Author: 360 MeshFire Team royalty: 700RMB (If you don’t agree, come and contribute!) Submission method: Send email to linwei#360.

Author: 360 MeshFire Team

Manuscript fee: 700RMB (If you don’t agree, come and contribute!)

Submission method: Send email to linwei#360.cn, or log in to the web version to contribute online

EPICBANANA, JETPLOW, SCREAMPLOW and other tools exposed by Shadow Brokers in August this year include Cisco ASA series firewall exploit and backdoor attack code, 360 The MeshFire team conducted a complete analysis of the backdoor technology principles and implantation methods of ASA equipment, and focused on studying its memory-type and persistent backdoor, demonstrating the backdoor attack principles and methods of network infrastructure.

0x01 Background

In August this year, Shadow Brokers organization disclosed a large number of hacker tools obtained after hacking NSA on its Twitter Weibo, and placed some of them online for auction. According to Shadow Brokers, these tools originally belonged to the famous hacker team Equation Group. Cisco's official blog also briefly analyzed the backdoor as soon as possible. The following is the research and analysis of vulnerabilities and backdoor modules given by Cisco's official blog. The 360 MeshFire team also conducted in-depth research and complete analysis of leaked files, 0DAY vulnerabilities and implanted backdoors as soon as possible.

In the previous article in this series, we mainly conducted a detailed analysis of the causes and utilization principles for the 0DAY vulnerability (CVE-2016-6366) of Cisco ASA firewall SNMP remote code execution in the EXTRABACON module. For details, see the link: http://bobao.360.cn/learning/detail/3053.html

This vulnerability has enabled the breakthrough of Cisco's network infrastructure and obtained network device administrator rights. How to implant backdoors and implement more hidden backdoor attacks and other attack methods are implemented in the modules of EPICBANANA and JETPLOW. The backdoor module provides more complex and hidden attack methods. We will analyze the backdoor principles and implant methods of ASA devices in detail in this article, and give a simple demonstration of the backdoor connection.

0x02 Introduction to Cisco ASA Backdoor

The leaked file specifically targets Cisco ASA firewall backdoors can be divided into memory type and persistent type. From our analysis, memory backdoors are named BANALRIDE and BANANAGLEE (BG for short), where BANALRIDE only provides basic control functions and some APIs for operating original devices, while BG is more powerful and complex than BANALRIDE; persistent backdoors are divided into JETPLOW and SCREAMPLOW, among which JETPLOW, as an early persistent backdoor, mainly targets PIX firewalls and some ASA devices, and the new version called SCREAMPLOW is an upgraded version of JETPLOW.

During the entire backdoor implantation process, the first thing you need to do is to use the command resolution vulnerability (CVE-2016-6367). The premise of exploitation is that the attacker can successfully log in to the device, log in with a known username and password, or use the vulnerability to modify the login process to achieve direct login in any account name and password (see the first article).

and then execute the epicbanana__2.1.0.1.py script to log in to the ASA system through ssh or telnet, and send payload to the console terminal. The script will construct 15 attack payloads to the console terminal to trigger the command line parsing vulnerability, and write the BANALRIDE backdoor to the ASA memory through memory overflow.

finally uses the bride-1120 connection tool in the directory to connect to the BANALRIDE backdoor. The screenshot of the BANALRIDE backdoor is as follows:

can perform operations including obtaining the system version, releasing, reading and viewing memory, etc. In addition, a BG backdoor with a more comprehensive control interface can be implanted (option 30).

persistent backdoor JETPLOW and SCREAMPLOW also need to be uploaded and implanted with the help of BG. But unfortunately, the leaked file does not contain the real payload of the BG backdoor. Could it be in the Shadow Broker auction transfer file? Even if there is no BG payload, we can still display the main functions of the backdoor by loading the wrong BG file, including reading configuration information, interface information and ARP table information, and more comprehensive reading and writing memory operations. More importantly, we realize modular loading and long-lasting attack backdoor.

