Overview

The SonicWall Capture Labs threat research team became aware of an arbitrary file read vulnerability affecting Splunk Enterprise installations. Identified as CVE-2024-36991 and given a CVSSv3 score of 7.5, the vulnerability is more severe than it initially appeared. Labeled as a path traversal vulnerability and categorized as CWE-35, this vulnerability allows attackers to traverse the file system to access files or directories outside the restricted directory. Splunk software uses computer-generated data to track, scan, analyze and visualize it in real-time. It is used for business and web analytics, application management, compliance, and security.

A proof of concept is publicly available on GitHub. In Splunk Enterprise, versions below 9.2.2, 9.1.5 and 9.0.10 are vulnerable. An attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise with Splunk Web enabled. Although Splunk is famous mainly for dev environments, up to 230k exposed servers are running Splunk according to Fofa. Splunk has released a patch, and it is advisable to update it immediately.

Technical Overview

The vulnerability exists because of the Python os.path.join function that removes the drive letter from path tokens if the drive in the token matches the drive in the built path. The function os.path.join() takes multiple path components as arguments and concatenates them into a single path. It ensures that the correct path separator is used according to the operating system, as shown in Figure 1.

Figure 1: os.path.join() function

Windows has a concept of a current directory for each drive. Due to that, “C: source dir” means “source dir” inside the current C: directory.

Figure 2: Directory listing on Windows and Linux

According to the os.path.join documentation, the drive is not reset on Windows when a rooted path segment (e.g., d’\foo’) is encountered. If a segment is on a different drive or is an absolute path, all previous segments are ignored, and the drive is reset.

Figure 3: Absolute path as Output in Python os.path.join () function

The CVE-2024-36991 flaw leverages the os.path.join function allowing an attacker to perform a directory listing on the Splunk endpoint, potentially enabling unauthorized access to sensitive files on the system. The issue is confined to instances of Splunk Enterprise with Splunk Web enabled.

Figure 4 shows utilizing a sample path traversal crafted GET request that can impact vulnerable Splunk Enterprise instances and lead to arbitrary file reads.

Figure 4: CVE-2024-36991 attack request

Exploiting the Vulnerability

A crafted GET request to a vulnerable Splunk instance with Splunk Web enabled is necessary and sufficient to exploit the issue. An attacker only needs to be able to access the instance remotely, which could be over the Internet or a local network. A working PoC with a crafted GET request aids in exploiting this vulnerability. Figure 5 is a demonstration of exploitation leveraging the publicly available PoC.

Figure 5: CVE-2024-36991 Exploitation

SonicWall Protections

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signatures have been released:

• IPS: 4469 – Splunk Enterprise Path Traversal

Remediation Recommendations

Administrators could turn Splunk Web off as a possible workaround. Secondly, they could disable unnecessary Splunk Enterprise components in the web.conf configuration specification file on active Splunk Enterprise.

Considering the severe consequences of this vulnerability and the trend of nefarious actors trying to leverage the exploit in the wild, users are strongly encouraged to upgrade their instances in accordance with the Splunk advisory to address the vulnerability.

Relevant Links

• NVD
• GitHub PoC
• Splunk
• Splunk Advisory
• python os.path.join()
• CVE-2024-36991-blog

The SonicWall RTDMI ™ engine has recently protected users against the distribution of the “6.6” variant of DarkGate malware by a phishing email campaign containing PDF files as an attachment. DarkGate is an advanced Remote Access Trojan that has been widely active since 2018. The RAT has been marketed as Malware-as-a-Service in underground forums, and threat actors are actively updating its code. The malware supports a wide range of features, including (Anti-VM Anti-AV Delay Execution multi-variant support and process hollowing, etc.), which are controlled by flags in the configuration data. This variant of DarkGate RAT supports more than 65 commands from the Command-and-Control server. The SonicWall threat research team has observed a spike in PDF file attachments that lead to the execution of DarkGate malware on the victim’s machine.

PDF

The PDF file disguises itself as an invoice file dated “26 Jun2024” and contains a download button that redirects to a compromised website to download a malicious VBScript file.

Figure 1: PDF file containing download link

VBScript

Function names and variable names in VBScript code are obfuscated, and large comments are added to harden the readability of the code. The malware keeps the malicious compressed data in the comments at the end of the VBScript code. The malware retrieves the compressed data using the regular expression “’\s([0-9A-Fa-f]+)(\r?\n|$)” and extracts files into “C:\Default\Autoit3.exe” and “C:\Default\script.a3x.” The malware executes the compiled AutoIt3 (AU3) script file using the WMIC command “wmic process call create “cmd /c C:\Default\Autoit3.exe C:\Default\script.a3x”” which further continues the execution of the malware.

Figure 2: Obfuscated VBScript code

AU3 Script

After decompiling the script file “script.a3x,” we get the legible AU3 script. It concatenates hexadecimal encoded strings of shellcode bytes, which are followed by the DarkGate loader binary bytes.

