{"id":2299,"date":"2014-02-20T13:56:40","date_gmt":"2014-02-20T13:56:40","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=2299"},"modified":"2014-02-20T13:58:25","modified_gmt":"2014-02-20T13:58:25","slug":"trivial-appid-impersonation","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2014\/02\/20\/trivial-appid-impersonation\/","title":{"rendered":"Trivial AppID Impersonation"},"content":{"rendered":"<p>I was wondering what would happen if one tried to impersonate the AppID of the common applications i.e. run my own application and change its AppID to that of a well-known application during run-time. Kinda lame, I know.<\/p>\n<p>To test it, I wrote a quick PoC that uses <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/dd378422%28v=vs.85%29.aspx\">SetCurrentProcessExplicitAppUserModelID<\/a> API to pretend it is Internet Explorer, Remote Desktop and Sticky Notes using their respective AppIDs. I also added the AppID for Notepad &#8211; while it doesn&#8217;t have a standard AppID like the 3 other applications I just wanted to show that we can still enforce the AppID association using Notepad&#8217;s normalized path {D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\notepad.exe (for details see my older post about <a title=\"JumpLists file names and AppID calculator\" href=\"https:\/\/www.hexacorn.com\/blog\/2013\/04\/30\/jumplists-file-names-and-appid-calculator\/\">AppIDs<\/a>).<\/p>\n<p>Here&#8217;s a list of AppIDs used:<\/p>\n<ul>\n<li>Internet Explorer &#8211; Microsoft.InternetExplorer.Default<\/li>\n<li>Remote Desktop &#8211; Microsoft.Windows.RemoteDesktop<\/li>\n<li>Sticky Notes &#8211; Microsoft.Windows.StickyNotes<\/li>\n<li>Notepad &#8211; {D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\notepad.exe<\/li>\n<\/ul>\n<p>I pinned all these 4 applications to the Taskbar on Windows 8.1. and then ran my test application, pausing it each time I changed the AppID to take a screenshot I got the result combined on the below picture. Not surprisingly anytime I changed the AppID a different pinned taskbar icon got highlighted (the test application needs to do some GUI operation for it to work; it can simply show a message box).<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2014\/02\/appid_rotation.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-2300\" alt=\"appid_rotation\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2014\/02\/appid_rotation.png\" width=\"564\" height=\"159\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2014\/02\/appid_rotation.png 564w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2014\/02\/appid_rotation-300x84.png 300w\" sizes=\"(max-width: 564px) 100vw, 564px\" \/><\/a><\/p>\n<p>This is quite a tiny level of impersonation &#8211; hard to really come up with some really useful scenarios here &#8211; perhaps one could use it to enforce social engineering attempts (e.g. escalation of privileges triggered by malware while pretending to be from some legitimate Windows application, or perhaps AV) ? But aren&#8217;t existing GUI manipulation tricks better than that? Oh well, trivial is trivial.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I was wondering what would happen if one tried to impersonate the AppID of the common applications i.e. run my own application and change its AppID to that of a well-known application during run-time. Kinda lame, I know. To test &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2014\/02\/20\/trivial-appid-impersonation\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[31,18],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2299"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=2299"}],"version-history":[{"count":6,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2299\/revisions"}],"predecessor-version":[{"id":2306,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2299\/revisions\/2306"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=2299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=2299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=2299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}