this thing on alright um started well
thank you everyone for calming today I'm
going to talk about calm hijacks a
little bit of background about me my
name is David Thewlis I'm an offensive
security practitioner and researcher I
currently work for NCC group I leave red
teams I do windows and ad pentesting
social engineering physical security
tests this is a picture I had absolutely
no business being and you know what they
say about being able to get anywhere you
want if you're wearing reflective vests
that is completely drew so what am I
going to talk about today I'm gonna
start by going over the basics of calm
understanding why it exists and how it
works I'll talk about the vulnerability
and the calm activation process how to
identify hijack events on a system
followed by demonstrations of how an
attacker can hijack objects to have
their code loaded by other processes
I'll talk about some practical usages
and offensive operations and then some
takeaways for red and blue teams so why
the interest in SOCOM is available in
all versions of Windows stating back to
Windows 3.1 abuse of the calm object
birthing process will cause other
processes to load arbitrary libraries of
the attackers choice depending on the
details of how this is done this can be
used for persistence for defense evasion
for lateral movement comm hijacking has
been observed in the wild mostly just
for persistence it's registered on the
miter attack framework as technique 1122
and for how useful and versatile this
technique is I don't think it's talked
about nearly enough as it should be so I
want to show you all how cool comm
hijackers
komm is a very interesting interface for
attackers and unless you have previous
experience in comm development it's
likely just a magical black box SOCOM
stands for the component object model
it's been around since 1992 so this
interface is actually older than me you
can imagine how archaic the interface is
after almost 30 years of age become is
the fundamental framework behind many
other Microsoft technologies including
ActiveX Oh le comm plus the comm and
more you know how in UNIX everything is
a file well in Windows everything is an
object and comm gives developers
language neutral way of implementing
objects that can be called by other
processes this allows programs which are
written by other vendors in other
languages to reuse objects and methods
from common abled libraries without any
knowledge of the internals this
flexibility allows for implementation
internals to change without acquiring
developers to recompile applications to
account for updates in a libraries
binary structure
komm gives us the ability to interact if
you've ever embedded an Excel an excel
sheet in a word doc this is handled by
Microsoft Word activating various Excel
comm objects and then calling their
methods to show you these Excel features
all from within word and there's no
Excel dot exe required tools here's
another example if you've ever created a
malicious VBA macro then you probably
created a W script shell calm object and
use that object to run arbitrary shell
commands from VBA using that objects run
men or maybe if you're familiar with
gems for Shaw's dotnet to jscript
project that magical black box of net in
VBA out that's all done through the
creation of certain calm objects which
expose the dotnet runtime from VBA
why does column need to exist well
windows is full of libraries there used
to pass around objects and functions
between processes and this is all done
through library files so put on your
developer hat tender developer you want
to distribute a library so that other
programs can interact with your program
so you can provide a statically linked
library in Windows
these are dot Lib files this means that
anybody who wants to use your library
must compile their program against your
library any updates you make to your
library then must distribute those
updates to developers who must recompile
against the new version plus you can
have multiple versions of the same
library existing on disk or in memory at
the same time just waste resources this
is not ideal you could provide a
dynamically linked library so now your
new package is a dll file in Windows you
exploit your methods rely on the OS to
dynamically resolve and link methods at
runtime using API calls like load
library or get proc address so now you
only have one DLL in memory but you risk
taking a trip to what's referred to as
DLL hell where software will overwrite
the DLL that other software relies on
breaking that functionality also not
ideal so comm solved all these problems
the core principle of comm is to
separate the library interfaces from the
library implementations developers will
define their interface to become
standard and allow their classes to be
instantiated from other processes and
other languages at any point in time
because applications and libraries need
to be updated and without changing the
underlying structure of the Syriac
procedures so when a binary is made
comma where it all is this standard so a
program can be updated recompiled and
third-party applications can still
instantiate that class access to
necessary functions implementations can
be changed but the life but the
interface has never changed so a
third-party application will always be
able to use that libraries resources
through the never changing interface
comm uses a client-server architecture
the reusable code must be registered as
a comm server this contains the
interfaces and the implementations a
comp
client is whatever code wants to make
use of that object and that functions
the functions implemented by the server
this is done by getting a pointer to the
column servers interfaces and then
calling the methods available servers