Figure 3: AU3 script decryption logic and shellcode

The AU3 script contains encrypted instructions, which are decrypted using a byte XOR operation, and the equivalent C representation of the algorithm is shown below.

Figure 4: C code for AU3 decryption logic

Figure 5: Encrypted command in the AU3 script

After decryption, the below instructions are executed by the AU3 script to transfer control to the shellcode bytes by registering a callback using API EnumWindows.

DllStructCreate(“byte[75613]”) DllCall(“kernel32.dll”, “BOOL”, “VirtualProtect”, “ptr”, DllStructGetPtr($pt), “int”, 75613, “dword”, 0x40, “dword*”, “null) DllStructSetData($pt, 1, $data) DllCall(“user32.dll”, “int”, “EnumWindows”, “ptr”, DllStructGetPtr($pt), “lparam”, 0)

Shellcode

The shellcode does PEB traversal to resolve API addresses using API names hashing. The shellcode enumerates PE headers of the DarkGate loader binary, which is followed by the shellcode bytes to get the address of the entry point. Execution is now transferred to the DarkGate loader entry point, and the 0x20th byte in the DOS header of the loader binary is updated to the value “2” to prevent re-execution of the loader binary in the next callback to the shellcode. The shellcode is registered as a callback function, and the updated value of the 0x20th byte in the DOS header helps to prevent multi-instances execution for the DarkGate loader.

DarkGate Loader

The loader reads the script file and retrieves the encrypted DarkGate bytes using the marker value “GDrdcpJy.” The malware decrypts the DarkGate binary with the key “GDrdcpJy” using the EncryptDecrypt algorithm, which is explained in the malware initialization section. The malware now loads the DarkGate binary in memory and transfers execution control to it.

DarkGate

Malware execution starts with initializing the version value “6.6” for the DarkGate variant. It loads the required DLLs and resolves APIs addresses dynamically at runtime in later stages to harden the analysis. Below is the list of loaded DLLs by the malware.

• Urlmon.dll
• user32.dll
• Advapi32.dll
• Shell32.dll
• ntdll.dll

The malware invokes a module which is responsible for the initialization of the key value. This key is used by the malware to encrypt and decrypt data.

Figure 6: DarkGate version initialization

Key Initialization

• Gets value for “ProductID” from registry entry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion.
• Gets value for “ProcessorNameString” from registry entry HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor.
• Gets hexadecimal encoded Unicode computer name using the API GetComputerNameW.
• Concatenates values (string “4” + ProductID + ProcessorInfo + ComputerName).
• Generates a customized MD5 value from the concatenated string.
• Computes MD5 from the customized MD5 value and performs substitute cipher encoding using the cipher table “abcdefKhABCDEFGH” to get the encoded string.
• Takes the initial 7 bytes “hbKEHBK” from the encoded string to create a file in %appdata%. If the %appdata% directory is not present on the machine, then the malware creates a file in the “c:\temp” directory.
• Generates a random string of length 0x14 and computes its MD5 and performs substitute cipher encoding to get the encoded string.
• The encoded string “GehdKEDaHaDcEbEeDHKAdeKFGDDdAhAd” is written into the file “%appdata%\ hbKEHBK.” The value is read from the file in every next execution of the malware on the same machine to compute the key value, which is used to encrypt and decrypt data.
• Reads file content from “%appdata%\ hbKEHBK” and generates a customized MD5 value, then gets the key value by computing MD5 and encoding using the substitute cipher method from the customized MD5 value.
• Saves the key value “fHFeFhhCEhbBKBcfKEAbCBeHFCHFEhFK” into memory.

Figure 7: Key generation process

Whenever we refer to the key to encrypt and decrypt data, we will be referring to this key value saved in the memory. Values mentioned above are specific to the infected system and vary on different systems. These values are mentioned for better understanding and referencing purposes.

Figure 8: Code snippet to get the initial 7 characters for the appdata file name

Test Environment Settings

The malware author has implemented a file-based detection method to detect a testing environment to avoid debugging and modification of the code while testing the malware execution. Malware execution can be disabled by creating a file “c:\temp\test.txt” which forces the malware to terminate after creating a file “c:\temp\test_ok.” The presence of “c:\temp\test.txt” on the machine can also save users from DarkGate infection.

Figure 9: Checks for testing environment

AntiVirus Detection

The malware enumerates the processes and saves the list of process names separated by “|.” It detects the security software based on either the presence of the installation directory or by the presence of the process name related to the security software. If security software is detected, the malware sets the corresponding flag and initializes the name string for that security software. If the malware does not find any security software, then it considers the presence of Windows Defender and initializes the flag and name values accordingly. Flag values are used to alter malware behavior based on the presence of particular security software. A list of security software and their detection methods are mentioned in the below table.

