Giuseppe Massaro N3mes1s

ZAM64.SYS (ZAMGUARD64.SYS) most interesting IOCTLs.

All parameters to the functions supplied from user-mode via DeviceIoControl parameters. Everything from this available for any local user on machine where this driver is running.

0x8000202C

Arbitrary file deletion. Resets file attributes via ZwSetInformationFile and then does ZwDeleteFile.

0x80002030

Wrapper around ZwQuerySystemInformation(SystemProcessInformation).

CVE-2020-0601 AKA ChainOfFools OR CurveBall

General

Microsoft disclosed a vulnerability in their monthly Patch Tuesday referenced under CVE-2020-0601.
The vulnerability was discovered by the U.S. National Security Agency, anounced today (2020-01-14) in their press conference, followed by a blog post and an official security advisory.
The flaw is located in the "CRYPT32.DLL" file under the C:\Windows\System32\ directory.

Vulnerability explanation

NSA description:
NSA has discovered a critical vulnerability (CVE-2020-0601) affecting Microsoft Windows® cryptographic functionality.

Overview

The following content is generated using a preview release of Swimlane's pyattck.

This snippet of data is scoped to the following actor groups:

APT33
APT34
APT39
Charming Kitten

	import asyncio
	import json

	from livekit import rtc
	from livekit.agents import JobContext, WorkerOptions, cli, JobProcess
	from livekit.agents.llm import (
	ChatContext,
	ChatMessage,
	)
	from livekit.agents.voice_assistant import VoiceAssistant

	#!/usr/bin/env python
	# -- coding: utf-8 --
	# Thomas Roccia \| IconDhash.py
	# pip3 install lief
	# pip3 install pillow
	# resource: https://www.hackerfactor.com/blog/?/archives/529-Kind-of-Like-That.html

	import lief
	import os
	import argparse

	import malduck
	import binascii
	import sys
	import hashlib
	from loguru import logger
	import collections
	import math
	import json
	import pefile

	using System;
	using System.Management;

	namespace SharpWMIPersist
	{
	class Program
	{
	public static void Main()
	{
	ManagementObject EventFilter = null;

	rule win_matiex_keylogger_v1 {

	meta:
	author = "Johannes Bader @viql"
	date = "2020-07-20"
	description = "detects the Matiex Keylogger"
	tlp = "white"

	strings:
	$obfuscator_1 = "OiCuntJollyGoodDayYeHavin_____________________________________________________"

	image: "rust:latest"

	default:
	before_script:
	- rustc --version
	- cargo --version

	stages:
	- test