Category Archives: (P) Windows

Web Pentest Lab Setup using bWAPP in Windows 10

bWAPP, or a buggy web application, is a deliberately insecure web application. It helps security enthusiasts, systems engineers, developers and students to discover and to prevent web vulnerabilities. bWAPP prepares one to conduct successful web application penetration testing and ethical hacking projects. It is made for educational purposes.

Some of the vulnerabilities included in bWAPP:

  • SQL, HTML, iFrame, SSI, OS Command, XML, XPath, LDAP and SMTP injections
  • Blind SQL and Blind OS Command injection
  • Bash Shellshock (CGI) and Heartbleed vulnerability (OpenSSL)
  • Cross-Site Scripting (XSS) and Cross-Site Tracing (XST)
  • Cross-Site Request Forgery (CSRF)
  • AJAX and Web Services vulnerabilities (JSON/XML/SOAP/WSDL)
  • Malicious, unrestricted file uploads and backdoor files
  • Authentication, authorization and session management issues
  • Arbitrary file access and directory traversals
  • Local and remote file inclusions (LFI/RFI)
  • Configuration issues: Man-in-the-Middle, cross-domain policy files, information disclosures
  • HTTP parameter pollution and HTTP response splitting
  • Denial-of-Service (DoS) attacks: Slow HTTP and XML Entity Expansion
  • Insecure distcc, FTP, NTP, Samba, SNMP, VNC, WebDAV configurations
  • HTML5 ClickJacking, Cross-Origin Resource Sharing (CORS) and web storage issues
  • Unvalidated redirects and forwards, and cookie poisoning
  • Cookie poisoning and insecure cryptographic storage
  • Server Side Request Forgery (SSRF)
  • XML External Entity attacks (XXE)

Download WAMP server here. Select save or run. Click open. After that follow the next steps.

Next you will see the Select Destination Location screen. Click Next to continue.

Next you will see the Ready to install screen. Click Install to continue.

Once the files are extracted, you will be asked to select your default browser. Select your default browser’s .exe file, then click Open to continue.

Once the progress bar is completely green, the PHP Mail Parameters screen will appear. Leave the SMTP server aslocalhost, and change the email address to one of your choosing. Click Next to continue.

Download the latest version of the Software from the here

Extract BWAPP lab setup in the location” C:\wamp\WWW\bWAPP” as is shown below.

Edit the file ‘admin/settings.php’ with your own database connection settings. Leave blank db_password anddb_name options

Browse to the file ‘install.php’ in the directory ‘bWAPP

http://localhost/bWAPP/install.php

Click on ‘here‘ (Click ‘here’ to install bWAPP). The database ‘bWAPP‘ will be created

Again Edit the file ‘admin/settings.php’ and setup the db_name see the screenshot below

Go to the login page. If you browse the bWAPP root folder you will be redirected. http://localhost/bWAPP/

 Login with the default credentials or make a new user.

Default credentials:

User name: bee

Password: bug

Turn on Windows “God Mode” on the Desktop

Windows 8 has countless settings you can hack, tweak, and customize. Many of them are accessible via the Control Panel and other scattered locations throughout Windows. It can be time-consuming to find them all, and the likelihood is that you’ll never remember where they all live. That means that many tweaks and hacks are far away, and some you’ll never even find.
There’s a simple solution: Use what some people call “God Mode.” Despite its name, it’s not really a separate mode. Instead, it’s a hidden folder that gives you fast access to all those settings. All you have to do is bring it out of hiding and place it on the Desktop.
To do it, right-click the Desktop and select New→Folder (Figure 3-10). Rename the folder GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}.

ScreenShot_20160402185717
Creating a new folder on the desktop
The folder icon changes, and it has the name GodMode

ScreenShot_20160402185757

The God Mode folder on the Desktop
Note: The “God.Mode” text isn’t what turns the folder into a special folder—it’s the {ED7BA470-8E54-465E-825C-99712043E01C}.You can use any text before the curly brackets you want. So if you wanted the folder to be called Fred.Folder, you could do that as well by renaming it like this: Fred.Folder{ED7BA470-8E54-465E-825C-99712043E01C}. It would show up as FredFolder on the Desktop, but still have the same features.
Double-click the icon, and you’ll come to a folder that has many dozens of tweaks, settings, and hacks . They’re organized by category, and you can expand or shrink each category by clicking the small triangle next to each. Each category displays a number next to it, showing how many settings there are.

