Information Thief Disguises itself as LDAPNightmare (CVE-2024-49113) Proof of Concept Exploit

Information Thief Disguises itself as LDAPNightmare (CVE-2024-49113) Proof of Concept Exploit | Trend Micro (US)

Content has been added to your Folio

Cyber Threats

Our blog article talks about a fabricated PoC exploit related to LDAPNightmare (CVE-2024-49113) that is being used to distribute malware that steals information.

By: Sarah Pearl Camiling

January 09, 2025

Read time: ( words)

In December 2024, two crucial security vulnerabilities in Microsoft’s Windows Lightweight Directory Access Protocol (LDAP) were resolved through Microsoft’s monthly Patch Tuesday rollout. Both vulnerabilities were identified as highly noteworthy given the wide usage of LDAP in Windows environments:

CVE-2024-49112: A remote code execution (RCE) flaw that can be abused by sending specifically crafted LDAP requests, allowing threat actors to execute unauthorized code on the target system.
CVE-2024-49113: A denial-of-service (DoS) vulnerability that can be exploited to disrupt the LDAP service, resulting in service outages.

Within this article, we examine a false proof-of-concept (PoC) exploit for CVE-2024-49113 (known as LDAPNightmare) designed to entice security researchers into downloading and executing malware that steals information.

Though the strategy of using PoC baits for malware distribution is not novel, this assault raises serious concerns, particularly as it preys on a trending topic that could potentially impact a larger group of victims.

Analyzing the technical aspects

The malicious repository containing the PoC seems to be a branch from the original author. In this situation, the initial Python files were substituted with the packed executable poc.exe that was compressed using UPX. While the repository might appear standard initially, the existence of the executableheightens suspicion because of its unforeseen appearance in a Python-centric project.

Figure 1. Repository containing “poc.exe”

Upon file execution by the user, a PowerShell script materializes and runs in the %Temp% directory. Consequently, a Scheduled Job is formed, triggering the execution of an encoded script.

Figure 2. Code snippet showing the creation of the Scheduled Job

Figure 3. Downloading another script from Pastebin

After decryption, the script downloads an additional script from Pastebin, fetching the public IP address of the victim’s system and uploading it via FTP.

Subsequently, the gathered information is compiled and compressed through ZIP, following which it is transmitted to an external FTP server using hardcoded credentials.

Device specifics
Running processes
Directories (Downloads, Recent, Documents, and Desktop)
Network IPs
Network adapters
Installed updates

Figure 4. Exfiltrating the gathered information

To safeguard against fraudulent repositories harboring malicious content, a blend of technical safeguards, security consciousness, and optimal approaches is necessary. These encompass the ensuing measures:

Exclusively obtain code, libraries, and dependencies from certified and respectable repositories.
Exercise wariness towards repositories holding suspicious content that may seem incongruous for the supposed tool or application it hosts.
If feasible, affirm the repository owner’s or organization’s identity.
Scrutinize the repository’s commit history and recent alterations for anomalies or hints of malevolent deeds.
Exercise caution towards repositories with minimal stars, forks, or contributors, particularly if they allege widespread usage.
Investigate reviews, issues, or dialogues about the repository to spot potential red flags.

preceding blog entry, which also details the Trend Micro rules and filters fashioned to furnish protection against the exploitation of CVE-2024-49113.

To remain proactive against evolving threats, Trend clients can delve into an array of Intelligence Reports and Threat Insights within Trend Vision One. Threat Insights enables clients to preclude cyber threats before their materialization and to enhance readiness against nascent perils. It furnishes exhaustive data on threat actors, their malevolent undertakings, and their modus operandi. By leveraging this intelligence, clients can take anticipatory measures to secure their environments, alleviate risks, and respond efficaciously to threats. 

Trend Vision One patrons can utilize the Search App to cross-reference or track the malevolent indicators highlighted in this blog post with their environmental data.    

Suspicious PowerShell script beneath %LocalAppData% subdirectory

eventSubId: 101 AND objectFilePath: /AppDataLocalTempw+.tmpw+.tmpw+.ps1/

Threat Insights Entitlement enabled. 

here.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts