Counter Infiltration

Future-Proof Counter Attacks Against Exploit Kit InfrastructureAbout Us
Yin Minn Pa Pa , Ph.D.
Researcher
Cyber Security Laboratory
PwC, Japan

Masaki Kamizono

Head of Laboratory
Cyber Security Laboratory
PwC, Japan

Hiroshi Kumagai
Senior Researcher
Cyber Security Laboratory
PwC, Japan

Takahiro Kasama , Ph.D.
Senior Researcher
Cyber Security Laboratory
NICT, Japan

Introduction
Traffic Direction System

Proxies

Landing Server

Panel Server
Fingerprint
Server

Exploit Kit Operator
API Server

Exploits

Database Server

Update ServerTake-away

Weaknesses
Inner
Workings

Choke
PointsHow toCounter
AttackWhat Exploit Kits?

2018

Aug

2017

Jun

Disdain

RIG 4.0

Feb

Oct

2016

2015

Aug

RIG 3.0

Feb

RIG 2.0

Neptune• YES, it works• YESBEPS/YES YES, even more…..
NebulaSundown• RICH
NeptuneHunter• Current customers?
• IoC
Sundown
PirateOutline• Inner Workings• Potential Attacks• Demonstrate Attack• Future Possibilities

RIG 2.0

Attack Infrastructure
VictimMalicious Site

Browser
Accesscompromised
site

Redirected to
TDS Server

Redirected to
Proxy Server

Fingerprinted

Exploited

TDS

1

Redirect to TDS• Get proxy url with API• Redirect Victim to
Proxy

3

Panel Server
api.php••

Proxy Info
VDS Info
MySQL

2
Proxy

VDS

proxy.php

core.php• Decrypt VDS
domain• Proxy traffic

•
•
•
•
•

PayloadUpdate proxy info
using API

Fingerprint Victim
Send Victim info
Exploit Victim
Receive Payload from
Panel server
Send payload to victim
Exploit••••
UpdateVictim InfoOS
Browser
LocationHashdownload.php• Parse Fingerprint
data from core.php• Get appropriate
payload• Update statistics

Payloads

Panel Server (Admin)Panel Server (Admin)Panel Server (User)

API for Proxy“http://panel_server_domain/api.php?apitoken= l3SKfPrFJx_ESYjDJunDTaNXPBbaHE3SzYuckOM”.

Inside the Leaked DB
Table nameexploits
files
flows
options
proxy
tarif
traff

exe files

No:
Rows
2

39,127,2,1496975943

14

2, real_path, /var/www/html/hitfm

7494, http://tree.changesomelives.com,,0

23
62
6882

Table structure
id, name, fault
id, user_id, file, filename,file size, avcheck
id, user_id, file_id,
last_token
id, option_name,option_value
id, url, description,
last_check
id, user_id, len
id, ip, os, br, cc, us, referer,
exp, user_id, flow_id, hashSample data

userrights
users

id, name, rights
id, user_login, user_pass,rights, color, first_time,
last_time, description, sid

400,131,1514753999'20756','94.156.115.146','Windows 7','MSIE 11.0','BG','Mozilla/5.0(Windows NT 6.1; Trident/7.0; rv:11.0) like
Gecko','oxprxt.tk','flash','133','51','390cc1ddfbdf70c5ff79d5d63c56
5b1b'1, admin, admin
134, ferdigstudios, a3a5823e48cccf107cf1eba5f2cdaa2d, user,
0000FF,
1423277805,1496974143,,a1a6557378ea20856aac56fa4229113

vds

id, ip, description

1, http://94.23.207.221/core_hit.php, ,2
81

Inside the Leaked DB• Total 75 countries• Italy (3849)• US (2118)• Singapore(131)