ScreenShot_20160402190017

Hacking the Hack
In the God Mode folder, you can create shortcuts to any of the items in the Quick Launch folder, in the Start Menu folder, and in the Power User Menu folder. That way they’re always within easy reach

 

Speed Up Boot Time

Hack Your BIOS for Faster Startups
When you turn on your PC, it goes through a set of startup procedures in its BIOS before it gets around to starting Windows.

So, if you speed up those initial startup procedures, you’ll make your system start faster.
You can speed up your startup procedures by changing the BIOS with the built-in setup utility.

How you run this utility varies from PC to PC, but you typically get to it by pressing either the Delete, F1, F2, or F10 key during startup. You’ll come to a menu with a variety of choices.

Here are the choices to make for faster system startups: Quick Power On Self Test (POST) When you choose this option, your system runs an abbreviated POST rather than the normal, lengthy one.

Change Your Boot Order If you change the boot order so that your BIOS checks the hard disk first for booting, it won’t check any other devices, and will speed up your startup time.

Boot Up Floppy Seek Disable this option. When it’s enabled, your system spends a few extra seconds looking for your floppy drive—a relatively pointless procedure, especially considering how infrequently you use your floppy drive.

Boot Delay Some systems let you delay booting after you turn on your PC so that your hard drive gets a chance to start spinning before bootup. Most likely, you don’t need to have this boot delay, so turn it off. If you run into problems, however, you can turn it back on.

How to Remove “Activate Windows” Watermark on Desktop or Laptop

Easily Remove “Activate Windows” Watermark

Are you sick with the “activate windows” watermark on your desktop or laptop screen that just won’t go away unless you pay the product full price of course that costs hundreds of dollars! Well, if you want to help Windows then you can pay the full amount easily. But to those you can’t then this tutorial is for you! It doesn’t matter if you are using Windows 7, 8, 8.1 or Windows 10 we can easily remove the watermark on those versions of Windows easily.

Instructions

  • Download KMSAuto 2015 Portable Version
  • If you are hesitant about the virus you can scan the file with your anti-virus to be sure. I am 100% though it is clean.
  • Unzip file and open up KMSAuto Net.exe

Activate Windows 10 and remove watermark

  • Click on the activation button and you will see 2 options
    • Activate Windows and Activate Office
  • For this tutorial, we will use Activate Windows option
  • Click Activate Windows and wait for the process to finish

Activate Windows

  • There you have it. Product successfully activated! On this step, you should see the watermark to disappear.
  • If you have your Microsoft office needed to be activated as well, then feel free to use the Activate office option too!

Make Your Own WIFI HotSpot using Desktop/Laptop + Screenshots

Create Your Own WIFI HotSpot using Laptop or Desktop

You can now turn your Laptop or Desktop to a Wifi router and easily create unlimited hotspots! Share your existing wired/wireless internet connection to others by creating your own hotspot and assigning your own password to it. You can even ask them to pay if you want though. Here’s how you can do it.

Why Use a WIFI Hotspot?

There are various reasons why you should use a WIFI Hotspot and some of them are as follows:

  • Problem 1: You have your internet connection and want to share it with others that do not have. Then turn on your WIFI Hotspot.
  • Problem 2: You want to make money with your internet connection and want to create a WIFI Hotspot with a password of it in which users will pay first before they got access.

How to create a WIFI Hotspot using your Windows 10 Desktop or Laptop?

Follow the below instructions and be amazed at how easy they are to implement.

Method 1: Using the Feature of Windows 10 OS

Create a WIFI Hotspot on Windows 10

The easiest way to do this is by using Windows 10 since you do not need any third-party software to make your hotspot. However, you should install the latest updates of this version of Windows since this feature is added to it.

Step 1: Open the General Settings Windows

Press the Windows button on your keyboard and click on the Settings “Gear” icon.

Open Settings Windows

Step 2: Click on the Network & Internet Settings

You updated windows 10 should have this feature available and should be not an issue to find. If you cannot find this feature then please update your Windows 10.

Click on the Network and Internet

Step 3: You can now setup your Wifi Hotspot

Click on the Mobile Hotspot and Tick “On”. Edit your Wifi name and password. You are now ready to publicize your WIFI hotspot to others. Please note that you can only add up to 8 devices to your Wifi network.

Windows 10 Wifi Hotspot Settings

On this version of Windows, everything is very easy to implement. Should you find some problems with this tutorial please comment below.

