Counter Infiltration
Future Proof Counter Attacks Against
Exploit Kit Infrastructure

Yin Minn Pa Pa, Hiroshi Kumagai, Masaki Kamizono, Takahiro Kasama

Black Hat Asia 2018

Table of Contents
Introduction .................................................................................................... 6
Background ..................................................................................................... 7
Exploit Kit.............................................................................................................. 7
Exploit Kit Offerings .............................................................................................. 7
General Attack Infrastructure................................................................................ 7
Live Exploit Kits..................................................................................................... 8

Leaked Exploit Kits ........................................................................................ 10
Replicating Exploit Kits..................................................................................12
RIG Exploit Kit...................................................................................................... 12

Servers in Attack Infrastructure ...................................................................................................................12
Attack Infrastructure .................................................................................................................................... 17
Database ....................................................................................................................................................... 18
Self-protection features ................................................................................................................................21
Weak Points ...................................................................................................................................................21

BEPS / Sundown Exploit Kit ................................................................................ 22
Servers in Attack Infrastructure .................................................................................................................. 22
Attack Infrastructure ................................................................................................................................... 29
Database ....................................................................................................................................................... 30
Self- Protection Features ............................................................................................................................. 33
Weak Points .................................................................................................................................................. 34

Hunter Exploit Kit ............................................................................................... 35

Servers in the Attack Infrastructure............................................................................................................ 35
Attack Infrastructure ................................................................................................................................... 39
Database ....................................................................................................................................................... 39
Exploits ......................................................................................................................................................... 40
Self-protection features ................................................................................................................................41
Weak Points ...................................................................................................................................................41

Neptune (Eris, Blaze, Terror) Exploit Kit ............................................................. 42

Servers in the Attack Infrastructure............................................................................................................ 43
Attack Infrastructure ................................................................................................................................... 46
Database ....................................................................................................................................................... 46
Exploits ......................................................................................................................................................... 47
Self-protection features ............................................................................................................................... 48
Weak Points .................................................................................................................................................. 48

Potential Attacks ........................................................................................... 49
RIG 2.0 Exploit Kit ............................................................................................... 49
Attack Infrastructure ................................................................................................................................... 49
Players in the Attack Infrastructure ............................................................................................................ 50
Potential Attack 1: Proxy Servers ................................................................................................................ 50
Potential Attack 2: SQL Injection.................................................................................................................51........................................................................................................................................................................51........................................................................................................................................................................51
Potential Attack 3: Reflected XSS Attack.................................................................................................... 52
Potential Attack: Related Servers on the Internet...................................................................................... 52

RIG 4.0 Exploit Kit............................................................................................... 53
Being an Insider ........................................................................................................................................... 53
Good Income ................................................................................................................................................ 54
RIG 4.0 Infrastructure ................................................................................................................................. 55
Attack 1: Decoying Proxies .......................................................................................................................... 58
Attack 2: Reveal the Hidden Panel Server IP ............................................................................................. 58
Attack 3: Collecting More and More Proxies .............................................................................................. 592

Attack 5: Peaking Attackers ..........................................................................................................................61

BEPS/ Sundown Exploit Kit ................................................................................. 65

Attack Infrastructure ................................................................................................................................... 65
Players in the Attack Infrastructure ............................................................................................................ 65
Potential Attack 1: Decoying Proxies .......................................................................................................... 66
Potential Attack 2: Fake API Access............................................................................................................ 66

Hunter Exploit Kit ............................................................................................... 67

Attack Infrastructure ................................................................................................................................... 67
Players in the Attack Infrastructure ............................................................................................................ 67
Potential Attack 1: Easy to Detect Panel Server ......................................................................................... 68
Potential Attack 2: Easy to Find Landing Page .......................................................................................... 68
Potential Attack 3: Related Servers on the Internet................................................................................... 68

Neptune Exploit Kit ............................................................................................. 69
Attack Infrastructure ................................................................................................................................... 69
Players in Attack Infrastructure .................................................................................................................. 69
Potential Attack 1: Fake API Access ............................................................................................................ 70
Potential Attack 2: Related Servers on Internet ......................................................................................... 70

Future Possibilities ......................................................................................... 71

Similar Design Patterns ................................................................................................................................ 71
Code Reuse ................................................................................................................................................... 72

Conclusion ..................................................................................................... 76
References ...................................................................................................... 78
Appendix – 1 ................................................................................................... 79

RIG 4.0 Proxy IP List ................................................................................................................................... 79

Appendix – 2 .................................................................................................. 80

RIG 4.0 Referrers ......................................................................................................................................... 80

List of Figures
Figure 1 - New Exploit Kits and their predecessors ........................................................................ 9
Figure 2 - RIG 2.0 Login Page ..................................................................................................... 13
Figure 3 - Statistics ...................................................................................................................... 13
Figure 4 - VDS Setting ................................................................................................................ 13
Figure 5 - Proxy Setting ............................................................................................................... 14
Figure 6 - Setting Page................................................................................................................. 14
Figure 7 - User Management Settings .......................................................................................... 15
Figure 8 - Statistics (User) ........................................................................................................... 15
Figure 9 - Payload Control ........................................................................................................... 16
Figure 10 - API Control ............................................................................................................... 16
Figure 11 - RIG 2.0 Attack Infrastructure..................................................................................... 17
Figure 12 - BEPS login page ........................................................................................................ 22
Figure 13 - Dashboard (Admin) ................................................................................................... 23
Figure 14 - User Control (Admin) ................................................................................................ 24
Figure 15 - Proxy Management (Domain) .................................................................................... 25
Figure 16 - Proxy Management (IP) ............................................................................................. 26
Figure 17 - Dashboard (User)....................................................................................................... 26
Figure 18 - Payload Management ................................................................................................. 27
Figure 19 - API Link & Statistics Link......................................................................................... 27
Figure 20 - Self Protection ........................................................................................................... 29
3

Figure 21 - BEPS Attack Infrastructure ........................................................................................ 29
Figure 22 - Sale Page ................................................................................................................... 35
Figure 23 - Hunter Login Page ..................................................................................................... 36
Figure 24 - Dashboard ................................................................................................................. 36
Figure 25 - Manage Exploits ........................................................................................................ 37
Figure 26 - Example of Report ..................................................................................................... 37
Figure 27 - Landing Page URLs ................................................................................................... 38
Figure 28 - Manage Exploits ........................................................................................................ 38
Figure 29 - Hunter Attack Infrastructure ...................................................................................... 39
Figure 30 - Post in Hacker Forum ................................................................................................ 42
Figure 31 - Neptune Advertisement ............................................................................................. 42
Figure 32 - Neptune Login Page .................................................................................................. 43
Figure 33 - Dashboard ................................................................................................................. 43
Figure 34 - Manage Payload ........................................................................................................ 44
Figure 35 - Statistics .................................................................................................................... 44
Figure 36 - Self Protection by IP .................................................................................................. 45
Figure 37 - Self Protection by User Agent .................................................................................... 45
Figure 38 - Neptune Attack Infrastructure .................................................................................... 46
Figure 39 - RIG 2.0 Attack Infrastructure..................................................................................... 49
Figure 40 - SQL Injection Request ............................................................................................... 51
Figure 41 - SQL Injection Response............................................................................................. 51
Figure 42 - Seller Page................................................................................................................. 52
Figure 43 - Panel Server............................................................................................................... 52
Figure 44 - RIG 4.0 Login Page ................................................................................................... 53
Figure 45 – Hot to Contact to RIG Seller ..................................................................................... 54
Figure 46 - Message to Seller ....................................................................................................... 54
Figure 47 – Bitcoin Transitions .................................................................................................... 55
Figure 48 – Received Bitcoins ..................................................................................................... 55
Figure 49 - RIG 4.0 Attack Infrastructure..................................................................................... 56
Figure 50 - Whitelist TDS ............................................................................................................ 56
Figure 51 - API Link.................................................................................................................... 57
Figure 52 - Proxy URL ................................................................................................................ 57
Figure 53 - Connection to Payload Server .................................................................................... 59
Figure 54 – Actual IP of RIG 4.0 Panel Server ............................................................................. 59
Figure 55 - Collected Proxy Server IP .......................................................................................... 60
Figure 56 - Directories in Panel Server......................................................................................... 60
Figure 57 - Directory in Panel Server ........................................................................................... 61
Figure 58 - EXE Files in Upload Directory .................................................................................. 61
Figure 59 - Flow 887 and Flow 880 ............................................................................................. 63
Figure 60 - Flow 902 and Flow 920 ............................................................................................. 64
Figure 61 - BEPS Attack Infrastructure ........................................................................................ 65
Figure 62 - Hunter Attack Infrastructure ...................................................................................... 67
Figure 63 - Hunter Panel Server ................................................................................................... 68
Figure 64 - Neptune Attack Infrastructure .................................................................................... 69
Figure 65 - Compromised Servers ................................................................................................ 70
Figure 66 - Code Reuse................................................................................................................ 72
Figure 67 - Code Reuse................................................................................................................ 72
Figure 68 - Code Reuse................................................................................................................ 73
Figure 69 - Code Reuse................................................................................................................ 73
Figure 70 - Code Reuse................................................................................................................ 74
Figure 71 - Code Reuse................................................................................................................ 74
4

List of Tables
Table 1 - Leaked Exploit Kits ...................................................................................................... 10
Table 2 - Tables in Database ........................................................................................................ 18
Table 3 - Proxy Domains ............................................................................................................. 19
Table 4 - Referrer Domains.......................................................................................................... 20
Table 5 - Type of Exploits ........................................................................................................... 20
Table 6 - Most Targeted Browsers ............................................................................................... 20
Table 7 - Most Targeted OS ......................................................................................................... 20
Table 8 - Actual Attackers and Exploit Ratios .............................................................................. 28
Table 9 - Tables in Database ........................................................................................................ 30
Table 10 - Proxy Domains ........................................................................................................... 31
Table 11 - Master Proxy Domains ................................................................................................ 31
Table 12 - Top Targeted Countries More than 5000 Victims ........................................................ 32
Table 13 - Top Targeted Browsers ............................................................................................... 33
Table 14 - Top Targeted OS......................................................................................................... 33
Table 15 - Tables in Database ...................................................................................................... 40
Table 16 - Exploits....................................................................................................................... 41
Table 17 - Tables in Database ...................................................................................................... 47
Table 18 - Exploits....................................................................................................................... 47
Table 19 - Attackers Using RIG 4.0 and Exploit Rates ................................................................. 625

Introduction
Recently, operators behind exploit kit as a service offering put more effort into hiding theiroperational infrastructure while providing better service to their customers. Namely, almost all
popular exploit kits nowadays are operated using sophisticated networks of several servers suchas proxies or gates, VDS (Virtual Dedicated Server), rotators, up-loaders, panel servers, APIs andmore. This complex setup makes it very hard for researchers to analyze the inner workings of these
networks, thus limiting the information security community’s ability to respond to such threats.
However, this customer facing approach also exposes the operators to direct attacks fromresearchers.
Over the past year, we have replicated several exploit kit infrastructures from leaked sources. This
allowed us to gain a deeper understanding of their inner workings, choke points, and weaknesses.
We discovered several attacks with the potential to take down an exploit kit that may be performed
with nothing but regular customer privileges. We discuss all of these potential attacks in this paperand demonstrate some attacks as a user of the RIG 4.0 exploit kit, which a very recent and currently
highly active exploit kit. Our approach let us detect several proxy servers belonging to RIG 4.0, findthe actual IP of panel server hiding behind cloud services, and even discover new vulnerabilities
revealing who the attackers are, how many attackers are using the RIG 4.0 exploit kit as a service,what kind of exploits they are using and which victims are most likely to be successfully exploited.
Furthermore, our curiosity even let us figure out how rich the operators are.
In addition, we also found that code and design-pattern reuse among different exploit kits isfrequent, thereby allowing us to use the same attacks against different exploit kits. Thus, it is likelythat the same approaches will work for the detection and takedown of future exploit kits as well.
In this paper, we will share our findings, analytical approaches, and recommendations for future
engagement with similar offerings. We will also share insights into the customers of these services.
The following are the three main takeaways from this paper.
•

How exploit kit services work internally, what services they offer to customers, who thecustomers are, how they hide from detection and what their weaknesses are.