Exploit
unknown
ie10
flash
msie
silver

Count
5662
793
263
135
21

BrowserCount

MSIE 11.0

2988

MSIE 8.0

1198

Unknown

Referrer domain

Status of Domain (June 2017)

kouidri.com

217.23.6.139

hitrigenter.com

NXDomainoxprxt.tk

NXDomainwww.attentive.pl

58.128.170.129

www.freesafeip.com

104.18.46.32, 104.18.47.32-

104.25.229.53
Proxy Server Domains

Status of Domain (June 2017)

auto.challenge-this.com

NXDomain795

batton.changesomelives.com

46.182.30.163

MSIE 9.0
MSIE 7.0766
656

blank.challenge-this.com

NXDomainblog.challenge-this.com

NXDomain

MSIE 10.0

430change.changesomelives.com

46.182.30.163

MSIE 6.0

40

filter.changesomelives.com

46.182.30.163

Firefox EB1190

land.recondentalimplants.org

NXDomainlive.captionthephoto.com

NXDomainFirefox D7F520

log.challenge-this.com

NXDomainmusic.captionthephoto.com

NXDominone.changesomelives.com

46.182.30.163

one.recondentalimplants.org

NXDomainout.challenge-this.com

NXDomainphoto.captionthephoto.com

NXDomainsome.changesomelives.com

46.182.30.163

tank.captionthephoto.com

NXDomain

OS

Count

Windows 7
Windows 8.1
Unknown
Windows XP
Windows Vista
Windows 8
Windows Server 2003
Windows 2000
Windows 98
Mac OS

2729
1483
891
857
549
169
93
90
20
1

ticket.recondentalimplants.org

NXDomaintree.changesomelives.com

46.182.30.163

trip.recondentalimplants.org

NXDomain

two.recondentalimplants.org

NXDomainvideo.captionthephoto.com

NXDomain

was.captionthephoto.com

NXDomainDecoying Proxies
VictimTDS

Malicious Site

Browser

Update proxy info
using API

Panel Server
api.php• Get proxy url with API• Proxy Info
• Redirect Victim to“http://panel_server_domain/api.php?apitoken=l3SKfPrFJx_ES
YjDJunDTaNXPBbaHE3SzYuckOM”
1• VDS Info
Proxy
Accesscompromised
site

Redirected to
TDS Server

Redirect to TDS

MySQL

2

• OS
• Browser“http://proxydomain/proxy.php?PHPSSESID=njrMNruDMh7GCJzBKvPcT7tEMU7PSRnMmdLGyvrPVsbu|• Location“http://proxydomain/proxy.php?PHPSSESID=njrMNruDMh7GCJzBKvPcT7tEMU7PSRnMmdLGyvrPVsbu|
VDS
Proxy
• HashRedirectedto“http://proxydomain/proxy.php?PHPSSESID=njrMNruDMh7GCJzBKvPcT7tEMU7PSRnMmdLGyvrPVsbu|

ZDA0ZTUyNDA1OWMzN2EwZTEzMTM5ZWZiOGRmNjBhYTk”
ProxyServer3“http://proxydomain/proxy.php?PHPSSESID=njrMNruDMh7GCJzBKvPcT7tEMU7PSRnMmdLGyvrPVsbu|
proxy.php
core.php
ZDA0ZTUyNDA1OWMzN2EwZTEzMTM5ZWZiOGRmNjBhYTk”“http://proxydomain/proxy.php?PHPSSESID=njrMNruDMh7GCJzBKvPcT7tEMU7PSRnMmdLGyvrPVsbu|
UpdateZDA0ZTUyNDA1OWMzN2EwZTEzMTM5ZWZiOGRmNjBhYTk”
download.php• Decrypt VDS
ZDA0ZTUyNDA1OWMzN2EwZTEzMTM5ZWZiOGRmNjBhYTk”•
Fingerprint
VictimVictimInfo
Fingerprinted
ZDA0ZTUyNDA1OWMzN2EwZTEzMTM5ZWZiOGRmNjBhYTk”
domain• Send Victim info
• Parse Fingerprint• Proxy traffic

Exploited•••

Payload

Exploit Victim
Receive Payload from
Panel server
Send payload to victim
Exploit

data from core.php• Get appropriate
payload• Update statistics

Payloads

RIG 4.0

Message

The Rich?

7.8 Million US$

Bitcoin Received

2018 February

2018 January

2017 December

2017 November

2017 October

2017 September

2017 August

2017 July

2017 June2017 May

2017 April

2017 March

RIG 3.02017 February

2017 January

2016 December

2016 November

2016 October

2016 September

2016 August

2016 July

2016 June

2016 May

2016 April

2016 March

2016 February

2016 January

2015 December

Till RIG 2.0

2015 November

2015 October

2015 September

2015 August

2015 July

2015 June2015 May

2015 April

2015 March

2015 February

2015 January

2014 December

2014 November

62014 October

2014 September

Bitcoin Amount

The Rich?
Bitcoin Received

12

10

8

RIG 4.04

20Attack Infrastructure
VictimMalicious Site

Browser
Accesscompromised
site

Redirect to TDS
1

TDS Server• Get proxy url with API• Redirect to fingerprint& proxy servers

RussiaUpdate proxyinformation using API

Payload Server

Connect every
10 minutes

Check updates on payload
Redirected
to Fingerprint
ServerFingerprint Server
3

Fingerprint Info?
Singapore!!!