can either be hosted in process through
a dll file that's loaded into another
process or an out of process server out
of process servers are required if you
want call a comm object that's available
on another machine comm server
components must be assigned physical
names and logical names so a logical
name like alert stop message box that
might be used by two different programs
so each commenter each comm object is
given a physical name that is global
unique or a gooood there's a lot of
goods and calm but the most important
view it is the the class ID this is the
identifier at the library's actual
implementation comm interfaces also have
IDs but all comm interfaces look the
same their uniform structure allows for
clients you don't know anything about
the interface or the implementations to
query the interface for a list of
pointers which point to the actual
interface is supported with a comm
library there's only three methods
exposed by this interface there's a
query interface that retrieves the
pointers do you do supported interfaces
of the object then there's the ability
to increment or decrement a reference
counter of who is using the object
and compliance really can in any
language compliance or languages that
are not natively supported by Windows
have libraries to help with the creation
and management of objects but at the
windows API level developers will often
use the code create instance API as a
generic function to create a single
instance of an object this function will
call the exported dll class object
function which is exported by all comm
libraries this calls the object
interface interfaces query interface
method this method retrieves the
pointers to the interfaces implemented
in the object and then from there you
can interact the common objects using a
pointer to its interface and if you
don't know the class I DDoS is capable
of resolving the prague ID to class ID
using the class ID from prague ID api
call comm objects must be registered by
the OS this is done using the register
32 binary this will register the dll
with the OS by calling the DLL is
exported dll register server or DLL
unregistered server functions if you
take a look at what this process is
doing to register the comm component
it's creating some register Keys
containing the class ID
take a look in the registry palm
libraries are all registered under the
software classes class ID key under each
class ID there will be various sub keys
which define object behavior this
particular object on the screen is an in
process because in proxy server 32 key
which points to a dll file on disk
so in procs in proxy server 32 or in
proxy server subkeys these are in
process servers the local server sub T
is 4 out of processors the 32 suffix
just in the case that the key is for 32
or 64-bit applications a key with no
suffixes or a 16 bit compatibility so
this is the most important key in the
comm registry structure because this
points to where a comm library is
located on disk comm objects can be
registered on a per user basis these are
registered in the H key current user
registry hive comm objects that are
registered system-wide are registered in
the H key local machine hive in both
cases writing under the software classes
class IV key if you're not familiar with
the H key so our hive H hkey classes
root hi this is a virtual hive it
doesn't actually exist in the same way
that h kc r or XR h k CU and hklm ives
do HK c r is a merged view of the class
IDs from both h k CU & hklm reg 2 times
if a program wants to write two h cases
are this requires privileges because
writes
2 h cases are are mapped to the local
machine registry hub so let's do a
survey of what com objects are
registered on a system my test box for
all of this was just a Windows 10 Pro
box
I installed Chrome I installed office
2016 I wanted this test box to resemble
systems that are often seen in
enterprise environments as seen in these
statistics the majority of comm servers
are in process servers and the majority
of comma objects are registered
system-wide and you can try this at home
if you want so I wrote a PowerShell
script for basic interactions calm and
calm hijacks it'll be uploaded to this
repository within the next week actually
de clean up my code a little bit and
write some documentation
if you want to see any of these objects
in more detail I recommend using the Oh
le vieux net project this is an open
source tool written by James Porsche for
exploring calm objects on a system
highly recommend so if you weren't
paying attention before to all the
boring stuff about calm internals I'm
going to talk about the fun part now so
recall that objects can be registered
either per user or system-wide so per
user objects have precedence any object
is registered in each case you hive will
be loaded before an object is registered
in the hklm hive the exception to this
rule is high integrity processes they
read directly from the hklm pipe because
it would be trivial to escalate your
privileges if high integrity processes
we're reading from the HKC you hive but
if you recall from the previous survey
remember remember that the common
objects were mostly registered
system-wide and although we do need
administrator level privileges to write
to hklm we don't need any of those
privileges to write to HKC you so any
class ID that you write in HK c registry
hive and that class ID you can point to
any comm server that you want that will
be loaded before the legitimate object
is loaded even if the key is duplicated
so when it has values in H cases when
hklm if the client is reading objects
from the HKSAR hive it's only going to
read that object that is present in HK
see you this technique is kind of the
cousin the dll hijacking so instead of
