Category Archives: Autostart (Persistence)

Beyond good ol’ Run key, Part 126

Posted on by

This is another quick post — this time about QT framework plugins; in fact, there is not much to write about it as it’s already fairly well documented on QT page.

The basic idea is that you can load additional plugins to programs written in QT by using either an environment path QT_DEBUG_PLUGINS or by editing a qt.conf file (creating if it doesn’t exist). If you are using IDA you might have noticed that qt.conf can be found a program’s main directory.

Luckily, plugin development has a lot of constraints and they will fail if these constraints are not met (read the article I linked to).

There is a growing number of QT-based applications hence this could be useful one day.

Beyond good ol’ Run key, Part 125

Posted on by

Update

Turns out @0gtweet posted about it in January and I missed that!!!

Old Post

Been awhile since I posted in this series, so here comes a new trick.

It is not your typical executable for sure, change.exe that is. When I looked at it for the first time I was perplexed — within first few lines of code it literally executes other executables. Must be something good I thought, and good it was indeed.

When launched, change.exe does something very strange – it enumerates Registry entries under this location:

  • HKLM\System\CurrentControlSet\Control\Terminal Server\Utilities\change

These entries are … interesting, because they look like some stringified flags followed by executable names. Possible abuse opportunity?

When you run ‘change /?’ you get the following help information:

CHANGE { LOGON | PORT | USER }

Do you see the pattern? — no? look at these Registry entries again.

In my first attempt I added ‘foo|0 1 NOTEPAD notepad.exe’:

I then ran ‘change notepad’ and … notepad executed.

Now, if you paid attention there are other registry keys listed on the first screenshot:

change -> change.exe 
query -> query.exe 
reset -> reset.exe

They all follow the same pattern and fetch command list from Registry!

So you can either add a new entry, or modify an existing one. Access rights are in place and the key is owned by TrustedInstaller, but… well… once on the box, always on the box.

Last, but not least – it’s a persistence mechanism and a LOLBIN in one.