0x03 BANALRIDE backdoor analysis

Due to the lack of BANANAGLEE backdoor load, it is impossible to successfully implant the persistent SCREAMPLOW backdoor. We will focus on dynamic analysis of the operating principle of BANALRIDE backdoor load that can achieve a complete connection, and only static analysis of the persistent backdoor SCREAMPLOW. The debugging environment of this article is based on Cisco ASA 5505 model ASA device, and the system image version is asa804-k8.bin.

1. Backdoor Initialization

When BANALRIDE is first implanted, all codes are divided into 14 fragments and distributed discretely in the main process of the ASA network processing main process lina process space. Controlling EIP to jump to the first fragment through shellcode to perform initialization operations. This code block mainly performs two parts of operations:

(1) Decrypting its own code

Since the BANALRIDE code is encrypted and implanted into the lina process, there is a process of decrypting subsequent code at the beginning of the initialization code:

The code at the address 0xddfeb332~0xddfeb33a decrypts the code starting from 0xddfeb33c through XOR, and there are also code snippets that decrypt other address segments in the decrypted code at the first place.

(2) Application memory

All other backdoor codes scattered in the lina process are spliced into the newly applied memory. Since the lina process manages memory through the memory pool method implemented by Cisco, the dynamic application of most memory in the ASA system also depends on the memory pool mechanism. The backdoor did not directly call the memory application function in glibc, but also reuses the memory pool operation function sub_89BCE60 in the lina process to apply for memory. The code is as follows:

records all scattered code snippet addresses in the initialization code, as shown below:

2. Network communication

ASA's processing of all network packets is driven by the lina program. Since the underlying Linux system of ASA cannot recognize the ASA's hardware interface device, it is impossible to complete network data level communication at the Linux system level, nor can it communicate with the system socket, and can only reuse the network communication functions in the lina process space.

(1) The network reception function hijacks

When the backdoor program completes the initialization operation, it will jump to the normal program flow of the ASA system. However, in order to be able to receive the attacker's connection instructions, the network reception function must be enabled. The backdoor connection does not specify a dedicated network port, so it must monitor the data traffic on all ports and filter out the connection instructions.

In the main process of ASA system, the network module uses the callback function sub_8660C30 to process each data packet received from the physical network port when processing data packets. BANALRIDE can hijack this function to make the normal message processing flow jump to its own code and take out the message address from the stack to achieve the purpose of hijacking all traffic through the ASA network port. The code of the HOOK network receiving program is as follows:

where 0x916bbb0 is the ASA system memory copy function, pointing the second parameter to the address to the first parameter to the memory, and the length is controlled by the third parameter. The code segments in the lina process space are changed before and after the code segment is changed, as shown in the figure below: When the

BANALRIDE backdoor is implanted into memory, modifying the code at address 0x08660C93 in the sub_8660C30 function, so that the program flow breaks out of the current function. A jump instruction entering the backdoor code area is written at address 0x80612c1, where 0xC5514B68 is the address where the backdoor code is stored. This address is changed and is dynamically applied from the initialization stage. Finally, a jump instruction to return the normal flow of the sub_8660C30 function after the execution of the BANALRIDE code is written at 0x807bef1. The entire jump process is as follows:

In this flow chart, it can be seen that the life cycle of each run of the BANALRIDE backdoor in memory is from receiving a network message to end processing of the message.

(2) Network sending function:

From the code, you can see the process of multiplexing lina function when BANALRIDE sends network messages to the control terminal. First, call the sub_89BD690 function to create a structure variable describing the data message, the size is 0x60E (1550) bytes, the code is as follows:

The analysis results of the data returned by sub_89BD690 are as follows:

123456789101112131415

struct struct_send_pkt{ char unknown_str1[30]; char mac_src[6]; _WORD type; unknown_str2[4]; struc_send_udp_info *p_send_udp_info; char unknown_str3[728]; char ip_header[20]; char ip_header[20]; char udp_header[8];};

You can see that this structure contains detailed information about the fields of the second and third-layer packet headers of the data packet. Although the sub_89BD690 function applies for a memory space of 1550 bytes, this structure only specifies the data format of the first 820 bytes of this memory segment, and then the rest is filled with the program's customized payload data. Therefore, the parameter transfer to the sub_89BD690 function cannot be less than 820 bytes.