exploiting insecurities in the windows
loader process and how it finds dll's
we're just exploiting the comm
resolution process and how come clients
are attempting to locate the library for
a comm server
so to uncover hijacked monkeys
sysinternals pokémon to test this it's
the same Windows 10 Pro machine there
I've got Chrome I've got office total 16
installed my testing strategy was really
simple for five minutes I launched each
application
I let them run I open files I saved
files you know normal user behavior I
want to find keys that are reliably
triggered through normal use otherwise
it's going to be of limited value to me
as an attacker the filter I used I used
to identify these events so we're
looking for registry keys where the
result was not found we'll further hone
the filter by looking in proxy server 32
keys because that's going to be the
majority of com servers on a machine I'm
also gonna ignore we used to the HP ALM
because that requires administrative
privileges to write to the result in
about five minutes there was over 11,000
attempted registry leads to user land
writable locations in the registry that
means that there's 11,000 events where
that attackers library could have
potentially been loaded into another
process take the results of this
exporter to a CSV for analysis so from
the previous sample capture this command
that I wrote to just parse the CSV and
from the sample that I took there was
about 628 unique class IDs that were
activated across various user processes
that were all launched over the five
minutes of testing
so let's write a proof-of-concept
librarian hijack one of these we found
in the previous slides so remember that
in process con servers they need to be
registered as a deeper they need to be
implemented in a DLL file but the good
news about this that DLL does not need
to implement any comp um shion's I
discussed previously there's no you
don't need to implement any of the
registration functions you don't need to
implement any of the interface querying
functions none of that is required so
DLL files have a DLL main function this
is called whenever a process attempts to
mapper on map a DLL into its process
space it's also called whenever a
process creates or stop to thread but
calm object activations it's going to be
loading libraries so this seems like the
best place to run some type of payload
DLL main is kind of an interesting
function it's not actually exported from
a DLL so there's a PE header which
contains the entry point for the PE file
and in the case of dll's this is just
the DLL main function but the potential
issue with this technique is that the OS
holds a loader lock whatever it's
loading DLL is that lock is held before
DLL main is called the loader lock is
held to ensure that multi-threaded
programs don't deadlock if multiple
threads within a process are attempting
to change the list of modules which have
already been loading missed because
doing this can introduce some dependency
loops inside of Windows extremely
fragile loading process so because of
this it's not really advised to do much
inside of DLL name we're kind of limited
here because anything that could cause a
lock or a hold for an extended period of
time will cause the program to crash we
can't lock anything we can't wait for
any locks you can't wait for a process
to do something you can't wait for a
thread to execute because all of these
actions will cause a deadlock here's an
implementation of DLL main it's nothing
special a library project but what this
reads is that if the DLL is being loaded
into another process signified by the
DLL process attach event
let's do evil stuff
what evil stuff here's a basic and naive
approach let's just spawn any process
all right let's see your proof of
concept so in this POC I'm going to show
first that I have no administrative
rights I'm just a low-level user there's
no tricks up my sleeve here so this is a
gooood for a comm object you'll see
right here and then there's the dll that
is has been dropped to disk all I'm
doing here is just creating a new
registry key with a gooood that exists
in hklm so I've added the register key
once it's done let's just do something
that a user is going to do let's like
click an icon on the desktop
[Music]
so look at the top there to see that in
pokémon as we have a calculator
so spawn and calc is a cool concept I'm
a red teamer I can't always spawning
process it's a B and E D are products
they're very good at catching processed
creations and I probably don't want to
do this in an actual environment I'm
testing so remember in loader lock can't
load any libraries we're going to be
limited we can't load any libraries
what's already loaded into the processes
memory space but we know that
kernel32.dll that's always going to be
loaded and this gives us quite a few
functions we can use say to get a handle
on a process may be allocated chunk of
memory write some shell code to that
memory block and then create a new
thread you know everything that we need
to do for shell code injection into
another process
so in this demo I'm going to show that
from DLL main you can call windows API
functions just required to inject
shellcode into another process and then
how to run so in this demo I'm hijacking
a class ID that I know is called by
chrome dot exe we're adding the registry
key again so just watch the pokémon at
the top you'll see that as it's launched
chrome Chrome has loaded our DLL this
time it's notepad if you look on the
right you'll see in process Explorer
that notepad actually spawned from
Explorer this is just showing that our
shell code even though it was launched
from Chrome it was run inside of Hick's
for memory space so now we're not
spawning any processes some downsides