Redirected
to ProxyServer
Exploited
Payload23.php••Proxy Info
VDS Info?

2

Redirected
to TDS

Fingerprinted

API Server

Proxy Server
4
Proxying Traffic
Russia•••Landing Servercore.php?
• Process fingerprint info
• Exploit victim• Get appropriate payload

Panel Server

RussiaUpdate Info

Get Payload

MySQL
OS
Browser
Location
Referrer

Payload

Exploit?
index.php
Web Application

Panel Server (User)

API Link

Decoying Proxies
VictimMalicious Site

Browser
Accesscompromised
site

Redirect to TDS
1

TDS Server• Get proxy url with API• Redirect to fingerprint& proxy servers

RussiaUpdate proxyinformation using API

Payload Server

Connect every
10 minutes

Check updates on payload
Redirected
to Fingerprint
ServerFingerprint Server
3

Fingerprint Info?
Singapore!!!

Redirected
to ProxyServer
Exploited
Payload23.php••Proxy Info
VDS Info?

2

Redirected
to TDS

Fingerprinted

API Server

Proxy Server
4
Proxying Traffic
Russia•••Landing Servercore.php?
• Process fingerprint info
• Exploit victim• Get appropriate payload

Panel Server

RussiaUpdate Info

Get Payload

MySQL
OS
Browser
Location
Referrer

Payload

Exploit?
index.php
Web Application

Decoying Proxies
Proxy Server IP count20
18

Unique IP count

16
14
12
10
8
6
4
2
0
22-Feb

23-Feb

24-Feb

25-Feb

26-Feb

27-FebLink 1

Link 228-Feb

1-Mar

2-Mar

3-Mar

4-Mar

5-Mar

Decoying Proxies•Other users are also using same proxy•Change Proxy Randomly•Total IP - 108 Proxies (5th March 2018)•Location - Russia•Hosting - timeweb hosting Russia, telecom.uk

Reveal the Hidden IP

More and More Proxies•Insufficient Authentication at API Server•Get Proxy IP even after subscription period•Updated Proxy List Till Today is XXXX

Directory ListingPeaking Attackers• 400 Customers till 2018/02• 21 Customers Data …..

No

Flow IDTop Country

Hits

Exploits%

Top Browser

Top OS

Referrers
DomainExploitTypes

1

874 (mxmxmx)

Mexico92

22.2

MSIE 11.0

Windows 10

1

2

2

975 (mx)

Mexico

5437

378

7

MSIE 11.0

Windows 7

9

6

3

880

Brazil714451

94351

13.2

MSIE 11.0

Windows 7

10

6

4

884 (TRAFF)

United Kingdom

1

0

0

MSIE 8.0

Windows Vista

0

0

5

887

US

14982

418

2.8

MSIE 11.0

Windows 7

10

5

6

890

United Kingdom

1

0

0

MSIE 11.0

Windows 7007898(col)

US

213

6

2.8

MSIE 11.0

Windows 10

4

2

8

899 (korsaisback)Netherlands

190

4

2.1

MSIE 11.0

Windows 7

10

2

9

902

Turkey

58560

7874

13.4

MSIE 11.0

Windows 7

10

6

10

906

Turkey

794

96

12.1

MSIE 11.0

Windows 7

1

3

11

907

Mexico200MSIE 11.0

Windows 7

1

0

12

908 (Nutrino)

US

11

0

0

MSIE 11.0

Windows 10

0

0

13

910

US

788

28

3.6

MSIE 11.0

Windows 7

1

5

14

912 (First Server)

US

2860

41

1.4

MSIE 11.0

Windows 7

10

3

15

913 (Second Server)

US

3241

47

1.5

MSIE 11.0

Windows 7

10

3

16

914

Egypt

140

10

7.1

MSIE 11.0

Windows 7

1

2

17

920 (first)