Security Software	Detection Methods
Bitdefender	Presence of directories: C:\ProgramData\Bitdefender, C:\Program Files\Bitdefender
SentinelOne (EDR)	Presence of directory: C:\Program Files\SentinelOne
Avast	Presence of directories: C:\ProgramData\AVAST, C:\Program Files\AVAST Software
AVG	Presence of directories: C:\ProgramData\AVG, C:\Program Files\AVG
Kaspersky	Presence of directories: C:\ProgramData\Kaspersky Lab, C:\Program Files (x86)\Kaspersky Lab
Nod32	Presence of process: |egui Presence of directory: C:\ProgramData\ESET
Avira	Presence of directory: C:\Program Files (x86)\Avira
Norton	Presence of processes:|ns.exe, |nis.exe, nortonsecurity.exe
Symantec	Presence of process: |smc.exe
Trend Micro	Presence of process:  uiseagnt.exe
McAfee	Presence of processes: mcshield.exe, mcuicnt.exe
SUPER AntiSpyware	Presence of process: superantispyware.exe
MalwareBytes	Presence of process: |mbam.exe Presence of directory: C:\Program Files\Malwarebytes
Comodo	Presence of processes: vkise.exe, |cis.exe
ByteFence	Presence of process: bytefence.exe
Search & Destroy	Presence of process: sdscan.exe
360 Total Security	Presence of process: qhsafetray.exe
Total AV	Presence of process: totalav.exe
IObit Malware Fighter	Presence of directory: C:\Program Files (x86)\IObit
Panda Security	Presence of process: psuaservice.exe
Emsisoft	Presence of directory: C:\ProgramData\Emsisoft
Quick Heal	Presence of directory: C:\Program Files\Quick Heal
F-Secure	Presence of directory: C:\Program Files (x86)\F-Secure
Sophos	Presence of directory: C:\ProgramData\Sophos
G DATA	Presence of directory: C:\ProgramData\G DATA
Windows Defender	Absence of any other security software

To prevent false detection of security processes for smaller process names, the malware uses “|” with the process name while searching in the list of running processes. As “|” is used as a separator in the running process names list, it will avoid any match from the middle of the running process name.

Figure 11: Code snippet comparing installation directory for security software

Malware Initialization

The malware decrypts the configuration data from memory with the key “ckcilIcconnh” using an XOR-based algorithm. The malware uses the same algorithm to encrypt and decrypt data but with a different key. We will be referring to this algorithm as the EncryptDecrypt algorithm in further discussion.

Figure 12: EncryptDecrypt algorithm

The decrypted data is a representation of key-value pairs, where keys are integer indexes and values are either “Yes” or “No” flags or can be data used by the malware.

Figure 13: Decrypted configuration data

The malware generates hash-encrypted folder names from corresponding plain text folder names.

Plain text folder name	Hashed folder name
Mainfolder	Dehffdh
Logsfolder	Chhdddd
Settings	Ddahcgk
Domain	Kkgfbgh

Figure 14: Hash-based folder names

The malware creates the hash-encrypted named mainfolder “dehffdh” in “C:\ProgramData.” Instead of “C:\ProgramData,” the malware uses the directory “C:\” if any of the Avast or AVG security software is present on the victim’s machine. The malware creates other folders and files in the mainfolder.

• C:\ProgramData\dehffdh\
• C:\ProgramData\dehffdh\chhdddd\
• C:\ProgramData\dehffdh\ddahcgk
• C:\ProgramData\dehffdh\kkgfbgh

Figure 15: Code gets hash-based names from plain folder and file names

The code appends “Domain=<host IP>” and “EPOCH=<current timestamp>” to the configuration data, encrypts it using a stored key with the EncryptDecrypt algorithm, and writes the encrypted data into the settings file located at “C:\ProgramData\dehffdh\ddahcgk.” Additionally, it captures domain information using the command “cmd.exe /cz wmic ComputerSystem get domain” and stores it in the domain file “C:\ProgramData\dehffdh\kkgfbgh.” The code also conceals the main folder if Avast or AVG security software is detected on the machine.

Figure 16: Gets domain information.

Debug Mode Network Communication 

If the malware finds the string “optpad” in the encrypted configuration data, it considers the execution in a debug environment and uses localhost (127.0.0.1) instead of the actual Command and Control (C2) host. This might be done by the malware author to investigate the proper working of the network communication with the malware. The malware also checks for the presence of the directory “c:\debug” to display a debug message with the DarkGate version number.

Figure 17: Debug message with DarkGate version

Configuration Data 

The table shows the key-value pairs of configuration data and its interpretation in the malware code.