Method 2: Using Commercial Software

Windows 7, Windows 8, Windows 8.1 and Windows 10 OS for this method.

On this method, we are going to use a commercial software in which has tons of feature if you want to get serious on commercializing your internet connection. Some of the important features of this software are that you can add a limitation on each device connected to your WIFI Hotspot. Like you can limit the time the device is connected or limit the bandwidth the device must use.

Create a WIFI Hotspot using Connectify Hotspot

Step 1: First download Connectify Hotspot 2017

Click on the “Buy Now” button if you want to buy the full version of the software or click on “Download” to instantly download the product and use the free version with the limitation of course. These limitations are, however, not that important since you can still use the full use of the software.

Download Connectify Hotspot 2017

Step 2: Install and Open Connectify Hotspot 2017

You may need to reboot your PC to successfully install the software. After the installation, you are now ready to use Connectify Hotspot 2017. Please note that we are using the free version of the software thus, we cannot edit the WIFI name. You can still edit the WIFI password though. After that, you are now ready to start your Hotspot connection.

Create a Wifi Hotspot using Connectify Hotspot 2017

Step 3: Check your Mobile for the Hotspot

To go your mobile WIFI tab and check for the WIFI network you have just enabled.

Check for Additional WIFI Connection

Reminders: Note that you can only use the Hotspot you have created with both method when your PC is turned on.

So that was both methods I have used and currently using the create a wifi hotspot on my home and to the public. Feel free to share your own method by commenting below.

Install and Run Windows 10 8 7 XP on Any Android Phone NO ROOT 2017

Click Here To Watch

Install and Run Windows 10 8 7 XP on Any Android Phone NO ROOT 2017

Links: https://goo.gl/YxhwfY

Updated Windows image Link: https://goo.gl/reOTw4

Mirror Link: https://goo.gl/gDtE55

More Mirrors: https://goo.gl/jyH4As https://goo.gl/gTQ5wb

New Updated Mirrors(April 25th 2017) https://goo.gl/YIIWud

New Updated Windows 10 Link x64 (Download Gandalf file) https://goo.gl/1cD90W

Windows 10 Link x86(Use Gandalf file) https://goo.gl/MqJ6pa

Application: Limbo https://goo.gl/YxhwfY

 

image file: https://goo.gl/5u8ixq

Windows 10 tip: Protect removable storage devices with BitLocker encryption

Do you use a USB flash drive, MicroSD card, or portable hard drive to keep backups of important files? Protect yourself by encrypting removable storage devices so your files can’t be accessed if the drive is lost or stolen.

 

humb drives, SD cards, and portable hard drives are tremendously convenient. They’re also tremendously risky.

If your removable drive is lost or stolen, whoever finds it has complete access to its contents, which might include confidential files and personal information.

To eliminate that risk, use the BitLocker To Go feature of Windows 10 Pro and Enterprise editions to encrypt the drive so that it can’t be read without a password.

After inserting the drive, open File Explorer, right-click the drive’s entry, and click Turn On BitLocker. That starts the BitLocker Drive Encryption wizard. Enter a password and save a recovery key so that you can regain access to the data if you forget that password. For removable drives, choose Compatible Mode (which allows you to open the drive even on older Windows PCs) and then finish the wizard.

The encrypted drive can be opened on any Windows PC, even one that’s running a non-business edition of Windows. Enter the password and choose the Automatically unlock on this PC option to avoid having to enter the password on a PC where you’re already signed in. If you lose the drive, whoever finds it will be unable to read its contents without the password or recovery key.

Remove Bitmessage Ransomware Permanently

Research on Bitmessage Ransomware

In case your Microsoft Office files, images, videos, audios, emails and databases are injected with an .1999, .bleep, or .ccc extension, it indicates that your computer has been infected with file-encrypting Ransomware such as TelsaCrypt, RSA-2048 or Bitmessage , which is destructive virus made by hacker for robbing money online. Similar to common ransomware, Bitmessage mainly sneaks into your system via spam email attachments. Such suspicious emails will disguise as normal email sent by your friends, families or from famous companies, and they usually contain a document, photo or video file needed you to download. As soon as you download the attachments and open it, your files will be ruined by Bitmessage within a sec. Most of your files are changed into weird name with .1999, .vvv, or .ccc extension, and you will see a unknown TXT file in the infected folders or a popup photo on your screen, which is used to show you the warning message asking you to pay ransom fees to buy the decryption key.

delete Bitmessage

Bitmessage is definitely an evil tool used by hacker to make money illegally. After it locks your files, it charge lots of money for recovering your files. Some people think that they can call the police or FBI to catch the hackers and get the files back, but unfortunately, no one can track these top hackers so far, because they use encrypted tunnel with fake name to contact the victims, and their accounts for receiving the money are Bitcoin account, thus they can rob your money without being punished.