•

What actions may take exploit kits down.

•

How different exploit kits relate to one another and how this knowledge can be used fortaking down future exploit kits.

6

Chapter 1

Background
Exploit Kit
An Exploit Kit is a suite of web applications for automated attacks. It is used by attackers for driveby download attack in which, when an innocent victim accesses a malicious website, he or she isredirected through several servers until reaching the landing server, fingerprinted, served with asuitable exploit and finally lead to malware infection. An exploit kit automates all these processesof redirecting, fingerprinting, exploiting and infecting with malware. Malware dropped by an exploit
kit - also known as the payload - ranges from cryptocurrency miner malware to ransomware
depending on different campaigns setup by attackers.

Exploit Kit Offerings
There are two types of exploit kit offerings: Exploit Kit as a Service and Exploit Kit as a Package.
In exploit kit as a service offering, an attacker pays for a service and he does not need to take careof any server in the attack infrastructure. The attacker does not have control over exploits and only
needs to set up which malware he wants to use for a campaign. He contacts the exploit kit operator
in an underground market through instant messaging, mostly Jabber, to negotiate a service
contract. Transactions are conducted mostly with Bitcoins and the price varies from $80 to $4000.
Recent exploit kits are mostly offered as a service to the attacker.
In contrast with this, an attacker may also pay for an exploit kit application package for which
servers and attack infrastructure need to be set up according to the manual in the package. The
attacker has admin privileges on the panel server and he can update the exploit kit application.

General Attack Infrastructure
In order to protect themselves, recent exploit kits have a sophisticated attack infrastructure
including proxy servers, API servers, VDS servers, update servers, etc. A general rule is that theolder the exploit kit is, the simpler the infrastructure becomes; in its barest form consisting of only
a panel server and landing page.

7

Live Exploit Kits
The exploit kit landscape has been rocky since 2016 with newer kits constantly replacing the taken
down kits. Some active exploit kits in recent years are:
•

RIG

•

Disdain•

Nebula•Sundown Pirate•

NeptuneRIG 2.0, one of the most prolific exploit kits, was leaked in February 2015. The recovered version
named RIG 3.0 was seen in August 2015 again with an average of 27,000 machines being infected
per day. RIG was the dominant exploit kit during 2016 but attacks relating to RIG 3.0 started to
decline in April 2017. From August 2017, RIG 4.0 came onto the scene and attacks relating to it
seem to increase until the time of this writing in February 2018. RIG 4.0 exploit kit services costs$500 and $1500 for a week and a month respectively.
Disdain was sold on an underground forum in August 2017 and seems to be a copy and paste
version of the BEPS/Sundown exploit kit leaked in February 2017. It is available for rent on a daily,
weekly, or monthly basis. The prices are $80, $500, and $1,400 respectively.
The Nebula Exploit Kit came onto the scene on February 2017. It is likely to be a variant of
BEPs/Sundown whose source code was leaked in February 2017. It has a subscription for 24hours, one week, one month and prices of $100, $600 and $2000 respectively.
Sundown-Private was uncovered in June 2017. It borrows code from its predecessors the Hunterand Terror exploit kits whose source code was leaked in October 2016. The Hunter exploit kit costs$2500 for a lifetime package.
The Neptune exploit kit was first seen on underground forums in October 2016. In theadvertisement, the author claims that it has 17 different exploits. In August 2017, the Neptune
exploit kit is used for dropping a cryptocurrency - specifically Monero - miner. Depending on thetype of the package, the Neptune exploit kit costs from $2400 to $4000 per month and from $750
to $950 per week.

8

In fact, all these new exploit kits are updated versions of exploit kits leaked in previous years.
Figure 1 shows the results of our initial studies on how new exploit kits are based on leaked kits.
Namely, RIG 4.0 is completely based on the leaked RIG 2.0 exploit kit. Disdain and Nebula are
based on the previously leaked BEPs/ Sundown. In the same way, Sundown Pirate and Neptune
also depend on the leaked kits Hunter and Neptune respectively.

Figure 1 - New Exploit Kits and their predecessors

9Chapter 2

Leaked Exploit Kits
We have collected leaked exploit kits from many different available information sources on theInternet such as Cerberus, which is a file sharing service on the dark web, leaked forums, GitHub
and Virus Total. We were able to collect 33 different exploit kits and 44 kits in total as some kits
have different versions.
We analyzed all the kits to see whether they include exploits, payloads (malware), databases, codefor connecting and controlling servers and how many different servers need to be set up to
replicate the kits in our lab environment. In general, most exploit kits include database schema,
exploits, payloads, and control panel web applications. Some kits have dumped SQL databasewith more than 400,000 records of the exploit kit’s users, referrer URLs, fingerprints of infectedvictims and exploit details.
In addition to the control panel web application, we notice that some kits have code for proxy
servers, landing servers, uploader servers, update servers and SSH servers. Most kits seem to beable to be set up on LAMP (Linux, Apache, MySQL, PHP) while a few need to be set up on an
Nginx and Oracle DB environment. Table 1 shows the summary of our analysis results.

Table 1 - Leaked Exploit Kits
PayloadNO

NameVersionExploit

Data
in DB

Panel Server
DB
Control
SchemaCode

Proxy Server
Connect
Control
Codes
Codes

Landing Server
Connect
Control
Codes
Codes

ServerTypes

Other
Servers

LAMP

VDS
Server
ExploitServerRotatorServerUpdateServer-

1

RIG

1007 1/2

✖

✔

✔

✔

✔

✖

✔

✖

✔

2

Sakura

2014

✔

✖

✖

✔

✔

-

-

-

-

LAMP

3

2017

✖

✔

✔

✔

✔

✔

✔

✖

✖

Nginix4

BEPS/Sundown
Hunter

5

0x88

6Neptune(blaze)789Siberia
Sava
Elenore

2015

✔

✔

✔

✔

✔

-

-

-

-

LAMP

master
2.6

✔

✔

✔

✔

✔

✖

✖

✔

✔

✔

-

-

-

-

3.0
2017

✖

✖

✔

✔

✔

✖

✔

✔

-

-

✔

-

-

✔

✔

✔

LAMP
LAMP
LAMP
LAMP

✖

✖

✖

✔

✔

✔

✔

✖

✔

✔

✔

✖

✖

✔

✔

-

-

-

-

LAMP
OracleLAMP

UploaderServer
SSH
Server
-

-

-

✔

-

LAMP

-

LAMP

-

Elenore Exp

2011
2011
2010/
1.4.4
1.2

✔

✖

✔

✔

✔

10

Fragus

2009

✔

✖

✖

✔

✔

11

Demon
HunterImpassion
Frameshit

01.11.201
4
-

✔

✔

✖

✔

✔

-

-

✔

✔

LAMP

-

✔

✔

✔

✔

✔

-

-

-

-

LAMP

-

adpack-1

1

✔

✔

✖

✔

✔

-

-

-

-

LAMP

-

12
13

10

14
15
16

adpack-2
Armitagecry217
fiesta17

firepack

18
19

g-pack
ice-pack

20
21

infector
mpack

22

multisploit

23

my-polysploit
RDS
SmartPack
TargetExploitTor
Mushroom
Bleeding
Life
Crimepack
DCpp
Phoenix
Blackhole

24
25
26
27
28
29
30
31
32
33

2
1
2

✔

✔

✖

✔

✔

✔

✔

✖

✔

✔

✔

✔

✖

✔

✔

✔

✖

✖

✔

✔

✔

✖

✖

✔

1
2(0.18)
1
2
3
none
81
86
99
none
v3
-

✔
✔
✔
✔
✔
✔
✔
✔
✔
✖
✖
✖
✔
✔

✖
✖
✖
✖
✔
✔
✔
✔
✔
✔
✔
✔
✖
✖

✖
✖
✖
✖
✖
✖
✖
✖
✖
✖
✖
✖
✔
✖

✔
✔
✔
✔
✔
✔
✔
✔
✔
✔
✔
✔
✔
✔

-

✖
✔
✔

✖
✖
✖

✖
✖
✖

2011
-

✔
✔

✔
✔

✖
✖

2.5
100
102

✔

-

-

-

-

✔
✔
✔
✔
✔
✔
✔
✔
✔
✔
✔
✔
✔
✔

-

-

-

✔
✔
✔

✔
✔
✔

-

-

✔
✔

✔
✔
Code cannot be read

-

-

-

-

LAMP
LAMP
LAMP

-

✔

✔

LAMP
LAMP

-

Code cannot be readC++ files
Old exploit kits based on PHP and needs to set up MySQL server together with SMB server.
Code cannot be read
Code cannot be read

11

-

LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP
LAMP

Chapter 3

Replicating Exploit Kits
Recent and highly active exploit kits such as RIG 4.0, Nebula, Disdain, Sundown Pirate, and
Neptune are in fact updated versions of leaked exploit kits such as RIG 2.0, BEPS/Sundown,
Hunter and Neptune exploit kits. Thus, in this chapter, we will explain these four main predecessorsof currently active exploit kits.

RIG Exploit Kit
RIG exploit kit was first seen in 2014 and it is still active at the time of this writing in February 2018.
The current version is RIG 4.0. RIG exploit kit is used for several campaigns to infect victims withdifferent malware ranging from ransomware to cryptocurrency miner malware.
A falling out between developers and one of the sellers of the RIG exploit kit resulted in a partial
leak of the kit’s source code on a hacker forum in February, 2015. We have downloaded the leaked
kit from Github, which is RIG version 2.0, consisting of database files, cache data, and a PHP
based web application for controlling servers such as proxy and panel servers. The actual exploits
are not included in the leaked kit.

Servers in Attack Infrastructure
The attack infrastructure of the RIG exploit kit is composed of a panel server, TDS (Traffic Direction
System) server, VDS (Virtual Dedicated Server), and proxy server.
Panel Server (Admin Account): The panel server is an Apache-based web server. The admin
account has four main functions: checking exploit statistics, controlling exploit kit users, setting up
cryptographic and token settings and managing URLs for VDS and Proxy servers. A screenshot of
the login page to the panel server is depicted in Figure 2.

12Figure 2 - RIG 2.0 Login Page

After login, admin can check statistics relating to infection rate, exploits, victim information andactivities of registered exploit kit users as seen in Figure 3.

Figure 3 - Statistics

Admin can set up URLs for proxy servers and VDS as shown in Figure 4 and Figure 5. The RIG 2.0
exploit kit uses proxy servers in order to hide its actual landing server (VDS server). In addition,

Figure 4 - VDS Setting

13

these proxy domains are rotated randomly in order to prevent easy takedowns and to confuse
security researchers.

Figure 5 - Proxy Setting

As for the third function, cryptographic keys such as the data XOR key for generating API tokens
and the file XOR key for encrypting payloads, TTL for the VDS server, AV warning counts to killproxies and paths for the web application can be set up in the panel server as shown in Figure 6.
It uses the Avdetect service to receive AV warning counts for proxy domain. All settings here arein fact self-protection features of the RIG 2.0 exploit kit.