Key	Type	Value	Description
0	data	91.222.173.170|	C2 host domain
8	flag	No	Enables display of message box
11	data	DarkGate	Caption string for message box
12	data	R0ijS0qCVITtS0e6xeZ	Custom base64 encoded “Hello World!” text for message box
13	data	6	Unreferenced in this variant
14	flag	Yes	Unreferenced in this variant
15	data	80	C2 port number
1	flag	Yes	Enables process hollowing, persistence and installation of malware
32	flag	No	Enables process hollowing depends on flag 1
3	flag	Yes	Enables anti-VM on display device name
4	flag	No	Enables anti-VM on hard disk size
18	data	100	Minimum hard disk size
6	flag	Yes	Enables anti-VM on display device name
7	flag	No	Enables anti-VM on minimum RAM size
19	data	4095	Minimum RAM size
5	flag	No	Enables anti-VM check for Xeon processor
21	flag	No	Unreferenced in this variant
22	flag	No	Is DLL variant
23	flag	Yes	Is AU3 variant
31	flag	No	Is AHK variant
24	data	26sp	Unreferenced in this variant
25	data	trafikk897612561	Unreferenced in this variant should be campaign ID
26	flag	No	Unreferenced in this variant
27	data	GDrdcpJy	Marker and key to decrypt DarkGate binary from script file
28	flag	No	Unreferenced in this variant
29	data	2	Used in DLL variant for GUP.exe + libcurl.dll if value is “7” KeyScramblerLogon.exe + KeyScramblerIE.dll
34	flag	No	Is C2 communication HTTPS
35	flag	No	Enables keylogging
Table	data	(.w]IqBUhsgZ LVbE)xH58FRASkj2K6W&…	Unreferenced in this variant

Figure 18: Table contains configuration data as key-value pairs

Anti-VM

1. If flag 5 is “Yes,” the malware gets the value for “ProcessorNameString” from registry entry HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor and checks for the string “xeon” to terminate malware execution.
2. If flag 3 is “Yes” or flag 6 is “Yes,” the malware checks for the following strings in the display device name to terminate malware execution:

• microsoft hyper-v video
• virtual
• vmware
• standard vga graphics adapter
• microsoft basic display adapter

Figure 19: Compares display device name

3. If flag 7 is “Yes,” the malware retrieves the minimum RAM size value “4095” from field data 19, and if the system RAM size in MB is less than the minimum RAM size required, the malware terminates its execution.
4. If flag 4 is “Yes,” the malware retrieves the minimum hard disk size value “100” from data 18, and if the system hard disk size in GB is less than the minimum hard disk size required, the malware terminates its execution.

Multi Variant Support

The malware code is written to support three types of variants listed below and behaves accordingly:

• AutoHotkey variant (flag 31)
• AutoIt v3 variant (flag 23)
• DLL variant (flag 22)

This malware variant is an AutoIt V3 (AU3) variant, which is identified by the value “Yes” for flag 31.

Actions Based on Installed AV

• If any security software from nod32 (ESET), Avast, or AVG is present on the victim’s machine, the malware sets the value for flag 1 and flag 32 to “Yes,” enabling the execution of the malware using process hollowing.
• If ESET is present, the malware checks for the username “abby” to terminate the malware execution.
• If SentinalOne or Bitdefender is present, the malware displays a message box containing random text of length 6 using API MessageBoxTimeoutA. However, the message cannot be seen by the user as it has a timeout value of only 2 milliseconds and disappears immediately.

Delay Execution

Malware delays execution for some time if the user is focused on the Process Hacker or Process Monitor window, to avoid malicious activity observation from the user. The malware runs in a 100 milliseconds sleep loop for 40 times in which foreground window text is checked for strings “process hacker” or “process explorer,” and if it does not match, the malware exits from the loop.

Hello Message

If the value of flag 8 is “Yes,” the malware takes the value “DarkGate” from field data 8 as caption and decrypts the value from field data 12 using custom Base64 decoding to use as text for displaying in the message box with a timeout value of 1770 milliseconds.

Figure 20: DarkGate says Hello World!

Malware Installation

If the value of flag 1 is “yes,” the malware retrieves the running executable path and script path from the process arguments to copy them into Autoit3.exe and AU3 script respectively into the main folder in “c:\ProgramData”. The malware decrypts the DarkGate binary with the key value “GDrdcpJy” from field data 27 using the EncryptDecrypt algorithm. The key value also works as a marker to retrieve the encrypted DarkGate bytes from the AU3 script file.

Process Hollowing

If the value of flag 1 and flag 32 is “Yes,” the malware invokes the process hollowing code. If Norton security software is found, the malware finds the process name “Norton.exe” in running processes to load and inject the DarkGate binary. If SentinalOne is present on the victim’s machine, the malware skips process hollowing. If SentinalOne is not present, the malware targets the following files sequentially for process hollowing:

• C:\Program Files (x86)\Microsoft\EdgeUpdate\substring<updatecore.exe>
• C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
• C:\Program Files (x86)\Google\Update\substring<updatecore.exe>
• C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe

If the value of flag 1 is “Yes” and the value of flag 32 is “No,” the malware skips process hollowing and creates a persistence entry by dropping a Windows Shortcut (LNK) file into “%appdata%\Microsoft\Windows\Start Menu\Programs\Startup”. The LNK file launches the AU3 script using Autoit3.exe on Windows startup, which further executes the DarkGate malware from the script file. The malware spawns a thread that keeps looking for foreground windows text and deletes the dropped LNK file if it finds one of the following strings:

• process hacker
• process explorer
• ccleaner
• system config
• malwarebytes
• farbar recovery
• avast
• startup
• rootkit
• autoruns
• editor de registro
• editor del registro
• registry editor
• gerenciador de tarefas
• zhpcleaner
• task manager
• junkware removal
• administrador de tareas
• hijackthis
• tcpview
• process monitor
• wireshark
• taskmanager

Prevent Sleeps

Before starting communication with the C2 server, the malware calls API SetThreadExecutionState to prevent the system from sleeping.

