{"id":206005,"date":"2018-07-01T01:47:00","date_gmt":"2018-06-30T23:47:00","guid":{"rendered":"https:\/\/www.borncity.com\/blog\/?p=206005"},"modified":"2023-01-30T15:37:29","modified_gmt":"2023-01-30T14:37:29","slug":"applocker-mit-squiblydoo-com-hijacking-aushebeln","status":"publish","type":"post","link":"https:\/\/borncity.com\/blog\/2018\/07\/01\/applocker-mit-squiblydoo-com-hijacking-aushebeln\/","title":{"rendered":"AppLocker mit #squiblydoo COM Hijacking aushebeln?"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline\" src=\"https:\/\/borncity.com\/blog\/wp-content\/uploads\/2015\/01\/Schutz.jpg\" width=\"40\" align=\"left\" height=\"47\"\/>Kann man mit einer als #squiblydoo bezeichneten Technik f\u00fcr COM Hijacking den in Windows 10 Enterprise eingebauten AppLocker-Schutz umgehen?<\/p>\n<p><!--more--><\/p>\n<p>Ich kippe hier mal einige Info-Splitter in Sachen Windows-Sicherheit und AppLocker hier im Blog-Beitrag zusammen. K\u00fcrzlich bin ich auf <a href=\"https:\/\/twitter.com\/bohops\/status\/1011350358566821891\" target=\"_blank\" rel=\"noopener noreferrer\">diesen Tweet<\/a> von @bohops gesto\u00dfen, der eine l\u00e4nger bekannte M\u00f6glichkeit zum Aufruf von COM-Funktionen mittels <em>rundll32.exe <\/em>und dem <em>\/sta<\/em>-Parameter \u00fcber ClassID-Codes thematisiert.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"de\">\n<p lang=\"en\" dir=\"ltr\">Interesting way to call a COM CLSID:<\/p>\n<p>rundll32.exe -sta {CLSID}<br \/>rundll32.exe \/sta {CLSID}<\/p>\n<p>Use this with @subTee's <a href=\"https:\/\/twitter.com\/hashtag\/squiblydoo?src=hash&amp;ref_src=twsrc%5Etfw\">#squiblydoo<\/a> COM Hijack method for a default AppLocker Bypass<\/p>\n<p>Haven't found any sec-related resources with -sta (single threaded apartment)<\/p>\n<p>Anyone seen this before? <a href=\"https:\/\/t.co\/6yPpsSOKpl\">pic.twitter.com\/6yPpsSOKpl<\/a><\/p>\n<p>\u2014 bohops (@bohops) <a href=\"https:\/\/twitter.com\/bohops\/status\/1011350358566821891?ref_src=twsrc%5Etfw\">25. Juni 2018<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>  <\/p>\n<p>Ist etwas kryptisch, aber es geht wohl darum, dass eine Malware eine eigene COM-Klassen \u00fcber die ClassID in der Registrierung eintragen k\u00f6nnte. Anschlie\u00dfend besteht die M\u00f6glichkeit, \u00fcber rundll32.exe diese Klasse aufzurufen, die dann wiederum weitere Funktionen aktiviert. So wie ich es verstanden habe, lie\u00dfe sich durch dieses COM-Hijacking der <a href=\"https:\/\/msdn.microsoft.com\/de-de\/library\/hh831440(v=ws.11).aspx\" target=\"_blank\" rel=\"noopener noreferrer\">AppLocker-Schutz<\/a> von Windows 10 zum Whitelisting von Apps umgehen. <\/p>\n<p>Bisher ist zu diesem Szenario wohl noch wenig in Punkto Sicherheit ver\u00f6ffentlicht worden. Auf GitHub habe ich <a href=\"https:\/\/gist.github.com\/enigma0x3\/469d82d1b7ecaf84f4fb9e6c392d25ba\" target=\"_blank\" rel=\"noopener noreferrer\">diesen Eintrag<\/a> gefunden. Dort befasst sich jemand mit .sct-Skriptprogrammen, die eine Backdoor remote installieren k\u00f6nnen. Und in <a href=\"https:\/\/github.com\/trietptm\/Security-News\/blob\/master\/Twitter\/Zube\/2016\/2016_04_30.txt\" target=\"_blank\" rel=\"noopener noreferrer\">diesem GitHub-Beitrag<\/a> gibt es eine Zusammenfassung \u00e4lterer Sicherheitsmeldungen. Dort schreibt ein Twitter-Nutzer mit Namen subtee folgended:<\/p>\n<blockquote>\n<p>Well. <\/p>\n<p>So turns out regsvr32 will take an .sct file from a URL. <\/p>\n<p>PowerShell Empire Fileless Stager: <\/p>\n<p>Posted this a while back. <\/p>\n<p>Hey #BlueTeam  <\/p>\n<p>We're breaking down the tradecraft used to pwn #HackingTeam on tomorrow's episode. Join us live at Noon ET!  &#8230; #Infosec <\/p>\n<p>This&#8230; <\/p>\n<p>Though&#8230;If I catch you doing this. Executing against a repo you do not control&#8230;. Please. Its just a demo&#8230; <\/p>\n<p>Guaranteed to learn a lot on this week's episode. Can't wait to discuss!  &#8230; #DFIRhttps:\/\/twitter.com\/TradecraftTues\/status\/722318895646904321 &#8230;  <\/p>\n<p>AppLocker Script Rule Bypass- <\/p>\n<p>If you think only admins can call regsvr32&#8230; You are wrong. <\/p>\n<p>Achievement Unlocked. <\/p>\n<p>Proof Of Concept #PowerShell Server \/ <\/p>\n<p>I updated gist with indicators. <\/p>\n<p>I think each PowerShell Empire Stager needs a Logo. <\/p>\n<p>[Blog Post] <\/p>\n<p>Today's #BHISblog by @fullmetalcache &#8211; more fun bypassing #antivirus &amp; #whitelisting using method dev by @subTeehttp:\/\/ow.ly\/4mU6HI  <\/p>\n<p>Security ramblings of a disgruntled blue teamer ;) <\/p>\n<p>Intrusions will likely leave many signs. Teach your analysts not to treat alerts as singular events, but how to look beyond an alert. #DFIR <\/p>\n<p>.SCT Update <\/p>\n<p>\"Its not well documented that regsvr32.exe can accept a url for a script.\" (via  &#8230; ). Understatement of the century. <\/p>\n<p>My favorite shout out. Thanks Again Alex.https:\/\/twitter.com\/aionescu\/status\/723266342829182976 &#8230;  <\/p>\n<p>@diodesign @subTee it's built-in remote code execution without admin rights and which bypasses Windows whitelisting. I'd say it's pretty bad <\/p>\n<p>Ok all. Good night Twitter. LOL Feed is blowing up. IPA at the pub now. Talk to you all in the am. -Cheers :-) <\/p>\n<p>@subTee's COM Scriptlet stager is now in the Empire dev branch:https:\/\/github.com\/PowerShellEmpire\/Empire\/blob\/dev\/lib\/stagers\/launcher_sct.py &#8230;  <\/p>\n<p>[current status] Ice climber. I love the skull.pic.twitter.com\/Kdbk9nJDVn <\/p>\n<p>Just pushed the com_exec module to CME! Get all the shells using @subTee's COM scriptlet whitelist bypass!pic.twitter.com\/FVEYlIP4Cq <\/p>\n<p>User Exploitation at-Scale http:\/\/blog.cobaltstrike.com\/2016\/04\/28\/user-exploitation-at-scale &#8230; pic.twitter.com\/68AzKuEyYh <\/p>\n<p>Defend against @subTee's AppLocker Bypass technique using EMET's ASR  &#8230; &#8230; #squiblydoo <\/p>\n<p>COM Object hijacking: the discreet way of persistence<\/p>\n<\/blockquote>\n<p>Ist alles sehr fragmentiert, aber wie ich es verstanden habe, f\u00fcr Angriffsszenarien \u2013 auch Remote in Netzwerk verwendbar. Dieser Artikel enth\u00e4lt noch einige Informationen zum Thema. Und <a href=\"https:\/\/bohops.com\/2018\/04\/28\/abusing-dcom-for-yet-another-lateral-movement-technique\/\" target=\"_blank\" rel=\"noopener noreferrer\">hier<\/a> gibt es einen Artikel zu einem \u00e4hnliche Problem. Ich habe es mal im Blog aufgenommen, um es im Fall des Falles als Referenz vorzuhalten. Vielleicht kann jemand von Euch was mit anfangen.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Kann man mit einer als #squiblydoo bezeichneten Technik f\u00fcr COM Hijacking den in Windows 10 Enterprise eingebauten AppLocker-Schutz umgehen?<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[426,301],"tags":[916,4328,4325],"class_list":["post-206005","post","type-post","status-publish","format-standard","hentry","category-sicherheit","category-windows","tag-hacks","tag-sicherheit","tag-windows"],"_links":{"self":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/206005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/comments?post=206005"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/206005\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/media?parent=206005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/categories?post=206005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/tags?post=206005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}