00:00:00.083-->00:00:05.958
>>Hi everybody! I am here to
present and demonstrate to you a
new method and tool I formed.

00:00:05.958-->00:00:11.458
It’s called BITSInject and it
let’s you as the local
administrator to gain and

00:00:11.458-->00:00:18.208
execute any program of your will
as the local system user in
session zero. First a couple

00:00:18.208-->00:00:23.208
words about myself I am Dor
Azouri uh after a couple of
years in the IDF I know do

00:00:25.333-->00:00:30.958
security res-research uh at Safe
Breach in Israel. Um started
from data analysis to network

00:00:30.958-->00:00:37.042
research and now I am doing uh
mostly software research of many
kinds of creatures, the bad ones

00:00:37.042-->00:00:39.625
such as ransomware and the uh
other malware. And the good ones
such as the this windows

00:00:39.625-->00:00:44.625
component. This whole method eh
is about 2 uh general techniques
that I used. I’m attacking the

00:00:49.542-->00:00:56.375
[inaudible] organization
mechanism that BITS uses, we
will talk about it, and doing a

00:00:56.375-->00:01:01.375
trick a bagging trick to bypass
uh security check that is
enforced by this service. Uh

00:01:04.083-->00:01:09.083
First let me introduce this uh
mechanism and I say mechanism
because BITS is not only a

00:01:13.042-->00:01:18.625
service it is also a protocol
you might already know it as a
protocol it sits on top of htp

00:01:18.625-->00:01:25.125
it had some new behavior using
new headers and and different
handling of the requests. It

00:01:25.125-->00:01:30.250
stands for background
intelligent transfer service.
And I ask myself why is it

00:01:30.250-->00:01:37.042
called intelligent? There are 2
reasons I think. Uh it has many
advanced features and it

00:01:37.042-->00:01:42.042
optimises the bandwidth usage to
obtain uh better transfer rates.
Um in in short this service lets

00:01:49.000-->00:01:54.375
you, as any client, as a program
error, or as a utility to
transfer files. Either upload or

00:01:54.375-->00:02:06.125
download. A it is here with us
along time ago since windows XP
since uh 2001. It has it had uh

00:02:06.125-->00:02:14.958
4 major ver-versions since then
we’re now at version 4 since uh
uh 2012. It is used mostly by

00:02:14.958-->00:02:19.167
software to download updates in
the background. It is a good
candidate for doing that and the

00:02:19.167-->00:02:24.000
most known use and popular use
that you may already know is the
use that windows update is doing

00:02:24.000-->00:02:30.667
with BITS. It has many advanced
features such as doing retries
on errors such as uh using

00:02:30.667-->00:02:35.000
proxies and authentication and
many others and last but not
least, is the feature of

00:02:35.000-->00:02:39.750
defining a call back. It’s
called command line and a
notification command line that

00:02:39.750-->00:02:47.000
lets you define a program to
execute when the job ends. You
can look at the operations and

00:02:47.000-->00:02:51.583
the different actions that it’s
doing using uh event viewer when
you filter the BITS client. Now

00:02:51.583-->00:03:00.083
we start with with a
demonstration. I take you with
this one click to it has many

00:03:00.083-->00:03:05.292
other features but I do that
with easy mode, I will take you
to interactive session in

00:03:05.292-->00:03:39.417
session zero and you will see
how funny it is to be in the
system. First I just, I just

00:03:39.417-->00:03:45.375
emptied the queue for it to be
easy to understand it can work
with a full queue as well. I am

00:03:45.375-->00:04:09.042
talking about the queue that
BITS maintains for all the jobs
he’s handling. Sorry for that.

00:04:09.042-->00:04:22.833
Yep, thanks. So the easy, the
easy uh interface um this
[inaudible] all you have to give

00:04:22.833-->00:04:40.667
it is the program that you want
to execute. You, you give it the
path, sorry, yeah thanks, and

00:04:40.667-->00:04:44.417
that’s it. It starts with
building a payload of the job a
binary payload that will be

00:04:44.417-->00:04:50.750
injected into the que we’ll go
over the exact details
afterwards and on the second

00:04:50.750-->00:05:16.625
screen I can show you how the,
how the que looks in a specific
time. Sorry about that. Yeah so

00:05:16.625-->00:05:23.292
after the the execution has
ended eh the the que as returned
to be empty. Just as it was

00:05:23.292-->00:05:30.333
before and if you notice we got
uh notification a pop up by
windows saying that the service

00:05:30.333-->00:05:37.333
is trying to communicate with
the active desktop. So we’ll go
and view that message and this

00:05:37.333-->00:05:44.958
is the place. This is session
zero and if you’re confused as
what what what we are here, you

00:05:44.958-->00:05:57.875
can ask the computer. We are the
system. [applause] There are
many cool things you can do here

