BSides MCR 2016: From CSV to CMD to qwerty

Editor's Notes

• #2: For SlideShare NB: May not look nice in places due to animations etc. I’ve made a few post-presentation edits to help with clarity and address questions I had
• #5: None of this would normally be difficult Onsite internal test, no pentest laptop Corporate machines, locked-down users Gotchas and bugs when cracking hashes
• #7: Just a snippet Essentially the entire Excel file was sent up, not just cell contents but presentation data, to come back down again!
• #8: In fact it did work as a GET Incorrect content-type could yield XSS but spoiled by Content-Disposition Cache-control Report may include sensitive data May not be cached due to other headers like Content-Disposition (without this Content-Type plays a role – in this case it would be cached due to text/html but application/vnd.ms-excel for .xls or application/vnd.openxmlformats-officedocument.spreadsheetml.sheet for xlsx less certain – browser-dependent?) Even apps that have good caching headers can fall down on file download (because these requests not processed in same way, e.g. it’s a static file returned by server not application)
• #9: Request with all possible single byte values
• #10: Everything except the null byte came back Scope for a request that would return a malicious exploit-payload Just a curiosity – OS command execution could be achieved much more simply…
• #11: James Kettle, PortSwigger DDE call Cell reference is not required, could be anything (cells are used when data source is another Excel sheet) Imagine e.g. program=“shares”, topic=“LSE”, item=“NCC” It’s because the DDE call fails that Excel offers to run cmd.exe
• #12: First warning is particular to this example as the simplest payload made an XLS file that wasn’t in XLS format CMD.EXE might raise an eyebrow Other warnings may follow, by this time the payload has run
• #13: Okay, proof of concept, but not very exciting…
• #14: Being inside makes those creds immediately valuable
• #15: No particular reason for choosing John - I knew the username and password, it was mine! NETNTLMv2 is a constant
• #16: Steps are a bit like SSL/TLS handshake NTLM weak as third DES key is padded with 5 NULL bytes
• #17: Workstation domain, name and build are all in fact optional Can be used by the server to determine whether the client is eligible for local authentication NTLM Security Support Provider (SSP) The Window SSP Interface (SSPI) framework specifies a core set of security functionality that is implemented by supporting providers such as NTLMSSP The Microsoft equivalent of the GSS-API (Generic Security Service Application Program Interface, RFC 2743) The SSPI specifies, and the NTLMSSP implements, the core operations of authentication, integrity, and confidentiality services
• #18: OS also Windows 7 here as attacker’s machine was a client workstation In Negotiate Flags, Target Type bits describe what Target Name is – share / server / domain Info leak: NetBIOS, DNS and workstation names but since server is me, not interesting!
• #20: No LM – as you’d expect from default Windows 7 The first “NTLM client challenge” is used for LMv2 Client challenge a feature of NTLMv2 not NTLM
• #21: Older version of Wireshark names the HMAC field differently e.g. “HMAC”!
• #22: Onsite time was ending but I didn’t need to be onsite to keep trying…
• #24: John Stuart Mill – English philosopher 1843 book “A System of Logic” included Mill’s methods – codified scientific approach to causation (technically “induction” as opposed to “deduction” – the former is probable cause, the latter is certain)
• #26: For recalculation, catflap can take an ordinary hashcat file as well as a Wireshark pcap
• #27: When editing blog, be careful not to remove half a byte (1 byte = 2 hex chars!) Footnote (1): only found out that Linux wasn’t affected while preparing demo – ha ha! That was another difference back on the hashcat slide – go JS Mill!
• #28: I’ll be loosely switching between web app Excel export and red-team scenarios
• #29: (1) because it’s come from internet location (2a) first encounter – creates registry entry to be “trusted” (2b) when trusted but links not autoupdated (3) because DDE call fails More warnings may follow after payload launches
• #30: Piranha = NCC phishing platform Jobs where users had to accept Excel warning(s) Note that these jobs used spreadsheets laced with macros – this is different to DDE – but it’s clicking through warnings that’s of interest here Clearly we didn’t know what the user experience was in terms of warnings but the fact there was a difference between opened spreadsheets and macros run shows that some further step must have been necessary Internal Excel files often contain macros, especially within areas such as finance – users are habituated to the warnings, or the warnings may have been disabled!