Figure 6 - Setting Page

14

User control function such as user privileges, passwords and expiry dates of the exploit kit users
can be set in the page named “Users” as shown in Figure 7.

Figure 7 - User Management Settings

Panel Server (User Account): The user interface of a registered user is depicted in Figure 8.

Figure 8 - Statistics (User)
The user can check exploit statistics such as infection rate at the “Main Stats” page and, upload
at most two malware files (payloads) on the “Exe Control” pages shown in Figure 9.

15

Figure 9 - Payload Control

On the “Get Flow” page depicted in Figure 10, a user can generate API links by clicking the “GetLink” button.

Figure 10 - API Control

The generated API link looks like “http://panel_server_domain/api.php?apitoken= l3SKfPrFJx_ES
YjDJunDTaNXPBbaHE3SzYuckOM”. This API link is used for retrieving the proxy URL. The proxy
URL consists of the domain of the proxy server and a PHPSSESID. For example, the proxy URL
looks like “http://proxydomain/proxy.php?PHPSSESID= njrMNruDMh7GCJzBKvPcT7tEMU7P
SRnMmdLGyvrPVsbu|ZDA0ZTUyNDA1OWMzN2EwZTEzMTM5ZWZiOGRmNjBhYTk”. The firstpart of the proxy URL (bolded part of PHPSSESID) consists of the domain of the VDS server (theactual landing server) and the second part is the TTL (time to live) value of VDS server. Clicking the“IpList” button of Figure 10, a user (attacker) can whitelist the IP address of a server. The API isonly accessible from the whitelisted servers.
TDS Server: TDS servers are provided by TDS vendors who buy and sell Web traffic. Attackers
abuse TDS services and let the TDS redirect traffic to the proxy servers of the RIG 2.0 exploit kit
to infect the victim with malware. In order to do so, the TDS needs to know the proxy server URL.
As these proxy URLs are rotating and changing dynamically, so the TDS server uses the API link16

to update the proxy URL. Thus, we think that an attacker lets the TDS knows his API link andwhitelists the TDS IP on panel server in order to prevent API abuse.
Proxy Server: The proxy server handles all the traffic between the victim and the VDS server. In
the proxy server, the file named “proxy.php” manages the PHPSSESID sent by a redirected victim
and proxies traffic between the victim and the landing server (VDS server). The key for decrypting
the PHPSSESID is setup in the “proxy.php” script. Thus, only the proxy server can see the VDS
server’s domain. We think that this is to hide the IP or domain of the VDS server from victim. The
proxy server also handles the ping connection from the panel server.
VDS Server: The VDS server is actually the landing server, hidden behind a proxy server. Please
note that the leaked kit does not include the contents of the VDS server. According to the cacheddata of the panel server we have, we guess that there is a PHP script named “core.php” on the
VDS server, which is the actual landing page of RIG exploit kit. It may have functionalities tofingerprint the victim environment, exploit it according to fingerprinted information and send thevictim’s information to “download.php” on the panel server, which will store that data in the
database. Actual exploit codes may also be contained in the VDS server.

Attack Infrastructure
We replicate the attack infrastructure of the RIG 2.0 exploit kit as in Figure 11.

Figure 11 - RIG 2.0 Attack Infrastructure

17

Red colored numbers in the Figure 11 represents the traffic from the victim’s browser and dottedlines show how servers behind the senses are working together to perform the drive-by download
attack. Attack flow is as follows:
1. Firstly, the victim accesses to compromised site and is redirected to the TDS server.
2. The TDS server updates the proxy URL using the API. Namely, the TDS server connects tothe panel server using the previously assigned API link and redirects the victim to the rightproxy server. For example, the TDS connects to the panel server with the link,“http://panel_server_domain/api.php?apitoken=l3SKfPrFJx_ESYjDJunDTaNXPBbaHE3Sz
YuckOM”. As a result, the TDS server receives a proxy URL containing a proxy domain and
PHPSSESID. The received proxy URL looks like “http://proxydomain/proxy.php?PHPSSES
ID=njrMNnjrMNruDMh7GCJzBKvPcT7tEMU7PSRnMmdLGyvrPVsbu|ZDA0ZTUyNDA1OWMzN2EwZTEzMTM5ZWZiOGRmNjBhYTk”. Using this proxy URL, the TDS redirects thevictim to the right proxy server.
3. A PHP script named “proxy.php” on the proxy server decrypts PHPSSESID received fromthe victim. The first part of PHPSSESID (bolded in 2)) includes the domain of the VDS server
and the second part is the TTL of the VDS server. The proxy server handles the connection
between the victim and the VDS server where the landing page named “core.php” andexploit codes exit. The script named “core.php” fingerprints the victim’s information,passes the data to “download.php” on the panel server, exploits the victim, receives anappropriate payload for the victim and transfers the encrypted payload to the victim via a
proxy. The file named “download.php” in the panel server receives data from the “core.php”
file, returns the RC4 encrypted payload and updates the statistics of exploited victims inthe database of the panel server. Finally, the victim is infected with malware.

Database
The dumped database in the leaked kit contains more than 6,000 records. The name of thedatabase is “baza3”. We replicated it on a SQL DB. The analysis results of the DB are shown in
Table 2.
Table 2 - Tables in Database
Table name

Table structure

Sample data

No:
Rows
-

exploits

id, name, fault

-

files

id, user_id, file, filename,file size, avcheck
id, user_id, file_id,
last_token
id, option_name,option_value

exe files

2

39,127,2,1496975943

14

2, real_path, /var/www/html/hitfm

7

flows
options18

proxyid, url, description,
last_check
id, user_id, len

494, http://tree.changesomelives.com,,023

400,131,1514753999

62

traff

id, ip, os, br, cc, us, referer,
exp, user_id, flow_id, hash'20756','94.156.115.146','Windows 7','MSIE 11.0','BG','Mozilla/5.0(Windows NT 6.1; Trident/7.0; rv:11.0) like
Gecko','oxprxt.tk','flash','133','51','390cc1ddfbdf70c5ff79d5d63c565b1b'

6882

userrights
users

id, name, rights
id, user_login, user_pass,rights, color, first_time,
last_time, description, sid
id, ip, description

1, admin, admin
134, ferdigstudios, a3a5823e48cccf107cf1eba5f2cdaa2d, user, 0000FF,
1423277805,1496974143,,a1a6557378ea20856aac56fa4229113

2
8

1, http://94.23.207.221/core_hit.php, ,

1

tarif

vds

The tables named “exploit” and “files” are empty. The tables named “flows, options, tarff,
userrights” are used for the panel server application. Proxy server domains stored in the proxytable are shown in Table 3.
Table 3 - Proxy Domains
Proxy Server Domains

Status of Domain (June 2017)

auto.challenge-this.com

NXDomainbatton.changesomelives.com

46.182.30.163

blank.challenge-this.com

NXDomainblog.challenge-this.com

NXDomainchange.changesomelives.com

46.182.30.163

filter.changesomelives.com

46.182.30.163

land.recondentalimplants.org

NXDomainlive.captionthephoto.com

NXDomainlog.challenge-this.com

NXDomainmusic.captionthephoto.com

NXDominone.changesomelives.com

46.182.30.163

one.recondentalimplants.org

NXDomainout.challenge-this.com

NXDomainphoto.captionthephoto.com

NXDomainsome.changesomelives.com

46.182.30.163

tank.captionthephoto.com

NXDomainticket.recondentalimplants.org

NXDomaintree.changesomelives.com

46.182.30.163

trip.recondentalimplants.org

NXDomain

two.recondentalimplants.org

NXDomainvideo.captionthephoto.com

NXDomain

was.captionthephoto.com

NXDomain

While almost all proxy domains are NXDOMAIN (Non-existent domain), others are still resolving toa single IP address, located in Russia, at the time of our analysis in June 2017. Only one record,“http://94.23.207.221/core_hit.php" is included in the VDS table. From the IP, the server is a
dedicated server provided OVH dedicated server service from France. Victim information such as
IP address, OS, country, browser, the referrer URLs and name of succeeded exploits are stored in
the “traff” table. We notice a total of 6,009 victim IP addresses in the table. According to the data19

in the “traff” table, a total of 75 countries are targeted; among them Italy, US, and Singapore haveinfected IP counts of 3849, 2118 and 131 respectively. Windows 7 and Windows 8.1 are the mosttargeted OS. In term of the browser, IE 11.0 and IE 8.0 are the top browsers out of all targetedbrowsers. Exploits named ie10 and flash are the most successful exploits out of all exploits. A
summary of data in the “traff” table relating to exploits, OS, and browsers is shown in the following
tables.
Table 4 - Referrer Domains
Referrer domain

Status of Domain (June 2017)
217.23.6.139
NXDomain
NXDomain
58.128.170.129
104.18.46.32, 104.18.47.32
104.25.229.53

kouidri.com
hitrigenter.com
oxprxt.tk
www.attentive.pl
www.freesafeip.com-

Table 5 - Type of Exploits
Exploit

Count
5662
793
263
135
21

unknown
ie10
flash
msie
silverTable 6 - Most Targeted Browsers
BrowserCount

MSIE 11.0
MSIE 8.0
Unknown
MSIE 9.0
MSIE 7.0
MSIE 10.0
MSIE 6.0
Firefox EB11
Firefox D7F5

2988
1198
795
766
656
430
40
90
20

Table 7 - Most Targeted OS
OS

Count

Windows 7
Windows 8.1

2729
1483

20

Unknown
Windows XP
Windows Vista
Windows 8
Windows Server 2003
Windows 2000
Windows 98
Mac OS

891
857
549
169
93
90
20
1

Self-protection features
In order to protect itself, the RIG exploit kit uses the following features;•

Use proxy servers in order to hide the VDS (landing) server.

•

Proxy server domains are rotated to prevent easy takedowns and to confuse security
researchers.

•

Use an API to update proxy URLs in ral-time counteracting the easy tracking of proxy
servers.

•

Retrieve the AV warning count from Avdetect to kill detected proxy domains and renew
them in real time.

•

The VDS server has a TTL in order to prevent duplicate access from counterparties.

•

The payload is encrypted to prevent analysis and being abused by rivals.

•

API server access is limited whitelisted servers in order to prevent API abuse.

Weak Points
The RIG 2.0 exploit kit also has vulnerabilities that might lead to taking it down.
•

The leaked kit has SQL Injection and reflected XSS Vulnerabilities.

•

Proxy domains are rotated and a registered customer can collect as many proxy domains
as possible by repeatedly using API. Please check Chapter 4 for detailed information.

•

Directory listing is not prevented.

21

BEPS / Sundown Exploit Kit
The BEPS (Browser Exploit Packs) or Sundown exploit kit was the first exploit kit to abuse the CVE2015-2444 vulnerability in the Internet Explorer in August 2015. Through several updates, BEPS
became a significant threat responsible for a large number of infections in 2016. Its source code
was leaked in February 2017 consisting of some payloads and source code for the panel server,
proxy server, and rotator server although exploits are not included in the leaked kits. We
downloaded the leaked kit from a hacking forum.

Servers in Attack Infrastructure
The attack infrastructure of the BEPS exploit kit is composed of a panel server, TDS server, proxy
server and VDS server. Details on each server are explained in the following sections.
Panel Server (Admin Account): The admin account on panel server has four main functions 1) tocheck all exploit statistics for all registered users, 2) to control user registration, 3) to manage proxydomains and 4) to control IP addresses of the proxy server. It is a PHP based web application
running on the Nginx web server. A screenshot of the login page to the panel server is depicted in
Figure 12.

