MUI Poisoning in practice

In my old post I discussed the idea of MUI poisoning. Today I want to show a practical example of this technique – one that has an interesting impact on incident response efforts.

Some security solutions rely on running local, native OS binaries to collect information from the system. Tool like netstat, ipconfig, etc. are executed on regular basis and data is collected and aggregated in some log repository.

These local tools often rely on MUI files and this is where we step in. By modifying the MUI files of selected tools one could force these tools to return complete garbage. For instance, the following example shows netstat.exe where its MUI was modified to always return a source IP where the destination IP would be listed. The change can be made using the old tool Resource Hacker:

Once we replace the MUI file, netstat.exe will return stuff like this:

This anti-forensic technique could be potentially expanded to cover every single piece of software that relies on external language files (let it be MUI, or anything else). As long as these format string patterns can be manipulated security software could be forced to present garbage output; for instance – malware alerts reporting wrong paths (e.g. hardcoded, non existing paths), or Windows Event logs reporting misleading information.

Command line do-nothingness

Yesterday I came up with a silly game – find commands that do nothing, when executed from command line. I didn’t specify rules very precisely, but the rough idea was that the commands shouldn’t modify the environment. Grzegorz and a few other researchers joined me in this game and they added a lot of twisted and creative ideas (thx!).

One may ask: why doing it at all?

First of all it is fun. Secondly, it is a good research exercise as it brings ideas that may expose imperfections of a command line interpreter and tools. These in turn may lead to some new research avenues. In fact, many lolbin and persistence discoveries started with observing what commands and programs do, when executed (including checking the command line arguments they expect).

This is a list of all commands we came up with:

rem foo
:foo goto foo
for %k in () do echo
goto :eof
if foo==foo goto :eof
pushd . & popd
type nul
:: foo
echo > nul
copy nul nul
copy nul .
copy nul con
call call
cmd /c exit
cmd /r exit
cd .
cd .\.\.\.\.\.
cd ./././././.
cmd /c exit
cmd /r exit

We also had a few cheats (stream redirection/piping):

ver > nul
vol > nul
time /t >nul
set foooooo=
copy nul nul > nul
echo > NUL
copy nul > nul

And the funny bits discovered? Let’s have a look.

  • nul – non existing and non-sensical command, but you can still launch it and cmd.exe will report “Access is denied.”
  • copy nul nul – reports “1 file(s) copied.”
  • certutil – when launched w/o any command line argument, it prints out non-sensical “CertUtil: -dump command completed successfully.”
  • hostname – when launched with an invalid command line argument it shows non-sensical “sethostname: Use the Network Control Panel Applet to set hostname. hostname -s is not supported.”
  • set ” ” – prints additional 2 extra lines that don’t show up when you run “set”