Analysing a Firefox Malware browserassist.dll - FLARE-On 2018

This is another challenge of the FLARE-On 2018 CTF. This challenge is about analysing the functionality of a Firefox malware, but I got really lucky :D
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#MalwareAnalysis #ReverseEngineering #CTF

[@liteoner]

5:48 when a Mac/Linux user first encounters modern IE

[@PwnFunction]

LOL

[@firefish111]

I send a smile, not a frown.

[@liteoner]

@@Anti-i25 Microsoft does this in many products, including Office

[@TimLF]

Firefox had the smile feature for a long time...

[@k1ngjulien_]

windows users too, noone opens IE on purpose :D

[@Hans5958]

Linux user being paranoid on Internet Explorer

[@kirschitz64]

stop WINEing

[@a8552bc]

@@kirschitz64 isn’t that the apt package that lets you execute windows programs?

[@zombie_pigdragon]

@@a8552bc Yes, though it's just a program, not an apt package (apt does package it though).

[@gersomwastaken]

:eyes:

[@aumpalosa]

Man, I don't know, but something in the way you explain things, the way you organize your thoughts, or maybe the way you confidently talk, makes your videos fun to watch. Not to mention the actual great information that you learn from them. Keep it up. You are really up for something great.

[@CarlvanEijk]

man, I was thinking exactly the same thing!!

[@bumbixp]

The funniest thing about that IE smiley is the keyboard shortcut for sending a frowny face.

[@rootabeta9015]

5:51 LiveOverflow: "Is this a virus?"

[@sashimisub8536]

Lol

[@cy8berpunk831]

"I decided to approach it again with logic" 😂👍

[@chylex]

Maybe it was an NPAPI plugin, those stopped being supported in FF 52.

[@oisins.6066]

All new addons have to use the WebExtensionsApi now, which is quite limiting in some ways, so they probably wrote the addon on the old api

[@samfoxman7046]

For some reason, the malware prevents itself from running if firefox is newer than version 55. Probably, the developers wanted to make the challenge more difficult.

[@richardp7412]

It would be amazing if you started a 0 to hero series explaining the basics of reverse engineering malware, as someone who also enjoys malware I find your videos fascinating but I would always love to learn more from you.

[@TB-tv2zf]

Vouch

[@martysh1226]

a bit late, but check out his binary exploitation videos. this should get you started.

[@anishagrawal7068]

ur videos are amazingggg!!Thanks for bringing such quality content

[@zecekobold2140]

Well... This is neat. Not entirely sure why youtube decided this is my jam, but I do appreciate a good explanation and seeing someone put a lot of effort towards something.

[@adfadff6361]

There is a function to get version of ur firefox in that .dll file. Btw, ur way to solve this challenge is awesomeeeee =]] i never imagine u can solve this challenge in ur way =]]]] amazing video

[@zanidd]

wow, didn't know about flare vm! Might get into analysing malware soon as well! thanks for the great video, as always!

[@MasterNoxob]

your content is great, looking forward to see the next one!

[@alfoncejean8826]

6:00 *open IE *see the smile thing *OK this actually exist!

[@lonelycount1]

I dont understand shit here but i feel a lot smarter now, thanks @LiveOverflow.

[@abgehn7869]

This video gave me the missing clue to solve my first CTF (a different one of course) on my own! Thanks a lot! :D

[@mistsu1171]

I watch this video with no knowledge of hacking, but I really feel entertained and educated by your content ;'3

[@TymoteuszCzech]

12:37 laughed my head off :D

[@user-vn7ce5ig1z]

Sadly, he's right. Adults ain't got time for solving problems and enjoying the challenge of it; we've got stuff to get done!

[@kiritsu9582]

i have little to no idea what youre talking about but im loving every second of it

[@Zooiest]

You can try shutdown -a when you boot the VM. Also Ctrl + Alt + Del when shutting down and opening task manager from there actually interrupts the shutdown... I found the last one myself testing the very combination on shutdown

[@justfaysou738]

This is very complex but interesting, ty for your contents

[@RobinObinray]

Ty😠 LEECHERS!!!!!

[@asafcohen3562]

This not that complicated look at his other stuff

[@kisame_5331]

I love your work!

[@vergil9397]

Wow your analysis skill is so good bro

[@IAMFeelings]

I don't understand most of the things you say but I'm sitting here enjoying your videos hoping one day I do understand.

[@KidJV]

you deserve more subscribers. subscribed!

[@HugeDisgrace]

Holy shit that was awesome. There is so much out there that i don't know!

