Pierluigi Paganini June 28, 2018

This is a very bad news for security community, the NSA-linked DoublePulsar exploit can now target Windows Embedded devices.

The DoublePulsar exploit was released publicly in April 2017 by ShadowBrockers hackers that allegedly stole them from the NSA.

The hackers leaked a huge trove of hacking tools and exploit codes used by the US intelligence agency, most of Windows exploits were addressed by Microsoft the month before.

DoublePulsar is sophisticated SMB backdoor that could allow attackers to control the infected systems since its leak it was working on almost any Windows system except on devices running a Windows Embedded operating system.

News of the day is that a security researcher who uses the online with the moniker of Capt. Meelo has developed a version of the DoublePulsar exploit code that also works on devices running a Windows Embedded operating system.

The experts discovered that even if the devices running a Windows Embedded operating system are vulnerable to the exploits, the relevant Metasploit modules wouldn’t work on them.

To confirm this hypothesis, the researcher used the NSA FuzzBunch exploit code and discovered that the target device was indeed vulnerable via the EternalBlue exploit.

“I then quickly used the EternalBlue module and the result was successful – the backdoor was successfully installed on the target. So I guessed the authors of the MSF exploit modules just forgot to add the support for Windows Embedded version. ” wrote the expert in a blog post.

“Since the backdoor was already installed, the last thing that needs to be done to complete the exploitation and gain a shell was to use DoublePulsar.”

Summarizing the expert was able to exploit the EternalBlue attack against the target device but the deployment of the DoublePulsar backdoor was failing , so the researcher decided to analyze the implant to discover why.

What he found was that one simple line of code was enough to make it work on Windows Embedded.

DoublePulsar was designed to check the Windows version on the target machine and take one installation path on Windows 7 or another (and perform other OS checks) on other platform iterations. However, there was no check for Windows Embedded, which generated an error message.

By simply modifying an instruction in the “Windows 7 OS Check,” the researcher was able to force the implant into taking that specific installation path.

“To do this, I went to Edit > Patch program > Change byte. Then I changed the value 74 (opcode of JZ) to 75 (opcode of JNZ). I then created a DIF file by going to File > Produce file > Create DIF file,” Capt. Meelo explains.

The expert used the @stalkr_’s script (https://stalkr.net/files/ida/idadif.py) to patch the modified exe file. and then moved the modified Doublepulsar-1.3.1.exe back to its original location.

This trick allowed him to inject the generated DLL payload to the target host.

Pierluigi Paganini

(Security Affairs – Doublepulsar, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]