{"id":4081,"date":"2017-01-16T19:43:00","date_gmt":"2017-01-16T19:43:00","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4081"},"modified":"2017-01-16T19:43:00","modified_gmt":"2017-01-16T19:43:00","slug":"beyond-good-ol-run-key-part-54","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/01\/16\/beyond-good-ol-run-key-part-54\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 54"},"content":{"rendered":"<p>The need to test modules and the will to support legacy stuff have one thing in common &#8211; at least on Windows. These functions are heavily integrated with the system and both offer lots of various built-in mechanisms that can be used as an uncommon persistence mechanism. I have already described many of them, but recently I came across yet another legacy settings that we can add to our &#8216;dodgy autostart&#8217; repertoire.<\/p>\n<p>Let me introduce you to so-called Legacy CPL Mapping.<\/p>\n<p>It is available since at least Windows 7, works under win10, and&#8230; it has to do with the way Control Panel Applets are launched; speaking pragmatically &#8211; there is a setting in Registry that helps to handle legacy Control Panel Applets.<\/p>\n<p>The setting is stored in the following location:<\/p>\n<ul>\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\<br \/>\nControl Panel\\Legacy CPL Map<\/li>\n<\/ul>\n<p>By opening a number of CPL files and filtering procmon logs to focus on the &#8216;Legacy CPL Map&#8217; keys only we can quickly confirm that anytime the .cpl file is launched, the system &#8216;talks&#8217; to the Registry to check the respective &#8216;Legacy CPL Map&#8217; setting for the applet:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4084\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap-300x90.png\" width=\"500\" height=\"150\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap-300x90.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap-768x230.png 768w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap.png 1007w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a>The keys stored underneath include names of the Control Panel applets, and can be CPL names (f.ex. main.cpl), <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ee330741(v=vs.85).aspx\">canonical names<\/a> (f.ex.: Microsoft.PowerOptions, Microsoft.EaseOfAccessCenter), or DLLs (f.ex. ntvdmcpl.dll \/this is the one that actually led me to this discovery\/).<\/p>\n<p>Each key represent the legacy setting for a given applet and can contain one of two values:<\/p>\n<ul>\n<li>AppletCanonicalName<\/li>\n<li>ShellExecute<\/li>\n<\/ul>\n<p>The first is a canonical name of the applet we wish to replace the legacy applet with (f.ex. could use &#8216;Microsoft.PowerOptions&#8217;). The name is then used by the <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/bb775394(v=vs.85).aspx\">IOpenControlPanel::Open<\/a> method to launch the mapped applet.<\/p>\n<p>The second is just a command line that will be passed to ShellExecuteEx function.<\/p>\n<p>Obviously, both can be abused.<\/p>\n<p>Let&#8217;s have a look at the easy one &#8211; the ShellExecute.<\/p>\n<p>The settings:<\/p>\n<ul>\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\<br \/>\nControl Panel\\Legacy CPL Map\\Microsoft.PowerOptions\\ShellExecute<\/li>\n<\/ul>\n<p>are being accessed when we click the &#8216;Additional Power Settings&#8217; button under Settings\\Power &amp; Sleep:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap3.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4082\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap3-300x207.png\" width=\"500\" height=\"345\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap3-300x207.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap3.png 639w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>By setting this value to calc.exe, we will launch the Calculator anytime someone tries to launch these settings:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap4.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4085\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap4-300x270.png\" width=\"500\" height=\"451\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap4-300x270.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap4-768x692.png 768w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap4.png 842w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>This is what procmon sees when we click the button:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4083\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap2-300x36.png\" width=\"499\" height=\"60\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap2-300x36.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap2-768x92.png 768w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap2-1024x123.png 1024w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/cplmap2.png 1247w\" sizes=\"(max-width: 499px) 100vw, 499px\" \/><\/a><\/p>\n<p>Of course, relying on Power Options is probably not enough &#8211; some users don&#8217;t touch it all. But&#8230; There is plenty of other .cpl files to look at&#8230;<\/p>\n<ul>\n<li>c:\\WINDOWS\\system32\\appwiz.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\bthprops.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\desk.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\Firewall.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\FlashPlayerCPLApp.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\hdwwiz.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\inetcpl.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\intl.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\irprops.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\joy.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\main.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\mmsys.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\ncpa.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\powercfg.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\sysdm.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\TabletPC.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\telephon.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\timedate.cpl<\/li>\n<li>c:\\WINDOWS\\system32\\wscui.cpl<\/li>\n<\/ul>\n<p>Another interesting feature: one could add &#8216;c:\\WINDOWS\\system32\\powercfg.cpl&#8217;, or any other .cpl to one of the standard Startup locations and it will never raise suspicion since it&#8217;s a Microsoft-signed binary. Once the Startup entry is launched, the calc.exe (or possible malware) will pop up!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The need to test modules and the will to support legacy stuff have one thing in common &#8211; at least on Windows. These functions are heavily integrated with the system and both offer lots of various built-in mechanisms that can &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/01\/16\/beyond-good-ol-run-key-part-54\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35,15,19,46,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4081"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4081"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4081\/revisions"}],"predecessor-version":[{"id":4087,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4081\/revisions\/4087"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4081"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4081"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4081"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}