What would be Windows without all these hidden, test, debugging features?<\/p>\n
I loathe Windows 10 for many reasons and so far do not plan installing it on my computer, but I do welcome all its updates and changes as they provide a fertile soil for research of any sort. New persistence tricks are of course pretty high on my list and I especially welcome these ones that ‘break’ something new.<\/p>\n
Such is the case of the persistence trick I am going to cover today: persistence within Metro Apps.<\/p>\n
Despite the Metro Apps no longer being plain vanilla PE files they still need to be loaded.<\/p>\n
The task of loading them is delegated to WWAhost.exe that launches respective Metro App when we click the app’s icon. For instance, loading and launching Netflix App that you install from the Microsoft Store leads to the following process being created:<\/p>\n
and the current directory of the app is set to:<\/p>\n
I am not that familiar with Metro App internals yet, so I got curious about their loading process and started poking around this particular host process. I quickly discovered that it leverages the good old IFEO key and tests for a presence of an entry called ‘WWAInject’.<\/p>\n
Ah, how nice…\u00a0 seeing IFEO and ‘inject’ in the same sentence (a.k.a. one Procmon log row) can only lead to one conclusion: this is probably a new persistence trick!<\/p>\n
So…<\/p>\n
I added:<\/p>\n
and pointed it to my test DLL.<\/p>\n
Then I launched the test Metro App… and… nothing.<\/p>\n
Not only it didn’t launch properly, it actually crashed.<\/p>\n
Hmm…<\/p>\n
Looking at the Procmon logs I discovered that the Access denied was reported for my DLL when the application was loaded. The fact it was accessed was a good sign. The fact it didn’t load… a bit of a disappointment. It then hit me. Metro App are sandboxed and use various mechanisms to restrict access of the protected apps to the local system.<\/p>\n
After checking the OS libraries’ rights that are obviously loaded by the wwahost.exe without any problem I noticed that on a file system level they grant access to the following entities:<\/p>\n
I cheated and used icacls with its \/save and \/restore options to copy the OS library rights to my DLL:<\/p>\n
and then (after editing the name of the DLL) inside the ‘foo’ file to test.dll:<\/p>\n
Now the DLL file has all the rights identical with C:\\Windows\\System32\\rpcss.dll and can be loaded via the WWAInject entry with no problem. No more crashes, and the DLL does whatever I want it to.<\/p>\n","protected":false},"excerpt":{"rendered":"
What would be Windows without all these hidden, test, debugging features? I loathe Windows 10 for many reasons and so far do not plan installing it on my computer, but I do welcome all its updates and changes as they … Continue reading