{"id":7189,"date":"2020-05-22T23:12:51","date_gmt":"2020-05-22T23:12:51","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=7189"},"modified":"2020-05-22T23:31:57","modified_gmt":"2020-05-22T23:31:57","slug":"wow-64-lolbin-bring-back-netmeeting","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/05\/22\/wow-64-lolbin-bring-back-netmeeting\/","title":{"rendered":"Wow! 64! Lolbin! Bring back NetMeeting!"},"content":{"rendered":"\n<p>All Windows Lolbins are dead.<\/p>\n\n\n\n<p>Right?<\/p>\n\n\n\n<p>The native OS program that I never looked at caught my attention today. Its location is:<\/p>\n\n\n\n<ul><li>c:\\windows\\SysWOW64\\instnm.exe<\/li><\/ul>\n\n\n\n<p>And it caught my attention, because its filename implies it is some sort of installer. And since installers are <a href=\"https:\/\/www.hexacorn.com\/blog\/category\/living-off-the-land\/lolbins\/\">renowned<\/a> for offering LOLBIN functionality I started digging&#8230;<\/p>\n\n\n\n<p>The version info made me shiver&#8230; <br>&#8211; <em>32-bit NetMeeting Installer for Win64<\/em>.<\/p>\n\n\n\n<p>Que?<\/p>\n\n\n\n<p>I have not heard of &#8216;NetMeeting&#8217; for at least 700 years&#8230;<\/p>\n\n\n\n<p>To my surprise, the program is very small (8K) and after loading it into IDA I realized why. It uses Setup APIs to install&#8230; stuff. <\/p>\n\n\n\n<p>So, my hunch was right and the LOLBIN opportunity became real. <\/p>\n\n\n\n<p>Like a dog that got thrown a bone I raised to the occasion and unleashed all the research powers at my disposal. I painstakingly crafted (<em>googled it really<\/em>) an artisan .inf file that satisfies the ugly desires of SetupOpenInfFileW API that I spotted in the first line of decompiled code:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">[Version]\nSignature=$CHICAGO$\nLayoutFile=layout.inf\n\n[DefaultInstall]\nRegisterDlls=foo\n\n[foo]\n11,,test.dll, 1<\/pre>\n\n\n\n<p>I proceeded to collect my winning lottery ticket and&#8230; nothing happened. <\/p>\n\n\n\n<p>Like a wounded offensive researcher so eager to release his pervert creations&#8230; I scowled. I have already created a web site (<em>with a logo<\/em>), a github repo, and a joke to piss off critics of offensive research. Could I be so shortsighted that I did all this without a foresight of failure? Gods of research must be very pleased seeing me struggling, I thought&#8230; and in an attempt to reconcile with them I put my hopes in a paradigm shift that I decided to empower my research with. <\/p>\n\n\n\n<p>Like a dog that was thrown a ribeye steak, I scowled again&#8230; then I pushed that envelope and proceeded to unleash all the research powers at my disposal, plus one. I decided to actually read the second line of code that IDA presented to me in its wisdom:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">SetupOpenAppendInfFileW<\/pre>\n\n\n\n<p>With a cautious candor I sniffed around this inferior piece of code and then I realized that my soul left my body&#8230; and I scowled again, because it dawned on me (<em>didn&#8217;t read the RTFM<\/em>) that&#8230; what led me to the garden of evil was a stupid cross-reference. It turns out, you see, that the API I listed above, one whose name should never be mentioned again has&#8230; expectations. <\/p>\n\n\n\n<p>That entitled bratwurst of a code that happened to be used by <em>instnm.exe<\/em> requires that the .inf file you provide as a command line argument contains a reference to the <em>LayoutFile<\/em> so that it can, wait for it, make two .inf become one. I bet the guy who wrote that piece of code listened to <em><a href=\"https:\/\/www.youtube.com\/watch?v=FA5jsa1lR9c\">Spice Girls<\/a><\/em> for too long. The idiot almost costed me my reputation and caused this post to be that long. <\/p>\n\n\n\n<p>Like a dog that became wolf and was thrown a piece of A5 wagyu I scowled again\u2026 In an unprecedented move that this blog has never witnessed I created 2 .inf files to save this LOLBIN almost-catastrophe:<\/p>\n\n\n\n<p><strong>layout.inf<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">[Version]\nSignature=$CHICAGO$\n[DefaultInstall]<\/pre>\n\n\n\n<p><strong>instnm.inf<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">[Version]\nSignature=$CHICAGO$\nLayoutFile=layout.inf\n\n[DefaultInstall]\nRegisterDlls=foo\n\n[foo]\n11,,test.dll, 1<\/pre>\n\n\n\n<p>I proceeded to collect my winning lottery ticket and\u2026 again&#8230; nothing happened.<\/p>\n\n\n\n<p>G-O-D    D-A-M-N    I-T!<\/p>\n\n\n\n<p>Like a&#8230; <\/p>\n\n\n\n<p>I went old-school. I Launched Procmon, found out this idiot coder wants my DLL in c:\\windows\\syswow64. But I don&#8217;t want to place it there. I drop it in c:\\test. Bite me. I then make my new instnm.inf file:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">[Version]\nSignature=$CHICAGO$\nLayoutFile=layout.inf\n[DefaultInstall]\nRegisterDlls=foo\n[foo]\n11,,..\\..\\..\\..\\..\\test\\test.dll, 1<\/pre>\n\n\n\n<p>Then this happens:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"467\" height=\"176\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/instnm.png\" alt=\"\" class=\"wp-image-7190\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/instnm.png 467w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/instnm-300x113.png 300w\" sizes=\"(max-width: 467px) 100vw, 467px\" \/><\/figure>\n\n\n\n<p>NetMeeting is back!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>All Windows Lolbins are dead. Right? The native OS program that I never looked at caught my attention today. Its location is: c:\\windows\\SysWOW64\\instnm.exe And it caught my attention, because its filename implies it is some sort of installer. And since &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/05\/22\/wow-64-lolbin-bring-back-netmeeting\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[56,64,18],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7189"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7189"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7189\/revisions"}],"predecessor-version":[{"id":7193,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7189\/revisions\/7193"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}