Submit #6165: BACKDOOR.WIN32.ZOMBAM.GEQ / Remote Buffer Overflowinfo

TitleBACKDOOR.WIN32.ZOMBAM.GEQ / Remote Buffer Overflow
DescriptionDiscovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/fd14cc7f025f49a3e08b4169d44a774e.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.geq Vulnerability: Remote Buffer Overflow Description: Zombam.geq listens for connections on TCP port 80 and trys connect to SMTP port 25. By sending a HTTP GET request of about 2000 bytes triggers buffer overflow corrupting the stack and overwriting EDX register. Type: PE32 MD5: fd14cc7f025f49a3e08b4169d44a774e Vuln ID: MVID-2021-0037 Dropped files: ASLR: False DEP: False Safe SEH: True Disclosure: 01/19/2021 Memory Dump: (19a0.17cc): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=00000000 ecx=048ffa24 edx=41414141 esi=00000003 edi=00000003 eip=773ced3c esp=048ff0bc ebp=048ff24c iopl=0 nv up ei pl nz na po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202 ntdll!ZwWaitForMultipleObjects+0xc: 773ced3c c21400 ret 14h 0:004> .ecxr eax=048ff9f4 ebx=040202d0 ecx=048ffa24 edx=41414141 esi=040202d0 edi=00404626 eip=004024f8 esp=048ff9dc ebp=048ffa2c iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 *** WARNING: Unable to verify checksum for Backdoor.Win32.Zombam.geq.fd14cc7f025f49a3e08b4169d44a774e.exe *** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.Zombam.geq.fd14cc7f025f49a3e08b4169d44a774e.exe Backdoor_Win32_Zombam_geq_fd14cc7f025f49a3e08b4169d44a774e+0x24f8: 004024f8 8b4204 mov eax,dword ptr [edx+4] ds:002b:41414145=???????? 0:004> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* FAULTING_IP: Backdoor_Win32_Zombam_geq_fd14cc7f025f49a3e08b4169d44a774e+24f8 004024f8 8b4204 mov eax,dword ptr [edx+4] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 004024f8 (Backdoor_Win32_Zombam_geq_fd14cc7f025f49a3e08b4169d44a774e+0x000024f8) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 41414145 Attempt to read from address 41414145 PROCESS_NAME: Backdoor.Win32.Zombam.geq.fd14cc7f025f49a3e08b4169d44a774e.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 41414145 READ_ADDRESS: 41414145 FOLLOWUP_IP: Backdoor_Win32_Zombam_geq_fd14cc7f025f49a3e08b4169d44a774e+24f8 004024f8 8b4204 mov eax,dword ptr [edx+4] MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 FAULTING_THREAD: 000017cc BUGCHECK_STR: APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141 PRIMARY_PROBLEM_CLASS: STRING_DEREFERENCE_FILL_PATTERN_41414141 DEFAULT_BUCKET_ID: STRING_DEREFERENCE_FILL_PATTERN_41414141 LAST_CONTROL_TRANSFER: from 004020ac to 004024f8 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. 048ffa2c 004020ac 41414141 048ffa40 00000415 Backdoor_Win32_Zombam_geq_fd14cc7f025f49a3e08b4169d44a774e+0x24f8 048ffaa4 41414141 41414141 41414141 41414141 Backdoor_Win32_Zombam_geq_fd14cc7f025f49a3e08b4169d44a774e+0x20ac 048ffaa8 41414141 41414141 41414141 41414141 0x41414141 048ffaac 41414141 41414141 41414141 41414141 0x41414141 048ffab0 41414141 41414141 41414141 41414141 0x41414141 048ffab4 41414141 41414141 41414141 41414141 0x41414141 048ffab8 41414141 41414141 41414141 41414141 0x41414141 048ffabc 41414141 41414141 41414141 41414141 0x41414141 048ffac0 41414141 41414141 41414141 41414141 0x41414141 048ffac4 41414141 41414141 41414141 41414141 0x41414141 048ffac8 41414141 41414141 41414141 41414141 0x41414141 048ffacc 41414141 41414141 41414141 41414141 0x41414141 048ffad0 41414141 41414141 41414141 41414141 0x41414141 048ffad4 41414141 41414141 41414141 41414141 0x41414141 048ffad8 41414141 41414141 41414141 41414141 0x41414141 048ffadc 41414141 41414141 41414141 41414141 0x41414141 048ffae0 41414141 41414141 41414141 41414141 0x41414141 048ffae4 41414141 41414141 41414141 41414141 0x41414141 048ffae8 41414141 41414141 41414141 41414141 0x41414141 048ffaec 41414141 41414141 41414141 41414141 0x41414141 048ffaf0 41414141 41414141 41414141 41414141 0x41414141 048ffaf4 41414141 41414141 41414141 41414141 0x41414141 048ffaf8 41414141 41414141 41414141 41414141 0x41414141 048ffafc 41414141 41414141 41414141 41414141 0x41414141 048ffb00 41414141 41414141 41414141 41414141 0x41414141 048ffb04 41414141 41414141 41414141 41414141 0x41414141 048ffb08 41414141 41414141 41414141 41414141 0x41414141 048ffb0c 41414141 41414141 41414141 41414141 0x41414141 048ffb10 41414141 41414141 41414141 41414141 0x41414141 048ffb14 41414141 41414141 41414141 41414141 0x41414141 048ffb18 41414141 41414141 41414141 41414141 0x41414141 048ffb1c 41414141 41414141 41414141 41414141 0x41414141 048ffb20 41414141 41414141 41414141 41414141 0x41414141 048ffb24 41414141 