[@strategyoracle]

What was the mechanism by which the browserassist.dll got loaded into the Firefox process? Did I miss something?

[@LiveOverflow]

I have no clue 🤷‍♀️

[@strategyoracle]

@@LiveOverflow SPOILER ALERT: blog.attify.com/flare-on-5-writeup-part2/ "This method adds browserassist.dll to the AppInit_DLLs registry key. The AppInit_DLLs are a set of Dynamic Linked Libraries (DLL) that are loaded upon startup into the address space of every executable that links with user32.dll. Essentially, this means everytime a GUI application is run, browserassist.dll"

[@kathipaw]

It's like LD_PRELOAD on Linux, just using the registry :)

[@kathipaw]

@@tripplefives1402 I was saying that it's the same principle. It both instructs the dynamic linker to load certain modules, no matter the scope

[@yellowcrescent]

@@tripplefives1402 There is a similar feature on Linux that works globally-- /etc/ld.so.preload -- I've seen Linux malware utilize this to hide themselves from process and file listings.

[@longcat666]

I love this chall, because like in real case technique at banking malware, it will injection with external dll, which means it hooking the PR_Write function and this only work at old firefox version, CMIIW

[@amrojjeh]

Microsoft does the smiley thing with ALL of their windows products (And some open source ones too) as far as I am aware.

[@citroenboter]

Ye I think I saw it in Excel as well. It kind of tickled my virey-sense but apparently it belongs there.

[@Broughman9]

Really enjoy your videos despite not really getting everything. Guess I need to start learning c#, .net etc. I follow along but I would really get stuck if it was me doing the task.

[@mal-nr3ym]

firefox changed the way they deal with addons in quantum, including dropping support for (i believe) dll/native code based plugins (java, flash, etc.)

[@Retrovergo]

Great Job man

[@cocosloan3748]

Congrats ! You are one smart puppy :)

[@stephanodennielpineda6414]

Nice content! Kudos

[@TheoParis]

This was really interesting!

[@kbhasi]

4:45 Oh wow, the old Office 2003 UI kit thing. -5:57-- That was there since Windows 8, and I believe Internet Explorer is still in Windows 10 only for backward compatibility with older applications that use the Trident engine (which IE uses) in order to render Web content.- 6:15

[@Mindflayer86]

6:45 Hmm. First thing which came to my mind after I heared that the challenge surrounds around a Firefox maleware was: "Better use an older firefox version for the analysis. They might have patched something"

[@danielkrajnik3817]

this is such a great content!

[@OthmanAlikhan]

Thanks for the video =)

[@m42d]

I got such a nostalgic feeling when you opened PEid.

[@itscarve]

I'm sure you're busy.. but... You should totally still make your handwriting into a font ❤

[@JonJon2040]

I think that if you find what is the vulnerability by analyzing the dll, you can search for something like "dll injection Firefox", etc. And you'll see approximately in what version it was fixed.

[@jamesmadlangtuta3156]

Right since every infection has a condition to meet.

[@overratedpancake9034]

That was awesome! I'd love to be able to de this some day, is there a place where I can start learning the basics?

[@FamilienSoelberg]

Flare-on 2018 was so hard. The hardest ever :-0. Took me a month to complete.

[@RogerBarraud]

Impressive :-) Thanks!

[@pavelmisik4303]

Nice video....I love your videos...

[@_crimson1624]

wow! what valuable material 👍👍👍👍

[@RicardoUngureanu]

The installer drops the dll and sets a registry key. My educated guess is that newer Firefox versions does not take that registry key into consideration when loading dlls, whereas the older version does. I solved the entire challenge statically, it was interesting to bypass a few checks and analyze all the dll requests. If I recall correctly, the dll has some checks then it does 2-3 HTTP requests, retrieves some encrypted data and after a few decryption stages and data manipulation it is possible to extract the javascript inserted into the browser alongside the JSON you observed in the stack trace. At this point, I manually injected the javascript code into my browser (after deobfuscation), ran the commands and got the flag. :)

[@ukaszMarianszki]

The registry key is used by all windows software. (iirc user32.dll injects these dlls from the registry) the dll simply checks the firefox version

[@shans2408]

how can you people check a whole pe file statically? :/ I give up if it is longer than two screen-fulls. teach me, sensei!!

[@mimizdani8194]

i am addicted to watching your videos

[@Mochi-kane]

Very Thanks !!

[@jazminakarainy]

idk w a single thing in this video but they are fun to watch

[@syedumararfeen8146]

I'm a simple man. I get notification of LiveOverFlow uploading a video. I watch.