Figure 12 - BEPS login page

After login, the exploit statistic for all the registered users can be seen on a page named“Dashboard” as in Figure 13. Victim information such as countries, cities, browser and the nameof the attacker using the BEPS exploit kit, and the referrer domains are shown on the dashboard
page. In addition, server status such as CPU usage, RAM usage and disk usage can also bechecked there.

22

Figure 13 - Dashboard (Admin)

User control functions shown in Figure 14 consist of setting up user ids, passwords, expiration
times, and tokens for login and uploading the compiled exploit kit for each user. Admin can upload
zipped exploit kit files for the user. We guess that this might be for users who want to resell the
BEPS exploit kit. User passwords are salted and encrypted before storing in the DB.

23

Figure 14 - User Control (Admin)

24

The proxy control page manages proxy domains as in Figure 15. Proxy domains have three levels
including third level domains (hostname) and second level domains also called the master proxydomain. Admin can add proxy domains and master domains one by one or en-masses. Masterproxy domains are registered using the “NameCheap” DNS hosting service. Authoritative DNS

Figure 15 - Proxy Management (Domain)25

servers to control third level domains (hostname) of proxy domains are managed by an operator of
the

BEPS

exploitkit

using theauthoritative

nameservers,

pns25.cloudns.net

andpns26.cloudns.net. of clouDNS. We believe that domains are checked (potentially by a cron job)
to see whether they are detected as malicious or not using the scan4you service. IP addresses forthe proxy server are managed at a page named “Proxy Server” shown in Figure 16.

Figure 16 - Proxy Management (IP)Panel Server (User Account): A registered user (attacker) to the BEPS exploit kit service can set
up the payloads, get API links and check exploit statistics in their respective user control panel.
On the dashboard, a user can check exploit statistics such as hits (accessed IP to proxy), exploited
IPs, threads, exploit ratios, locations, browsers, OSs and referrers as depicted in Figure 17.

Figure 17 - Dashboard (User)26

On the page named “Files” shown in Figure 18, a user can manage payloads such as uploading,scanning, and deleting files.

Figure 18 - Payload Management

On the page named “Threads” shown in Figure 19, a user can set up at most three payloads andgenerate “URL Rotator” link and “Public Stats” link for each payload by clicking the GetURL button.
The first URL is an API link to receive the rotating proxy URLs and the second URL is to check
exploit statistics without logging into the panel server. The sid value in the API link is an API token
generated by encrypting the flow_id, user_id and proxy_host values of a user using RC4. We thinkthat this API link is used by the TDS server as explained in following section.

Figure 19 - API Link & Statistics Link

27

Table 8 shows the summary of exploit statics of all registered users using the BEPS exploit kit
before it is leaked.

Table 8 - Actual Attackers and Exploit Ratios

No
1
2
3
4
5
6
7
8
9
10

User
admin
stalinfirebenderrfrswefg
mycucubullxx2
djaro
synkoxAndsdig
goldendragon

Hits223298
10379
13066
24
22
24
31
12313
343
28294

Exploited
77588
620
7644
8
33
7
15
2549
40
8307

Threads (exploit type)
3
4
2
2
4
2
1
1
3

Rate of infection
6%
59%
33%
150%
29%
48%
21
12
29%

TDS Server: The TDS is server is provided by TDS vendors who buy and sell Web traffic. Attackers
abuse TDS services and let TDS redirect traffic to the proxy server of the BEPS exploit kit to infectthe victim with malware. In order to do so, TDS needs to know proxy server URL. Since, theseproxy URLs are rotating and changing dynamically, TDS server uses an API to update the proxy
URL. Please note that the existence of a TDS server is our assumption and there might also beother ways to redirect a victim to the proxy server.
Proxy Server: The “index.php” script on the proxy server fingerprints a visiting victim’s informationsuch as OS, browser, location and updates this information in the “hits” table of the panel server.
It then calls the “landing_$flowid.php” script which seems to be the actual script to exploit thevictim. Please note that this landing_$flowid.php script is not included in the leaked kit wecollected. In any case, we guess that “landing_$flowid.php” exploits the victim together with otherexploit scripts existing on the VDS server whose exploit codes are not leaked as well.
On proxy server, another file named “z.php” serves an appropriate payload, fingerprints of
exploited victims, and updates a victim’s information in the “hits” table in the panel server. In
addition, the proxy server protects itself from being detected by crawlers and the security
community by setting blacklisted http-user-agent and browsers as in Figure 20.

28

Figure 20 - Self Protection

VDS Server: We think that the VDS server might contain actual exploit codes whose functions arecalled by “landing_$flowid.php” on the proxy server. As the leaked kit does not include these
exploit codes, we do not know details on how these codes are functioning together with“landing_$flowid.php” to exploit the victim. We think that as exploit codes are the main
components of an exploit kit, exploit kit operators protects VDS server behind proxy servers verywell.

Attack Infrastructure
We replicate the attack infrastructure of the BEPS exploit kit in our lab environment as in Figure
21.

Figure 21 - BEPS Attack Infrastructure

29

Red colored numbers in Figure 21 represent the traffic from a victim’s browser and dotted lines
show how servers behind the senses are working together to perform the drive-by download
attack. Attack flow is as follows:
1. Firstly, a victim access to the compromised site and is redirected to TDS server.
2. The TDS server updates the proxy URL using the API and redirects the victim to the proxy
server. Namely, TDS updates the proxy information using an API link such as“http://panelserver_IP/api.php?sid=9Hbrbjv_nfRcSSPd0al”. As result, TDS receives proxysever URL such as “http://ablt.mexicanvoter.info/index.php?zX3kA02R2cBabnur=tie3YDn
12KddRG32N1kce8FmnhMZmrxBhrlf6mlQwcgmmksnik7V3FDJB”. Using this link, TDS
redirects the victim to the proxy server.
3. The proxy server fingerprints the victim’s OS, browser, location and referrer URL, updates
this information in the panel server and exploits the victim. We think that “index.php” and“landing_$flowid.php” work together with actual exploit codes on the VDS server in order
to exploit the victim. After the victim is successfully exploited, “z.php” on the proxy server
fingerprints the exploited victim, updates the “hits” table on the panel server and provides
the appropriate payload to the victim. Finally, victim is infected with malware.

Database
The dumped database in the leaked kit contains more than 400,000 records. The name of thedatabase is “panels”. We replicate it on a SQL DB. The analysis results of tables in the DB are
shown in Table 9.
Table 9 - Tables in Database

Table
Name
domains

Table Structure

Sample Data

id, name

622, wallstreetsradar.org

30

file_scans

id, file, owner, name, hash, rate,
result218

files

id, owner, name, file, hash,description, timestamp, url

217,750,59,accelerate.exe,ba3f78935efde8
83e1c07a890fb71adf5a3ab9a3, 1/35,
AVDFree:OK Avast:OK
676, 60, tihjyuu.exe, exe_file,
fa35b9cf029d867ee509a3891a1ce643e38e
a22,’ ‘, 1473195774, NULL

flows

id, user_id, file_id, last_token

126, 60, 738, 1473246262

126

30

Rows

24

hits

id, owner, flow, ip, agent,referrer, country, city, browser,
exploited, timestamp, os

889961,22,44,'221.40.158.156','Mozilla/5.
0 (Windows NT 6.3; WOW64;
Trident/7.0; rv:11.0)
likeGecko','http://nikefukuoka.jp/m/banner.php','JP','Unknown','MSIE11.0',0,1465996
320,'Windows 8.1'

404,905

proxy

id, url, description, last_check10880,
http://rig.mexicanvoter.info/index.php,
autogenerated, 1473246001

9tokenstoken, flow_id, timestamp

5stcclXg49RSo, 126, 1473246262

103

users

id, name, pwd, registered,last_login, last_ip, expiration,uid, comment, token

40, firebender,$2y$10$dJ6IkN4JMxzqX87SNxQ0oe4rnB
CzufIjDV1TZFLpYesd8QZkxPrQm,
1469572046, 1473225147,
185.93.185.229, 1473552000, 1a80cc68,,95RJctOWpJv09vds

id, ip, description

9, http://109.236.92.187/index.php

1

Master domains and proxy domains in the domains table and proxy tables are shown in Table 10
and Table 11. At the time of our analysis in June 2017, all these domains are NXDomains (NonExistent Domain).
Table 10 - Proxy Domains

No Domains
1 'http://rig.mexicanvoter.info/index.php'

StatusNXDomain2'http://tyoig.mexicanvoter.info/index.php'

NXDomain3'http://swxdt.mexicanvoter.info/index.php'

NXDomain

4'http://edqn.mexicanvoter.info/index.php'

NXDomain

5'http://dgeo.mexicanvoter.info/index.php'

NXDomain

6'http://sothj.mexicanvoter.info/index.php'

NXDomain

7'http://ynq.mexicanvoter.info/index.php'

NXDomain

8'http://zmlfg.mexicanvoter.info/index.php'

NXDomain

9'http://ablt.mexicanvoter.info/index.php'

NXDomain

Table 11 - Master Proxy Domains

No
1

Domains'cozumeloffers.com'

StatusNXDomain
31

2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

'diamondsoffers.info''diamondsoffers.net''diamondsoffers.org''fifthaveny.net''fifthaveny.org''fifthavenyc.net''fifthavenyc.org''hispanicethnicity.info''hispanicethnicity.org''horseoffers.info''horseoffers.net''horseoffers.org''junksnacks.info''junksnacks.org''latinoethnicity.info''latinoethnicity.org''mexicantequilas.info''mexicantequilas.org''mexicanvote.info''mexicanvoter.info''retail-price.net''saintthomasoffers.com''stocksunder11.com''thefifthaveny.com''thefifthavenyc.com''visitchankanaab.com''wallstreetsradar.net''wallstreetsradar.org'

NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain
NXDomain

A table named “hits” contains more than 400,000 records of fingerprinted victim information andreferrer URLs. The total victim IP count is 224,727 and the total count of referral URLs is 51,826.
There are 1,390 unique domains if domains of referral URLs are counted. The analysis offingerprinted victim information such as OS, browser, locations, and type of exploits of hits tableis shown in the following Tables.

Table 12 - Top Targeted Countries More than 5000 Victims

No
1
2
3

Country

Count
38145
32083
15316

RU (Russia)
GB (United Kingdom)
US (United States)
32

4
5
6
7
8
9
10
11

BR (Brazil)
JP (Japan)
IN (India)
DE (Germany)
ES (Spain)
FR (France)
IT (Italy)
VN (Vietnam)

14485
14039
12298
10093
9778
8357
6389
5290

Table 13 - Top Targeted Browsers

No
1
2
3
4
5
6

Browser
MSIE 11.0
MSIE 8.0
MSIE 7.0
MSIE 10.0
MSIE 9.0
Chrome 50.0.2661.102

Count
92,425
42,11528,19527,12524,215
5,440

7
8
9

MSIE 6.0
Firefox 46.0
Chrome 46.0.2486.0

4,177
1,966
1,790

10

Chrome 49.0.2623.112

1,071
Table 14 - Top Targeted OS

No
1
2
3
4
5
6
7
8
9

OS

Count
136,059
22,935
22,15520,443
16,862
9,703
2,628
1,591
1,442

Windows 7
Windows 8
Windows XP
Windows 8.1
Windows 10
Windows Vista
Unknown
Mac OS
Linux

Self- Protection Features
In order to protect itself, the BEPs exploit kit uses the following features;•

Proxy server domains are rotated to prevent easy takedown and to confuse security
researchers.

