{"id":3768,"date":"2016-07-28T21:34:44","date_gmt":"2016-07-28T21:34:44","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3768"},"modified":"2016-07-28T22:53:30","modified_gmt":"2016-07-28T22:53:30","slug":"beyond-good-ol-run-key-part-43","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2016\/07\/28\/beyond-good-ol-run-key-part-43\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 43"},"content":{"rendered":"<p>Testing, testing, testing&#8230; such an important part of the software development cycle. So important that its components are often referenced in the release code.<\/p>\n<p>The testing functionality in Microsoft products is nothing new. I wrote about it <a href=\"https:\/\/www.hexacorn.com\/blog\/2014\/02\/09\/beyond-good-ol-run-key-part-7\/\">here<\/a>, and <a href=\"https:\/\/www.hexacorn.com\/blog\/2014\/04\/16\/beyond-good-ol-run-key-part-10\/\">here<\/a>. And today I will write about yet another component which appears to be testing-related and&#8230; can be abused to achieve persistence. This time, on Windows 10 only (have not tested servers).<\/p>\n<p>When Windows 10 accepts the remote desktop session, it queries the following Registry key:<\/p>\n<ul>\n<li>HKLM\\SYSTEM\\CurrentControlSet\\Control\\<br \/>\nTerminal Server\\AddIns\\TestDVCPlugin<\/li>\n<\/ul>\n<p>If such key exists, the OS will attempt to read the <em>Path<\/em> value underneath.<\/p>\n<p>Once the <em>Path<\/em> is read, the DLL that it points to will be loaded via LoadLibrary.<\/p>\n<p>And that&#8217;s it! We now have yet another persistent mechanism to load the DLL. Anytime the first remote desktop session is established&#8230;<\/p>\n<p>An example of the potential malicious Registry Entry is shown below:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin0.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3769\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin0-300x222.png\" alt=\"TestDVCPlugin0\" width=\"400\" height=\"297\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin0-300x222.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin0.png 596w\" sizes=\"(max-width: 400px) 100vw, 400px\" \/><\/a><\/p>\n<p>In a test scenario, I created a DLL that &#8211; when loaded &#8211; creates a c:\\test\\test_attached file.<\/p>\n<p>The following screenshot shows what happens:<\/p>\n<ul>\n<li>The user is logged on (console session) &#8211; the two first commands show situation at that moment and no presence of the file created by the DLL<\/li>\n<li>The user then logs on remotely (under the same account &#8211; rdp-tcp#1 session).<\/li>\n<li>The moment user logs on, the c:\\test\\test_attached file is created &#8211; the code is loaded<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3770\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin1-300x190.png\" alt=\"TestDVCPlugin1\" width=\"400\" height=\"253\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin1-300x190.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin1-80x50.png 80w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin1.png 455w\" sizes=\"(max-width: 400px) 100vw, 400px\" \/><\/a><\/p>\n<p>The c:\\test\\test.dll is loaded into svchost.exe process and stays resident (until reboot\/service restart)<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3771\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin2-300x241.png\" alt=\"TestDVCPlugin2\" width=\"400\" height=\"322\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin2-300x241.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/07\/TestDVCPlugin2.png 638w\" sizes=\"(max-width: 400px) 100vw, 400px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Testing, testing, testing&#8230; such an important part of the software development cycle. So important that its components are often referenced in the release code. The testing functionality in Microsoft products is nothing new. I wrote about it here, and here. &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2016\/07\/28\/beyond-good-ol-run-key-part-43\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35,15,19,46,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3768"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3768"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3768\/revisions"}],"predecessor-version":[{"id":3776,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3768\/revisions\/3776"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}