most importantly injecting shell code
into other processes this is a very
well-known technique to avian edr hell
to even run that proof-of-concept I had
to disable Windows Defender but there
are a lot of other techniques for
process injection that no I didn't
really test that's kind of out of scope
of this talk there's a collection of
different injection techniques on the
evil bits github repository great remote
thread is definitely the most well-known
and well signature technique so just
probably changing this technique to a
more obscure process injection technique
could make this technique usable in this
movie so some of you are probably asking
well why don't I just create a thread
inside and that really would be the best
case we our DLL can continue to live
inside of the compliance process without
creating any new processes without
calling any suspicious api's to inject
shell code in genetic process but
whatever threads we create inside a PLL
main the thread entry point is not going
to be called until the loader lock is
released but there is another function
that we could possibly use here so the
DLL gate class object function
this is exported by all common Abel DLLs
this fetches the class objects
implemented in the library this function
is called whenever a comm object is
activated and there's no loader lock
that's held when this function is called
so we can try to keep our DLL loaded in
memory by not returning you know the
okay sign whenever DLL can unload is
called so this is called pretty
regularly when a process is trying to
free up modules that are needed anymore
but we do have some other problems
outside of this so when you're hijacking
a comm object you're preventing the
process from loading a library that it
needs to function properly so you know
the process goes to the registry to find
its calm server it gets a library it is
not expected the library doesn't have
the exports the name and the path on
what's expected without implementing you
need to calm interfaces it's just not
acting right potentially catastrophic
side effects other than just complete
program crashes you could get random
error messages certain UI elements like
rich or misbehave or does not respond at
all and about reverse engineering to
compliant you can't know for sure what
that behavior of a hijack is going to be
so while some class IDs do cause crashes
in this behavior hijacked there are a
lot of class IDs which really don't care
what the hell happens don't load any DLL
they don't really care a few examples of
such Keys how did I find them so I
created another concept library so we're
creating a thread in DLL main and we're
creating another thread in DLL gate
class object in Maya proof of concept
these threads are just updating a file
with an incrementing number but
obviously you can change this to do
whatever activity you desire as long as
you remember the caveat of running a
function when the loaded lock is held
and that threads and DLL main won't
start until DLL main exits so let's see
what this looks like
so in this demo here I've got six
different class at use I'm gonna hijack
all at the same time just using the
hijack multiple keys command lit that I
wrote in my PowerShell hum hijack
toolkit script but this what this
command is doing on the back end we're
just gonna load a unique DLL for each
class ID hijacked will see this just
because it's each each class ID we're
gonna hijack it said yellow with just in
the name of the class ID just so we can
keep track of who is loading what well
once the keys are hijacked you know
we're gonna launch Explorer and this
time there's no cow there's no notepad
instead when the DLL the dll's are
loaded we're just starting some threads
that are logging to a file that's unique
per class ID and per thread created to
just by observing the size log files
know that the thread is still alive and
running our code it's important to note
here though the DLL gate class object
this can be called potentially several
times within the same the same thread so
in which case you might get a file like
this but you could get a file where
there's you know multiple threads
writing the same file so you know you do
kind of need to make sure that the code
you write is thread state that's
absolutely I really wish you the best of
luck writing thread safe code sucks
there may be some cases where dropping a
dll into the target environment might
not fly so this technique was originally
documented by Casey Smith and Matt
Nelson in their 2017 talk Windows
operating system archaeology so instead
of registering a malicious DLL a comm
hijacking register scratch awl so this
is this is legitimate Microsoft binary
this is already on the system and then
by using the scriptlet URL key you can
associate a window script file to run
when the object is activated and this
can be a file that's on disk but this
can also be a URL to a script like file
and this is really cool because if you
choose to host thats triplet remotely
this this is almost file this like
you're not dropping anything to a file
you're only adding a few reg to subkeys
this is not a common occurrence though I
haven't seen any legitimate uses of the
script what your L key on any systems
where I've looked at though so blue team
tech note let's see a demo of this so
I've got this script file that's that
we're gonna hijack payload is just
creating our favorite W script shell
calm object and using that object to
start out that EHC so we're gonna hijack
that yellow just a local path of the
script file but this could be a URL to a
remote file as you click on explore
there's our calculator so you see that
pokémon is on this screen as well but
sckraab j could already be loaded into
Explorer in which case it won't see that
