MBAE (Malwarebytes Anti-Exploit) vs All EKs (Exploit Kits)

Disclaimer: Malwarebytes is a client. This is a sponsored post.

The goal for Malwarebytes is to show how effective is Malwarebytes Anti-Exploit (MBAE).
My goal is to try to find an exploit/Exploit Kit where it's being defeated.
I know many passes despite being made against different exploit kit are technically redundant  but I have been asked to make a MBAE vs All EKs, so here is it.

I'll try Mbae against many live exploit kits with different setup.
I took the last version available to public for a first set of runs on 2014-04-28/29 and 2014-05-02 :

Malwarebytes Anti-Exploit 0.10.3.0100

MBAE - 0.10.3.0100 in Windows 7

1- Mbae vs Nuclear Pack :

1.a.1 XP, IE8 (CVE-2013-2551 vulnerable), Java 7.0.07, Adobe Reader 9.3.0.148, Flash 11.5.502.146

First Pass : MBAE win.

Only exploit Being Delivered is the Flash (CVE-2013-0634/CVE-2014-0497) IE crashed and relaunched but IP Blacklisted by NP.

Alert received (this is what user sees -  i will show the log but it's not prompted)

What i can see in the log (don't trust date&time VM reverted, datetime not already synced)

I decided to disable flash and make another pass.

1.a.2 XP, IE8 (CVE-2013-2551 vulnerable), Java 7.0.07, Adobe Reader 9.3.0.148

Here CVE-2013-2551 (IE), CVE-2013-2423 (java<=17) and CVE-2010-0188 (PDF) We can see the payload being downloaded...but it's not being executed

Payload blocked

Off Topic:  we just escaped : 8d30917be0991a4a18c513943dc027a3 which should be BitCrypt (Crypto Ransomware)

CVE-2013-2460 (java <=21) and pdf could strike, CVE-2013-2551 is tried but could not have break

PDF and Java exploit traces

Off topic : we just escaped : 77f210c71962325d09aee79e455cd18e

1.b.1 Win7 x64 IE10 CVE-2014-0322 vuln, Flash 12.0.0.44, Silverlight 5.1.10411.0, java7u25

In that config, MBAE is not needed as Nuclear can't exploit the computer. No code for CVE-2014-0322 or CVE-2013-0074/3896 (Silverlight) and for some reason CVE-2014-0497 was not fired.

Config b.1 did not faced exploitation from Nuclear Pack

1.b.2 Win7x32 IE10 CVE-2014-0322 vuln, Flash 12.0.0.38, Silverlight 5.1.20513.0, Adobe Reader 11.0.01, Java6.u.45

CVE-2013-2465 fired

And blocked.

Off topic: payload was : 59bd57b840bfa9809e32e753e8c0375c

2 - MBAE vs Angler EK

2.a.2 XP, IE8 (CVE-2013-2551 vulnerable), Java 7.0.07, Adobe Reader 9.3.0.148

CVE-2013-2551 triggered an alert and MBAE blocked the exploit. On IE reload exploit kit reject us.

1 more line in the logs of MBAE for that VM (+ some entries for 1.a.2)

( This is when I decided to add the config a.3 for all pass. Check without the IE exploit trigger )

2.a.3  XP, IE8 Up to date, Flash 13.0.0.182 Adobe Reader 9.3.0.148 + java.

I made 2 pass there...in that config no need for MBAE as the exploit kit fail with java 7u21(2.a.3.a) et 7u7 (2.a.3.b)

Angler EK fail with Jre7u21

Angler EK fail with jre7u7

2.b.1 Win7 x64 CVE-2014-0322 vuln, Flash 12.0.0.44, Silverlight 5.1.10411.0, java7u25

On first pass the CVE-2014-0322 made the Browser crashing, and we also see the silverlight call

First pass on Angler (2.b.1.a)

Screen after Pass 2.b.1.a

2.b.2 Win7x32 IE10 CVE-2014-0322 vuln, Flash 12.0.0.38, Silverlight 5.1.20513.0, Adobe Reader 11.0.01, Java6.u.45

Angler EK Launching CVE-2014-0497 and CVE-2014-0322

Flash Exploit intercepted just before CVE-2014-0322 make browser Crash

After pass 2.b.2

3 - MBAE vs Infinity

3.a.2  XP, IE8 (CVE-2013-2551 vulnerable), Java 7.0.07, Adobe Reader 9.3.0.148

MBAE vs Infinity - CVE-2013-2551 catched. IE Crash and Reload.

