Category Archives: Archaeology

RTF…M

Posted on by

One of the best ways to generate ideas for research is reading manuals and original documentation. Not only we learn new stuff, we also re-learn the old stuff and if we happen to re-visit different versions of the same documentation over the years there are chances that a) we will be aware of changes & stuff that has been phased out b) we will be able to find stuff we missed in previous reading iterations.

Such is the case I want to quickly discuss today.

If I asked you what is the RTF file magic you would most likely reply:

{\rtf OR {\rtf1

Well, I thought so too until I looked at Rich Text Format (RTF) Specification again. It is where I found the following long-forgotten tags:

  • \pwdN
    • Substitute for \rtfN. Introduced by Pocket Word to distinguish its files from general RTF files. Currently only 1 is emitted and the number is ignored by the RTF reader.
  • \urtfN
    • Identifies an RTF file in which all text characters are encoded in UTF-8. Only binary data escapes this transformation. Word does not read this encoding of RTF.

So, there you have it… corner cases, you can’t exploit them per se (I think), but at least now we know.

Certulitis – one tool that keeps on giving

Posted on by

Update

EC who is one of the most technical guys I know pinged me because he figured out the meaning of that 0x00FB switch, The idea behind it is Windows archeology at its best and it goes as follows:

The code page your windows terminal uses is 437. Endash (‘–’) is an ASCII character 150 (0x96). When this character is inputted on terminal using code page 437 it will be mapped to ‘û’ which is code 0xFB.

How to use it with certutil?

You can run:

certutil ALT+150<command of your choice>

Old Post

Certutil is a really naughty tool. It accepts lots of various command line arguments that I believe are not widely known – and this post (and maybe some follow-up posts) is hoping to change that.

One of the first things I caught when I started analysing its command line arguments was the mysterious, case-insensitive command line argument comparison with the ‘uSAGE’ string. It turns out that certutil offers two different usage information depending on a command line option. If you just use ‘?’ then it’s the ‘official’ version. If it’s ‘uSAGE’ then it’s the unofficial one. Of course, once I found out I ran into Google and Twitter to find out if it is IN THE KNOWN.

Yes, it was. @0gtweet did it my favourite way – the hard way :-), @dunarth did it the right way, and @chris_ayres did it the earliest way (AFAICT).

Okay, with this out of the way, we look at the actual command line arguments.

Wait. What about the command line switches? Similarly to PowerShell, certutil accepts command line arguments using a number of different characters:

  • / (Unicode 0x002F)
  • – (Unicode 0x002D)
  • – (Unicode 0x2013)
  • − (Unicode 0x2212)
  • ? (Unicode 0x00FB)

I still can’t figure out why the last Unicode character on that list is being accepted. The Unicode character 0x00FB is ‘û’. If you know, please let me know and I will update the post.

Another discovery is brought to us by two unusual environment variables:

  • certsrv_rawhex – shows stuff in raw hex (e.g. certs)
  • CertSrv_Chain – enables debugging information being available for cert chain
  • CERTSRV_LOGMAX – maximum length of the certutil.log file
  • CERTSRV_DEBUG – enables certutil debug mode
  • CERTSRV_LOGFILE – name of the log file

The ‘certutil.log’ file is a log file that is created if DbgIsSSActive function imported from ‘certcli.dll’ which forwards it to ‘certca.dll’ returns true. I am kidding, it’s a convoluted way to say that certain conditions need to be met for the ‘certutil.log’ to be created, They can be either set via Registry (HKLM\Software\Microsoft\Cryptography\AutoEnrollment\Debug=XXX OR HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\Debug=XXX), or via environment variables listed below.

In fact, setting 

set CERTSRV_LOGFILE=c:\test\foo.log
set CERTSRV_DEBUG=0xFFFFFFFF

will enable full logging to your main console and to the file c:\test\foo.log.

Pick up your favorite certutil command and give it a go. You will like the output as it helps to troubleshoot your manual testing 🙂

Finally, while certutil is primarily a command line application, it does create a windows called ‘CertUtil Application’ of class ‘CertUtil’, and apart from it, provides a UI for some of its commands (e..g -URL).