{"id":2774,"date":"2015-01-09T18:11:14","date_gmt":"2015-01-09T18:11:14","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=2774"},"modified":"2015-01-09T18:19:58","modified_gmt":"2015-01-09T18:19:58","slug":"beyond-good-ol-run-key-part-23","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/01\/09\/beyond-good-ol-run-key-part-23\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 23"},"content":{"rendered":"

Today I will talk about something that can be called ‘the god of all persistence mechanisms’. One that is so powerful that can use pretty much any .exe on your system as a persistence mechanism.<\/p>\n

It’s called dotlocal (.local).<\/p>\n

If you run Process Monitor often enough you will (sooner or later) discover that anytime you launch an .exe the system will always try to find a file or a directory called <filename.exe>.local.<\/p>\n

That – my friend – is a debugging feature.<\/p>\n

It is a redirection mechanism designed to test COM objects<\/a> and pretty much means that if either a file or directory named\u00a0<filename.exe>.local exists the OS will understand it as a ‘testing in progress’ signal and will attempt to load DLLs from a different directory than usual. In other words, it will search for dependent DLL libraries in a path different from the typical DLL search order<\/a>. This allows us to intercept pretty much any DLL dependency we wish except for these that are listed under KnownDLLs registry key (HKLM\\CurrentControlSet\\Control\\Session Manager\\KnownDlls).<\/p>\n

For the sake of a demo, I will show you a very stupid example using the least malicious program on your system called… Notepad.<\/p>\n

Notepad relies on a couple of libraries, most of them are present on the Known DLLs list (can’t be abused unless you remove them from the Registry and reboot the system); except for comctl32.dll. This library has many versions and thanks to that requires a dedicated entry in the manifest solving the so-called DLL hell problem:<\/p>\n

<dependency>\r\n\u00a0\u00a0\u00a0 <dependentAssembly>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <assemblyIdentity\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 type=\"win32\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 name=\"Microsoft.Windows.Common-Controls\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 version=\"6.0.0.0\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 processorArchitecture=\"x86\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 publicKeyToken=\"6595b64144ccf1df\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 language=\"*\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/>\r\n\u00a0\u00a0\u00a0 <\/dependentAssembly>\r\n<\/dependency><\/pre>\n
The practical implication of this manifest file is that OS will try to load the following comctl32.dll file (on Windows XP)<\/p>\n
x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\\comctl32.dll<\/p>\n
located inside the Windows directory (c:\\WINDOWS\\WinSxS\\).<\/p>\n
Introducing a directory c:\\windows\\system32\\notepad.exe.local we can force the OS to leverage the dotlocal ‘feature’ and load the following ‘malicious’ library instead:<\/p>\n
c:\\WINDOWS\\system32\\notepad.exe.local<\/strong>\\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\\comctl32.dll<\/p>\n
It works on Windows 10 too, except that it will be loaded from a different path:<\/p>\n
c:\\WINDOWS\\system32\\notepad.exe.local<\/strong>\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9841.0_none_38d154a85935aa0a\\comctl32.dll<\/p>\n
The following example shows the moment of a malicious DLL loaded via dotlocal mechanism into a Notepad session on Windows 10.<\/p>\n
\"notepad10\"<\/a><\/p>\n
Notepad obviously crashes, cuz I was lazy and just implemented a dummy comctl32.dll, but in a real-case scenario one could hide the presence of such a malicious DLL by using it as a proxy and redirecting all API calls to the legitimate comctl32.dll DLL.<\/p>\n
\"notepad10_2\"<\/a><\/p>\n
In other words, dropping the malicious comctl32.dll in these directories on respective systems will ensure that these malicious DLLs are loaded anytime someone starts Notepad.<\/p>\n
Now, for the scary part. Notepad was a stupid example as it requires admin rights to write to c:\\WINDOWS\\system32\\notepad.exe.local\\ on Windows 10, but any file outside of areas protected by system is a much easier target.<\/p>\n","protected":false},"excerpt":{"rendered":"
Today I will talk about something that can be called ‘the god of all persistence mechanisms’. One that is so powerful that can use pretty much any .exe on your system as a persistence mechanism. It’s called dotlocal (.local). If … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35,15,19,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2774"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=2774"}],"version-history":[{"count":4,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2774\/revisions"}],"predecessor-version":[{"id":2781,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/2774\/revisions\/2781"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=2774"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=2774"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=2774"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}