41414141 41414141 41414141 0x41414141 048ffb28 41414141 41414141 41414141 41414141 0x41414141 048ffb2c 41414141 41414141 41414141 41414141 0x41414141 048ffb30 41414141 41414141 41414141 41414141 0x41414141 048ffb34 41414141 41414141 41414141 41414141 0x41414141 048ffb38 41414141 41414141 41414141 41414141 0x41414141 048ffb3c 41414141 41414141 41414141 41414141 0x41414141 048ffb40 41414141 41414141 41414141 41414141 0x41414141 048ffb44 41414141 41414141 41414141 41414141 0x41414141 048ffb48 41414141 41414141 41414141 41414141 0x41414141 048ffb4c 41414141 41414141 41414141 41414141 0x41414141 048ffb50 41414141 41414141 41414141 41414141 0x41414141 048ffb54 41414141 41414141 41414141 41414141 0x41414141 048ffb58 41414141 41414141 41414141 41414141 0x41414141 048ffb5c 41414141 41414141 41414141 41414141 0x41414141 048ffb60 41414141 41414141 41414141 41414141 0x41414141 048ffb64 41414141 41414141 41414141 41414141 0x41414141 048ffb68 41414141 41414141 41414141 41414141 0x41414141 048ffb6c 41414141 41414141 41414141 41414141 0x41414141 048ffb70 41414141 41414141 41414141 41414141 0x41414141 048ffb74 41414141 41414141 41414141 41414141 0x41414141 048ffb78 41414141 41414141 41414141 41414141 0x41414141 048ffb7c 41414141 41414141 41414141 41414141 0x41414141 048ffb80 41414141 41414141 41414141 41414141 0x41414141 048ffb84 41414141 41414141 41414141 41414141 0x41414141 048ffb88 41414141 41414141 41414141 41414141 0x41414141 048ffb8c 41414141 41414141 41414141 41414141 0x41414141 048ffb90 41414141 41414141 41414141 41414141 0x41414141 048ffb94 41414141 41414141 41414141 41414141 0x41414141 048ffb98 41414141 41414141 41414141 41414141 0x41414141 048ffb9c 41414141 41414141 41414141 41414141 0x41414141 048ffba0 41414141 41414141 41414141 41414141 0x41414141 048ffba4 41414141 41414141 41414141 41414141 0x41414141 048ffba8 41414141 41414141 41414141 41414141 0x41414141 048ffbac 41414141 41414141 41414141 41414141 0x41414141 048ffbb0 41414141 41414141 41414141 41414141 0x41414141 048ffbb4 41414141 41414141 41414141 41414141 0x41414141 048ffbb8 41414141 41414141 41414141 41414141 0x41414141 048ffbbc 41414141 41414141 41414141 41414141 0x41414141 048ffbc0 41414141 41414141 41414141 41414141 0x41414141 048ffbc4 41414141 41414141 41414141 41414141 0x41414141 048ffbc8 41414141 41414141 41414141 41414141 0x41414141 048ffbcc 41414141 41414141 41414141 41414141 0x41414141 048ffbd0 41414141 41414141 41414141 41414141 0x41414141 048ffbd4 41414141 41414141 41414141 41414141 0x41414141 048ffbd8 41414141 41414141 41414141 41414141 0x41414141 048ffbdc 41414141 41414141 41414141 41414141 0x41414141 048ffbe0 41414141 41414141 41414141 41414141 0x41414141 048ffbe4 41414141 41414141 41414141 41414141 0x41414141 048ffbe8 41414141 41414141 41414141 41414141 0x41414141 048ffbec 41414141 41414141 41414141 41414141 0x41414141 048ffbf0 41414141 41414141 41414141 41414141 0x41414141 048ffbf4 41414141 41414141 41414141 41414141 0x41414141 048ffbf8 41414141 41414141 41414141 41414141 0x41414141 048ffbfc 41414141 41414141 41414141 41414141 0x41414141 048ffc00 41414141 41414141 41414141 41414141 0x41414141 048ffc04 41414141 41414141 41414141 41414141 0x41414141 048ffc08 41414141 41414141 41414141 41414141 0x41414141 048ffc0c 41414141 41414141 41414141 41414141 0x41414141 048ffc10 41414141 41414141 41414141 41414141 0x41414141 048ffc14 41414141 41414141 41414141 41414141 0x41414141 048ffc18 41414141 41414141 41414141 41414141 0x41414141 048ffc1c 41414141 41414141 41414141 41414141 0x41414141 048ffc20 41414141 41414141 41414141 41414141 0x41414141 048ffc24 41414141 41414141 41414141 41414141 0x41414141 048ffc28 41414141 41414141 41414141 41414141 0x41414141 048ffc2c 41414141 41414141 41414141 41414141 0x41414141 048ffc30 41414141 41414141 41414141 41414141 0x41414141 048ffc34 41414141 41414141 41414141 41414141 0x41414141 048ffc38 41414141 41414141 41414141 41414141 0x41414141 048ffc3c 41414141 41414141 41414141 41414141 0x41414141 048ffc40 41414141 41414141 41414141 41414141 0x41414141 048ffc44 41414141 41414141 41414141 41414141 0x41414141 048ffc48 41414141 41414141 41414141 41414141 0x41414141 048ffc4c 41414141 41414141 41414141 41414141 0x41414141 048ffc50 41414141 41414141 41414141 41414141 0x41414141 048f
Source⚠️ https://www.malvuln.com/advisory/fd14cc7f025f49a3e08b4169d44a774e.txt
User
 malvuln (UID 14984)
Submission01/20/2021 02:45 (5 years ago)
Moderation01/20/2021 07:48 (5 hours later)
StatusAccepted
VulDB entry168120 [Backdoor.Win32.Zombam.geq HTTP GET Request stack-based overflow]
Points20

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!