[@syedumararfeen8146]

PS ~ F

[@martinpaul3383]

Same here.

[@blueelvis2698]

As I remember the dll hooking some function to inject the javascript. In newer version of firefox those functions don't exist so it failed :)

[@therealb888]

Damn that’s such a complex challenge! Feeling dumb :( But at least learnt something. Gong to need a few more attempts to learn this well...

[@jamesmadlangtuta3156]

Can you include all the softwares and tools you used there in the vid description? Thanks a lot 😁

[@MoBeigi]

Off the top of my head, maybe using the latest Firefox version matching any datestamp found inside the binaries/strings?

[@Kong_plays]

Dont really understand, but it was interesting :)

[@shersanginov1792]

What are some other websites you guys recommend for challenges like flare-on.com?

[@gcanary562]

overthewire.org, hackthebox.eu

[@user-hv5kk8tb7u]

root-me.org is also great

[@shersanginov1792]

o

[@mugundhanbalaji]

@LiveOverflow you might already know this, to solve complicated key comparisons/generation, we can use Z3

[@LiveOverflow]

modelling this in z3 would have taken the at elast the sameamount or longer ;) Also: kzbin.info/www/bejne/iqHHdaRra7B7Z6s

[@mugundhanbalaji]

@@LiveOverflow ok, i was practicing z3 this week, totally forgot about that video, thanks again

[@mircoheitmann]

what would we do if the web shell didn't have sl

[@RobinObinray]

Google for solutions?

[@Calumg89]

Could you have just set the model root to 1 and bypassed the need for reversing the password, or did the dll inject the extra stuff after the password was right?

[@AmaroqStarwind]

I like puzzles. I want to obfuscate a whole bunch of code that, when deobfuscated, literally just congratulations you for solving the puzzle.

[@LKD70]

The smiley face got me LOL

[@dan-garden]

yeah boiii

[@glennv.merkel3020]

i love ur channel bro :P

[@derrickberg2825]

Do you have a Discord channel? You should definitely make one!

[@ducphanduy534]

I don't recall the exact details of the code but the DLL does do version check of Firefox. If I recall correctly, it's any version before or equals to 40 that works. After the check, the DLL downloads the encrypted javascript from a pastebin and decrypts it.

[@cone16v]

1001000 1101111 1110100 1100101 1101100 111111 100000 1010100 1110010 1101001 1110110 1100001 1100111 1101111

[@Menaceirl]

Would you please make a video (or post) at least listing all the software you use? (and preferably what you find them most useful for)

[@djrick1999]

Heard on some other video that an older version of firefox had an java injection leak

[@beratbikiri]

Savage!

[@videosambo01]

Umm is this normal on ie because i have some kind of smiley in ie and avast or malvare bytes does not reconize it?

[@Masterrunescapeer]

@LiveOverflow doesn't work in newer FF as web extensions don't allow JS injection (from FF Quantom on-wards). Was actually one of the big motivations of why we moved over. Too bad FF Quantum messed up multiple tab handler, it is annoying. We're finally getting it backed in.

[@TheActualTed]

Can someone explain the part of code with XOR statement? I thought ^ is the symbol for AND / conjuction and don't really understand how it works.

[@LiveOverflow]

In programming languges ^ is often XOR. It doesn’t follow the mathematical logic notation. An AND would be &&

[@no-trick-pony]

It depends on the programming language - in JavaScript ^ is the XOR operator (as it's in many other languages). XOR is just another logical operator like AND/OR/NOT and is the "either/or"-function. Look up the truth table for it. ^^ It is a very intersting function, because its inverse is XOR too. So, if you XOR two bits and get a third one, you can XOR this third one with any of the other two to retrieve the third one. This concept is very useful and used for RAIDs to duplicate data.

[@270jonp]

I cant speak for the .exe as i skipped that during my run. However there was no easy way to figure out the version needed for the .dll other than realizing that it must have been patched. Personally I found twitter to be fairly useful and not really giving away anything.

[@somedudeonyoutubefrfr]

Hallöle ^^ Ich interessiere mich schon seit einigen Jahren für das Thema... Nun, da ich jetzt weiß, dass man "einfach" an solchen CTF's teilnehmen kann: Könntest du mir "Beginner"-CTF's vorschlagen, um in das Thema noch besser rein zu kommen? Mit freundlichen Grüßen, R00T

[@ErikUden]

I could imagine someone just had the old Firefox because he didn't use a virtual machine as advised.