33

•

Proxy domains are DGA domains and registered automatically using the Namecheap API.
This allows the exploit kit to register new proxy domains in real time if current proxydomains are detected.

•

Use of proxy servers in order to hide the VDS (landing) server•

Use of API to update proxy URLs preventing easy tracking of proxy servers•

Payload is encrypted to prevent analysis and being abuse by rivals•

Use of scan4you service to prevent detection on proxy domains•

Check detection ratio of payload (executable files) using scan4you so that payload can be
updated•DNS A records of proxy domains are managed by separate clouDNS servers so that
operator can handle host names of proxy domains efficiently.

•

Block search engine bots and crawlers from the security community using http-user agent
block list.

Weak Points•

TDS servers are not whitelisted and so anyone with access to API information can abuse
the API link.

•

Proxy domains are rotated and a registered customer can collect as many proxy domains
as possible by using API several times. Please look at Chapter 4 for detailed information.

•

Directory listing is not prevented.

34

Hunter Exploit Kit
Hunter exploit kit was first seen in 2015 and its source code was leaked in 2016. Drive-by download
attack performed by the Hunter exploit kit mainly targeted banking customers in Brazil. According
to the Ranger Exploit group selling hunter kit, the price is $2500 for a lifetime package as shownin Figure 22.

Figure 22 - Sale Page

A group of popular hackers named “peace of mind” have hacked their rival website w0rm.ws.an,a website where hackers can discuss topics and sell knowledge or tools, in October 2016. In
addition, “peace of mind” dumped the site’s entire database and leaked online. The leaked dataconsists of the entire website’s data including files, databases, exploit kits, user data including
accounts, passwords, history, PMs, forum posts and other sensitive data. The hunter exploit kit isincluded in this leaked dataset. We have downloaded it from Crack Pro. The leaked code is Hunterversion 1.0.1 and it includes database files, a PHP based web application for controlling panel
servers and update server.

Servers in the Attack Infrastructure
The attack infrastructure of the Hunter exploit kit consists of a panel server and update server. The
panel server seems to be set up by an attacker. Updates for the web application running on thepanel server can be downloaded from the update server.
Panel Server: The panel sever is a PHP based web application running on Apache. It is mainly
used to manage the exploitation task, generate landing page URLs and check statistics of the35victim. The login page of the Panel server is shown in Figure 23. After login, a user can checkstatistics and insider news on the Dashboard page as shown in Figure 24.

Figure 23 - Hunter Login Page

Figure 24 - Dashboard

On the page named Exploit Kit, a user can check current tasks and using the column named
Options shown in Figure 25, a user can generate a statistical report relating to the current task, get
URLs to the landing page and manage tasks such as start, stop and delete. Here, “task” means a
set of chosen exploits and payloads chosen by a user.

36

Figure 25 - Manage Exploits

Screenshots of the statistical report relating to the current task and landing page URL are shownin Figure 26 and Figure 27.

Figure 26 - Example of Report37

Figure 27 - Landing Page URLs

In Figure 27, two different types of landing page URLs are generated. The first two URLs arebasically the same, one with an iframe tag and the other without it. The same applies for the second
two URLs. The first two URLs (first and second URL from above) are for fingerprinting victim
information and exploiting a victim whatever the victim environment may be. The second two URLs
(third and forth from above) will not exploit victim, rather, it will let the victim download a fake adobe
flash player application.
A user can generate new tasks by choosing exploits and payloads as in Figure 28. In contrast withother exploit kits, for each task, a user can customize exploits out of all available exploits. At any
given time, only three tasks can be generated. Two landing pages will be generated for each task
and the attacker redirects the victim to these landing pages so that the victim can be exploited andinfected. The first landing page will do carpet bomb exploitation and the other one will exploit
according to the victim’s environment.

Figure 28 - Manage Exploits

38

Attack Infrastructure
We replicated the attack infrastructure of the Hunter exploit kit as in Figure 29.

Figure 29 - Hunter Attack Infrastructure

Red colored numbers in the Figure 29 represent the traffic from a victim’s browser and dotted lines
show how servers behind the senses are working together. Attack flow is as follows:
1. Firstly, a victim accesses the compromised site and is redirected to two landing pages.
2. When a victim accesses the first landing page, the victim’s information such as IP, country,browser, OS, and referrer will be recorded. All exploits will be tried regardless of what thevictim’s environment is. In the jargon, such exploit behavior is called a carpet bomb.
3. When a victim accesses the second landing page, a fake adobe flash player will be
downloaded without exploiting the victim. When this file is executed by the victim manually,
it will be infected with malware.
4. If the exploit in step 3 succeeds, malware will be downloaded for infection.

Database
The dumped database does not include much data. The name of the database is “kit” and thesummary of tables in the database is described in Table 15.

39

Table 15 - Tables in Database

Table Name

Table Structureclientside_task

id, taskname, sploitlist,
shellcodetype, data, status,
taskurl, agenturl, zipass

ekit_clientside

id, sploitname, sploitcode

ekit_manage

id, sploitname, dateadd,
stable, detail, pbypass, icon

ekit_multiple

id, sploitname, sploitcode

ekit_task

id, taskname, sploitlist,
shellcodetype, date, status,
taskurl, triggerurl, agenturl,
domain, dns1, dns2

ekit_taks_hello

id, ip, country, browser, os,ostype, referer dateusers

username, password

Sample Data
57,11, Adobe Acrobat Reader Remote
Code Execution (6-7-8-9),
Download/Exec, May 11 15:07:59
2015, Active,
http://81.17.25.3/666f726d20656e6374
7970653d226d756c746970617274/d07
d50a751bc6ddf12bf3af0efee9b45/11/6
512bd43d9caa6e02c990b0a82652dca.z
ip, , 111
1,Microsoft Office word Remote Code
Execution (2003-1007-2010-2013),e20141876
20, Adobe Flash Player remote Code
Execution, 2015-08-12, Good, CVE2015-3090
1, Internet Explorer Remote Code
Execution,
045423c0415da1d4293522d9ec3a19a7
201, hello, Mozilla Firefox Remote
Code Execution, Downlod/Exec, Aug
24 16:29:39 2015, Active ,http://81.17.25.3/666f726d20656e6374
7970653d226d756c746970617274/tas
k/hello/index.php,
http://81.17.25.3/666f726d20656e6374
7970653d226d756c746970617274/tas
k/hello/c7d08e09a44d2b453e7eeecebf
0a8daf/index.php,
81.17.25.3/666f726d20656e63747970
653d226d756c746970617274/5128f35
c9b4be13788ba41bdb6d1fc1f/5138840
586.exe
1, 43.241.26.88, Japan, Firefox,
Windows XP, 64bit, , Aug 24 16:34:04
2015
admin, hash of “hunter”

No:
Rows
1

4
20
17
1

1
1

Exploits
There are 14 different types of exploits in the leaked kits. In addition, one fake flash downloader
which will be downloaded to the victim whether the exploit succeeded or not is included. The target
application and respective CVEs of the exploits are depicted in Table 16.

40

Table 16 - Exploits

No
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

Target Application

CVE
CVE-2014-6332
CVE-2015-3043
CVE-2013-2470
CVE-2013-1710
CVE-2014-8636
CVE-2015-5119
CVE-2015-5122
CVE-2015-2419
CVE-2014-1510
CVE-2015-0311
Unknown CVE
Unknown CVE
Unknown CVE
Unknown CVE
-

IE
Flash
Java
FirefoxFirefox
Flash
Flash
IE
Firefox
FlashFake Flash downloader

Self-protection features
In order to protect itself, directory listing is prevented by the Hunter exploit kit.

Weak Points•

The landing page and panel server seem to be on the same server and thus it is easy todetect them.

•No other functions for self-protection are seen.

•

There is a special character called “task” in every iframe generate by the Hunter exploit kit.
This might lead to detecting landing page easily.

41

Neptune (Eris, Blaze, Terror) Exploit Kit
The Neptune exploit kit was first seen in 2016. It was used for drive-by download attacks. In August
2017, the Neptune exploit kit is used for dropping a Monero miner. It is sold as an exploit kit
package.
We downloaded Neptune Exploit Kit from VirusTotal. It seems that the leaked kit we downloaded
is what the original owner of the Neptune exploit kit (terror) mentions in hacker forums (in October2016) as shown in Figure 30. The leaked data consists of the web application for the panel server,
the database, the source for the uploader server and exploits. The price ranges from $ 750 to$ 4000 according to advertisement about Neptune exploit kit shown in Figure 31.

Figure 30 - Post in Hacker Forum

Figure 31 - Neptune Advertisement

42Servers in the Attack Infrastructure
The attack infrastructure of the Neptune exploit kit consists of a panel server, an uploader server
and a landing server. The panel server is the main server controlling the web application interface
for the exploit kit users and the payloads used. The uploader server downloads payload from thepanel server, creates the landing page and uploads it to the landing server. The landing server
serves the landing page, fingerprints the victim and updates the “hits” table in the database of the
uploader server.
Panel Server: The panel sever is a PHP based web application running on Apache. It has functions
to manage payloads, generate landing page URLs and check the statistics of the victims.
The login page to Panel server is shown in Figure 32. After login, a user can check statistics on
how many victims are exploited with what kind of exploits, hits (visit landing page but not exploited)
and license time left as in Figure 33.

Figure 32 - Neptune Login Page

Figure 33 - Dashboard

43

From the menu on the left, if we click on files, we can setup a flow, which is our payload file. After
finishing the setup, the exploit URL (landing page) is automatically generated together with an
example of how to redirect victims to the landing server with an iframe as shown in Figure 34.

Figure 34 - Manage Payload

On a page named “Stats” shown in Figure 35, a user can check statistics relating to the infectedvictim such as operating system, browser, country and type of exploits.

Figure 35 - Statistics

Uploader Server: The uploader sever has two main functions. Firstly, it connects to the panel
server using the API and downloads payloads whenever a new flow is set up on the Panel server.

44

Then, the uploader server generates a folder with a random name which contains, a landing page
with randomized name, exploits, payload and configurations files to connect back to the databaseon the main server. The generated folder is copied to the landing server through as SSH channel.
The uploader server connects to panel server one a minute.
Landing Server: The landing server running on Apache hosts the landing page with exploits andconnects back to the main server in order to update victim information. When a victim accesses alanding page, it first checks the victim’s environment and exploit the victim according to it. In orderto protect itself, the landing page blocks search engine robots by filtering http-user-agent andblocks google and trend micro through IP filters as shown in Figure 36 and Figure 37 respectively.

Figure 36 - Self Protection by IP

Figure 37 - Self Protection by User Agent45

Attack Infrastructure
We replicated the attack infrastructure of Neptune exploit kit as shown in Figure 38.

Figure 38 - Neptune Attack Infrastructure

Red colored numbers in Figure 38 represent the traffic from a victim’s browser and dotted lines
show how servers behind the senses are working together. Attack flow is as follows:•Firstly, a victim accesses the compromised site and is redirected to the landing page.

•

When a victim accesses the landing page, victim information such as IP, country, browser,
OS, and referrer will be recorded. Then, the victim will be exploited according to its
environment.

•

Finally, an exploit is downloaded and the hit data record of DB in panel server will be
updated. Now, the victim is owned by the attacker.

Database
The dumped database does not include much data. The name of the database is “blaze” and tablesin the database are summarized in Table 17.