4 lines in the logs generated by 2 Infinity Landings vs MBAE.

3.b.1 Win7 x64 CVE-2014-0322 vuln, Flash 12.0.0.44, Silverlight 5.1.10411.0, java7u25

Infinity CVE-2014-0322 pass. IE Crashed too but on reload exploit was successfully triggered

CVE-2014-0322 in Infinity blocked by MBAE

3.b.2 Win7x32 IE10 CVE-2014-0322 vuln, Flash 12.0.0.38, Silverlight 5.1.20513.0, Adobe Reader 11.0.01, Java6.u.45

CVE-2014-0322 , Silverlight Exploit and Flash exploit Fired

Intercepted by MBAE

4 - MBAE vs FlashPack

4.a.2  XP, IE8 (CVE-2013-2551 vulnerable), Java 7.0.07, Adobe Reader 9.3.0.148

MBAE vs FlashPack. CVE-2013-2551 spotted and blocked

2 new lines in the log. CVE-2013-2551 from FlashPack intercepted by MBAE

To see further we'll do another pass with IE8 up to date.

4.a.3  XP, IE8 Up to date, Flash 13.0.0.182, Java 7.0.21, Adobe Reader 9.3.0.148

Flash Pack trying CVE-2014-0497 (that wouldn't strike in that config anyway) and CVE-2013-2465 or 2471

FlashPack Java exploit intercepted by MBAE

Off Topic : We escaped Glupteba (as expected from the Flash Pack thread owned by Windigo guys)
abf7690306b1d3782a0a8b43da70ec46

4.b.1 Win7 x64 CVE-2014-0322 vuln, Flash 12.0.0.44, Silverlight 5.1.10411.0, java7u25
Once again first pass made Browser crash.

CVE-2014-0322 and CVE-2013-0074/3896 fired...But  not need for AntiExploit In that case as browser Crashed (4.b.1.a)

I made 3 pass. Each time Crashing. So at that time i decided to add a config b.2 based on win7x32

4.b.2 Win7x32 IE10 CVE-2014-0322 vuln, Flash 12.0.0.38, Silverlight 5.1.20513.0, Adobe Reader 11.0.01

IE Crashed again...

Pass 4.b.2.a

Same with pass 4.b.2.b on the Windigo Flash EK instance.

4.b.3 Win7x64 , Flash 13.0.0.182 (CVE-2014-0515 vulnerable)
I added that config since this exploit kit is becoming mainstream.

CVE-2014-0515 pass (the EK also tries to fire CVE-2014-0322) 2014-06-06

MBAE stopped it again :

Alert and logs from MBAE after CVE-2014-0515 try.

5 - MBAE vs Magnitude (top-exp)

5.a.2  XP, IE8 (CVE-2013-2551 vulnerable), Java 7.0.07, Adobe Reader 9.3.0.148

Magnitude vs MBAE, last line is payload from Java.

Logs showing the jar payload blocked and CVE-2013-2551 intercepted (Magnitude 2014-04-28)

Off topic : We escaped that payload : 69c737cabafceb7fe4a62ffba7518164 (Simda)

 5.a.3 XP, IE8 Up to date, Flash 13.0.0.182, Java 7.0.21, Adobe Reader 9.3.0.148
In that config no exploitation :

Java from Magnitude blocked by Java Settings in pass 5.a.3.a

I made another pass lowering those settings from High to medium

I choose to accept the risk and run but no exploitation

Pass 5.a.3.b (no exploitation...no need for MBAE there)

RIG vs MBAE 2014-05-22

MBAE vs Rig first pass : Mbae win.

CVE-2014-0322 - CVE-2013-0634 (!?) and Silverlight Exploit fired by RIG 2014-05-22

and blocked by mbae

12 - MBAE vs Gondad

Gondad 2014-05-22

CVE-2013-0634 in Gondad successfully blocked by MBAE