Most of victims may choose to compromise and send the ransom fees to exchange their precious files but are you sure that these cyber criminal who created Bitmessage virus will recovere your files after you pay? Our research team found that there is no guarantee on such payment, lots of victims paid lots of money but still lost all files. Therefore, we suggest not to pay money to these hackers. It is a huge risk, not only on your money , but your private information such as banking accounts. Your credit cards and banking accounts may even be hacked by Bitmessage if you pay the ransom money.

In such a situation, the right things you need to do is: 1. Remove all malicious files, codes of Bitmessage and related threats from your system completely; 2. Restore your files with your back-up (if available), or use third party legitimate data recovery software to recover your files. In case you are a victims of Bitmessage ransomware, follow the guide below to cure your computer now and try your luck with the data recovery tools to save your files. We hope this tutorial will be helpful to you.

Bitmessage Removal Tutorial

First Method – Manually Remove Bitmessage (For Users with Expert Skills)

Second Method – Automatically Remove Bitmessage Quickly and Safely (Easy For All Computer Users)


First Method – Bitmessage Manual Removal

Step 1 – End Bitmessage process in Task Manager.

1. Press “Ctrl+ Shift + Esc” keys to call out Windows Task Manager
2. Click Processes > find Bitmessage process or suspicious processes and select End process.
remove Bitmessage virus

Step 2 – Uninstall Bitmessage and suspicious programs from Control Panel.

Windows 10 : Click Start Menu >> Click All Apps >> Find out Bitmessage and other unwanted programs, then right-click on it and select Uninstall:
get rid of Bitmessage

delete Bitmessage

Windows 8
  • Move the mouse to the lower-left corner of the screen and clicking the Start button;
  • Type “control panel” in search box and then click Control Panel.
  • Find Bitmessage and unwanted programs >> click Uninstall

Bitmessage removal

how do i remove Bitmessage
Win 7 / Vista / XP
  • Click Start button >> click Control Panel in Start Menu
  • Click Uninstall a program to open Programs and Features
  • Find Bitmessage and unwanted programs >> click Uninstall

 

how can i get rid of Bitmessage
how do i delete Bitmessage

Step 3 Remove Bitmessage related registry files in Registry.

  • Press Win + R keys together to open Run window
  • Type “regedit” and click OK
  • Find out all related registry files of Bitmessage:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWpm
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain “Default_Page_URL”
HKEY_LOCAL_Machine\Software\Classes\[adware name]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\random
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run\random
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0


(Note – This guide is only provided as an reference to help you get rid of Bitmessage ransomware to make your PC healthy and prevent new files being infected. We cannot promise that the recommended tools can recover every user’s files which have been encrypted by the most dangerous ransomware such as Bitmessage. Wish you with good luck!)

———————————————————————————
Tips on Prevent Virus and Malware Such as Bitmessage
If you want to keep your PC from all kinds viruses and malware active online, you need to always follow these rules while using your PC:
1. Always choose Custom Installation while installing freeware so that you can deselect unwanted options or cancel unauthorized change;
2. Always scan attachments in emails before you open it; never open any attachment or click links on emails which you do not know if it is safe;
3. Do not visit any porn website because most of porn websites embedded with malicious codes from cyber criminal;
4. Always scan torrent files and other files downloaded from third party website before you open them;
5. Never update any of your software from third party website; make sure the software update alert appearing on your screen is from official website;

6. Do not click ads (e.g. “Ads by “, “Ads brought by “, “Ads powered by “, etc. ) which do not belong to the websites you visit.

LaZagne – Password Recovery Tool For Windows & Linux

The LaZagne project is an open source password recovery tool used to retrieve passwords stored on a local computer. Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases and so on). This tool has been developed for the purpose of finding these passwords for the most commonly-used software. At this moment, it supports 22 Programs on Microsoft Windows and 12 on a Linux/Unix-Like operating systems.