ASA system for the function encapsulation of sending messages is not as simple and clear as system calls in Linux systems. Considering that the layer 2 network destination address needs to be filled in the struc_send_pkt structure, it is necessary to find the next hop address of the message in the ASA routing table:

sub_8778AF0 function finds the next hop IP address pointed to by the first parameter, and stores the result in the address pointed to by the second parameter. The return result is a structure, which offsets 16 bytes from the starting point to the next hop IP, and then uses the sub_84C0200 function to find the corresponding MAC address of the next hop IP in the ARP table, and then calls the sub_84BE670 function to fill the queryed address into struct_send_pkt:

Finally, the constructed struc_send_pkt structure variable is passed to the sub_863FE50 function to construct the complete network message and add it to the send queue:

(3) Transmission communication encryption

BANALRIDE When communicating with the control terminal network, the Diffie-Hellman algorithm is used to negotiate the key in the session stage. In the subsequent communication, all data is encrypted using this key for AES algorithm.When receiving the control command, the session will be determined first. The code is as follows:

If the session already exists, the connection quadruple information with the previously established session will be judged. If the session has not been established, first determine whether the first character of the receiving payload is A8, which means whether the control instruction is A8, indicating whether a new session is established. The code is as follows:

BANALRIDE will perform integrity verification on the received payload. The specific method is to calculate and compare the checksum of the last two bytes of the payload. After verification is passed, the encryption key is calculated and returned to the control terminal:

calculation checksum processing flow is shown in the figure below:

0x04 SCREAMPLOW Persistence Backdoor Analysis

In Section 2, we introduce SCREAMPLOW As a persistence backdoor, it is actually JETPLOW In the upgraded version, the backdoor program is in the BANANAGLEE\BG3121\Install\LP directory. After connecting the BG memory backdoor UDP500 port through the BPICKER-3100 tool, the relevant payload module is loaded and implanted into the target device. BPICKER-3100 is a new version of writeScreamingPlow and writeJetPlow. After the SCREAMPLOW planting is successfully maintained, you can also use the lp tool to connect and manage the target.

When BPICKER-3100 successfully establishes a connection with the target, it will receive the ASA system and backdoor version information returned by the target, and then search for files with the name based on platform_name-moduledata-bg_version.tgz format in the current directory, but the leaked files only contain the unique version: asa-moduledata-3101.tgz. This file contains the load and configuration files required to plant SCREAMPLOW.

static code analysis of BPICKER-3100 found that during the implantation process, the pif file under the asa directory in the asa directory in the asa-moduledata-3101.tgz file will be decrypted. The decryption key is written into the BPICKER-3100 program through hard code. The stored procedure only does XOR encryption once. The relevant code for obtaining the key is as follows:

The plaintext key after decryption is: my hovercraft is full of eels.Then decrypt all pif files, the command is as follows:

Decrypted pif file part content is as follows:

This XML file describes Cisco ASA with SCREAMPLOW backdoor infection target ROMMON version 1.0(12)6 The 5505 model device, and the original BIOS image file before infection is stored in bin/asa5505/asa5505_10126_bios_sectors1-E_clean.bin, through this XML file, you can roughly understand the code area in the BIOS memory of the backdoor implanted in the ASA, as shown in the figure below:

SCREAMPLOW backdoor is persisted by infecting the BIOS process space. Since the BIOS code in the memory of the Cisco ASA device is not reloaded from the file after executing the reload command, the backdoor cannot be completely cleared by reload restarting.

