You are browsing the archive for Archaeology.

The Archaeologologogology #3 – Downloading stuff with cmdln32

April 30, 2017 in Archaeology, Reversing

One of the less-known tools residing in Windows system32 directory is cmdln32.exe. It is being used by CMAK (Connection Manager Administration Kit) to set up Connection Manager service profiles. The profile is typically packaged into an .exe that can be deployed to the user system. The package installs the profile that can be used to launch a Dial-up/VPN connection.

On older versions of Windows f.ex. XP you could fool cmdln32.exe to act as a simple downloader.

You can create 3 files:

  • A profile file
    [Profile Format]
    
    Version=4
    
    [Connection Manager]
    
    CMSFile=<settings file name - described next>
  • A settings file
    [Connection Manager]
    
    TunnelFile=<tunnel file name - described next>
  • A tunnel file
    [Settings]
    
    UpdateUrl=URL pointing to the file

The file that UpdateUrl points to needs to start with a [VPN Servers] Profile Section, followed by the actual data  f.ex.:

[VPN Servers]
This could be anything...

All you have to do now is to launch cmdl32.exe passing to it a full path to the profile file and providing a VPN argument f.ex.:

cmdln32 c:\test\profile /vpn

The program will read the profile file, then read the file name of the settings file; then read the settings file and extract the file name of the VPN tunnel file, and finally from the VPN file it will retrieve the URL for the update. Once downloaded, the file that the UpdateUrl location point to will replace the tunnel file (overwrite).

If it sounds complicated, it definitely is :), but it works and such download could potentially fly under radar of security products.

The request sent by the tool looks as follows:

GET / HTTP/1.1
User-Agent: Microsoft(R) Connection Manager Vpn File Update
Host: <domain>

So it’s easy to look for it in the logs. The version of the tool that is used on newer versions of Windows is a bit more careful. It checks if the RAS connection provided in the settings file is present (note, in my example the RAS connection is not listed inside the settings file) and only if it does, the tool continues. The alternative to the VPN download is the PhoneBook download, but this also requires the presence of the RAS connection. You can read about Connection Manager Tools and Settings on the Microsoft web page from 2003.

If you have a spare XP box you can test this functionality by downloading this package, placing its content inside c:\test and launching the cmdl32.exe via the following command:

cmdln32 c:\test\cmdl32_xp.cmp /vpn

Will this still work on newer versions?

I don’t know, but here are two ideas:

  • As long as _some_ program can be smuggled in to the victim’s system (f.ex. from the malicious attachment) it could launch cmdln32.exe under control of custom debugger and patch the RAS Enumeration check during run-time
  • Perhaps it’s possible to find a configuration where the RAS Enumeration check will work and knowing the RAS connection’s name one could set up a profile that would allow the download

In terms of forensics, you may find the following file inside the %TEMP% folder (XP-only):

  • %Temp%\VPN<random>.tmp

In any case, it’s just a trivia – it cannot really become a replacement for BITS…

The Archaeologologogology #2 – the romantic view as seen through the winlogon.exe’s window…

November 27, 2016 in Archaeology, Reversing

Every once in a while people report that they suspect their systems to be infected. This is because they discover their winlogon.exe uses a very unusual, and definitely suspicious icon – the one with a the Moon, and the stars:

winlogonYou won’t see this on Windows 8 or 10 anymore, but if you look at the resources of winlogon.exe you can still find the icon there:

winlogon10Looking for the code referring to ID 14 inside the Windows 10 winlogon.exe doesn’t show any immediate results. We can try to do the same with winlogon.exe from Windows 7 – one of the OSs on which the icon is still visible directly in the Windows Explorer pane. I couldn’t find the code either, but I noted that this time the icon was listed under a different ID (notably, Windows XP lists it under the very same ID):

winlogon7First, let’s try to explain why the icon is no longer visible inside the Windows Explorer on Windows 10&8.

When Explorer chooses the icon to show for a given executable it enumerates the resources inside the file and searches for the first one that is defined as RT_GROUP_ICON (which is a bit like a set of icons – the good ol’ Resource Hacker shows it under the “Icon Group” branch). As a side note, the most typical way RT_GROUP_ICON lists are defined makes the very first icon we see on the list of icons inside Resource Hacker the one that is used by Windows Explorer.

Let’s have a look at the winlogon.exe icon groups from Windows 7.

winlogon10-iconsThe first one is ‘IDD_APPLICAITON_ICO’.