00:05:57.875-->00:06:02.000
you’ll see very strange behavior
when you try and respond
different programs even the

00:06:02.000-->00:06:17.125
explorer we won't have time to
do that now but you can try it
at with yourself. [pause] Yes so

00:06:17.125-->00:06:21.083
I was very excited to see this
place in the, in the first time
I I guess that if you never had

00:06:21.083-->00:06:29.625
developed a service uh yourself
you didn’t get to see that. Eh
and I haven’t as well. Uh so

00:06:29.625-->00:06:36.458
we’ll go about a couple of uh uh
basic terms about BITS before we
understand the um method. BITS

00:06:36.458-->00:06:43.458
can be used by many different
programs and utilities. There is
ability and utility in windows

00:06:43.458-->00:06:48.792
called bit, called bitsadmin eh
it is now replicated and you can
use the powershell command to

00:06:48.792-->00:06:53.917
control BITS now in the recent
versions. Eh you can also use
one of the 3rd-party apps to

00:06:53.917-->00:07:02.708
create your own. So jobs bits
jobs are added for many
different sources. All of them

00:07:02.708-->00:07:10.375
are either of one type. Down uh
download and upload or an
upload-reply. They are all using

00:07:10.375-->00:07:16.875
the COM interface. Using the
qmgr proxy that proxies the
reimplementation that calls to

00:07:16.875-->00:07:23.958
the reimplementation at qmgr
dll. It is important to
understand that BITS needs to

00:07:23.958-->00:07:29.167
maintain and effortlessly handle
all the requests and all the
transfer jobs and for doing that

00:07:29.167-->00:07:35.667
BITS maintains a state file.
This is just a binary
presentation on the hard disk of

00:07:35.667-->00:07:41.958
the whole queue of the jobs. And
the job objects themselves. This
is where the attack happens we

00:07:41.958-->00:07:48.500
will we will take we will
understand in a few minutes. Now
each job that is added has an

00:07:48.500-->00:07:55.417
owner the owner is the user that
requested the job and only this
user can then make actions on

00:07:55.417-->00:08:02.167
the job, crucial actions.
Because many unknown malicious
users uh before it is used as a

00:08:02.167-->00:08:06.292
malware download just using
[inaudible] and as a
persis-persistency mechanism it

00:08:06.292-->00:08:13.000
can be used to trigger a job
that will dow redownload the
same binary and will execute it

00:08:13.000-->00:08:24.458
even months after the creation.
Yeah okay, thanks. Uh. It is
also used b to do C 2

00:08:24.458-->00:08:29.083
communication uh taking
advantage of the advanced
features such as the proxies and

00:08:29.083-->00:08:36.583
the authentication it is a good
candidate for a malware to use
it to communicate. So. What is

00:08:36.583-->00:08:41.500
the real abuse we are doing? I
have started with looking at at
uh how many how different

00:08:41.500-->00:08:47.208
programs are using BITS and I
was very jealous of how windows
update service is using BITS to

00:08:47.208-->00:08:56.125
download updates and then
execute them as the system. The
enabling feature that hides

00:08:56.125-->00:09:00.875
behind the uh the notification
command line the call back that
I recently that that I

00:09:00.875-->00:09:08.167
previously told you about eh
what what’s behind it is just a
call to set notify command line

00:09:08.167-->00:09:12.667
which eventually calls
createprocess as user. And this
is what we’re taking advantage

00:09:12.667-->00:09:18.500
of you if the user, the owner of
the job, eh is system then the
command line will be executed as

00:09:18.500-->00:09:27.792
system. So what we really want
to do is create our own job
being in system being it’s owner

00:09:27.792-->00:09:38.042
so the first made try was uh
using psexec, psexec lets me uh
execute my own commands as the

00:09:38.042-->00:09:44.583
system user. But psexec gives
you the interface at your own
station, at the user’s station

00:09:44.583-->00:09:52.542
and not at station zero. Station
zero is where the service that
psexec creates runs. So it I

00:09:52.542-->00:09:59.042
started with a naive try and
wanted to create a job uh and
the creation was uh s-successful

00:09:59.042-->00:10:06.750
cause it only adds uh a new good
to the que but trying to do a
real crucial uh uh operation

00:10:06.750-->00:10:12.708
such as adding the file the
finishing to be transferred
caused an error. And the and the

00:10:12.708-->00:10:17.375
exception was unable to add file
to job uh the operation being
requested was not performed

00:10:17.375-->00:10:21.750
because the user has not logged
on to the network. And this is
crucial to understand that

00:10:21.750-->00:10:26.708
security enforcement that we
will later bypass and the funny
part about that is that when I

00:10:26.708-->00:10:31.833
tried to cancel or delete that
job using the command I couldn’t
and I got the same exception. So

