View More Demos
c1.exe

analyze this file

Dr.Binary
createTask
Executing task: Static analysis of c1.exe binary
workspace_list_files
ghidra_open_server
ghidra_list_imports
ghidra_list_methods
ghidra_decompile_function
ghidra_decompile_function
ghidra_decompile_function
ghidra_decompile_function
ghidra_decompile_function
ghidra_list_strings
Task Static analysis of c1.exe binary completed: The analysis indicates that c1.exe is a malicious exploit targeting CVE-2018-8120, designed to escalate privileges to SYSTEM and execute arbitrary commands. It leverages Windows API functions, including low-level system calls, process and token manipulation, and desktop settings, to create a process with SYSTEM privileges. The binary performs memory and bitmap manipulations likely related to the exploit payload and suspicious actions such as changing the window station and handling raw process output, which could leak sensitive information. Its functionalities and API usage clearly point to malicious intent, constituting a privilege escalation tool exploiting a known vulnerability for unauthorized system access.

The binary "c1.exe" is a privilege escalation exploit tool targeting CVE-2018-8120. It is designed to run arbitrary commands with SYSTEM level privileges on a Windows system. The program creates a process with elevated privileges, manipulates memory and process tokens, and uses low-level system calls to execute the exploit successfully.

If you need a deeper analysis of any particular function or behavior in this binary, please let me know.

draft a report

Dr.Binary
createTask
Executing task: Draft technical report for c1.exe analysis
workspace_list_files
ghidra_list_imports
ghidra_list_functions
ghidra_decompile_function
ghidra_decompile_function
ghidra_decompile_function
ghidra_decompile_function
Task Draft technical report for c1.exe analysis completed: The static analysis of "c1.exe" reveals it as a weaponized binary specifically crafted to exploit the Windows CVE-2018-8120 privilege escalation vulnerability. It employs advanced techniques such as manipulating window stations and bitmaps, resolving native Windows API functions, and directly interacting with kernel modules like "ntkrnlmp.exe" or "ntoskrnl.exe" to elevate privileges to SYSTEM level. The executable accepts user commands, creates hidden processes with SYSTEM rights, and captures their output via pipes, indicating its malicious intent. Its behavior, including version-specific checks, low-level API usage, and kernel memory manipulations, confirms its role as an exploit targeting compromised Windows systems, posing a significant security risk by enabling full system compromise. Immediate containment, patch application, and security monitoring are strongly advised.

Here is a draft technical report on the binary c1.exe analysis:

Technical Report on Static Analysis of Binary File c1.exe

  1. Purpose
    The binary file "c1.exe" is identified as a proof-of-concept exploit targeting the vulnerability CVE-2018-8120. The primary purpose of this executable is to exploit a privilege escalation flaw in Windows systems, allowing an attacker to execute commands with elevated SYSTEM privileges. The exploit was modified by @Topsec_Alpha_lab (https://github.com/alphalab).

  2. Description
    The binary is a Windows executable that performs various checks on the operating system, loads kernel modules, and executes a user-supplied command with escalated privileges. It leverages native Windows API calls to allocate memory, create processes, and manipulate system objects such as window stations and bitmaps to achieve privilege escalation.

  3. Key Functions Analysis

  • Main Exploit Routine (FUN_1400012b0):
    • Parses and validates command-line arguments, demanding exactly one argument (the command to run).
    • Retrieves module handle for "ntdll" and resolves address of critical functions like "RtlGetVersion", "NtAllocateVirtualMemory", "NtQueryIntervalProfile".
    • Performs Windows version checks for compatibility (Windows 7 or Windows 8 versions).
    • Creates a window station object and sets it for the process, a known exploit technique.
    • Uses CreateBitmap and SetBitmapBits APIs in a particular way forming the exploit payload.
    • Allocates virtual memory in the process, establishes anonymous pipes, and creates a process running the specified command as SYSTEM.
    • Captures output from the elevated process for display or logging.
  • Kernel Module Enumeration and Loading (FUN_140001150):
    • Enumerates loaded device drivers, identifies kernel version, and loads kernel modules accordingly.
    • Resolves kernel function addresses likely targeted by the exploit.
  • Output Logging Functions:
    • Handles formatted output and synchronization for console or file logging.

  1. Imported Functions
    The binary extensively uses Windows APIs for process, memory, synchronization, I/O, graphics, debugging, and system information. These include CreateProcessW, NtAllocateVirtualMemory, EnumDeviceDrivers, CreateBitmap, GetProcAddress, and others enabling deep OS interaction.

  2. Suspicious Behavior

  • Explicitly identifies as a CVE-2018-8120 exploit.
  • Manipulates system objects rarely used in regular applications (window stations, bitmaps).
  • Makes syscall-level calls bypassing standard API restrictions.
  • Performs actions typical of privilege escalation exploits to run arbitrary commands as SYSTEM.
  • Uses pipes to capture output from the SYSTEM-level executed commands.

  1. Potential Impact
    Successful exploitation leads to SYSTEM-level privileges allowing full system control, arbitrary command execution, potential persistence, and severe security compromise.

  2. Recommendations for Handling

  • Quarantine and block this binary if found.
  • Patch all systems against CVE-2018-8120.
  • Monitor for related suspicious behavior (process creation, memory allocation patterns).
  • Restrict administrative privileges and educate users against untrusted executables.

Summary:
The analyzed binary is a specialized privilege escalation exploit designed for CVE-2018-8120 on Windows. It uses advanced API and kernel manipulation techniques to run commands as SYSTEM. It should be treated as malicious and handled with appropriate security measures.

Let me know if you want the report in any specific format or further details included.