Network Communication

The malware collects the following information from the victim’s machine and concatenates them using separator “|”:

• Hexadecimal encoded Unicode text from active window
• Last input time
• Time in seconds from system start
• Is user admin
• DarkGate version

Figure 21: Information sent to C2 in plain text

The data is concatenated with the value “1000” and then encrypted using the EncryptDecrypt algorithm mentioned earlier with the key saved in memory. The malware concatenates the key and encrypted data and encodes using custom Base64 encoding. The malware sends the encoded data to the C2 server “91.222.173.170”. If the value of flag 34 is “Yes,” the malware communicates over HTTPS; otherwise, it communicates over HTTP.

Figure 22: Encrypted and encoded information sent to C2

The malware receives the encrypted and custom Base64 encoded data from the C2 server, which can be decoded using custom Base64 and decrypted using the EncryptDecrypt algorithm with the saved key in memory. At the time of analysis, the malware receives response data “1000|2000,” in which “1000” is the command to perform action and “2000” is the additional data used in performing the action which varies based on the command value.

Figure 23: C2 Communication

The malware performs various actions based on the command received from the C2 server. In this variant, the malware supports more than 65 commands, and a few of them are mentioned below.

The malware performs various actions based on the command received from the C2 server. In this variant, the malware supports more than 65 commands, and a few of them are mentioned below.

Command: 1000 (Continue)

Sleeps based on the value from additional data separated by “|” and sends the machine information again to C2.

Command: 1111 (Ransomware)

The malware retrieves the ransom note and ransomware payload bytes from additional data, which are separated by “||--|--||”. The malware drops the ransom note into the directory “C:\temp” and executes the ransomware binary.

Command: 1065 (WebBrowserPassView)

Along with the command, response data contains multiple binary file bytes, separated by “resourcesplit,” which are written into the following files:

• c:\temp\freebl3.dll
• c:\temp\mozglue.dll
• c:\temp\nss3.dll
• c:\temp\softokn3.dll
• WebBrowserPassView

The malware executes the WebBrowserPassView to steal and send credentials to the C2 server and then deletes the created files.

Command: 1108 (Launch DLL variant)

Response data contains multiple binary file bytes for the DLL variant of DarkGate, separated by “||--|--||,” which are written and executed from the directory C:\temp using API ShellExecuteA.

• libcurl.dll
• test.txt
• GUP.exe

Command: 1104 (Launch AHK variant)

Response data contains multiple binary file bytes for the AutoHotKey variant of DarkGate, separated by “||--|--||,” which are written and executed from the directory C:\temp using API ShellExecuteA.

• script.ahk
• text.txt
• AutoHotKey.exe

Command: 1097 (Launch AU3 variant)

Response data contains multiple binary file bytes for the AutoHotKey variant of DarkGate, separated by “||--|--||,” which are written and executed from the directory C:\temp using API ShellExecuteA.

• script.a3x
• Autoit3.exe

Command: 1084 (Restart)

Restarts the victim’s machine immediately after closing running applications using command “cmd.exe /c shutdown -f -r -t 0”.

Command: 1110 (Enumerate Drives)

Enumerates system drives except CD-ROM.

Command: 1083 (Shutdown)

Shuts down the victim’s machine immediately after closing running applications using command “cmd.exe /c shutdown -f -s -t 0”.

Command: 1082 (Shutdown Display)

The malware runs in an infinite loop to keep shutting down the victim’s display using API SendMessageA by broadcasting message “WM_SYSCOMMAND” and setting SC_MONITORPOWER with the value “2”.

Figure 24: API call to shut down display

Command: 1081 (BSOD)

The malware generates a hard error with the value “0xC0000350” using API NtRaiseHardError, which displays the BSOD (Blue Screen of Death).

Figure 25: Blue Screen of Death

Command: 1071 (FileZilla)

The malware sends the content of the following files from “%appdata%\FileZilla” to the C2 server:

• recentservers.xml
• sitemanager.xml

Command: 1059 (Terminate Process)

The malware terminates the process associated with the received process ID.

Unavailability of the PDF file in any of the popular threat intelligence sharing portals like VirusTotal and ReversingLabs at the time of writing this blog indicates its uniqueness and limited distribution.

Figure 26. VT screenshot

Evidence of detection by RTDMI can be seen below in the Capture ATP report for this file:

Figure 27: Capture Report

IOCs 

0a3764e9972dcdd3819f4728038d094a28a1ccff43d7d9e413eab794c9ecbe05 (PDF)
49a46f2ff414ad11b2b623a7dc811002bf78979b5db1fb6f03334fd1fa20f8a6 (VBScript)
83f1fab236357817270f995a6e3e32f90661dad6d625ad1e1f16b06c248da1d1 (AU3 script)
6c8e82b582f55a03277427e757331e5aa53dcf6656785dcb44f2958ef5516863 (DarkGate)

Overview

The SonicWall Capture Labs threat research team became aware of an XML External Entity Reference vulnerability affecting Adobe Commerce and Magento Open Source. It is identified as CVE-2024-34102 and given a critical CVSSv3 score of 9.8. Labeled as an Improper Restriction of XML External Entity Reference (‘XXE’) vulnerability and categorized as CWE-611, this vulnerability allows an attacker unauthorized access to private files, such as those containing passwords. Successful exploitation could lead to arbitrary code execution, security feature bypass, and privilege escalation.

