{"id":609002,"date":"2023-02-17T07:49:03","date_gmt":"2023-02-17T13:49:03","guid":{"rendered":"https:\/\/news.sellorbuyhomefast.com\/index.php\/2023\/02\/17\/new-malware-abuses-microsoft-iis-feature-to-establish-backdoor\/"},"modified":"2023-02-17T07:49:03","modified_gmt":"2023-02-17T13:49:03","slug":"new-malware-abuses-microsoft-iis-feature-to-establish-backdoor","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2023\/02\/17\/new-malware-abuses-microsoft-iis-feature-to-establish-backdoor\/","title":{"rendered":"New Malware Abuses Microsoft IIS Feature to Establish Backdoor"},"content":{"rendered":"
<\/a><\/p>\n
\n
<\/p>\n
<\/picture><\/figure>\n

Threat Hunter Team<\/span>Symantec<\/span><\/p>\n

<\/app-author><\/div>\n

\n

<\/p>\n

\n

Symantec, by Broadcom Software<\/a>, has observed a new malware that abuses a feature of Microsoft\u2019s Internet Information Services (IIS) to deploy a backdoor onto targeted systems.<\/p>\n

The malware, dubbed Frebniis (Backdoor.Frebniis), was used by a currently unknown threat actor against targets in Taiwan.<\/p>\n

The technique used by Frebniis involves injecting malicious code into the memory of a DLL file (iisfreb.dll) related to an IIS feature used to troubleshoot and analyze failed web page requests. This allows the malware to stealthily monitor all HTTP requests and recognize specially formatted HTTP requests sent by the attacker, allowing for remote code execution. In order to use this technique, an attacker needs to gain access to the Windows system running the IIS server by some other means. In this particular case, it is unclear how this access was achieved.<\/p>\n

Failed Request Event Buffering<\/h2>\n

IIS is a general-purpose web server that runs on Windows systems to serve requested HTML pages or files. An IIS web server accepts requests from remote client computers and returns the appropriate response. IIS has a feature known as Failed Request Event Buffering (FREB) that collects data and details about requests, such as originating IP address and port, HTTP headers with cookies, etc.<\/p>\n

A feature called Failed Request Tracing can be used to troubleshoot IIS failed requests. Failed Request Tracing buffers the trace events for a request and flushes them to disk if the request meets the definition of \u201cfail\u201d set by the user. Failed request tracing can, for example, be used to learn why requests are returning a specific HTTP status code (401 or 404, etc.), or why a request is taking too long to process, or is not responding.<\/p>\n

Stealth Code Hijacking of IIS<\/h2>\n

Frebniis ensures Failed Request Tracing is enabled and then accesses w3wp.exe (IIS) process memory, obtaining the address of where the Failed Request Event Buffering code (iisfreb.dll) is loaded.\u00a0 With this code start address, Frebniis searches from there for a function pointer table to hijack code execution.<\/p>\n

The authors of Frebniis have determined that a particular function pointer within iisfreb.dll is called by iiscore.dll whenever any HTTP request is made to IIS from a web client. This function normally checks if the content of the HTTP request matches the Failed Request Tracing rules.\u00a0<\/p>\n<\/div>\n

<\/app-paragraph-rte><\/span><\/p>\n

\n
\"Figure<\/picture>
Figure 1. Function pointer table used to hijack execution<\/figcaption><\/figure>\n<\/div>\n

<\/app-paragraph-image-inline><\/span><\/p>\n

Frebniis hijacks this function by injecting its own malicious code into IIS process memory and then replacing this function pointer with the address of its own malicious code. This hijack point allows Frebniis to stealthily receive and inspect every HTTP request to the IIS server before returning to the original function.<\/p>\n

<\/app-paragraph-rte><\/span><\/p>\n

\n
\"Figure<\/picture>
Figure 2. After running its own malicious code, Frebniis jumps back to the original function<\/figcaption><\/figure>\n<\/div>\n

<\/app-paragraph-image-inline><\/span><\/p>\n

\n

The Frebniis malicious injected code parses all received HTTP POST requests for \/logon.aspx or \/default.aspx along with a parameter password set to \u20187ux4398!\u2019. If the password matches, Frebniis decrypts and executes a section of the injected code, which is .NET executable code consisting of the main backdoor functionality. No executables are saved to disk in this process, keeping the backdoor completely stealthy.<\/p>\n

The .NET code provides proxying functionality and remote code execution controlled by a provided second HTTP parameter that is a Base64 encoded string.<\/p>\n