46

Table 17 - Tables in Database

Table name

Table Structure

Sample Data

No:
Rows

domainsflows

id, domain
id, user_id, flow_id,
file_url, original_name,status, remote_directory,
flow_url, flow_server

3
1

flows_to_deletehits

4, www.google.com
41', '1', '1117524043','uploads/1117524043.exe','messagebox_crypted_02.exe', 'complete','1sV77pgWNLxl244sTyYogIab','http://127.0.0.1:1380/1sV77pgWNLxl244s
TyYogIab/VoceCLnEONIQ.php',
empty'ubuntu_vm_03'

id, flow_server,
remote_directoryid, flow , ip, agent, referrer, 2', '1117524043', '192.168.217.2',
country, browser, exploited, 'Mozilla/5.0 (Windows NT 10.0; WOW64;
unixtime, os
Trident/7.0; rv:11.0) like Gecko', 'direct', '','Internet Explorer', '0', '1488075374','Unknownmd5ofpassword,OS'id, username, password,
1,admin,1
active

user

0
3

1

Exploits
There are 11 different types of exploits in the leaked kits. Although we know the CVE for 8 exploits,
we do not know the last 3. Some exploits codes seems to not be completed yet. The target
application and respective CVEs of exploits are depicted in Table 18.
Table 18 - Exploits

No
1
2
3
4
5
6
7
8
9
10
11

Target Application
IE
Windows
IE
IE
FirefoxFirefoxFirefoxFirefox-CVE
CVE-2013-2551
CVE-2014-6332
CVE-2015-2419
CVE-2016-0189
CVE-2013-1710
CVE-2014-1510
CVE-2014-8636
CVE-2016-9078
Unknown CVE
Unknown CVE
Unknown CVE

47

Self-protection features
In order to protect itself, the Neptune exploit kit uses the following features;•

Directory listing attack is prevented.

•

Landing page name is randomized.

•

There is code for encrypting payloads although the current version does not use it.

•

The landing server blocks search engine bots and security vendors such as TrendMicro•

The Jabber message box for buying exploit kits does not accept messages from strangers.

•

Blocking search engine bots and crawlers from the security community using IP block lists
and http-user agent block lists.

Weak Points•

The panel server does not have whitelist IPs and everyone with API seems to be able todownload payload from it.

48

Chapter 4

Potential Attacks
By replicating the attack infrastructure of exploit kits, we have found weaknesses in theirinfrastructure, such as the way servers are managed. From this, we believe that there is a potential
to counter-attack the exploit kit infrastructure with nothing but customer privileges. In this chapter,
we will discuss the weaknesses of each of the leaked exploit kits and potential attacks againstthem.
In order to confirm our findings of potential attacks, we became an actual customer of the Rig 4.0
exploit kit for one week. Please note that we became a customer only for research purposes as
RIG 4.0 is currently highly active compared to other exploit kits. In this chapter, we will also discuss
how we became the customer of the RIG 4.0 exploit kit, our analytical approach to current attack
infrastructure, and potential methods to take down some servers of the RIG 4.0 exploit kit.

RIG 2.0 Exploit Kit
Attack Infrastructure
The replicated attack infrastructure of RIG 2.0 is depicted in Figure 39.

Figure 39 - RIG 2.0 Attack Infrastructure49Players in the Attack Infrastructure
Controlling parties of the RIG exploit kit attack infrastructure includes operators, attackers, andTDS vendors.
Operators: Operators offer exploit kit services to customers.
Attackers: Attackers use exploit kit service offered by operators.
TDS vendors: TDS (Traffic Direction System) vendors buy and sell Web traffic. The server used bythem is called the TDS (Traffic Direction System) server.
Firstly, an attacker who would like to launch the campaign needs to register for exploit kit service
with operators. In case of the RIG exploit kit, the panel server, VDS server and Proxy/Gate in Figure
39 are managed by operators behind the RIG exploit kit.
Then, in order to infect computers, an attacker needs to buy web traffic from TDS vendors. TDS
services are not malicious but attackers abuse them for malware infection. The TDS server in Figure
39 connects to a panel server using API token assigned to the attacker in order to get active proxy
server URL. The TDS server needs to have its IP whitelisted on the panel server in order to prevent
other servers accessing to the API server and getting proxy URLs. Please refer to Chapter 3 fordetailed functions of each server and the attack flow of drive-by download attack.

Potential Attack 1: Proxy Servers
API management: When an attacker registers as a customer of the RIG exploit kit, he or she will
receive access to a panel server. Then, the attacker sets up payloads to use for the campaign andreceives links to access to API server. An example of the general API link format used to accessthe API server is “http://panel_server_domain/APIscript.php?APItoken=tokenvalue”. When that
API link is accessed by TDS, proxy URL is generated by the API server and TDS uses this proxy
URL to redirect a victim to the right proxy server.
Attack Scenario: According to how proxy URLs are generated using the API link discussed above,
we notice that a customer can collect as many proxy URLs possible using an API link. As the API
server does not appear to enforce any access limits on generating these URLs and as proxy URLs
are rotated from time to time, a customer can get as many proxy URLs as possible. We assume
that this might lead to eventually exhausting the proxy server domains or IP addresses controlled
by operators using only customer privileges. In addition, we also assume that these domains or50

IPs of proxy domains might be reused among all attackers registered with the RIG exploit kit. We
will prove our potential attack being a real customer of RIG 4.0 in the following sections.

Potential Attack 2: SQL Injection
We found a SQL injection vulnerability in the RIG 2.0 exploit kit. With this vulnerability, it is possible
to change data from a certain table in the database or dump the whole database. Figure 41 shows
our SQL injection test request using Burp and Figure 40 is the response from the RIG 2.0 panel
server.
POST /manage/gears/saveVDS.php HTTP/1.1
Host: 192.168.1.175
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: ja,en-US;q=0.7,en;q=0.3
Referer: http://192.168.1.175/manage/index.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 126
Cookie: dS1G86KwRZ=1b88f059dabdbe9e9d6d8aeddbc4b676
Connection: close
1%5Bid%5D=1&1%5Bip%5D=http%3A%2F%2F192.168.1.161%2Fdownload.php&1%5Bdescription%5D=&2%5Bid%
5D=2&2%5Bip%5D='&2%5Bdescription%5D=

Figure 40 - SQL Injection Request<pre style='border:3px dashed red;border-radius:10px;padding:10px;text-transform:none;'>array ('Error' => 0,'Message' =>array (
0 => 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the
manual that corresponds to your MySQL server version for the right syntax to use near \'\'\'\' WHERE `id` = 1\' at line1',
1 => 'UPDATE `vds` SET `ip` = \'http://192.168.1.161/download.php\', `description` = \'\'\' WHERE `id` = 1;',),
'In file' => '/var/www/gears/db.php','On line' => 88,)</pre>Figure 41 - SQL Injection Response

51Potential Attack 3: Reflected XSS Attack
The RIG 2.0 panel server is vulnerable to reflected XSS attacks as well. With this, there is apossibility for session hijacking targeting customers and operators of the RIG 2.0. exploit kit.

Potential Attack: Related Servers on the Internet
From the leaked source code, we extracted some signature words allowing us to find servers
relating to the RIG 2.0 exploit kit on Internet. Seller pages and panel server pages found on theInternet are shown in Figure 42 and Figure 43.

Figure 42 - Seller Page

Figure 43 - Panel Server

52

RIG 4.0 Exploit Kit
In order to prove our findings of possibilities to detect and take down proxy domains, we becamea customer of the RIG 4.0 exploit kit for one week. Our analytical approach of their attack
infrastructure, how we became a customer and potential attacks on the RIG 4.0 exploit kit are
explained in the following sections. Please note that although we became a customer of the exploit
kit as a service offering, we did not buy any traffic from a TDS to redirect real victims. Instead, we
setup our own TDS server and all the victim clients came from our lab environment.

Being an Insider
The RIG 4.0 exploit kit started to be active in August 2017. It is used for campaigns aiming to drop
cryptocurrency mining payloads. From the forum discussing the RIG 4.0 exploit kit, we noticed thedomain of a panel server (www.rigpriv.com) hidden behind the Cloudflare DDoS protection service.
The panel server login page is depicted in Figure 44.

Figure 44 - RIG 4.0 Login Page

We received the Jabber contact (rig_exploit_pack@exploit.im) of a RIG seller from the login page.
The contact method is explained on the exploit.im main page in Russian. Original and translated
explanations are depicted in Figure 45. Figure 46 shows messages between us and the RIG seller.
It seems that there are two different types of licenses; for a week and a month costing $500 US
and $1500 US respectively. At the time of our registration, we estimate that there were more than
400 registered users based on our customer ID.

53

Figure 45 – Hot to Contact to RIG Seller

Figure 46 - Message to Seller

Good Income
Our curiosity leads us to check the transitions of the bitcoin address used by the RIG 4.0 operator.
From public information, we found that the address started trading from 2014-09-27. At the timeof writing, the account received a total of 767.30 bitcoins equivalent to about 7.8 million US dollars.
Figure 47 shows the amount of transitions and total received bitcoins. Figure 48 is the amount of
bitcoin received from 2014 to 2018. It is interesting to know that the amount of transitions increases
right after the new version is released.

54

Figure 47 – Bitcoin Transitions

Till RIG 2.0

RIG 4.0

RIG 3.0

Figure 48 – Received Bitcoins

RIG 4.0 Infrastructure
We depict the attack infrastructure of RIG 4.0 in Figure 49 by analyzing all network traffic visible tous as a customer.
In Figure 49, the gray colored boxes are servers managed by the operators behind the RIG 4.0
exploit kit. Blue colored boxes are servers and clients controlled by us. A white colored box is aserver we cannot see as the customer. The straight lines are all network traffic of victims and TDS
vendors we are able to capture. Dotted lines are network traffic we cannot see.
The attack infrastructure of the RIG 4.0 exploit kit consists of five different types of servers.
Panel Server: The panel servers is the main server running the web application managing the RIG
4.0 exploit kit. It is hidden behind the Cloudflare DDoS protection service. The domain at the timeof this writing is (www.rigpriv.com).

55

Figure 49 - RIG 4.0 Attack Infrastructure

API Server: The API server returns proxy domains whenever it is accessed by a whitelisted TDS
server. In order to get access to the API server, customers need to whitelist the TDS IP as shownin Figure 50 and click the get link button as shown in Figure 51.

Figure 50 - Whitelist TDS

56

Figure 51 - API Link

Proxy Server: Proxy servers seem to be used to proxy traffic between the victim and VDS servers.
Please note that we cannot see VDS servers hidden behind the proxy server. Links to proxy servers
can be generated by accessing the API server.
Fingerprint Server: Before a victim is sent to the proxy server, it connects to the fingerprint serverand sends some encrypted payload. We think that the victim is sending its environment information
to that server.
TDS Server: We set up our own TDS (traffic redirection server) which connects to a panel serverwith API to get the proxy link and redirect the victim to a proxy server. We think that the VDS server
IP and fingerprint server IP is encrypted in the parameters of the proxy link that the TDS receives
from the panel Server. An example of a proxy link received from the TDS server is shown in Figure
52 where 188.225.56.143 is the IP address of the proxy server.

Figure 52 - Proxy URL
Payload Server: A customer can setup a payload server URL in order to update payloads. We
setup a payload server listening on TCP port 80. An unknown IP connects to our payload server tocheck for updates every 10 minutes. Every time, the same IP connects us. When we connect backto this IP, it is hosting the same content as the panel server. From this finding, we conclude that57

the IP connecting to our payload server is the actual IP of the RIG panel server hiding behind
CloudFlare.

