{"id":4614,"date":"2018-02-04T01:30:25","date_gmt":"2018-02-04T01:30:25","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4614"},"modified":"2018-02-04T01:38:50","modified_gmt":"2018-02-04T01:38:50","slug":"propagate-follow-up-2-some-more-shattering-attack-potentials","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/02\/04\/propagate-follow-up-2-some-more-shattering-attack-potentials\/","title":{"rendered":"PROPagate follow-up #2 \u2013 Some more Shattering Attack Potentials"},"content":{"rendered":"<p>A few months back I discovered a new code injection technique that I named <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/10\/26\/propagate-a-new-code-injection-trick\/\">PROPagate<\/a>. Using a subclass of a well-known <a href=\"https:\/\/en.wikipedia.org\/wiki\/Shatter_attack\">shatter attack<\/a> one can modify the callback function pointers inside other processes by using Windows APIs like SetProp, and potentially others. After pointing out a <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/11\/03\/propagate-a-new-code-injection-trick-64-bit-and-32-bit\/\">few<\/a> <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/11\/07\/propagate-follow-up-some-more-shattering-attack-potentials\/\">ideas<\/a> I put it on a back burner for a while, but I knew I will want to explore some more possibilities in the future.<\/p>\n<p>In particular, I was curious what are the chances one could force the remote process to indirectly call the &#8216;prohibited&#8217; functions like SetWindowLong, SetClassLong (or their newer alternatives SetWindowLongPtr and SetClassLongPtr), but with the arguments that we control (i.e. from a remote process). These API are &#8216;prohibited&#8217; because they can only be called in a context of a process that owns them, so we can&#8217;t directly call them and target windows that belong to other processes.<\/p>\n<p>It turns out his may be possible!<\/p>\n<p>If there is one common way of using the SetWindowLong API it is to set up pointers, and\/or filling-in window-specific memory areas (allocated per window instance) with some values that are initialized immediately after the window is created. The same thing happens when the window is destroyed &#8211; during the latter these memory areas are usually freed and set to zeroes, and callbacks are discarded.<\/p>\n<p>These two actions are associated with two very specific window messages:<\/p>\n<ul>\n<li>\n<pre>WM_NCCREATE<\/pre>\n<\/li>\n<li>\n<pre>WM_NCDESTROY<\/pre>\n<\/li>\n<\/ul>\n<p>In fact, many &#8216;native&#8217; windows kick off their existence by setting some callbacks in their message handling routines during processing of these two messages.<\/p>\n<p>With that in mind, I started looking at existing processes and got some interesting findings. Here is a snippet of a routine I found inside Windows Explorer that could be potentially abused by a remote process:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/02\/wm_nccreate1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-4615\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/02\/wm_nccreate1.png\" alt=\"\" width=\"476\" height=\"214\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/02\/wm_nccreate1.png 476w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/02\/wm_nccreate1-300x135.png 300w\" sizes=\"(max-width: 476px) 100vw, 476px\" \/><\/a>Or, it&#8217;s disassembly equivalent (in response to WM_NCCREATE message):<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/02\/wm_nccreate2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-4616\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/02\/wm_nccreate2.png\" alt=\"\" width=\"278\" height=\"358\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/02\/wm_nccreate2.png 278w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/02\/wm_nccreate2-233x300.png 233w\" sizes=\"(max-width: 278px) 100vw, 278px\" \/><\/a><\/p>\n<p>So&#8230; since we can still freely send messages between windows it would seem that there is a lot of things that can be done here. One could send a specially crafted WM_NCCREATE message to a window that owns this routine and achieve a controlled code execution inside another process (the lParam needs to pass the checks and include pointer to memory area that includes a callback that will be executed afterwards &#8211; this callback could point to malicious code). I may be of course wrong, but need to explore it further when I find more time.<\/p>\n<p>The other interesting thing I noticed is that some existing windows procedures are already written in a way that makes it harder to exploit this issue. They check if the window-specific data was set, and only if it was NOT they allow to call the SetWindowLong function. That is, they avoid executing the same initialization code twice.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A few months back I discovered a new code injection technique that I named PROPagate. Using a subclass of a well-known shatter attack one can modify the callback function pointers inside other processes by using Windows APIs like SetProp, and &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2018\/02\/04\/propagate-follow-up-2-some-more-shattering-attack-potentials\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,57,15,52,46,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4614"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4614"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4614\/revisions"}],"predecessor-version":[{"id":4619,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4614\/revisions\/4619"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}