To enable the proxy, the encoded string is Base64 decoded and then decrypted (xor 0x08), with the first character representing a proxy command followed by expected parameters. The proxy is used to send and receive Base64 encoded data from other computer systems. This allows the attackers to communicate with internal resources that may normally be blocked from the internet via the compromised IIS server.<\/p>\n<\/div>\n

<\/app-paragraph-rte><\/span><\/p>\n

\n\n\n\n\n\n\n\n\n
Table 1. Frebniis commands \u2013 the function names have been misspelled by the malware author <\/caption>\n
Command<\/th>\n Function name<\/th>\n Parameter<\/th>\n Description<\/th>\n<\/tr>\n<\/thead>\n
1 <\/td>\n \tCreateConnect <\/td>\n \tHost:Port <\/td>\n Connect to a remote system for proxying, returns a UUID representing the remote system <\/td>\n<\/tr>\n
2 <\/td>\n \tReadScoket <\/td>\n \tUuid <\/td>\n \tRead a Base64 string from a remote system <\/td>\n<\/tr>\n
3 <\/td>\n \tWritescoket <\/td>\n Uuid, Base64 string <\/td>\n \tWrite a Base64 string to a remote system <\/td>\n<\/tr>\n
4 <\/td>\n \tCloseScoket <\/td>\n \tUuid <\/td>\n \tClose the connection <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

<\/app-paragraph-table><\/span><\/p>\n

The .NET backdoor code also supports remote execution. If an HTTP call to logon.aspx or default.aspx is received without the password parameter, but with the Base64 string, the Base64 string is assumed to be C# code that will be executed straight in memory. The Base64 string is decoded and then decrypted (xor 0x08) and is expected to be an XML document with the C# code to be executed in the \u2018\/doc\u2019 node under the \u2018data\u2019 attribute (E.g. ).\u00a0 The C# code is extracted and executed. This allows Frebniis to stealthily execute arbitrary code on the system.<\/p>\n

<\/app-paragraph-rte><\/span><\/p>\n

\n
\"Figure<\/picture>
Figure 3. Example of how Frebniis is used<\/figcaption><\/figure>\n<\/div>\n

<\/app-paragraph-image-inline><\/span><\/p>\n

\n

By hijacking and modifying IIS web server code, Frebniis is able to intercept the regular flow of HTTP request handling and look for specially formatted HTTP requests. These requests allow remote code execution and proxying to internal systems in a stealthy manner. No files or suspicious processes will be running on the system, making Frebniis a relatively unique and rare type of HTTP backdoor seen in the wild.<\/p>\n

Protection\/Mitigation<\/h2>\n

For the latest protection updates, please visit the Symantec Protection Bulletin<\/a>.<\/p>\n

Indicators of Compromise<\/h2>\n

If an IOC is malicious and the file available to us, Symantec Endpoint products will detect and block that file.<\/p>\n

6464f9a5da26aa53fb2221255e908fd4da8edf0633f94051beee74a14b9b001c \u2013 Backdoor.Frebniis<\/p>\n

b81c177c440e84635f22dc97b0411de93a24a983a41af676ffbbb4439487aaef \u2013 Backdoor.Frebniis<\/p>\n<\/div>\n

<\/app-paragraph-rte><\/span><\/p>\n

<\/p>\n
\n
<\/picture><\/div>\n
\n
\n

About the Author<\/h2>\n

Threat Hunter Team<\/h3>\n

Symantec<\/h4>\n<\/header>\n

The Threat Hunter Team is a group of security experts within Symantec whose mission is to investigate targeted attacks, drive enhanced protection in Symantec products, and offer analysis that helps customers respond to attacks.<\/p>\n<\/div>\n<\/div>\n

<\/app-blog-author><\/div>\n<\/div>\n

<\/main><\/div>\n

Read More<\/a>
\n Tomi Kucera<\/p>\n","protected":false},"excerpt":{"rendered":"

Threat Hunter TeamSymantecSymantec, by Broadcom Software, has observed a new malware that abuses a feature of Microsoft\u2019s Internet Information Services (IIS) to deploy a backdoor onto targeted systems. The malware, dubbed Frebniis (Backdoor.Frebniis), was used by a currently unknown threat actor against targets in Taiwan. The technique used by Frebniis involves injecting malicious code into<\/p>\n","protected":false},"author":1,"featured_media":609003,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[37355,4551,46],"tags":[],"class_list":{"0":"post-609002","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-abuses","8":"category-malware","9":"category-technology"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/609002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/comments?post=609002"}],"version-history":[{"count":0,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/609002\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media\/609003"}],"wp:attachment":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media?parent=609002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/categories?post=609002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/tags?post=609002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}