A proof of concept is publicly available on GitHub. Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier and Magento Open-Source versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier are vulnerable. Although Magento Open Source is popular mainly for dev environments, according to Shodan and FOFA, up to 50k exposed Adobe Commerce with Magento template are running.

Technical Overview

Magento (Adobe Commerce) is a built-in PHP platform that helps programmers create eCommerce websites and sell online. It is an HTTP PHP server application. Such applications usually have two global entry points: the User Interface and the API. Magento uses REST API, GraphQL, and SOAP.

Attackers can leverage this vulnerability to gain unauthorized admin access to REST API, GraphQL API, or SOAP API, leading to the disclosure of confidential data, denial of service, server-side request forgery (SSRF), port scanning from the perspective of the machine where the parser is located, and complete compromise of affected systems. This vulnerability poses a significant risk due to its ability to exfiltrate sensitive files, such as app/etc/env.php, containing cryptographic keys used for authentication, as shown in Figure 1. This key is generated during Magento 2 installation process. Unauthenticated actors can utilize this key to forge administrator tokens and manipulate Magento’s APIs as privileged users.

Figure 1: app/etc/env.php

The vulnerability is due to improper handling of nested deserialization in Adobe Commerce and Magento. This allows attackers to exploit XML External Entities (XXE) during deserialization, potentially allowing remote code execution. Unauthorized attackers can craft malicious JSON payloads that represent objects with unintended properties or behaviors when deserialized by the application.

Triggering the Vulnerability

XML External Entities (XXE) attack technique takes advantage of XML’s feature of dynamically building documents during processing. An XML message can provide data explicitly or point to a URI where the data exists. In the attack technique, external entities may replace the entity value with malicious data, alternate referrals, or compromise the security of the data the server/XML application has access to.

In the example below, the attacker takes advantage of an XML Parser’s local server access privileges to compromise local data:

• The sample application expects XML input with a parameter called “username.” This parameter is later embedded in the application’s output.
• The application typically invokes an XML parser to parse the XML input.
• The XML parser expands the entity “test” into its full text from the entity definition provided in the URL. Here, the actual attack takes place.
• The application embeds the input (parameter “username,” which contains the file) in the web service response.
• The web service echoes back the data.

Attackers may also use External Entities to have the web services server download malicious code or content to the server for use in secondary or follow-on attacks. Other examples wherein sensitive files can be disclosed are shown in Figure 2.

Figure 2: Disclosing targeted files.

Exploiting the Vulnerability

A crafted POST request to a vulnerable Adobe instance with an enabled Magento template is the necessary and sufficient condition to exploit the issue. An attacker only needs to be able to access the instance remotely, which could be over the Internet or a local network. A working PoC with a crafted POST query aids in exploiting this vulnerability. Figure 4 shows a demonstration of exploitation leveraging the publicly available PoC.

Exploiting CVE-2024-34102, steps are enumerated below, which will exfiltrate the contents of the system’s password file from the target server.

• Create a DTD file (dtd.xml) on the attacker’s machine. This file includes entities that will read and encode the system’s password file, then send it to your endpoint.
• Host the dtd.xml file on the attacker’s machine, accessible via HTTP on a random port.
• Send the malicious payload via a sample curl request to the vulnerable Magento instance, as shown in Figure 3. The payload includes a specially crafted XML payload referencing the DTD file hosted on the attacker’s machine.
• The XML parser in Magento will process the DTD file, triggering the exfiltration of the system’s password file as shown in Figure 4.
• Lastly, observe your endpoint to capture and decode the exfiltrated data.

Figure 3: CVE-2024-34102 attack request

Figure 4: CVE-2024-34102 Exploitation

Out of the 50k exposed Magento instances in the wild, multiple events were observed wherein attackers leveraged this vulnerability, as only 25% of instances have been updated since the vulnerability was exploited in the wild. According to Sansec analysis, CVE-2024-34102 can be chained with other vulnerabilities, such as the PHP filter chains exploit (CVE-2024-2961), leading to remote code execution (RCE).

SonicWall Protections

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signatures have been released:

• IPS: 4462 – Adobe Commerce XXE Injection

Remediation Recommendations

Considering the severe consequences of this vulnerability and the trend of nefarious activists trying to leverage the exploit in the wild, users are strongly encouraged to upgrade their instances, according to Adobe advisory, to address the vulnerability.