00:10:31.833-->00:10:39.000
I got 2 separate situations
where god in this system created
a job that he cannot delete. And

00:10:39.000-->00:10:45.875
actually th-this was my first
clue to go and investigate the
state file because the only way

00:10:45.875-->00:10:49.958
I have found to delete that uh
job was to completely delete the
state file which holds all the

00:10:49.958-->00:10:58.333
queue. uh so I went over and uh
looked at the flow that windows
app is using to create the jobs

00:10:58.333-->00:11:04.208
and the first would be to get
the context of the com server
the BITS server and then

00:11:04.208-->00:11:11.833
naturally you would create the
job and this is one of the of
the API calls the qmgr uh offers

00:11:11.833-->00:11:17.583
so if you look uh in this
example you will see the
description parameter being a WU

00:11:17.583-->00:11:21.833
Client Download and if you look
at your computer while it
downloads uh uh an update from

00:11:21.833-->00:11:30.042
windows for windows you will see
in the queue at least one job
with this description. Then the

00:11:30.042-->00:11:35.792
next thing just like we did in
the command line is adding a
file definition. Then only when

00:11:35.792-->00:11:42.000
you call explicit-explicity to
resume the job will com will
start and transfer the files.

00:11:42.000-->00:11:48.333
The two last calls are actually
being called by the BITS uh
service itself internally when

00:11:48.333-->00:11:53.958
it decides that new transfer
junk should should be
transferred. So I compared these

00:11:53.958-->00:11:59.333
2 flows the one valid one that
we got from uh windows update
and the failed one that I tried

00:11:59.333-->00:12:04.958
with psexec. The first call was
identical in parameters and
succeeded in both and the last

00:12:04.958-->00:12:10.667
call the second call was
identical in parameters but we
got an exception when we were

00:12:10.667-->00:12:19.333
running from psexec. I dig into
the reason and found that that
the security enforcement that is

00:12:19.333-->00:12:24.542
done here every operation that
is done on the job needs to be
verified that the client, the

00:12:24.542-->00:12:30.417
user that requested it is logged
on on that session and the
reason we got an exception is

00:12:30.417-->00:12:35.333
because the user the system was
not logged on in session 1 where
psexec would let me execute the

00:12:35.333-->00:12:44.042
commands. So what was the
solution just faking the session
ID in memory. So this is the

00:12:44.042-->00:12:49.750
flow that the is performed
before any call. Eh first BITS
wants to switch to the logon

00:12:49.750-->00:12:55.125
token of the user that requested
the action it needs to clone it
and to find the real token that

00:12:55.125-->00:13:00.167
it needs to clone it just
iterates through all the logged
in users in the in the session

00:13:00.167-->00:13:06.583
that was requesting the action.
Now the session is acquired by
gettokeninformation call. And

00:13:06.583-->00:13:15.833
when we when we accepted when we
uh run this uh with psexec we
got the exception because system

00:13:15.833-->00:13:24.542
is not logged on in session one.
All we had to do is change them
in memory the return value uh

00:13:24.542-->00:13:31.125
API call to zero and BITS will
then search for the logged on
user in that session and of

00:13:31.125-->00:13:35.792
course that succeeds because
this time it is logged on in
session zero. This is how, how

00:13:35.792-->00:13:42.542
we bypass the security check at
this gate but the new job which
is now valid and is in the state

00:13:42.542-->00:13:49.083
file is in suspended state this
is the initial state for each
job that is added and it means

00:13:49.083-->00:13:56.083
that it won't start transfer or
execute. So I went back to the
state file where you remember I

00:13:56.083-->00:14:04.375
saw those it it can control all
the flow of the of the jobs that
BITS maintains and that really

00:14:04.375-->00:14:10.500
is th the state file is actually
2 files that are updated
alternately and the current

00:14:10.500-->00:14:19.625
effective one is dated in the
registry in that value. So I
remind you we want to move the

00:14:19.625-->00:14:26.875
job from eh suspended stated to
queued state where it will con
start an execution. And what's

00:14:26.875-->00:14:33.167
in the state file? A state file
is just a clear straight forward
binary representation of the job

00:14:33.167-->00:14:38.667
objects and the queue at whole.
For example string
representation will look like

00:14:38.667-->00:14:44.417
that. Very easy to understand
and this this is really easy how
you are going to see it when you

00:14:44.417-->00:14:49.208
edit the file. It is
unencrypted. And it is partially
protected because as long as the

00:14:49.208-->00:14:54.917
service is on and running you
won't be able to edit it, even
not as the administrator but

00:14:54.917-->00:15:02.083
when you start the service the
administrator has full access to
that file. I remind you this is

00:15:02.083-->00:15:09.333
what we want you to do. And that
is the complete layout of the
method of and what the tool