LaZagne - Password Recovery Tool For Windows & Linux

It supports a whole bunch of software including things like CoreFTP, Cyberduck, FileZilla, PuttyCM, WinSCP, Chrome, Firefox, IE, Opera, Jitsi, Pidgin, Outlook, Thunderbird, Tortoise, Wifi passwords and more.

Usage

Retrieve version

Launch all modules

Launch only a specific module

Launch only a specific software script

Write all passwords found into a file (-w options)

Use a file for dictionary attacks (used only when it’s necessary: mozilla masterpassword, system hahes, etc.). The file has to be a wordlist in cleartext (no rainbow), it has not been optimized to be fast but could useful for basic passwords.

Change verbosity mode (2 different levels)

You can download laZagne here:

Windows – laZagne-Windows.zip
Source – Source-1.1.zip

Elevating privileges by exploiting weak folder permissions

Securing machines is always an on-going process whether it is by locking down settings, blocking applications, disabling Windows Services, making sure user privileges are kept to a minimum and so on. If we don’t then users will end up installing non-standard software, making changes to the system, malware doing more damage once getting compromised, etc. This post is about weaknesses in folder permissions leading to elevation of privilege by using DLL hijacking vulnerabilities in Windows Services.

What is DLL hijacking?
A few years ago there was quite a bit of hype being able to load malicious DLLs remotely or locally from the current working directory. The Microsoft article [1] explains it clearly

“When an application dynamically loads a dynamic-link library without specifying a fully qualified path name, Windows attempts to locate the DLL by searching a well-defined set of directories in a particular order. If an attacker gains control of one of the directories on the DLL search path, it can place a malicious copy of the DLL in that directory. This is sometimes called a DLL preloading attack or a binary planting attack. If the system does not find a legitimate copy of the DLL before it searches the compromised directory, it loads the malicious DLL. If the application is running with administrator privileges, the attacker may succeed in local privilege elevation.”

So if an application loads a DLL just by its name it goes through the search order below (32bit OS) to find the library

  1. The directory from which the application loaded
  2. 32-bit System directory (C:\Windows\System32)
  3. 16-bit System directory (C:\Windows\System)
  4. Windows directory (C:\Windows)
  5. The current working directory (CWD)
  6. Directories in the PATH environment variable (system then user)

What are we exploiting?
The goal here is to get local admin rights on the machine. In order to achieve this we need three things to make this work

  • Windows DLL search order
  • DLL hijacking vulnerability
  • Weak folder permissions

Windows DLL search order
In Windows DLL search order the directories of the path environment variable are the last search it carries out starting with the system variable path and then the user variable path. Unless the application hasn’t used a fully qualified path name for its DLL it will try to find the DLL through the search order even with certain mitigations in place.

DLL hijacking vulnerability
A quick way to find DLL hijacking vulnerabilities is to start Process Monitor, setup the relevant filtering and carry out some actions. Here we will be exploiting Windows Services as a large number of services run on SYSTEM privileges, just by stopping and starting the services and observing the search patterns. Keep in mind that Services running under SYSTEM does not search through user path environment. After stopping and starting Services a number of vulnerabilities had been discovered.

One Windows Service being the “IKE and AuthIP IPsec Keying Modules” This service is not started and set to manual by default but might be started or set to Automatic by VPN clients, policies, other Services, etc. For someone trying to obtain local admin rights starting Process Monitor will not be possible with limited permissions so let’s go through the steps if we didn’t have rights. In this example the IKE service is used but it can be any service for software that you may not have direct access to and need to audit.

First let’s take note of the service executable through Windows Services (say services.msc via run command) checking to see if its status has started and running under localsystem.

Now checking in the registry to see if there are any service dlls being loaded by the service

We can copy these files (svchost.exe and IKEEXT.DLL) off to another machine to do our static analysis. After loading in IDA and simply searching for loadlibrary and jumping to the call will show what library is going to load. If a fully qualified path is not specified then we may be in luck. Here in IKEEXT.DLL LoadLibraryW will try to load “wlbsctrl.dll”

Note: It is not always as straight forward as in this example as the dll called might be using fully qualified path name but linked at compile time with another dll which will try to load this at load time which might be vulnerable due to being in another folder or not available.

Lastly we search for the library wlbsctrl.dll on the system to see if it exists and if so take note as to where it is located.

C:\>dir wlbsctrl.dll /s

In this case wlbsctrl.dll does not exist on the system so it will go through the entire search order.