Relevant Links

• NVD
• GitHub PoC
• Magento-Docker
• php
• Adobe Advisory
• XXE
• CosmicSting
• CVE-2024-34102-blog
• REST API usage

Overview

The SonicWall Capture Labs threat research team became aware of a path traversal vulnerability in SolarWinds Serv-U, assessed its impact and developed mitigation measures. Serv-U server is a solution that provides a secure file transfer facility and control inside and outside the organization. Identified as CVE-2024-28995, SolarWinds Serv-U 15.4.2 HF 1 and previous versions allow an unauthenticated threat actor to access local files remotely, earning a high CVSS score of 8.6. On account of multiple reports of in-the-wild exploitation of the vulnerability, the users are strongly encouraged to upgrade their instances to the latest fixed version SolarWinds Serv-U 15.4.2 HF 2, as mentioned by the vendor in the advisory.

Technical Overview

This vulnerability arises from a flaw in the input validation mechanism while building a local path of a requested file in the BuildLocalPath method. It allows remote threat actors to provide a maliciously crafted InternalDir parameter in the request and traverse any path in the affected system. The Attacker can then provide any file name using InternalFile parameter to access the file.

The diff of the affected function provided by Rapid7 shows that the patch has introduced the check to eliminate the path traversal vector if it is present in the parameter, as seen in Figure 1. This implies that this function is highly likely to be the root cause of the issue.

Figure 1: Checks introduced in the affected function, source: rapid7

Additionally, as seen in Figure 2, the utilization of this affected function shows that it is responsible for processing the crucial inputs, InternalDir and InternalFile, provided by the user. These values are then used to retrieve a file. This means that the reading of an arbitrary file is possible by sending a crafted request.

Figure 2: Affected function processing user inputs, source: rapid7

Exploitation

To trigger and exploit this vulnerability, an attacker must send a request with a crafted value of InternalDir parameter, as seen in Figure 3. The exploitation of this vulnerability yields the remote threat actor an access to sensitive files and information on the server, as demonstrated by accessing win.ini file in the example. This vulnerability has a high impact on data confidentiality and does not require user interaction.

Figure 3: Exploit in action

SonicWall Protections

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signatures have been released:

• IPS: 4454 SolarWinds Serv-U Path Traversal 2
• IPS: 20138 SolarWinds Serv-U Path Traversal 3

Threat Graph

The SonicWall sensor data shows a significant number of exploit attempts, considering the software’s popularity.

Remediation Recommendations

Considering the widespread user base of SolarWinds products and the underlying risk of sensitive data exposure, users are strongly encouraged to upgrade their instances to the latest versions, as mentioned in the vendor advisory.

Relevant Links

• Vendor advisory
• Rapid7 blog

DarkMe RAT steals information from victims’ machines and responds to various commands received from its Command and Control (C&C) server. A spike in distributing DarkMe RAT was observed in February 2024, exploiting the zero-day (CVE-2024-21412) by the hacking group Water Hydra. The SonicWall threat research team recently analyzed a variant of the DarkMe RAT malware. Execution of DarkMe RAT starts from a Windows Shortcut File (LNK) which uses a Microsoft Installer File and COM DLL registration to evade detection from security software.

Windows Shortcut File

The Windows Shortcut File (LNK) displays an image related to a stock trading graph to distract the user while a malicious batch script from a URL is executed in the background. The batch script is responsible for downloading and executing the malicious Microsoft Installer File (MSI). MSI files are not commonly used by malware authors and thus arouse less suspicion from security software.

Figure 1: Content of Windows Shortcut File

Figure 2: Image displayed to the user

A URL-hosted batch script downloads the MSI file into the %temp% folder and starts its execution.

Figure 3: Content of batch script

The LNK file, along with the MSI file, is hosted on a WebDAV share by the threat actor.

Figure 4: Content of attacker-hosted server

Microsoft Installer File

Windows Installer (msiexec.exe) extracts files from “oxc.msi” and starts executing the DLL file “AFWIKFNMUI9430.ocx” using rundll32 by calling the exported function “RunDllEntryPointW.” The malware involves the execution of multiple executable files to load and execute the encrypted DarkMe RAT binary “Video01.mp4.”

Figure 5: Files extracted from MSI file

First Executable (AFWIKFNMUI9430.ocx)

The malware copies extracted files from the directory “%temp%” to “%appdata%\ WMProjectFiles” and imports registry entries from “info.txt” using the Registry Console Tool (reg.exe). The “info.txt” file contains registry entries to register the COM DLL “soundtrack.ocx” with CLSID “AAE802DB-FB67-4407-A175-61223EFF30D4.” The registered COM DLL is executed by “rundll32” with the CLSID in a Single-Threaded Apartment (STA) using the below command line: “rundll32.exe” /sta {AAE802DB-FB67-4407-A175-61223EFF30D4}

Figure 6: Content of registry file

Second Executable (soundtrack.ocx)

The malware copies a legitimate executable file from “%appdata%\WMProjectFiles\Sound.mp3” to “%appdata%\ProductConfigurations\WINDBVERS.EXE,” which is a targeted file for process hollowing to execute the DarkMe RAT binary. The malware decrypts the binary file “%appdata%\WMProjectFiles\WMFile01.tmp” into a DLL file “C:\Users\Public\Libraries\WMFile01.dll.” The file can be decrypted using a single byte XOR operation except for the initial few bytes of the MZ header. The malware invokes the decrypted DLL with the exported function “VBDLLDEMO.”