Attack 1: Decoying Proxies
From our analysis of RIG 2.0, we have found that customers can generate as many proxy domains
as possible using the API and that this might lead to taking down the proxy server using only
customer privileges. This approach has the limitation that if these proxy domains are used only for
one customer, even if we are able to take down the proxy it would be meaningless.
To prove our findings, we:
1. Collect as many proxy domains as possible and analyze their behaviors
2. Check whether these proxy domains appear in any other open source reports on theInternet
To collect proxies, our TDS server accesses the API server every 10 minutes. We then analyze allcollected proxy URLs and find out that, In RIG 4.0:
1. Rather than domains, proxy servers use IP addresses
2. Proxy IP addresses seem to be rotated randomly
3. Proxy information can be collected even after the registered period as a customer has
expired4. All IP addresses are hosted on the TimeWeb hosting service of Russia
5. All proxy server IP addresses we collected are also used for other customers as there is a
100% match between the proxy IPs we collected and those shared at ektracker.com.
Currently, we are able to collect 108 proxy server IP addresses and this information is shared in
the Appendix section.
From these findings, we are able to prove that proxy IPs can be taken down only with customer
privileges and that these rotating proxy IP addresses are shared among different users of thecurrent RIG 4.0 exploit kit.

Attack 2: Reveal the Hidden Panel Server IP
Panel server connects to our payload server to check for updated payloads for every 10 minutes.
When we connect back to this IP, it is hosting same content as the panel server. From this finding,we conclude that the IP connecting to our payload server is the actual IP of the RIG panel server

58

hiding behind CloudFlare. The actual panel server IP and contents are shown in Figure 53 andFigure 54.

Figure 53 - Connection to Payload Server

Figure 54 – Actual IP of RIG 4.0 Panel Server

Attack 3: Collecting More and More Proxies
Due to insufficient authentication performed by the API server, even after the registration period
has expired, we are able to access the API server and get updated proxy links. We assume that
this is due to a weak point in user access management. Using this weak point, we keep oncollecting proxy server IP addresses and currently we so far able to collect 108 proxy server IP
addresses during our analysis from February 22 to March 5 as shown in Figure 55. All IP addresses
are Russian IP addresses hosted at Time Web Hosting service.

59

Proxy Server IP count
20
18
16

Unique IP count

14
12
10
8
6
4
2
0
22-Feb

23-Feb

24-Feb

25-Feb

26-Feb

27-FebLink 128-Feb

1-Mar

2-Mar

3-Mar

4-Mar

5-Mar

Link 2

Figure 55 - Collected Proxy Server IP

Attack 4: Directory Listing
Based on our previous knowledge of analyzing the RIG 2.0 exploit kit, we have listed some of thedirectories and checked the contents. From this, we notice that RIG 4.0 is running on Apache
2.2.22 (Debian) and we are able to access some open directories such as the “/gears/ajax” and“/html” directories shown in Figure 56 and Figure 57. It seems that directory names are almost thesame as RIG 2.0. At the time of this writing, the directory “/gears/ajax” is not accessible. It seems
that the operators also keep on watching their panel server’s security.

Figure 56 - Directories in Panel Server

60

Figure 57 - Directory in Panel Server

Although the content of the folder named “/upload” was visible in RIG 3.0, it is not visible in RIG
4.0. However, we confirmed that the contents we were able to see before are downloadable. The
downloaded executable files and their detection ratio on Virus Total is shown in Figure 58.

Figure 58 - EXE Files in Upload Directory

Attack 5: Peaking Attackers
Due to a lack of access restriction enforcement, we are able to access statistics of other registeredusers. We tested different flow IDs ranging from 0 to 10 and 840 to 950. From this, we were able
to see the exploit rates of 21 users. A summary of our findings is shown in Table 19 . According toTable 19, there are about 111,255 computers being exploited with a total exploitation rate of
12.4 %. In addition, we collected 108 referrer domains which redirect victim traffic to the RIG 4.0
landing page.

61

Table 19 - Attackers Using RIG 4.0 and Exploit Rates
No

Flow IDTop Country

Hits

Exploits%

Top
Browser

Top OS

Referrers Exploit
Domain Types

1874 (mxmxmx)

Mexico92

22.2

MSIE 11.0

Windows 10

1

2

2

975 (mx)

Mexico

5437

378

7

MSIE 11.0

Windows 7

9

6

3

880

Brazil714451 94351

13.2

MSIE 11.0

Windows 7

10

6

4

884 (TRAFF)

United Kingdom

1

0

0

MSIE 8.0

Windows Vista

0

0

5

887

US

14982

418

2.8

MSIE 11.0

Windows 7

10

5

6

890

United Kingdom

1

0

0

MSIE 11.0

Windows 7007898(col)

US

213

6

2.8

MSIE 11.0

Windows 10

4

2

8

899 (korsaisback)Netherlands

190

4

2.1

MSIE 11.0

Windows 7

10

2

9

902

Turkey

58560

7874

13.4

MSIE 11.0

Windows 7

10

6

10

906

Turkey

794

96

12.1

MSIE 11.0

Windows 7

1

3

11

907

Mexico200MSIE 11.0

Windows 7

1

0

12

908 (Nutrino)

US

11

0

0

MSIE 11.0

Windows 10

0

0

13

910

US

788

28

3.6

MSIE 11.0

Windows 7

1

5

14

912 (First Server)

US

2860

41

1.4

MSIE 11.0

Windows 7

10

3

15

913 (Second Server)

US

3241

47

1.5

MSIE 11.0

Windows 7

10

3

16

914

Egypt

140

10

7.1

MSIE 11.0

Windows 7

1

2

17

920 (first)

Brazil

83293

7261

8.7

MSIE 11.0

Windows 7

10

6

18

921 (Maaa)

Germany

1

1100

MSIE 8.0

Windows 7

0

1

19

923 (test)

Taiwan

5530

691

12.5

MSIE 11.0

Windows 7

10

6

20

927 (test)

US

110

32

29.1

MSIE 7.0

Windows XP

10

5

21

929

US

417

15

3.6

MSIE 11.0

Windows 7

0

2

108

65

Total

891031 111255

12.4

Statistics of some of the high-profile users with more than 10,000 IP hits are shown in Figure 59
and Figure 60. We share the referrer domain list in the Appendix section.

62

Figure 59 - Flow 887 and Flow 880

63Figure 60 - Flow 902 and Flow 920

64

BEPS/ Sundown Exploit Kit
Attack Infrastructure
The replicated attack infrastructure of the BEPs exploit kit is depicted in Figure 61.

Figure 61 - BEPS Attack Infrastructure

Players in the Attack Infrastructure
Controlling parties of the BEPS/Sundown exploit kit attack infrastructure includes operators,
attackers, and TDS vendors.
Operators: Operators offer exploit kit services to customers.
Attackers: Attackers use exploit kit service offered by operators
TDS vendors: TDS (Traffic Direction System) vendors buy and sells Web traffic. The server usedby them is called the TDS (Traffic Direction System) server.
Firstly, an attacker who would like to launch the campaign needs to register for exploit kit services
with an operator. The panel server and proxy server in Figure 61 are managed by operators behind
the BEPS exploit kit.
Then, in order to infect computers, an attacker needs to buy web traffic from TDS vendors. TDS
services are not malicious as such attackers abuse them for malware infection. The TDS serverconnects to panel server using API token assigned to the attacker in order to get active proxy65

server URLs. Please refer to Chapter 3 for details on the functions of each server and the attack
flow of drive-by download attacks.

Potential Attack 1: Decoying Proxies
API management: When an attacker registers as a customer of the BEPS exploit kit, he or she will
receive access to the panel server. Then, attackers setup payloads to use for the campaign and
get

the

link

to

accesstheAPIserver

using

an

API

link

such

as

http://panelserver_IP/index/api.php?sid=XXX in which XXX is the API token value of the customer.
Attack Scenario:

From the analysis on how proxy URLs are generated using the API link

discussed above, we notice that a customer can generate proxy URLs using the API. As the API
server does not appear to enforce any limits on generating these URLs and as proxy URLs arerotated from time to time, a customer can get as many proxy URLs as desired. We assume that
this might lead to exhausting the proxy server domains or IP addresses controlled by operators
using only customer privileges.

Potential Attack 2: Fake API Access
IP addresses of TDS servers are not whitelisted on the panel server and so anyone with an API
token can access the proxy server. Namely, if we can guess or calculate an API token of acustomer, we will be able to get all proxy addresses used by that customer.

66

Hunter Exploit Kit
Attack Infrastructure
The replicated attack infrastructure of Hunter exploit kit is depicted in Figure 62.

Figure 62 - Hunter Attack Infrastructure

Players in the Attack Infrastructure
Controlling parties of the Hunter exploit kit attack infrastructure include operators and attackers.
Seller: In case of the Hunter Exploit Kit, operators only offer updates of the panel server web
application.
Attackers: An attacker buys the exploit kit as a package from the Seller.
Firstly, the attacker who would like to launch the campaign needs to buy the exploit kit web
application as a package from the seller. Attackers need to set up the panel server and landing
page.
Then, in order to infect computers, the attacker needs to buy web traffic from TDS vendors or use
any other way to get victims redirected to his landing page. Please refer to Chapter 3 for details on67

the function of each server and the attack flow of drive-by download attacks using the Hunter
exploit kit.

Potential Attack 1: Easy to Detect Panel Server
According to the analysis on the leaked code, the landing page and panel server seem to berunning on the same server. In addition, we did not find any proxy server functionality. Thus, wethink that the panel server can be detected easily.

Potential Attack 2: Easy to Find Landing Page
There is a special character “task” in every iframe generate by the Hunter exploit kit. This mightallow to detect landing pages easily.

Potential Attack 3: Related Servers on the Internet
From the leaked source code, we extracted some signature and crawled servers relating to the
Hunter exploit kit on the Internet. We are able to detect one panel server page on the Internet asshown in Figure 63.

Figure 63 - Hunter Panel Server

68Neptune Exploit Kit
Attack Infrastructure
The replicated attack infrastructure of Neptune exploit kit is as shown in Figure 64.

Figure 64 - Neptune Attack Infrastructure

Players in Attack Infrastructure
Controlling parties of the Neptune exploit kit attack infrastructure include sellers and attackers.
Seller: A seller sells code for the panel server, uploader and landing server as a package.
Attackers: An attacker buys the exploit kit as a package.
Firstly, the attacker who would like to launch a campaign needs to buy the exploit kit web
application as a package from the seller. Attackers need to set up the panel server, uploader andlanding server according to the manual in the package. Then, in order to infect computers, theattacker needs to buy web traffic from a TDS vendor or use any other way to get victims redirected
to his landing page. Please refer to Chapter 3 for details on functions of each server and the attack
flow of drive-by download attacks using the Neptune exploit kit.

69

Potential Attack 1: Fake API Access
The panel server does not whitelist IPs and everyone with API access seems to be able todownload payloads from it.

Potential Attack 2: Related Servers on Internet
From the leaked source code, we extracted some signature and crawled servers related to the
Neptune exploit kit on the Internet. We were able to detect some compromised servers on theInternet as shown in Figure 65.

Figure 65 - Compromised
Servers
70

Chapter 5

Future Possibilities
Upon our analysis of several different leaked exploit kits, we noticed the following two main
similarities between them:•

Exploit kits share similar design pattern in their attack infrastructure.

•

The code between different exploit kits is similar.

From this, we believe that the attack methods discussed in Chapter 4 are usable not only against
leaked kits but also against other unknown kits that share similarities with the leaked ones. In this
Chapter, we will discuss similar design patterns and similar code among different exploit kits.