Weak folder permissions
Now for the most important part “Weak folder permissions”. When new folders are created in the root it is writeable for all authenticated users by default. The “NT AUTHORITY\Authenticated Users:(I)(M)” gets added to the folder where M stands for modify access. So any application that gets installed on the root can be tampered with by a non-admin user. If binaries load with SYSTEM privileges from this folder it might just be a matter of replacing the binary with your own one.

It gets interesting when applications gets installed in the root and add its path to the system path environment. This now opens the attack surface for a large number of applications that may have DLL hijacking vulnerabilities. One scenario is software getting pushed onto machines, with the likes of Marimba, Landesk, etc. which use a Windows service running with system privileges to install the software. Since it runs with system privileges software pushed onto machines such as Perl, Python or Ruby it will add to the system path environment if adding the path had been set in the package along with being installed on the root as default. Or it could be an IT support personnel installs the software with their admin rights for the user. If a user installs manually (if possible) with non-admin rights then it may be added to user path environment and then exploitation would not be possible. We can use icacls.exe to check the permissions of the folder or by the folder properties security tab.

Pwning the box
From our previous sections what we know now are

  • Service “IKE and AuthIP IPsec Keying Modules” loads service dll IKEEXT.DLL
  • IKEEXT.DLL will try to load wlbsctrl.dll
  • OS with carry its search order to find wlbsctrl.dll
  • We have a writeable folder C:\Ruby200\bin which is in the search order

All we need to do now is drop our malicious crafted DLL wlbsctrl.dll in C:\Ruby200\bin, reboot the machine and it will carry out its action under SYSTEM privileges. Users requesting Ruby, Perl, etc. are probably developers and have rights anyway but there may be other software which gets installed on the root and adds to the system path where limited users might take advantage of and this where we need to do our assessment and make any changes before being deployed.

Testing folder paths
System path environment variable comes first and then user path environment variable. Running it in a medium integrity shell for an admin or non-admin user will give the same results.

Vulnerable Windows Services
Here are Windows Services that have been found to be vulnerable and could be exploited on Windows 7 (32/64)

IKE and AuthIP IPsec Keying Modules (IKEEXT)                     – wlbsctrl.dll
Windows Media Center Receiver Service (ehRecvr)               – ehETW.dll
Windows Media Center Scheduler Service (ehSched)             – ehETW.dll

The Windows Media Center Services startup type is set to manual and status not started and will only give us only Network service privileges so I cannot see it to being much use especially with its limited privileges. It can however be started temporarily via certain scheduled tasks.

schtasks.exe /run /I /TN “\Microsoft\Windows\Media Center\mcupdate”
schtasks.exe /run /I /TN “\Microsoft\Windows\Media Center\MediaCenterRecoveryTask”
schtasks.exe /run /I /TN “\Microsoft\Windows\Media Center\ActivateWindowsSearch”

A quick check on Windows XP has shown that these Services are vulnerable

Automatic Updates (wuauserv)                                                – ifsproxy.dll
Remote Desktop Help Session Manager (RDSessMgr)            – SalemHook.dll
Remote Access Connection Manager (RasMan)                      – ipbootp.dll
Windows Management Instrumentation (winmgmt)                 – wbemcore.dll

Other Services that might be installed are also vulnerable

Audio Service (STacSV)                                                    – SFFXComm.dll SFCOM.DLL
Intel(R) Rapid Storage Technology (IAStorDataMgrSvc)    – DriverSim.dll
Juniper Unified Network Service(JuniperAccessService)   – dsLogService.dll
Encase Enterprise Agent                                                    – SDDisk.dll

No dll hijacking vulnerabilities were found on a clean default installation of Windows 8 OS (64) so another good reason to start migrating to Windows 8.

Mitigation
There are a number of mitigations available to prevent this vulnerability to be exploited by using certain API’s, changing registry settings, applying updates, etc. it does start to get confusing as to what we are mitigating so hopefully this section will make it a bit clearer.

CWDIllegalInDllSearch
This update [2] at the time introduced a new registry entry CWDIllegalInDllSearch that allowed users to control the DLL search path algorithm. Tested on a fully patched Windows 7 machine this update is no longer required so it might have been later included in some security update. Once the patch is installed (if applicable) you will need to add the DWORD name CWDIllegalInDllSearch with a value in the registry key location

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]

The value data can be 1, 2 or ffffffff. If the value name CWDIllegalInDllSearch does not exist or the value data is 0 then the machine will still be vulnerable to CWD attack. Please be aware that the value ffffffff could break certain applications. The search order is the same but this time if a malicious DLL is located in the current working directory the library is not loaded.