Third Executable (WMFile01.dll)

The DLL file decrypts the final payload (Video01.mp4) using the same logic used to decrypt the file (WMFile01.dll). The malware creates a suspended process for a legitimate file “%appdata%\ProductConfigurations\WINDBVERS.EXE” and resumes its execution after loading the DarkMe RAT malware code using process hollowing.

DarkME RAT

The Visual Basic compiled DarkMe RAT executable is highly obfuscated to make analysis of the file more difficult. While debugging, the malware makes the analyst go through the obfuscation code inside each module or function call.

Obfuscation

The malware code is obfuscated with a large amount of garbage code preceded by an always-followed jump instruction to the next executable code. The address followed by the jump may be a malware instruction or further obfuscated code.

Figure 7: Obfuscated code

An IDA Python script can be used to simplify the obfuscated code, making it easier to debug. The Python script searches for obfuscated code and replaces it with a single jump instruction to the actual malware code.

Figure 8: IDA Python script to remove obfuscation

String Encoding

The malware keeps the strings encoded, decoding them before use. Strings are encoded by their hex values, sometimes through a single iteration or sometimes through a double iteration.

Figure 9: Strings decryption

Single Instance Execution

The malware checks for the window name “MS-Office network” using the API FindWindowA and terminates its execution if the window name is found. If the malware instance is not already running, the malware creates a window named “MS-Office network” and continues executing the malicious code.

Data Exfiltration

The malware collects various information from the victim’s machine, including the country name, information about the installed antivirus product, computer name, username, and active window name. To retrieve the country information, the malware uses the API GetLocalInfoA with arguments “LOCALE_SISO3166CTRYNAME” and “LOCALE_SENGLISHCOUNTRYNAME,” which gets values “US” and “United States” respectively.

Figure 10: English name of the country

Figure 11: ISO-based name of the country

The malware retrieves the computer name and username information from the environment variables.

Figure 12: Gets computer name and username

The malware gets the installed antivirus information using Windows Management Instrumentation (WMI) queries. All the strings related to WMI queries are kept encrypted and are decrypted by adding 0x0A to each byte of the encrypted string.

Figure 13: Decryption logic for WMI-related queries

The malware executes the query “SELECT * FROM AntivirusProduct” to retrieve the installed antivirus details.

Figure 14: Code to retrieve AV information

The malware gets the active window name using the APIs GetForegroundWindow and GetWindowTextA. The information can be used by threat actors at the C&C server to identify the debugging environment. For example, if the malware is being debugged using the IDA debugger, threat actors will receive the active window name as “IDA” and can avoid further communication with the targeted machine.

Network Communication

The RC4 encrypted C2 address (AA1EC8EE260AEB1B34081CA091FD29F6240C4F) is decrypted using the RC4 key “noway123!$$#@35@!” to get the C2 address “unfawjelesst322.com.” The malware gets the IP address for the decrypted C2 host using the API gethostbyname and uses socket APIs for communicating with the C2 server.

Figure 15: C2 information

The malware collects and sends system information to the C2 server using the send API from DLL ws2_32.dll. The stolen information is separated using the delimiter “0xA9.”

Figure 16: Stolen Information

Asynchronous Commands from C2

The malware creates a window using the API CreateWindowExA for the “STATIC” class with the window name “SOCKET_WINDOW” and registers a callback function with the API SetWindowLongA. The callback function is responsible for receiving data from the C2 server using the recv API from DLL “wsock32.dll.” The malware registers the window “SOCKET_WINDOW” to receive network events for the socket connected to the C2 server using message number “401.”

Figure 17: Register window to get socket event

When the callback function for the window “SOCKET_WINDOW” receives message number “401,” it receives a command from the C2 server using the API recv from wsock32.dll.

Figure 18: Window callback function to receive commands from C2

The malware supports the following commands from the C2 server:

• STRFLS
• STRFL2
• 300100
• SHLEXE
• RNMFIL
• DELDEL
• DIRMAP
• DELMAP
• SEITUS
• SEITUD
• ZIPALO
• FRIKAT
• COPALO
• PASALO

Persistence Entry

The malware registers the COM DLL “%appdata%\ \WMProjectFiles\soundtrack.ocx” and creates a persistence entry by adding a registry entry into “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” for executing the COM DLL.

Figure 19: Registers COM DLL

 

Figure 20: Makes persistence entry

Only a few security providers are detecting the LNK file at the time of analysis in popular threat intelligence sharing portals like VirusTotal and ReversingLabs, indicating its uniqueness and evasiveness:

Figure 21: LNK Detections on VirusTotal

Evidence of detection by the RTDMI(tm) engine can be seen below in the Capture ATP report for this file.

Figure 22: Capture report