low damage event but on the top right
let's look at the registry structure
required for his style of hijack so this
is the improv server through to Peter's
point ascribe to a dll that already
exists on the system that's a Microsoft
DLL and then this group of New Relic
each is pointing to the location of our
script little another slightly different
variation on this this hijack technique
is to take advantage of class IDs in the
registry that point to the dll that
doesn't actually exist on disk
this gives attackers the opportunity to
write their DLL to that location and
potentially have it loaded without
any type of Ritchie modifications this
only requires dropping an executable
file to disk now in most cases
especially those processes these
libraries are going to be stored in C
windows system32 that's gonna require
administrator privileges - right - but a
lot of third-party software especially
software where components are removed or
make the software has been uninstalled
may leave behind keys in the registry so
here's an example key that was left
behind by an older version of Chrome and
I guess a disclaimer this folder does
require administrator rights to access
to and there's also no promise that that
class ID is ever going to be activated
especially if it's a component has been
removed from the software but it might
be activated and there's other ways
where we can use this that I will
demonstrate later another alternative
method is by hijacking the prog ID so
remember the prog ID is the friendly
name of an object it's not guaranteed
unique but comm clients can ask the OS
choose all the prog ID to the class ID
and this is done in the registry so prog
IDs are mapped to class IDs in the
software classes so if you just add a
registry key into h k CU software
classes got a prog IE that points to a
class ID that you've added and is
loading or your library
it'll be hijacked the attacker just
needs to create the key have it point to
the dll or executable of your choosing
another alternative is the abuse of
comms treat as emulation so - - he means
that a class can be emulated by another
class so all activational quests and the
original class get forwarded to class ID
specified in the treat as registry key
this just means that if want to do a
hijack we need to create a new class ID
red pointing to whatever comm server
that we want and then we add a treat as
key to the class ID that we want the
hijack and point that to the class that
you created and then whenever that
object exactly so where can we use comm
hijacks in our attack chain as
demonstrated
Kampai decks are exploited by dropping a
dll to disk maybe making some registry
key additions in the HKC you have we
have several different options available
through which Keys we add and what kind
of files we want to drop the disk we
chose class at ease which were often
activated because as an attacker I have
an interest in having my persistent will
run on a machine to cross reduce you
know these hackers code is going to be
called whenever that object is activated
so whatever whatever type of key you
hijack you know whether it's on process
start or maybe it's you know some some
regularly run tasks the library code run
this technique doesn't necessarily
require any process restarts unless of
course the object you're hijacking I was
only triggered on startup this this
technique is also interesting because
Kampai jacks are not detected by these
sysinternals autoruns tool which is a
very popular forensic school so just
last week my friend layer released a
really cool piece of code so if you look
at the signature of DLL gate class
object this contains an argument for the
objects class ID so this information we
can go out to the registry you can find
the location of the legitimate comm
library we can load that library and
then call the libraries exported DLL via
class object function and effectively
proxy become objects through to the
legitimate library this means that we
won't cause any
stem instability as demonstrated
previously when we're hijacking Rob
a variant of this technique used for
persistence this was previously
documented by Matt Nelson of speck drops
but if you look through these scheduled
tasks on a system you may see tasks
custom handler action what is this it's
a calm objector scheduled tasks with a
calm trigger they're right for hijacking
all you have to do is hijack that object
make sure that scheduled task is
scheduled to run and you can run that
without the risk of corrupting the
runtime of another process you're in a
PowerShell script that you can use to
identify these digital tasks on a system
another technique we might be able to
use this for is processing so to evade
like a V or EDR detections an attacker
usually wants to do some type of process
injection to have their malicious code
running in another processes address
case this is a very well known evasion
technique just by using another
processes cover an attacker might be
able to interact with files and track
the network all from the process space
of well-known trusted executables like
explorer dot exe or chrome that is no
because chrome dot exe you know it has
to send network traffic maybe it's just
going to get a pass from EDR for sending
traffic to whoever CT server using the
actual techniques for performing process
injections is really a game of cat and
mouse
so I demonstrated in my second demo we
created a thread and DLL main we
injected some shell code into the
Explorer process using the create memo
thread API that's really just you know
one technique is a lot of other
techniques is a PC injection you can do
process following you can do thread
hijacking there's a lot of documented
techniques for performing process
