracted/dev sudo mount -t proc /proc ./_0.extracted/proc sudo mount -o bind /sys ./_0.extracted/sys sudo chroot ./_0.extracted/ /bin/bash

service nginx start >/dev/null 2>&1 service php-fpm start >/dev/null 2>&1 service tosdeamon start >/dev/null 2>&1

#include <stdio.h> #include <stdlib.h> #include "mbedtls/aes.h" #include <sys/types.h> #include <sys/stat.h> #include <unistd.h> #include <string.h> int main(int argc, char *argv[]){ struct stat info; mbedtls_aes_context ctx; FILE *filePtrRead,*filePtrWrite; char bufferTemp[255] = {0}; char iv[] = "842d42b98876f581"; char lenBuf[16]; char bruteForceContent[16]; int blockIndex = 0; //Encrypted filename filePtrRead = fopen(argv[1],"rb"); filePtrWrite = fopen("decrypted.php","wb"); fstat(fileno(filePtrRead), &info); char *fileContent = (char *) malloc(info.st_size*sizeof(char)); memset(fileContent,0x00,info.st_size); fread(fileContent,info.st_size,1,filePtrRead); fclose(filePtrRead); //MD5 hash of GH65Hws2jedf3fl3MeK mbedtls_aes_setkey_dec(&ctx, "842d42b98876f581f0dfbefb0cd2b5c3", 256); memcpy(bufferTemp,"842d42b98876f581f0dfbefb0cd2b5c3",strlen("842d42b98876f581f0dfbefb0cd2b5c3")); unsigned int fixContentIndex = 0x10; while ((int)fixContentIndex < info.st_size) { if ((int)fixContentIndex < 0x20) { lenBuf[fixContentIndex-16] = *(fileContent + fixContentIndex); } else { *(fileContent + fixContentIndex + -0x20) = *(fileContent + fixContentIndex); } fixContentIndex = fixContentIndex + 1; } int numberOfBlocks = info.st_size/16+(info.st_size%16 != 0); int decryptIndex = 0; char *fileContentPtr = fileContent; unsigned char byteValue = 0; for(int i = 0;i<256;i++,byteValue++){ blockIndex = 0; do{ *(bruteForceContent+blockIndex) = *(fileContent+blockIndex)^byteValue; blockIndex++; }while(blockIndex !=16); mbedtls_aes_crypt_cbc(&ctx, MBEDTLS_AES_DECRYPT, 16, bufferTemp, bruteForceContent, bruteForceContent); memcpy(bufferTemp,"842d42b98876f581f0dfbefb0cd2b5c3",strlen("842d42b98876f581f0dfbefb0cd2b5c3")); if(strstr(bruteForceContent,"<?php")){ break; } } printf("Correct byte value %d\n",(int) byteValue); while(decryptIndex< numberOfBlocks){ blockIndex = 0; do{ *(fileContent+blockIndex) = *(fileContent+blockIndex)^byteValue; blockIndex++; }while(blockIndex !=16); mbedtls_aes_crypt_cbc(&ctx, MBEDTLS_AES_DECRYPT, 16, bufferTemp, fileContent, fileContent); fileContent+=16; decryptIndex++; } fwrite(fileContentPtr,atoi(lenBuf),1,filePtrWrite); free(fileContentPtr); fclose(filePtrWrite); printf("Done\n"); return 0;

git clone https://github.com/ARMmbed/mbedtls.git

pip3 install jsonschema pip3 install jinja2

cd mbedtls make make install export CFLAGS="-I/usr/local/include" export LDFLAGS="-L/usr/local/lib"

gcc -o decrypt decrypt.c -lmbedtls -lmbedcrypto

./decrypt [encrypto_php_file]

import os import time def getAllSub(path, dirlist=[], filelist=[]): flist = os.listdir(path) for filename in flist: subpath = os.path.join(path, filename) if os.path.isdir(subpath): dirlist.append(subpath) getAllSub(subpath, dirlist, filelist) if os.path.isfile(subpath): filelist.append(subpath) return dirlist, filelist def getSufFilePath(fileList, suffix): for ff in fileList[:]: if not ff.endswith(suffix): fileList.remove(ff) def decryption(filename): head, tail = os.path.split(filename) filename2 = tail filename3 = "decrypted.php" path1 = head + "/" + filename2 print(f"{filename2}.php 파일을 복호화합니다.") os.system('./decrypt ' + path1) time.sleep(3) with open(filename3, 'rb') as p: if p.read(5) == b'<?php': p.close() os.system(f"mv {filename3} {path1}") print(path1) else: print(f"{filename2}.php 파일을 복호화 실패") if __name__ == "__main__": path = r'~/Desktop/CVE-2022-24990/_TOS_S2.0_Install_JM33_4.2.15_2107221409_2107221412.ins.extracted/_0.extracted/usr/www/' Dirlist, Filelist = getAllSub(path) getSufFilePath(Filelist, '.php') for FilePhp in Filelist: decryption(FilePhp)

ex)mac 주소 : 00:0c:29:2d:ae:74, 사용자 입력 : XXXX ⇒md5(2dae74XXXX) ⇒5f85ba6b33bfcb4f431bbd06a4a45851