  1. The directory from which the application loaded
  2. 32-bit System directory (C:\Windows\System32)
  3. 16-bit System directory (C:\Windows\System)
  4. Windows directory (C:\Windows)
  5. The current working directory (CWD)            [ dlls not loaded ]
  6. Directories in the PATH environment variable (system then user)

 

SetDllDirectory
This function [3] removes the current working directory (CWD) from the search order when loading DLLs. For instance, the DLL search order after calling SetDllDirectory(“C:\\program files\\MyApp\\”) becomes:

  1. The directory from which the application loaded
  2. C:\program files\MyApp\                                    [ added ]
  3. 32-bit System directory (C:\Windows\System32)
  4. 16-bit System directory (C:\Windows\System)
  5. Windows directory (C:\Windows)
  6. The current working directory (CWD)              [ removed ]
  7. Directories in the PATH environment variable (system then user)

Passing an empty string to SetDllDirectory(“”) the current working directory (CWD) is removed from the search order

  1. The directory from which the application loaded
  2. 32-bit System directory (C:\Windows\System32)
  3. 16-bit System directory (C:\Windows\System)
  4. Windows directory (C:\Windows)
  5. The current working directory (CWD)             [ removed ]
  6. Directories in the PATH environment variable (system then user)

If this parameter is NULL, the function restores the default search order.

SafeDllSearchMode
Safe DLL search mode [4] is enabled by default. To disable this feature we can create a DWORD name SafeDllSearchMode with value 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]

If SafeDllSearchMode is enabled, the search order is as follows:

  1. The directory from which the application loaded
  2. 32-bit System directory (C:\Windows\System32)
  3. 16-bit System directory (C:\Windows\System)
  4. Windows directory (C:\Windows)
  5. The current working directory (CWD)
  6. Directories in the PATH environment variable (system then user)

If SafeDllSearchMode is disabled, the search order is as follows:

  1. The directory from which the application loaded
  2. The current working directory (CWD)                   [ moved up the list ]
  3. 32-bit System directory (C:\Windows\System32)
  4. 16-bit System directory (C:\Windows\System)
  5. Windows directory (C:\Windows)
  6. Directories in the PATH environment variable (system then user)

Calling the SetDllDirectory(“”) or SetDllDirectory(“C:\\program files\\MyApp\\”) disables SafeDllSearchMode and uses the search order described for SetDllDirectory.

LoadLibraryEx function [5] takes another argument where a flag can be set to change the search order but I didnt get round to test it.

Mitigation for developers
For software developers there are a number of actions they can take

  • Use SetEnvironmentVariable(TEXT(“PATH”),NULL) API which removes the path environment variable from its search order
  • Change default installation folder to C:\Program Files
  • Use fully qualified path when loading DLLs, i.e. LoadLibrary(“C:\\program files\\MyApp\\mylibrary.dll”);
  • Use SetDllDirectory(“”) API removing the current working directory from the search order

Mitigation for IT professionals
For IT support professionals there are also a number of actions that can be taken

  • When packaging and deploying software via deployment tools such as Marimba, Landesk, etc. or manually  installing software change the installation folder to C:\Program Files
  • If software needs to be installed on the root check there are no binaries needing SYSTEM privileges
  • If SYSTEM privileges are required then change the ACL’s of the folder
  • Remove the path entry from the SYSTEM path variable if not needed

Conclusion
This post shows us how easily elevated privileges can be achieved with very little effort. Ultimately the solution is simple by just making sure all software gets installed in the C:\Program Files folder which will then inherent it’s more secure folder permissions. Malware could take advantage of this weakness not only to obtain system privileges but also to automatically load its malware making it that much harder to pinpoint its auto start entry points.

 

References
[1] http://msdn.microsoft.com/en-us/library/windows/desktop/ff919712(v=vs.85).aspx
[2] http://support.microsoft.com/kb/2264107
[3] http://msdn.microsoft.com/en-us/library/ms686203%28v=vs.85%29.aspx
[4] http://msdn.microsoft.com/en-us/library/ms682586%28v=vs.85%29.aspx
[5] http://msdn.microsoft.com/en-us/library/ms684179%28v=vs.85%29.aspx