Similar Design Patterns
We analyzed several attack infrastructures of different exploit kits and we were able to group theminto two main groups according to similarities in their attack infrastructure.
Group 1: Almost all old exploit kits in this group such as Sakura, Demon Hunter, Mushroom,
Elenore Express, etc., share a similar type of attack infrastructure among them. Namely, 1) landing
server and panel server exists on the same server, 2) no proxy is set up, 3) landing page URLs
have signatures that allow us to detect panel servers easily and 4) several web application
vulnerabilities exist.
The similarities in attack infrastructure lead to similarities in vulnerabilities too. Thus, attacks suchas detecting panel servers and web applications related to attacks are common among different
kits too. Therefore, operators behind exploit kits put more effort into self-defense features such as
rotating proxies, TTL of proxies, etc., in new kits.
Group 2: So-call advanced exploit kits common today such as RIG, BEPS/Sundown, etc., use
features such as 1) rotating proxies, 2) API to update proxies in their attack infrastructure, 3) VDS
servers and 4) hiding behind DDoS protection services, etc. In addition, recent exploit kits give
better service to their customers providing one-stop exploit statistic page and updating payloads
automatically. These features, in turn, lead to decoying of proxies, abusing APIs and leakage ofstatistical information of different exploit kit users.
We pointed out some possible attacks relating to these advanced features and we believe that it
might be possible to use them for future exploit kits as well.

71

Code Reuse
Code reuse among different exploit kits we analyzed is quite frequent. We were able to classify 33
leaked exploit kits into 6 groups according to code reuse among them.
Group 1: The first group includes the RIG, Hunter, Neptune and BEPS/Sundown exploit kits
sharing. An example of code reuse among them is shown in Figure 66.

Figure 66 - Code Reuse

Group 2: The second group includes the Demon Hunter and Bleeding Life exploit kits. An example
of code reuse among them is shown in Figure 67.

Figure 67 - Code Reuse

72

Group 3: The third group includes the Sakura and Armitage exploit kits. An example of code reuse
among them is shown in Figure 68.

Figure 68 - Code Reuse

Group 4: The fourth group includes the 0x88, multisploit, RDS and Infector exploit kits. An example
of code reuse of among them is shown Figure 69.

Figure 69 - Code Reuse

73

Group 5: The fifth group includes the Sakura and Armitage exploit kits. An example of code reuseof among them is shown Figure 70.

Figure 70 - Code Reuse

Group 6: The sixth group includes the rest of exploit kits such as ice-pack, Tor, etc. An example
of code reuse among them is shown in Figure 71.

Figure 71 - Code Reuse

74

Due to this code reuse pattern among several different exploit kits, we believe that vulnerabilities
will be similar and this might in turn lead to taking down future exploit kits with the same attack
methods we showed in this paper.

75

Conclusion
In this study, we analyzed many different leaked exploit kits. Most popular exploit kits nowadays
are just recovered versions of previously leaked ones. From this, we came up with a detailed
understanding of how API servers, panel servers, proxy servers, VDS servers, uploader servers,
update servers and fingerprint servers are working together in the exploit kit attack infrastructure.
Namely, the attack infrastructure of exploit kits, their self-protection features, and weak-points are
revealed in this study explained in Chapter 3.
We will first summarize self-protection features of exploit kits. They are as follows:
1) Use proxy servers in order to hide the actual attack infrastructure.
2) Use rotating domains and IPs for these proxy servers in order to prevent an easy takedown
and to confuse security researcher.
3) Domain registration for proxy and VDS servers is automated in order to keep theinfrastructure alive even after registered domains are sinkhole.
4) Block search engine bots and crawlers from the security community using IP block list andhttp-user agent block list.
5) VDS or landing pages have a TTL in order to limit duplicate access from counterparties.
6) The panel server is protected behind DDoS protection services to prevent attacks fromrivals and to hide the actual IP of the panel server.
7) API server access is limited to only whitelisted servers in order to prevent API abuse.
8) The landing URL is randomized to prevent detection of landing pages using URL signatures.
9) The payload is encrypted to prevent analysis and abuse by rivals.
10) Detection ratio of proxy domains and payloads is checked in order to update them overtime.
11) Directory listings on panel servers and proxy servers are prevented.
Understanding these self-protection features lets us know weak points of exploit kits when suchfeatures are not implemented and gives us ideas on how to counter attack them when they are. In
addition, the insights on how operators behind exploit kit services give better service to theircustomers summarized below and a deep understanding on their attack infrastructure gives us
ideas on how to counter-attack them using only customer privileges.

76Customer services:
1) An API for updating the rotating proxy URL so that customers can update the proxyeasily.
2) Public statistic checks so that customer can check infection ratio without logging in to
the panel server account.
3) A user can update their payload dynamically by registering a payload server URL atpanel server.
4) A service to let users check the detection ratio of his or her payload automatically isprovided.
With all these details in mind, we propose potential attacks against each exploit kit in Chapter 4.
In addition, we prove some of the proposed attacks by being an insider of today’s most profitable
exploit kit, RIG 4.0. From this, we prove that RIG 4.0 can be taken down by generating as many
proxy IPs as possible using only customer privileges. In addition, we also give insights on othervulnerable points of Rig 4.0 to counter-attack it in Chapter 4.
Finally, we believe that the potential attack methods proposed in this study can be used for future
exploit kits as well, due to most exploit kits sharing similar design patterns in their attack
infrastructure and the nature of code reuse among different exploit kits as explained in Chapter 5.

77

References
1) https://blog.trendmicro.com/trendlabs-security-intelligence/promediads-malvertisingsundown-pirate-exploit-kit/2) https://blog.skyboxsecurity.com/nebula-exploit-kit/3) https://forum.antichat.ru/threads/prodazha-trafika-android-deskop-vysokogokachestva.458691/
4)

https://www.proofpoint.com/us/threat-insight/post/Hunter-Exploit-Kit-Targets-BrazilianBanking-Customers5) https://www.hackread.com/hacking-forum-w0rm-ws-hacked-data-leaked/6) https://www.cyber.nj.gov/threat-profiles/exploit-kit-variants/
7) https://ifud.ws/threads/1-neptune-exploit-kit-17-exploits-in-one-10-30-executionrate.12471/
8) https://www.jpcert.or.jp/present/2018/JSAC2018_05_ikuse.pdf9) https://forum.antichat.ru/threads/prodazha-trafika-android-deskop-vysokogokachestva.458691/
10) https://www.v3.co.uk/v3-uk/news/2420811/rig-30-exploit-kit-hits-the-hackerunderground-and-infects-millions11) https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Reloaded---Examining-theArchitecture-of-RIG-Exploit-Kit-3-0/12) http://malware-traffic-analysis.net/2017/03/02/index.html
13) http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html
14) https://www.cyber.nj.gov/threat-profiles/exploit-kit-variants/sundown78

Appendix – 1
RIG 4.0 Proxy IP List
176.57.208.139

188.225.25.118

188.225.26.200

92.53.107.210

176.57.208.145

188.225.25.119

188.225.26.222

92.53.107.215

176.57.208.171

188.225.25.128

188.225.26.238

92.53.107.22

176.57.208.232

188.225.25.129

188.225.27.40

92.53.107.27

176.57.214.105

188.225.25.130

188.225.34.142

92.53.107.28

176.57.215.10

188.225.25.142

188.225.34.41

92.53.107.33

176.57.215.127

188.225.25.143

188.225.38.7

92.53.107.34

176.57.215.137

188.225.25.145

188.225.46.56

92.53.107.35

176.57.215.138

188.225.25.146

188.225.56.149

92.53.107.57

176.57.215.37

188.225.25.147

188.225.57.109

92.53.107.70

176.57.215.78

188.225.25.148

188.225.57.126

92.53.107.73

176.57.215.80

188.225.25.164

188.225.57.130

92.53.107.74

176.57.215.86

188.225.25.165

188.225.57.132

92.53.107.75

176.57.215.87

188.225.25.166

188.225.57.133

92.53.107.80

188.225.10.18

188.225.25.167

188.225.57.236

92.53.107.82

188.225.11.77

188.225.25.168

188.225.57.61

92.53.107.83

188.225.18.102

188.225.25.193

188.225.9.136

92.53.107.84

188.225.18.30

188.225.25.231

188.225.9.147

92.53.107.85

188.225.24.20

188.225.25.232

5.23.48.242

188.225.24.248

188.225.25.233

5.23.52.74

188.225.24.249

188.225.25.237

5.23.53.222

188.225.24.28

188.225.25.238

5.23.55.128

188.225.24.29

188.225.25.239

92.53.107.121

188.225.24.39

188.225.25.248

92.53.107.122

188.225.24.43

188.225.25.249

92.53.107.138

188.225.25.108

188.225.25.250

92.53.107.170

188.225.25.109

188.225.25.251

92.53.107.172

188.225.25.110

188.225.25.252

92.53.107.205

188.225.25.111

188.225.25.253

92.53.107.206

188.225.25.117

188.225.25.254

92.53.107.207

79Appendix – 2
RIG 4.0 Referrers
carlosmoles.club

fullmusculo.com

aluminiobalear.club

www.tedigocomosehace.com

fincalaleyenda.club

www.collegemagazine.com

188.225.57.186

superauto.es

188.225.57.189

www.cagliaricontainersagency.com

176.57.214.214

cagliaricontainersagency.com

188.225.57.188

www.canvascamp.us

188.225.57.196

www.clicktripz.com

188.225.33.250

totallythebomb.com

digitaldsp.com

cannabis.com

www.hitcpm.com

aga.grandparents.com

h8vzwpv.com

roomkey.com

recusticks.co

freedomdaily.com

0gctp5ht.top

www.warpedspeed.com

lowestpriceforall.gdn

profitablesoft.top

putrr18.com

earndoublecoin.top

v3rjvtt.com

investingtodayfix.top

lie2anyone.com

mymoneyfixing.top

deloton.com

myearnmoneybin.top

ajkzd9h.com

wowmoney.top

freksxx.c0m.li

link.tl

www.ebaumsworld.com

images.futbolbase.us

www.opentable.com

services.myspservices.com

www.theverge.com

www.imgsky.net

gfycat.com

kstate.ru

www.horoscope.com

sexnn1.c0m.li

www.hometalk.com

185.223.31.126

www.scribd.com

www.makeuseof.com

www.infowars.com

www.nerdwallet.com

www.grunge.com

diseasecalleddebt.com

80

www.eater.com

8teenxxx.mywifibaby.com

www.miamiherald.com

bigtitsgalleriesfree.biz

www.mendeley.com

pornoteenxxx.net

www.arduino.cc

www.fresh-galleries.com

www.google.co.id

ukrainemodels.ru

popmog.com

ateen.space

185.223.31.126

www.browsebitches.com

www.makeuseof.com

firsttimelesbianxxx.com

www.nerdwallet.com

nudismpage.com

diseasecalleddebt.com

hugeboobsgirl.com

www.eater.com
findagrave.com
www.google.co.id
www.mendeley.com
www.clickondetroit.com
www.ridgewallet.com
videonabludenn.top
lowestpriceforall.gdn
jebadu.com
newsbusters.org
mktogel008.com
adpays.net
panel.pwrads.com
deloton.com
ah.pe
moradu.com
assets.bro.adca.stthebloginfolife.blogspot.co.il
thebloginfolife.blogspot.tw
thebloginfolife.blogspot.com.es
thebloginfolife.blogspot.com.tr
thebloginfolife.blogspot.it
thebloginfolife.blogspot.fr
thebloginfolife.blogspot.co.uk
thebloginfolife.blogspot.com.br
thebloginfolife.blogspot.ru
thebloginfolife.blogspot.ro81