• #31: Like a packet with the evil bit set to off! Only once the Enable Content warning has been accepted does this setting make a difference =NotASheet!A1 is enough to prompt Enable Content security warning but doesn’t do anything suspicious Probably might as well hit them with everything in one go – certainly when time is limited in a test Trust Center “Workbook Links” are links to data in another workbook https://support.office.com/en-gb/article/Block-or-unblock-external-content-in-Office-documents-10204ae0-0621-411f-b0d6-575b0847a795 https://support.microsoft.com/en-us/kb/826921
• #32: Part of Trust Center but not visible through the UI Entry in registry doesn’t require users to save the file Protected View approval registered immediately Enable content approval registered once CMD warning answered (can be “no”) Full binary value meaning? Trusted Locations are default areas, nothing useful without prior access Attack scenario: user input influences filename or application always names the file the same way Browsers may be configured to auto-download in which case they will append numbers to stop accidental overwrite  If no filename in Content-Disposition then FF will name file by the page in the URI + an extension based on Content-Type e.g. export.asp.xls so this would produce same filename
• #33: Although CSV no PV, the EC warning means it can be trusted in registry Invalid XLSX not tolerated Excel 2010 vs 2013 no real difference URI extension: doesn’t matter if request is for .xls or .asp etc Content-Type / Content-Disposition filename dominant But text/csv not recognised so only if URI is .csv will it be opened correctly, otherwise e.g. .asp will fail Document opened inline vs saved & opened from disk If inline, URI must end CSV, otherwise similar to above Invalid XLS format 1,2,3,=cmd|'/k ipconfig'!A3 Valid XLS formats =cmd|'/k ipconfig'!A3 1 2 3 =cmd|'/k ipconfig'!A3 1 2 3 =cmd|'/k ipconfig'!A3
• #34: Can we get rid of or soften that CMD.EXE warning?
• #35: Tried =powershell in Excel 2010 (32-bit), 2013 (32-bit), 2016 (64-bit) Tilde means next character is a literal e.g. in Find, but can’t be escaped in formula with ~~ or \~ etc ??? Not many files have 8.3 alternative anyway Find files < 8 chars plus .exe by powershell "cmd /c dir *.exe /b |? {$_.length -lt 13}" explorer will open default browser Java Web Start – may be disabled anyway but fun!
• #36: Tcl first needs “package require dde” Data theft from sheet a little alarming, although something malicious would already have to be running You can overwrite cells of the spreadsheet that you can’t otherwise influence using the web app Use of Alert vs MsgBox -> XLM macro language in Excel 4.0 before VBA (old help file in reference at end) Alert also demonstrates multiple statements i.e. [macro 1][macro 2] Exec didn’t work  or fopen
• #37: Documentation on DDE interfaces poor – I was Googling so much, Google thought I was a robot! Progman manipulates shortcuts in Start | All Programs Screenshot of typing “word” into Start search menu Can’t use DeleteItem to delete real Microsoft Word 2010 as link is in “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office” which ordinary user can’t delete Folders instructs Windows Explorer (Shell interface unknown, seems to mirror Folders) The “2” minimises the window Doesn’t accept URL All 3 services seem to live in shell32.dll – is there a ShellFile topic? Clear out DDE channels from Excel https://social.technet.microsoft.com/Forums/office/en-US/7c8f845d-c4aa-4627-9008-3251d2772536/dde-links-crash-excel-2010-on-windows-7-64bits?forum=excel Dim i, ChannelNumber As Integer For i = 1 To 1000 Application.DDETerminate (i) Next i
• #38: Strings C:\Windows\System32\ieframe.dll WWW_URLEcho WWW_OpenURL WWW_GetWindowInfo WWW_ShowFile WWW_OpenURL WWW_Exit WWW_Activate WWW_UnregisterURLEcho WWW_RegisterURLEcho WWW_UnregisterProtocol WWW_RegisterProtocol WWW_OpenURLNewWindow WWW_ListWindows C:\Program Files (x86)\Mozilla Firefox\xul.dll WWW_GetWindowInfo WWW_RegisterViewer WWW_UnRegisterViewer WWW_CancelProgress WWW_Version WWW_OpenURL WWW_Activate
• #39: Only works if IE running
• #40: Trailing / in URL important Note that only URL of active tab obtained
• #42: With red-teaming, results may differ with emailing docs “From CMD to qwerty” - advice common to all tools not just password crackers The closer the test is to your unknown state, the better
• #43: The @ was originally an alias for = to make life easy for converts from Lotus Notes SUM could also be COUNT, COS… Consider phone number – it may have a + at the front but so structured elsewhere that it can be well protected Prefixing with ' may break some numerical operations on that cell e.g. SUM but if you’re expecting a number than use whitelist; text functions should still work For CSV what about regex \W.+\|.+!.+ or \W[a-zA-Z\.]+\(.*\) Only if whitelisting can’t be done! First for DDE, second for Excel formula \W (capital) matches non-alphanumeric It’s unlikely “normal” input would match these
• #44: Another good DDE reference (but beware ad clicks) http://www.angelfire.com/biz/rhaminisys/ddeapps.html#DDEExcelCrash
• #46: (1) Unicode = UTF-16 little endian iconv adds 2-byte “Byte Order Mark” (BOM) FFFE – a magic number to signal little ending UTF-16 xxd -p takes STDIN and outputs ASCII hex (2) NTHASH is the key ${USERNAME^^} converts to upper case (3) INTHASH is the key
• #47: Repeat question from audience