[@Android480]

This stuff looks really fun, but totally out of my skill level at the moment. Do you have / know of any places to find beginner reverse engineering challenges?

[@Kenny-xz4gw]

vulnhub.com hackthebox.eu are good places to start. Helps to know basic linux commands and a little kali knowledge.

[@xseman]

So if you update your Firefox because of some vulnerability, the old injected code may work on the latest version? It sounds like the upgrade should clear the cache every time you upgrade.

[@Mxmnt]

bit late, but laughed that it uses ConfuserEx to obfuscate the application. Easy to tell by the "ConfusedByAttribute" as well as the decrypting, decompressing method. Also, dnspy is a lot better for reversing .NET applications. It has a clean GUI, stable, gets updated a bit, a IL Viewer; which can be handy in removing anti-debugging calls, such as CheckRemoteDebuggerPresentEx, and more functionality.

[@spruhspruhknallbummmann9724]

Hey, ich studiere auch an der TU und wollte fragen ob du bei der IT-Sicherheits AG? Jeden Dienstag im TEL-Gebäude. Ich glaube die AG heißt Enoflag. Wäre richtig cool dich zu sehen :D

[@mirteb.1788]

So is this exploit for Firefox universally, like on Linux or Mac. Cuz I'm worried now

[@mirteb.1788]

Nvm probably not

[@LiveOverflow]

no, it's a malware.

[@Janrupf]

Well, I think it would be possible todo this on other platforms too, however, its not very likely to happen: 1. It was a Windows only Software 2. Its not that easy (for an application, ofcourse there are the PRELOAD variables on Mac and Linux) to inject some code into firefox 3. Looks like that has been patched in firefox or at least the injection doesn't work anymore. Still, it is possible

[@LiveOverflow]

There is nothing firefox can do to prevent this. The reason why it doesn’t work in a newer firefox versions are certainly just compatibility issues. The malware was not written to support these changes.

[@grave0x]

@@LiveOverflow exactly. Firefox still loads user32.dll which is the injection point

[@0x90meansnop8]

Klasse Video

[@kamilgowacki568]

5:16 >this entry point It must be encrypted

[@BarryMcCock]

What is your current computer setup?

[@engineeringsolutions9585]

I have been stuck on flare on challenge 2 of 2019 for a long period of time Kindly help Anyone ?

[@asailijhijr]

Does the requirement for the older version relate to Firefox x64 vs x86 ?

[@Ivo--]

Hi, I recommend the OALabs youtube channel for some great video tutorials on RE!

[@rootroot5693]

bro can you give us a link to download your youtube videos for those who have bad network bandwith

[@melihcelik9797]

Can someone explain why the dll was loaded to Firefox's memory map? I mean surely firefox did not request that dll and that dll wasn't even in the firefox folder. How does it get loaded with firefox?

[@neontiger2007]

JAJJAAJAJAJAJ 11:21 "Awghh... F!" so funny. I'm just discovering your videos! All of these things you explain are amazing! Even to devs like with some years on the back! :D Super pedagogical, fun, talking pretty advanced shit (I come from the XSS video series you made, so rad) looks like a pretty deserved subscribe, that material must be assimilated by my mind. Greetings from Argentina!

[@vamshipapani1563]

Great Video!!Very Helpful!! Can you'll help me with ".werd" file extension. All my file are encrypted. Is it possible to decrypt the files.

[@seanscon]

bruteforce all the versions ?

[@elihillman8758]

Me, a Firefox user: *I'm in danger*

[@DMWatchesYoutube]

Doesn't that mean you could use older versions of Firefox to mess with the newer versions?

[@redd_cat]

A reminder that IE is not broken per se. It's designed like that.

[@Napert]

0:18 bruh so I'm vulnerable to attacks and malware just because I want to be private on the internet?

[@dnetne5508]

oh wow

[@evertchin]

which also beg an important question, should browser update also invalidate the cache

[@cone16v]

1001000 1101111 1110100 1100101 1101100 111111 100000 1010100 1110010 1101001 1110110 1100001 1100111 1101111

[@HorochovPL]

Has somebody checked how does it affect other browsers, or just everybody went mozilla-hint way?

[@eventhorizon8014]

10:00 'su' doesnt mean switch user, it means super user (root). The Linux command which switches to the root user. That's why sudo runs a command as root (super user do).

[@qwertyqwerty-jp8pr]

Yes but su can switch to other user too. It doesn't need to be root

[@qwertyqwerty-jp8pr]

Also, su stands for substitute user