Hello everyone will come to their party of my analysis and reverse engineer course in this video.
We are going to talk about exploit kits so exploit it is a very popular mechanism this is used by attackers
has that delivery fees in the spam emails we discussed about two types of spams.
One was spear fishing and one was the regular spam.
So spearfishing was more like a targeted spam email which should be sent to specific organizations or
specific individuals within an organization whereas a generic spam would be more like email that gets
sent to a bunch of users in the same way.
Ex-White kids are not usually targeted.
They are basically hosted on a compromised website or they will be hosted on and on and so were by compromising
the scripts on the AD.
So the aim will be exploitative to infect as many users as possible.
So if you look here I have tried to do Nordic traditional campaigns that were used by oxcart kids so
they would usually host the script on one of the compromised site.
From there the attack will get redirected to the exploited.
So recently we have started seeing that they exploit kids have started using multiple redirects in order
to evade the intrusion detection and prevention systems.
So what happens is you'll visit our normal web site for example and use Lipsyte or probably a video
hosting Web site usually be that sites will contain some kind of ads in different sections of the page.
So the attackers are trying to weaponize those ads in order to land you to the exploit kits.
So your Web site will redirect you to an ad and the ad will basically redirect you to multiple tedious
gateways superior's gateways or nothing but load balancing gateways that can help in redirecting traffic
from one server to another.
So exploit gets use this technique to basically perform multiple redirects before the user gets infected
by an exploit gained by visiting the site.
So here is a snapshot of an exploit good traffic just to make it simple.
Let us consider that we already know that the explorer get server is hosted on $185 158 or 152 or 2
0 4.
So I'm using this presentation to give you a rough idea about what kind of filters you can apply when
you have been given a pre-cap that contains exploit that traffic that more should be your filter.
How would you figure out that this was an exploit get attacked.
What were the exploits that were launched and stuff like that.
So let us say we know that this is the culprit IP.
So what we can do here is that we can apply a filter at the peak hour say is that a UDP dog request
an IP address equals to the culprit IP.
So what we are doing here is that we are looking for all types of strictly IP requests whether it's
a get or post that have originated from this particular IP address.
So if you look here we have all they get requests three get requests that have been originated from
the particular IP address.
So this is one very critical filter to quickly see what all requests were made by your machine to this
particular cell we're so in exploit gets the flow of event is very straightforward.
What they do is that once you reach the landing page the landing page basically would contain a very
obfuscator script and this script tries to enumerate your browser plugins and your browser environment.
For example if you are using an Internet Explorer web browser the Explorer kid will try and launcher
Internet Explorer exploit onto your machine so that they can exploit the Internet Explorer and they
can get an unlimited privilege.
On the other hand let's say you are using Chrome or Firefox the picture can be slightly different.
The landing page will be explored Kilbey.
It will be reached by following all those multiple DDX redirection or once you reached the landing page
the landing page will no matter the browser it will try and figure out what all plugins are integrated
in your browser.
For example do you have a flash plugin.
Do you have a PTF reader plug in.
Do you have a Java reader plug in.
Do you have Silverlight plug ins and things like that so these are some of the common plugins that they
exploit kids usually target.
And they have bunch of exploits hosted on their server so one landing page is able to figure out the
version of plugins it sends that information back to the exploded server.
For example let's say they excluded was able to figure out that you are using PTF wurden 13 which might
be a little worrying.
You might be using Java 7.4 or something like that.
Which might again be a one notable version.
So once these details are sent to the explored Gates server they exploit good server goes ahead and
on just exploit.
Based on these Words because not all exploits are designed.
Do you know directly in fact any word.
Unless it's a zero or b so what X market alters do is that they first figure out what is the worst off
services that are plugins that are holstered on your browser.
Once they have that information they will launch the specific exploit and wenzi ones.
The exploitation is successful.
The attacker is basically able to bypass the sandboxing bar when that the browser has created.
So this is the reason why X exploit gets made to exploit your browser because of browser environment
is a sandbox environment and it has very limited functions onto the machine.
Once it gets exploited the browser process now has the ability to basically perform lot more actions.
For example downloading the payload.
So this is why exploit gauges rely heavily on exploits in order to drop their final payload.