Brazil

83293

7261

8.7

MSIE 11.0

Windows 7

10

6

18

921 (Maaa)

Germany

1

1100

MSIE 8.0

Windows 7

0

1

19

923 (test)

Taiwan

5530

691

12.5

MSIE 11.0

Windows 7

10

6

20

927 (test)

US

110

32

29.1

MSIE 7.0

Windows XP

10

5

21

929

US

417

15

3.6

MSIE 11.0

Windows 70

2891,031111,255

12.4

108

65

Total

RIG 4.0 – Attack Summary• Decoying Proxy IP with Customer Privilege• Reveal Hidden IP of Panel Server• List Directories• Get More Proxies• Peaking Attackers

BEPS/ Sundown

Attack Infrastructure
VictimBrowser
AccessCompromised
Site
Redirected to
TDS

Redirected to
ProxyFingerprinted
Exploited

Malicious Site

TDS
Get proxy url
using API

Redirect to TDS

1Update proxyinformation
using API

Panel Server
api.php
Proxy Infostatistics.php

2

Statistics
dga.php, sub.php

Proxyindex.php
3•Fingerprint victim•

Update Victim info•

Self Protection from

Update Victim
Info (hits)
VDS Server

Proxy Domain
Control
MySQL
OS, Browser
Locationcrawlers• Call landing_$flowid.php

Exploitlanding_$flowid.php
Payloadz.php• Update hits table• Get appropriate payload

Update Victim Info
(exploited hits)

PayloadRegisterDomainManageA records

namecheap DNS
serverMaster proxydomains
cloudns
DNS server
Proxy domains

Panel Server (Admin)Panel Server (User)

API Link

Data in the Leaked DB
Table Name
domains
file_scans
files
flows
hits

proxy
tokensusers

vds

Table Structure
id, nameid, file, owner, name, hash, rate, result

Sample Data
Rows
622, wallstreetsradar.org
30
217,750,59,accelerate.exe,ba3f78935efde883e1c07a89
218
0fb71adf5a3ab9a3, 1/35, AVDFree:OK Avast:OK
id, owner, name, file, hash, description,
676, 60, tihjyuu.exe, exe_file,24
fa35b9cf029d867ee509a3891a1ce643e38ea22,’ ‘,timestamp, url
1473195774, NULL
id, user_id, file_id, last_token
126, 60, 738, 1473246262
126
id, owner, flow, ip, agent, referrer, country, 889961,22,44,'221.40.158.156','Mozilla/5.0 (Windows
404,905
NT 6.3; WOW64; Trident/7.0; rv:11.0)
city, browser, exploited, timestamp, os
likeGecko','http://nikefukuoka.jp/m/banner.php','JP','U
nknown','MSIE11.0',0,1465996320,'Windows 8.1'10880, http://rig.mexicanvoter.info/index.php,
id, url, description, last_check9
autogenerated, 1473246001
token, flow_id, timestamp
5stcclXg49RSo, 126, 1473246262
103
id, name, pwd, registered, last_login,40, firebender,
9$2y$10$dJ6IkN4JMxzqX87SNxQ0oe4rnBCzufIjDV1TZFL
last_ip, expiration, uid, comment, token
pYesd8QZkxPrQm, 1469572046, 1473225147,
185.93.185.229, 1473552000, 1a80cc68,,95RJctOWpJv0
id, ip, description
9, http://109.236.92.187/index.php
1Data in Hits Table
No
Country
1 RU (Russia)
2 GB (United Kingdom)

Count
38145
32083

US (United States)
BR (Brazil)
JP (Japan)
IN (India)
DE (Germany)
ES (Spain)
FR (France)
IT (Italy)
VN (Vietnam)

15316
14485
14039
12298
10093
9778
8357
6389
5290

3
4
5
6
7
8
9
10
11
No
1
2
3
4
5
6
7
8
9

OS
Windows 7
Windows 8
Windows XP
Windows 8.1
Windows 10
Windows Vista
Unknown
Mac OSLinux

Count
136,059
22,935
22,15520,443
16,862
9,703
2,628
1,591
1,442

No

Browser

Count

1
2
3
4
5
6
7
8
9
10

MSIE 11.0
MSIE 8.0
MSIE 7.0
MSIE 10.0
MSIE 9.0
Chrome 50.0.2661.102
MSIE 6.0
Firefox 46.0
Chrome 46.0.2486.0
Chrome 49.0.2623.112