0x05 Implementing traffic backdoors through BANALRIDE

is a very important link for network device backdoor attacks. Among them, BANANAGLEE is the core backdoor module to provide relevant functional interfaces. However, due to the lack of BANANAGLEE payload, it cannot be actually studied and tested. However, we found that the currently leaked BANALRIDE backdoor already has most of the network backdoor functions of BG. It can be understood that it is a memory pony and BG is a memory pony. If some codes in BANALRIDE are appropriately modified to achieve complete traffic monitoring and redirect functions, the core functions of backdoor attacks will be realized. In the following example, we reproduce the traffic monitoring of HTTP messages through BANALRIDE and redirect them to the device file.

Since the BANALRIDE backdoor hijacks all traffic on the underlying network of the ASA device, it is possible to set filtering rules and filter out the data of interest. For example, you can listen to all HTTP messages flowing through the ASA physical network port and output the message to the text through the file output function sub_8074498. The result is shown in the figure below:

can fully utilize your imagination and send the intercepted data traffic mirror to the IP specified by the attacker in conjunction with the packet sending function function in lina mentioned in the previous section to send the intercepted data traffic image to the IP specified by the attacker, that is, to realize the traffic redirection function.

0x06 Conclusion

Based on this in-depth analysis of the Cisco ASA firewall backdoor, it can be seen that the attack programs against network infrastructure have reached a relatively high engineering implementation and have achieved the adaptation of multiple versions on the entire platform. From the perspective of R&D and implantation costs, relatively high technical thresholds are required.

1. The underlying layer of the ASA system is a Linux system, but it cannot penetrate through traditional Linux system methods. The data communication interface used by ASA device network communication is driven by the lina process, and the processing of all network messages is also implemented through the lina program. The underlying Linux system cannot recognize the network interface of the ASA data plane. Therefore, in the entire backdoor code, any Linux system calls including socket programs cannot be used to realize the core network functions of the backdoor. All backdoor behaviors, including encryption and decryption, memory management, network communication, etc., are reused the function pointers in the main ASA process lina. BANALRIDE listens for all traffic in the ASA system and filters out control commands from it.

2. By analyzing the calling functions in the code, it can be inferred that the backdoor R&D organization is very familiar with the ASA system and internal function calling functions. We found that the reverse ASA system in IDA contains nearly 40,000 functions, and the function addresses of each version of the system are different. If the functions required during the attack are obtained only through reverse methods, the workload is huge. It is not ruled out that the backdoor R&D organizations have more sufficient technical data for the ASA system to support their R&D.

3. The back door implanted by ASA devices is very concealed. First of all, the backdoor implantation does not open any TCP or UDP network monitoring ports on the network device. It relies entirely on the ASA underlying network reception function to monitor communication traffic on all physical ports and filter out connection instructions. Backdoor discovery cannot be done through network detection. In addition, the backdoor connection adopts a custom network protocol, and the connection is allowed after the D-H algorithm is used to negotiate the key verification. The communication process is also encrypted using the negotiated key, making it difficult to detect attacks through traditional IDS or IPS. Therefore, if you want to accurately detect the backdoor, you must construct network data packets according to the backdoor communication protocol and obtain feedback from the real backdoor to realize the detection of the backdoor.

4. The back doors of ASA equipment implantation are engineered and professional. Judging from the leaked file directory, the backdoor R&D organization has the full platform adaptability and modular backdoor loading capabilities for network infrastructure equipment. The entire backdoor attack program can be used as a network infrastructure attack framework. It only needs to explore new 0DAY vulnerabilities to facilitate expansion and use of existing attack payloads. The file contains multiple backdoor programs for network equipment. These programs have Rootkit capabilities and have encryption and anti-analysis capabilities.Especially when the target of the attack is an inconvenient network facility that is inconvenient to restart and upgrade, its persistent backdoor may not be completely cleared even after upgrading. This is a great challenge for security defense and detection parties. Firmware integrity verification for network equipment, memory integrity verification of network equipment, and supply chain security of firmware will become increasingly important.