Craig Lightning The Moth Trojan

The Moth Trojan
Paul Craig
Security-Assessment.com
© 2008 Security-Assessment.com
Who Am I?
Paul Craig, Principal Security Consultant
y
Security-Assessment.com
Myy Role
Application Penetration Tester
Published Security Author
Active Security Researcher
Devoted Hacker
Feedback?
Email: [email protected]
Just buy me a beer!
The Moth Trojan
The Moth Trojan
Idea: I Have Always Wanted My Own Trojan.

Hollywood hacker style.
In the theme of Hackers, War-Games, Sword-Fish.
Somethingg AMAZING.
But Somehow I never got around to it…
The Moth Trojan
“It Has To Be Done

Done.””
Goal: Write a 100% Undetectable Trojan.
Workk under
d both
b h Vista and
d XP.
Contain “Ninja Magic”.

Something Original
Completely New!
Without Further Delay

I Present To You:
Th M
The Moth
th T
Trojan
j
KIWICON EXCLUSIVE RELEASE
The Moth Trojan
Screw Anti
Anti-Virus,
Virus Call A Priest!
“Help, my computer is suffering from demonic possession.”
Welcome to the Moth.

Verbally abusive Trojan.
Abusive, Abrasive, Mocking.
Choice!
So The Big Question

What is the Moth?
Additional learning is required to understand…
Delve into some lesser known Windows functionality.
The Moth Trojan
Windows Management Instrumentation (WMI)

Extension to the Windows Driver Model. (WDM)
Provides
d an interface
f ffor components to send
d notifications
f to
other components.
WMI is Microsoft's implementation of WBEM.

Web
W b Based
B d Enterprise
E t i Management.
M t
WMI Has Eventing capabilities

WMI Events raised when ANYTHING happens in Windows.
WMI can notify
tif an Event
E t Subscriber
S b ib for f any raised
i d event.
t
WMI Query Language (WQL) is used to drive event queries.
The Moth Trojan
Event Subscribers Are Written in Managed Object Format

Supported under XP, Vista+
Compiled event subscribers are included into the CIM repository.

Common Information Model
%SystemRoot%\System32\WBEM\
Event Consumers Subscribe To WMI Events.

Events can originate from many places
From an Event Provider Component.
Disk
Di k Q
Quota
t PProvider.
id
Power Management Provider.
Event Log Provider.
The Moth Trojan
Extrinsic Events
(being outside a thing; outward or external; operating or coming from without)
Predefined events that cannot be linked directly to change.

Example: An event that describes a computer switching to
stand-by mode.
Intrinsic Events
((belonging
g g to a thing
g byy its veryy nature))
Event that occurs in response to a change.

Standard WMI events raised when anything happens.
Creating a Win32_LogicalDisk will raise a
__InstanceCreationEvent event.
The Moth Trojan
To Put It Simply:
When you do anything in Windows, you create a WMI event.
These
h events can be
b subscribed
b b d to using an event consumer.
WMI will forward any raised event to the associated consumer.
Temporary Event Consumer.

Only function when specifically loaded by a user.
Will not survive a reboot.
Permanent Event Consumer.

Permanent, will survive a reboot.
Works along as WMI is running.
Windows Permits 1,000

1 000 Event Consumers Per User Account.
Account
The Moth Trojan
Default Windows Event Consumer Classes.

Classes
5 predefined event consumer classes.
ActiveScriptEventConsumer Execute a predefined script in an arbitrary scripting

language
g g when an event is delivered.
LogFileEventConsumer Write customized strings to a text log file when an
event is delivered.
NTEventLogEventConsumer Log a message to the Windows NT event log when
an event is delivered.
SMTPEventConsumer Sends an e-mail message using SMTP each time
an event is delivered.
CommandLineEventConsumer Launch an arbitrary process in the local system
context when an event is delivered.
The Moth Trojan
So Back To My Original Point - What is The Moth Trojan
Malicious
l Managed
d Object
b Format Code
d
Multiple, malicious, persistent, ActiveScript event consumers.
100% VBScript/WQL
Consumes __InstanceCreationEvent.
Subscribes to events created when you run specific executables.
Implements Microsoft Text To Speech ActiveX control

control.
VBScript is executed as the user SYSTEM.
Works on Vista.
Executed as NETWORK_SERVICE.
SeImpersonate privileges available.
Example:
The Moth Trojan
Installing The Moth

Installing the Moth REQUIRES Administrative authority.
WMI is a core component off Windows.
d
The Moth Trojan becomes a CORE component of Windows.
Install from MOF File: Mofcomp.exe mothtrojan.mof
The Moth Trojan
Writing Files To Disk.