injections but comm hijacking is not
really considered effective for
performing process migrations and I
don't understand why not because well
tune security products you know weeks
using like machine learning or AI or
blockchain they're gonna know about
these API calls so any program that we
create that's calling these functions to
perform process migrations as
solid chance of being flagged as
suspicious so through registry
modifications only I demonstrated that
we have to have our code loaded into
other processes so just by knowing which
process is called which class IDs we can
hijack a comm object have our object
injected into a more favorable process
and avoid using these suspicious API
calls altogether the only drawback is
some kind of time delay you know until
the comm object is loaded and triggered
we're not going to be able to inject
we're using three remote Grad that
injection is going to be performed
almost instantaneously I really wanted
to show a demo of this technique but the
demo when I have a concept of this
within the next week
sophisticated adversaries they have an
interest in making their activities
using comm hijacking and conjunction
with other techniques an attacker has a
couple of different options or for
misdirection so none of these techniques
that I'm about to talk about they don't
require a comm hijack but when combined
with the common hijack it can augment an
attack chain that could you know bypass
whatever detective controls of present
in the environment are operating in so
first of all application whitelisting
bypasses there's several documented
Microsoft programs which take a class ID
or prog ID as an argument one run dll 32
is the most well known but you know
there's others there's X wizard is the
verified class ID executable and then
see these all take comm objects as
arguments so a great place to use this
as an example would be after hijacking
key so I mentioned it might not an
abandoned key might not regularly be
called by a process so by using these
binaries you could drop a dll to disk
call a Microsoft signed binary on a
class ID that already act already on the
system and then have your code loaded
into another process
another activity this could be used for
his lateral movements this technique was
originally documented by PO hops but if
an attacker has administrative access on
another host they can use the remote
registry to perform the hijack they can
drop their comm server to disk and then
they can either use decom to activate
the object remotely or they could just
wait for the object to be activated
through normal user interaction so what
are all two takeaways for Red Team so I
can't call should be incorporated
multiple stages and their attack has and
because this is not a very popular
technique I think it has a place in
everyone's offensive toolkit I've shown
that comm hijacking as a cool way for
use the land persistence this technique
is not really widely used when compared
to techniques such as registry run keys
scheduled tasks W my subscriptions so it
can put you at an advantage calm
interface abuse also gives attackers a
layer of misdirection by appearing to
use components of other processes this
technique could confuse EDR signatures
or maybe even like a tier one analyst so
there a value initial access is another
area where column hijacks can give use
so since common hijacks are really just
causing the applications to run our code
you know why not why don't we see any
stage zero loaders that are just
dropping a DLL to disk and then
hijacking that object and having the
code run hijacks also have the potential
to be used for migrating into other
processes to evade detection or to get
access to that processes memory space
without using suspicious API calls like
your MOU thread which is well known to
defenders certain processes like edge or
in an infant Internet Explorer on newer
versions of Windows systems is use
Microsoft code integrity guard this is
preventing unsigned dll's from being
loaded as the process at a kernel level
but these are not the only processes
where developers don't want you loading
additional libraries in their processes
hardened applique
browsers or maybe like anti-cheat
engines they're actively preventing deal
all injections they don't want unsigned
or untrusted code loaded and they're
going to accomplish this through hooking
of different API calls like create
remote thread or load library to prevent
these functions from being used to
launch code that isn't explicitly
whitelisted by the developer but with
comm hijacking it could still be
possible to bypass these negations and
load a dll into a hardened process
without any of the traditional
techniques what are the takeaways so
what I just said
you know if people are in comm in your
environment like if you're not watching
for rich de editions under HK Cu
software classes class IDs you should be
these registry Keys should be treated
with much as closely watched as you
watch run keys or schedule tasks
additions hkcee class IDs aren't common
as seen in the survey I conducted so the
pulse positives here should be pretty
low in proximity to key additions are
already monitored by Swift bound
security system on config you should
also pay special attention to script at
URL at treat as keys because these keys
can also be used to load malicious
objects if an attacker already has
administrative access on a machine they
do have the option any of the techniques
I've talked about but on the hklm hive
you know they can overwrite a key
location with a dll they can hijack prog
ID resolution that can try to emulate a
class with treat as but hklm is owned by
trusted installer so an attacker does
want to go this route of prom abuse as
an administrator they'll be required to
