Upon double clicking an XLL, the user is greeted by this screen:

___________________________
@hacking_Attack
@Hacking_Video

This single dialog box is all that stands between the user and code execution; with fairly thin social engineering, code execution is all but assured.Something that must be kept in mind is that XLL's, being executables, are architecture specific. This means that you must know your target; the version of Microsoft Office/Excel that the target organization utilizes will (usually) dictate what architecture you need to build your payload for.There is a pretty clean break in Office versions that can be used as a rule of thumb:Office 2016 or earlier: x86Office 2019 or later: x64It should be noted that it is possible to install the other architecture for each product, however these are the default architectures installed and in most cases this should be a reliable way to make a decision about which architecture to roll your XLL for. Of course depending on the delivery method and pretexting used as part of the phishing campaign, it is possible to provide both versions and rely on the victim to select the appropriate version for their system.ResourcesThe XLL payload that was built during this research was based on this (https://github.com/edparcell/HelloWorldXll) project by edparcell. His repository has good instructions on getting started with XLL's in Visual Studio, and I used his code as a starting point to develop a malicious XLL file.A notable deviation from his repository is that should you wish to create your own XLL project, you will need to download the latest Excel SDK (https://docs.microsoft.com/en-us/office/client-developer/excel/welcome-to-the-excel-software-development-kit) and then follow the instructions on the previously linked repo using this version as opposed to the 2010 version of the SDK mentioned in the README.DeliveryDelivery of the payload is a serious consideration in context of UDA. There are two primary methods we will focus on:Email AttachmentWeb DeliveryEmail AttachmentEither via attaching a file or including a link to a website where a file may be downloaded, email is a critical part of the UDA process. Over the years many organizations (and email providers) have matured and enforced rules to protect users and organizations from malicious attachments. Mileage will vary, but organizations now have the capability to:Block executable attachments (EXE, DLL, XLL, MZ headers overall)Block containers like ISO/IMG which are mountable and may contain executable contentExamine zip files and block those containing executable contentBlock zip files that are password protectedMoreFuzzing an organization's email rules can be an important part of an engagement, however care must always be taken so as to not tip one's hand that a Red Team operation is ongoing and that information is actively being gathered.For the purposes of this article, it will be assumed that the target organization has robust email attachment rules that prevent the delivery of an XLL payload. We will pivot and look at web delivery.Web DeliveryEmail will still be used in this attack vector, however rather than sending an attachment it will be used to send a link to a website. Web proxy rules and network mitigations controlling allowed file download types can differ from those enforced in regards to email attachments. For the purposes of this article, it is assumed that the organization prevents the download of executable files (MZ headers) from the web. This being the case, it is worth exploring packers/containers (https://github.com/mgeeky/PackMyPayload).The premise is that we might be able to stick our executable inside another file type and smuggle it past the organization's policies. A major consideration here is native support for the file type; 7Z files for example cannot be opened by Windows without installing third party software, so they are not a great choice. Formats like ZIP, ISO, and IMG are attractive choices because they are supported natively by Windows, and as an added bonus they add very few extra steps for the

___________________________
@hacking_Attack
@Hacking_Video

victim.The organization unfortunately blocks ISO's and IMG's from being downloaded from the web; additionally, because they employ Data Loss Prevention (DLP) users are unable to mount external storage devices, which ISO's and IMG's are considered.Luckily for us, even though the organization prevents the download of MZ-headered files, it does allow the download of zip files containing executables. These zip files are actively scanned for malware, to include prompting the user for the password for password-protected zip files; however because the executable is zipped it is not blocked by the otherwise blanket deny for MZ files.Zip files and executionZip files were chosen as a container for our XLL payload because:They are natively compatible with WindowsThey are allowed to be downloaded from the internet by the organizationThey add very little additional complexity to the attackConveniently, double clicking a ZIP file on Windows will open that zip file in File Explorer:

___________________________
@hacking_Attack
@Hacking_Video

Less conveniently, double clicking the XLL file from the zipped location triggers Windows Defender; even using the stock project from edparcell that doesn't contain any kind of malicious code.

___________________________
@hacking_Attack
@Hacking_Video

Looking at the Windows Defender (https://www.kitploit.com/search/label/Windows%20Defender) alert we see it is just a generic "Wacatac" alert:

___________________________
@hacking_Attack
@Hacking_Video

However there is something odd; the file it identified as malicious was in c:\users\user\Appdata\Local\Temp\Temp1_ZippedXLL.zip, not C:\users\user\Downloads\ZippedXLL\ where we double clicked it. Looking at the Excel instance in ProcessExplorer shows that Excel is actually running the XLL from appdata\local\temp, not from the ZIP file that it came in:

___________________________
@hacking_Attack
@Hacking_Video

This appears to be a wrinkle associated with ZIP files, not XLL's. Opening a TXT file from within a zip using notepad also results in the TXT file being copied to appdata\local\temp and opened from there. While opening a text file from this location is fine, Defender seems to identify any sort of actual code execution in this location as malicious.If a user were to extract the XLL from the ZIP file and then run it, it will execute without any issue; however there is no way to guarantee that a user does this, and we really can't roll the dice on popping AV/EDR should they not extract it. Besides, double clicking the ZIP and then double clicking the XLL is far simpler and a victim is far more prone to complete those simple actions than go to the trouble of extracting the ZIP.This problem caused me to begin considering a different payload type than XLL; I began exploring VSTO's (https://medium.com/@airlockdigital/make-phishing-great-again-vsto-office-files-are-the-new-macro-nightmare-e09fcadef010), which are Visual Studio Templates for Office. I highly encourage you to check out that article.VSTO's ultimately call a DLL which can either be located locally with the .XLSX that initiates everything, or hosted remotely and downloaded by the .XLSX via http/https. The local option provides no real advantages (and in fact several disadvantages in that there are several more files associated with a VSTO attack), and the remote option unfortunately requires a code signing certificate or for the remote location to be a trusted network. Not having a valid code signing cert, VSTO's do not mitigate any of the issues in this scenario that our XLL payload is running into.We really seem to be backed into a corner here. Running the XLL itself is fine, however the XLL cannot be delivered by itself to the victim either via email attachment or web download due to organization policy. The XLL needs to be packaged inside a container, however due to DLP formats like ISO, IMG, and VHD are not viable. The victim needs to be able to open the container natively without any third party software, which really leaves ZIP as the option; however as discussed, running the XLL from a zipped folder results in it being copied and ran from appdata\local\temp which flags AV.I spent many hours brain storming and testing things, going down the VSTO rabbit hole, exploring all conceivable options until I finally decided to try something so dumb it just might work.This time I created a folder, placed the XLL inside it, and then zipped the folder:

___________________________
@hacking_Attack
@Hacking_Video

Clicking into the folder reveals the XLL file:

___________________________
@hacking_Attack
@Hacking_Video

Your First Bug (Burp Suite)
https://systemweakness.com/your-first-bug-burp-suite-ad3f7fe56e46?source=rss------bug_bounty-5

Cc: InsidePHDContinue reading on System Weakness » (https://systemweakness.com/your-first-bug-burp-suite-ad3f7fe56e46?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The Tale Of SSRF To RCE on .GOV Domain
https://medium.com/@tobydavenn/the-tale-of-ssrf-to-rce-on-gov-domain-191185b32b37?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Welcome back, I hope everyone is well. Without further hesitation let’s dive into it!Continue reading on Medium » (https://medium.com/@tobydavenn/the-tale-of-ssrf-to-rce-on-gov-domain-191185b32b37?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video