Disk
The Moth can be used to drop and execute files.
Arbitrary
b executables
bl embedded
b dd d in VBScript.
Excellent method of re-deployment.
Used in conjunction with your favourite rootkit.
The Moth Trojan
Moth Trojan is a Unique Method of Hiding Malicious Code.

Code
AFAIK the first malicious event subscriber, ever.
Using functionality
f l unknown
k by
b most people.
l
Application
pp Level Trojan.
j
Typical Trojan technique is “Getting Low”
Manipulate API calls, Kernel calls, Hardware calls.
My Approach Is the Complete Opposite!

Get as High as Possible!
Hide malicious code within native Windows functionality.
VBScript!
The Moth Trojan
Is It Really Undetectable?
You CAN detect the Moth Trojan. /
Requires WMI Administrator
d tools.
l
WMI console application.
Enumerate all event consumers.
You Need To Know Where To Look.

Uses relatively unknown functionality.
Forensic methodology does not focus on WMI!
Who knew About CIM/WBEM/WMI this morning?
The Moth Trojan
What Else Can You Do With MOF?

A Trojan which is launched when user Joe logs in.
Removedd when
h the
h user Admin
d logs
l in.
Speed
p Trojan:
j
Activates when the CPU fan slows below 100 RPM.
Worst Day Trojan:
Lay dormant until twenty bad sectors are reported in the
hard drive.
Infect Your Friends
Copy
py malicious files to anyy USB keyy inserted.
Rootkit Dropper & Executor
Re
Re-deploy
deploy an existing rootkit whenever it is removed
removed.
The Moth Trojan
Source Code:
Currently Unpublished Source Code:
h
http://ha.cked.net/moth.zip
//h k d / h
Includes MS Text To Speech API

Craig Lightning The Moth Trojan

Uploaded by

Copyright:

Available Formats

Craig Lightning The Moth Trojan

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Craig Lightning The Moth Trojan

Uploaded by

Copyright:

Available Formats

The Moth Trojan

 The Moth Trojan

 Idea: I Have Always Wanted My Own Trojan.

 But Somehow I never got around to it…

 “It Has To Be Done

 Contain “Ninja Magic”.

 Without Further Delay

KIWICON EXCLUSIVE RELEASE

 Welcome to the Moth.

 So The Big Question

 Windows Management Instrumentation (WMI)

 WMI is Microsoft's implementation of WBEM.

 WMI Has Eventing capabilities

 Event Subscribers Are Written in Managed Object Format

 Compiled event subscribers are included into the CIM repository.

 Event Consumers Subscribe To WMI Events.

 Predefined events that cannot be linked directly to change.

 Event that occurs in response to a change.

 Temporary Event Consumer.

 Permanent Event Consumer.

 Windows Permits 1,000

 Default Windows Event Consumer Classes.

ActiveScriptEventConsumer Execute a predefined script in an arbitrary scripting

 So Back To My Original Point - What is The Moth Trojan

 Implements Microsoft Text To Speech ActiveX control

 Installing The Moth

 Install from MOF File: Mofcomp.exe mothtrojan.mof

 Writing Files To Disk.

 Moth Trojan is a Unique Method of Hiding Malicious Code.

 My Approach Is the Complete Opposite!

 You Need To Know Where To Look.

 What Else Can You Do With MOF?

 Includes MS Text To Speech API

You might also like

The Moth Trojan

Idea: I Have Always Wanted My Own Trojan.

But Somehow I never got around to it…

“It Has To Be Done

Contain “Ninja Magic”.

Without Further Delay

Welcome to the Moth.

So The Big Question

Windows Management Instrumentation (WMI)

WMI is Microsoft's implementation of WBEM.

WMI Has Eventing capabilities

Event Subscribers Are Written in Managed Object Format

Compiled event subscribers are included into the CIM repository.

Event Consumers Subscribe To WMI Events.

Predefined events that cannot be linked directly to change.

Event that occurs in response to a change.

Temporary Event Consumer.

Permanent Event Consumer.

Windows Permits 1,000

Default Windows Event Consumer Classes.

So Back To My Original Point - What is The Moth Trojan

Implements Microsoft Text To Speech ActiveX control

Installing The Moth

Install from MOF File: Mofcomp.exe mothtrojan.mof

Writing Files To Disk.

Moth Trojan is a Unique Method of Hiding Malicious Code.

My Approach Is the Complete Opposite!

You Need To Know Where To Look.

What Else Can You Do With MOF?

Includes MS Text To Speech API