change the registry key permissions
before conducting the hijack Blue team
members should also be checking systems
and golden images for abandoned keys so
exploiting these abandoned keys doesn't
require any kind of bridge view
modifications so if you're only watching
for registry rights and HKC you you
could miss an attacker exploiting an
abandoned class idea
if you're developing security sensitive
applications or maybe if you're
reviewing an application the rugs in
userspace
don't rely on the OS or the registers
locate comm objects don't use Poe create
instance instead you should try to
identify the location of the library on
disk manually you know check the
registry check the files is to make sure
that this is a library that you're
expecting to load then you can call load
library and directly call the DLL gate
class object on the DLL still use all
become features without relying on
lookup procedure and this only applies
to user land processes is elevated
processes they're going to read directly
from hklm
which makes this type of abuse and
positive and if you were removing an
application component and where if your
application has been uninstalled please
clean up the registry you don't leave
dangling references to dll that don't
exist on the system that an attacker
I think there's a lot more that's
possible calm abuse that I didn't have
time to talk about today so I didn't
really talk about hijacking how to
process calm servers you know there
could be other rich dukey's that are
usable in the same way that you know
prog ID or treat as is Freda is another
really cool project so this is used for
reverse engineering and debugging I
think it can be used to get a better
understanding of calm client behavior
when it's activating calm object you
know what kind of specific user actions
will trigger loading a particular class
ID comma jacking also gives the attacker
the ability to hook calls between
applications reader modify their
contents access since the data change
application behavior this could be very
interesting to an attacker there's also
been some documented hijacks that give
bonus effects when hijacks a few
examples of this so Matt Nelson was able
to disable the Microsoft anti-malware
scanning interface this just gives a V
programs visibility into script
executions but he was able to do this he
was able to prevent the am GPL all from
being loaded through a comm hijack
that's really cool
James Porsche I was also able to
demonstrate a comp hijack which was part
of a larger attack code that was able to
execute code inside of ring 0 inside of
a VirtualBox kernel driver which a comm
hijack assisted with so I'm sure there's
other keys out there that Lyn hijacked
could uh you know maybe prevent some
type of EDR solution from access and a
DLL it needs dude there's a lot of that
I didn't have time to look at
so what am I going to be releasing on
github so I have a PowerShell script
basic surveys systems parsing data
related to comp I Jack and performing
hijacks I'll also releasing all the
concept details that I wrote this
presentation there's two approved
concepts that run a payload inside deal
I'll main I'll release the DLL which
measures thread lifetimes after the
library has been loaded all release of
proof of concepts or performing process
migrations only using comm hijacks I
expect to have this up within the next
week I just need a little bit more time
to clean up and document I really stand
on the shoulders of giants here my
presentations are not have been possible
without the help of some of my friends
without the support of fantasy group
research directors and other researchers
who have published their findings on
Comm abuse so thank you to all these
people on this slide does anyone have
any questions are there
[Music]
so that is definitely possible the
reason I didn't really go that route
every dll you want to hijack and that
would be a lot of work so I think the
kind of proxying technique that I showed
in neo Lumix like calm proxy project is
come the most effective and efficient
way of doing that
any other questions
yeah
can you speak up I can't hear you you
speak up okay
[Music]
[Applause]
[Music]
so I mean the powerful script is more
for just kind of research I really not
expecting this PowerShell script you
know inside of some environment because
I mean PowerShell is pretty suspicious
these days so this is the PowerShell
script is more for just on your own test
system identifying these hijack events
than using that on a different system
which you might have a little less
control over does that answer your
question
[Music]
I mean so there's not really there's no
way to block this prevent this from
happening and I other than like the sis
Mon config that monitors the in proxy
over 32 key editions
I don't I don't know if anyone's like
really scrutinizing that that sub key to
watch for these hijack events
[Music]
so I think endgame had a blog post about
calm hijacks where they were like oh
yeah will detect this but I mean I
haven't been able to test you know
endgame product other than that I don't
know of any other products that are
explicitly detecting this kind of
activity
[Music]
yes
[Music]
um I mean not being able to drop like a
DLL to disk using like the script of URL
hijack
I mean that could work like I said
scriptlet URL is not common occurrence
and I think newer versions of Windows
have like the Windows Defender
it's like WD I see I can't remember what
it stands for but it it prevents the
sckraab J DLL from the loading untrusted
scriptlet files it depends I can't
really answer that question
and feels alright there are neither
talked about other techniques that
entity group is using on our red team's
love to talk to you but I think you
listen