You are browsing the archive for Living off the land.

Beyond good ol’ Run key, Part 125

July 30, 2020 in Autostart (Persistence), Living off the land, LOLBins

Update

Turns out @0gtweet posted about it in January and I missed that!!!

Old Post

Been awhile since I posted in this series, so here comes a new trick.

It is not your typical executable for sure, change.exe that is. When I looked at it for the first time I was perplexed — within first few lines of code it literally executes other executables. Must be something good I thought, and good it was indeed.

When launched, change.exe does something very strange – it enumerates Registry entries under this location:

  • HKLM\System\CurrentControlSet\Control\Terminal Server\Utilities\change

These entries are … interesting, because they look like some stringified flags followed by executable names. Possible abuse opportunity?

When you run ‘change /?’ you get the following help information:

CHANGE { LOGON | PORT | USER }

Do you see the pattern? — no? look at these Registry entries again.

In my first attempt I added ‘foo|0 1 NOTEPAD notepad.exe’:

I then ran ‘change notepad’ and … notepad executed.

Now, if you paid attention there are other registry keys listed on the first screenshot:

change -> change.exe 
query -> query.exe 
reset -> reset.exe

They all follow the same pattern and fetch command list from Registry!

So you can either add a new entry, or modify an existing one. Access rights are in place and the key is owned by TrustedInstaller, but… well… once on the box, always on the box.

Last, but not least – it’s a persistence mechanism and a LOLBIN in one.

How to con your host?

May 25, 2020 in Living off the land, LOLBins

Good bye threat hunting configs and filters of the past. Microsoft introduced Windows Terminal and there is no way back.

While reading its actual source code today I noticed quite a lot of familiar code (I did poke around in conhost.exe code with Ida before), but then I stumbled upon an interesting bit that this post is all about.

The following command:

conhost.exe notepad.exe

doesn’t do anything on older version of Windows 10. However, the latest version (tested on 18363) has a little LOLBINish surprise:

So… go back to your config and remove filters on conhost.exe. Remember, hate the message, not the messenger 😉