The Archaeologologogology #3 – Downloading stuff with cmdln32

Posted on by

Update 2021-11-03

Turns out there is a way to make it work on newer OSes — see @ElliotKillick post demoing it !

Old post

One of the less-known tools residing in Windows system32 directory is cmdln32.exe. It is being used by CMAK (Connection Manager Administration Kit) to set up Connection Manager service profiles. The profile is typically packaged into an .exe that can be deployed to the user system. The package installs the profile that can be used to launch a Dial-up/VPN connection.

On older versions of Windows f.ex. XP you could fool cmdln32.exe to act as a simple downloader.

You can create 3 files:

  • A profile file 
    [Profile Format]

Version=4

[Connection Manager]

CMSFile=<settings file name - described next>
  • A settings file 
    [Connection Manager]

TunnelFile=<tunnel file name - described next>
  • A tunnel file 
    [Settings]

UpdateUrl=URL pointing to the file

The file that UpdateUrl points to needs to start with a [VPN Servers] Profile Section, followed by the actual data  f.ex.:

[VPN Servers]
This could be anything...

All you have to do now is to launch cmdl32.exe passing to it a full path to the profile file and providing a VPN argument f.ex.:

cmdln32 c:\test\profile /vpn

The program will read the profile file, then read the file name of the settings file; then read the settings file and extract the file name of the VPN tunnel file, and finally from the VPN file it will retrieve the URL for the update. Once downloaded, the file that the UpdateUrl location point to will replace the tunnel file (overwrite).

If it sounds complicated, it definitely is :), but it works and such download could potentially fly under radar of security products.

The request sent by the tool looks as follows:

GET / HTTP/1.1
User-Agent: Microsoft(R) Connection Manager Vpn File Update
Host: <domain>

So it’s easy to look for it in the logs. The version of the tool that is used on newer versions of Windows is a bit more careful. It checks if the RAS connection provided in the settings file is present (note, in my example the RAS connection is not listed inside the settings file) and only if it does, the tool continues. The alternative to the VPN download is the PhoneBook download, but this also requires the presence of the RAS connection. You can read about Connection Manager Tools and Settings on the Microsoft web page from 2003.

If you have a spare XP box you can test this functionality by downloading this package, placing its content inside c:\test and launching the cmdl32.exe via the following command:

cmdln32 c:\test\cmdl32_xp.cmp /vpn

Will this still work on newer versions?

I don’t know, but here are two ideas:

  • As long as _some_ program can be smuggled in to the victim’s system (f.ex. from the malicious attachment) it could launch cmdln32.exe under control of custom debugger and patch the RAS Enumeration check during run-time
  • Perhaps it’s possible to find a configuration where the RAS Enumeration check will work and knowing the RAS connection’s name one could set up a profile that would allow the download

In terms of forensics, you may find the following file inside the %TEMP% folder (XP-only):

  • %Temp%\VPN<random>.tmp

In any case, it’s just a trivia – it cannot really become a replacement for BITS…

Beyond good ol’ Run key, Part 62

Posted on by

Update

This is not an RCE. If it was, I would not publish it on this blog 🙂

Turns out “Simpsons already did it” and as pointed out by @arekfurt a normal template-based persistence is already implemented in EmpireProject and is based on awesome work of @enigma0x3. Interestingly, enabling macros is not needed to deliver the same functionality (as explained below).

Dropping any macro sheet inside the XLSTART folder and opening it from there will not show the macro warning 🙂

Old Post

Every once in a while we come across weird things that we not only discover accidentally, but are finding hard to understand. Today I was playing around with Word Macros and to my surprise I was able to accidentally run one, while my Macro Options were set to Disable all macros with notification.

Intrigued, I quickly realized that instead of adding it to a test word document, I accidentally added it to the normal template file.

Could it be… ?

I rushed to add the AutoOpen macro to the normal template that will launch the Calculator anytime the template is used:

Now I only needed to open some word document…

How nice!

Interestingly, the Security Warning appears ONLY after I visit options while the document is open.

Swap calculator with anything else, and a new stealth persistence mechanism is born…

Now, what about Excel?

Excel doesn’t have the Normal template equivalent by default, but you can add one. To do so, you just need to record any macro named Auto_Open and store it inside a personal template (by choosing ‘Store macro in Personal Macro Workbook‘):

(alternatively, you can create a personal template directly on the system by placing a prepared XLSB file in a following location: c:\Users\<USER>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB)

Then switch to the macro editor, and write the code as below:

This will ensure the Calculator will be executed anytime someone opens Excel, even if the macros are *cough* *cough* disabled…