ITSEC Newsletter 2024-05-23

I was recently analyzing a malware sample that abuses the Beep function as an interesting evasion tactic. The Beep function basically plays an audible tone notification for the user. The Beep function accepts a parameter DelayInterval, which is the number of milliseconds to play the beep sound. The calling program’s thread that executed the function will “pause” execution for the duration of the beep. This can be an interesting anti-sandbox and anti-debugging technique. Let’s take a deeper look at the Beep function.

In this article I will introduce, and provide an example of, another technique from my upcoming training, A Basic Guide to Bug Hunting with Ghidra. The topic this time is on attack surface enumeration and specifically how to use Ghidra to produce a secondary script for tracing targeted function calls in GDB.

A new RCE in Git caught my attention on a recent security feed, labeled CVE-2024-32002. The idea of an RCE being triggered through a simple git clone command fascinated me. Given Git’s ubiquity and the widespread use of the clone command, I was instantly intrigued. Could something as routine as cloning a repository really open the door to remote code execution? My curiosity was piqued, and I had to investigate. Plus, who doesn’t want an excuse to break stuff in the name of research? What’s the fun in just reading about an RCE? I wanted to see it wreak havoc – maybe launch a rogue application, or worse, wipe out my directories. At least, I wanted it to pop my calculator. In this post, I’ll walk you through my journey of reversing the Git RCE, from initial discovery to crafting a working exploit.