92,425
42,11528,19527,12524,215
5,440
4,177
1,966
1,790
1,071

Total victim IP count is 224,727
Referrer URL is 51,826
Domains 1,390

Attackers List in Database
No

User

Hits

ExploitedThreads (exploit type)

Rate of infection

1

admin

223298

77588

-

-

2

stalin

10379

620

3

6%

3

firebender

13066

7644

4

59%

4

rfrswefg

24

8

2

33%

5

mycucu

22

33

2

150%

6

bullxx2

24

7

4

29%

7

djaro

31

15

2

48%

8

synkox

12313

2549

1

21

9

Andsdig

343

40

1

12

10

goldendragon

28294

8307

3

29%

Decoy Proxies
http://panelserver_IP/api.php?sid=9Hbrbjv_nfRcSSPd0al

http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn12KddRG32N1kce8
http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn12KddRG32N1kce8
http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn12KddRG32N1kce8
FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB
http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn12KddRG32N1kce8
FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB
http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn12KddRG32N1kce8
FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB
http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn12KddRG32N1kce8
FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB
http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn12KddRG32N1kce8
FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB
http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn12KddRG32N1kce8
FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB
http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn12KddRG32N1kce8

FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB
FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB
FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB

Fake API Access
VictimBrowser
AccessCompromised
Site
Redirected to
TDS

Redirected to
ProxyFingerprinted
Exploited

Malicious Site

TDS

Panel Server
api.php
Proxy Info

NOT Whitelisted

Get proxy url
using API

Redirect to TDS

1Update proxyinformation
using APIstatistics.php

2

Statistics
dga.php, sub.php

Proxyindex.php
3•Fingerprint victim•

Update Victim info•

Self Protection from

Update Victim
Info (hits)
VDS Server

Proxy Domain
Control
MySQL
OS, Browser
Locationcrawlers• Call landing_$flowid.php

Exploitlanding_$flowid.php
Payloadz.php• Update hits table• Get appropriate payload

Update Victim Info
(exploited hits)

PayloadRegisterDomainManageA records

namecheap DNS
serverMaster proxydomains
cloudns
DNS server
Proxy domains

HunterAttack InfrastructurePanel ServerPotential Attacks• Detect Panel Server• Find Landing Server• Related Servers on Internet

NeptuneAttack InfrastructurePanel ServerPotential Attacks• Fake API Access• Related Servers on Internet

Future Possibilities

Leaked Exploit Kits
• RIG

• adpack-1• Target Exploit• SAKURA• adpack-2• Tor• BEPS/Sundown• Armitage• Mushroom• Hunter• fiesta• Bleeding Life

• 0x88• firepack• Crimepack• Neptune• g-pack• DCpp• Siberia• ice-pack• Phoenix• Sava• infector• Blackhole• Elenore• mpack• Ddos• Elenore Exp• multisploit• Fragus• my-poly-sploit• Demon Hunter• RDS• Impassion Frameshit• SmartPack

Future Possibilities• Similarity in Attack Infrastructure• Code Reuse

Old Days vs New Days
Proxies

Landing Server

Landing Server

Panel Server

Fingerprint Server
Exploit Kit Operator

API Server

Exploits

Exploits

Database Server

Database

Update Server

Code ReuseCode Reuse
RIG

Demon
Hunter

SakuraRIG , Hunter , Neptune(Blaze) ,BEPS/Sundownдебаг

0x88

Demon Hunter , Bleeding Life
CVisitors

Mushroom

Sakura , Armitage
detect_country

OthersIce-pack

0x88 , multisploit , RDS , infector
CultureToCountryCode

Mushroom , Elenorecrypt_with_key

ice-pack , Tor
x1.php

adpack, blackhole, crimepack, cry217, dcpp, fiesta, firepack, fragus, gpack, impassioned FrameShit, mpack, my-poly-spolit, phoenix_2.5,
sava, siberia, smartpack, target-exploit

Conclusion
Analyze
LeakedExploit Kits

RIG 2.0
BEPS/Sundown
Hunter
NeptuneKnow Inner
Workings

Potential
Attacksve soPr acktt
A

RIG 4.0

FuturePossibilities

Final Take-away

Complex

Vulnerable

Future-Proof

Take Down