(As a side note, you have probably noticed the typo i.e. ‘applicaiton’ vs. ‘application’ in the ‘IDD_APPLICAITON_ICO’ ID name. It is actually quite an important mistake and I will explain why later on)

On Windows 7 it is slightly different:

winlogon7_iconsRight, so it’s ‘IDD_SHUTDOWN_BITMAP’, and the only icon in this set is… the Moon&the stars.

Going a bit further back, the Windows XP doesn’t use the name, but the number 4:

winlogonxpSo, we see the icon on Windows XP and 7, because it’s the very first RT_GROUP_ICON listed.

One mystery solved.

Let’s come back to the resource names we came across inside winlogon.exe from Windows 10. The name of the ‘IDD_SHUTDOWN_BITMAP’ may look familiar – if you take another look at that window (see below) you will notice that the developers inserted ‘IDD_APPLICAITON_ICO’ right above the ‘IDD_SHUTDOWN_BITMAP’ group – we can also confirm the latter is the very same icon group as in Windows 7 and on Windows XP:

winlogon10-icons2So, it’s obviously a cosmetic change intended to replace the romantic icon with a boring default application image in the newer versions of Windows.

If we take yet another look at the Icon Groups above, there is one more detail that is quite striking. There are 2 groups that use names (prefix ‘IDD_’) and 2 that use numbers.

Was it intentional?

I don’t think so.

The way Resource compiler works is that when the resource files (files with the extension .rc /which I believe are still used to build the ‘old’ executables even on Windows 10/) are compiled, the parser is looking for definitions of resource IDs which other resources may later refer to. Typical way to use the ID names is by using the approach shown below.

Inside the header file (resource.h) you write something along these lines:

#define IDD_SHUTDOWN_BITMAP 4

and later, you can refer to this resource by using the defined name (inside the .rc file):

IDD_SHUTDOWN_BITMAP ICON "moonstars.ico"

The funny side-effect (a bug/feature?) of the resource compiler is that it does not complain when it comes across a resource name that has not been defined earlier. In such cases it will blindly assume that it is… a string (a text). The root cause for this is that resource ID can be both numbers, and strings, so the arbitrary decision by the Resource Compiler to treat all unknown resource names as strings creates situations we see demonstrated on the above screenshots. Note that I intentionally chose to define IDD_SHUTDOWN_BITMAP as 4 (#define IDD_SHUTDOWN_BITMAP 4) to bring your attention to the difference between Windows XP (Icon group is number 4) and Windows 7 (icon group is a textual name ‘IDD_SHUTDOWN_BITMAP’).

The winlogon developer most likely modified the source code and removed a number of things between XP, Vista and 7, but failed to remove:

  • the icon itself
  • the group icon resource
  • and even if these 2 were meant to stay, the dev most likely removed the ‘IDD_SHUTDOWN_BITMAP’ declaration from the header file – this made the resource compiler incorporate the actual constant name into the compiled resource!

And this is where I can come back to the typo I mentioned earlier & why is it important. What I believe happened is that the dev declared:

#define IDD_APPLICATION_ICO <some number>

inside the header file, but then inside the .rc file referred to the name making a typo :

IDD_APPLICAITON_ICO ICON "moonstars.ico"

Resource Compiler couldn’t find the declaration of IDD_APPLICAITON_ICO and decided to treat it as a string.

So, it’s an unintentional data leakage in both cases as we learn about constants used in the source code 🙂

Finally, it’s time to reveal what was the purpose of the romantic icon…

Luckily, this is actually quite simple: by checking what other stuff can be found inside resources of winlogon.exe from XP, we can discover this dialog box definition:

winlogonxp_dialogand which Resource Hacker allows us to preview as:

winlogonxp_dialog2This is a dialog box that would pop up on ancient versions of Windows NT (before APM became a standard?) – luckily someone made a youtube video how it looks like so you can confirm it yourself.

The code referring to it is still partially present inside the winlogon.exe from Windows XP, but the dialog template is not really used after being loaded.

The described typos, partially removed code, and the ancient artifacts still present in Windows 10 should be a good excuse for anyone interested in reversing and forensics to explore the system internals more – fundamentally, reversing is reading other peoples’ code and bugs are a norm & knowing how tools that build programs work allow us to better understand the root cause of some of these mistakes.