00:15:09.333-->00:15:15.917
does. It stops the service
modifies the file, the files,
puts them in place and start the

00:15:15.917-->00:15:21.125
service, the service again. When
the service restarts it just
loads the objects, the binary

00:15:21.125-->00:15:27.833
presentations of them loads them
to memory and continues the
execution. And when we do that

00:15:27.833-->00:15:38.292
and look at the queue, we can
see that we added the file uh we
added the job and with the

00:15:38.292-->00:15:41.375
system being the owner it is now
connecting meaning the execution
has started and when it ends the

00:15:41.375-->00:15:49.792
command line would be eh the CMD
run a system in an elevated
integrity level. So from that

00:15:49.792-->00:15:56.458
point, after we have managed to
do it once I wanted, I wanted to
make the eh solution better and

00:15:56.458-->00:16:01.583
m-m-migrating the files to
another machine on the same eh
location. Surprisingly did the

00:16:01.583-->00:16:10.250
job. I just copied the file to
another machine and the machine
would have the same queue as the

00:16:10.250-->00:16:13.542
original machine. It is not
machine dependant but it is
version dependant. Different

00:16:13.542-->00:16:19.292
versions have different,
slightly different state file
structure and th it’s not, it’s

00:16:19.292-->00:16:25.958
not hard to to see the
difference there’s no new
capabilities. This is just a

00:16:25.958-->00:16:30.083
glimpse of how it looks and you
will get the passive for looking
at the, at your state files for

00:16:30.083-->00:16:37.625
yourself. And and another
improvement I want to do is to
not overwrite existing jobs. If

00:16:37.625-->00:16:43.292
I go and put it, the whole file
in a different machine I would
ruin the existing job and

00:16:43.292-->00:16:48.875
interfere with them. So what we
had to do is just increase the
job content which located

00:16:48.875-->00:16:54.333
somewhere at the top of the
queue uh uh structure and push
the job payload the binary

00:16:54.333-->00:17:01.667
payload to the right place. This
is what the tool does. It just
injects a local system job it’s

00:17:01.667-->00:17:06.667
binary payload it removes it
when it finishes and what you
get is what you see. What you

00:17:06.667-->00:17:12.000
saw before is the execution of
the program that is specified.
You can also change the job

00:17:12.000-->00:17:20.125
parameters and do many more uh
the easy way uh to do that is
what I showed you before. Uh and

00:17:20.125-->00:17:27.500
if you noticed uh when we had to
go to the end of the job to
really get the execution the end

00:17:27.500-->00:17:31.875
of the job can either be a
completion of the transfer or
going into ERROR state and i

00:17:31.875-->00:17:36.583
wanted to accelerate the time it
takes eh to get into ERROR
state. So on windows 7 I just

00:17:36.583-->00:17:45.417
set up a local host and and
intentionally put an answer to
the request that would cause an

00:17:45.417-->00:17:51.875
error. The job immediately goes
into ERROR state and the
execution starts. Uh on windows

00:17:51.875-->00:17:58.500
10 it is even better because you
don’t even have to produce any
network traffic. If you fake, if

00:17:58.500-->00:18:03.458
you fake the the volume serial
number, which is one of the
properties of the job uh you get

00:18:03.458-->00:18:10.708
a mismatch from the path that
you specified and uh uh visuals
uh volume serial number and the

00:18:10.708-->00:18:16.208
error will happen before any
network traffic is made, and you
will immediately will get the

00:18:16.208-->00:18:25.000
execution. Other potential
abuses I’ve seen a along the way
is choking specific windows

00:18:25.000-->00:18:30.833
update. When BITS downloads a
file it first creates a hidden
file in a very specific format

00:18:30.833-->00:18:37.333
uh of a name. This format
encloses only about 70 thousand
names so if I create 70 thousand

00:18:37.333-->00:18:44.792
hidden names uh 70 thousand
hidden files with that names I
choke all the namespace that

00:18:44.792-->00:18:48.917
BITS can use and it just fails.
And the error you will see is
not very indicative it just says

00:18:48.917-->00:18:55.417
that windows encountered a
problem. Um you can also use the
proposed method to uh create

00:18:55.417-->00:19:02.958
job, to create job and modify
current job and just think what
you can do with that for other

00:19:02.958-->00:19:10.792
programs that use BITS. That was
uh microsoft security center
response a malicious

00:19:10.792-->00:19:18.958
administrator can do much worse
things and and that’s it.
[laughs] [applause] You can see

00:19:18.958-->00:19:27.667
the links here. [applause] Thank
you! [applause] You can file
the, find the tool code and

00:19:27.667-->00:19:33.583
parser and the site uh
development which is a simple uh
BITS server and hit me up for

00:19:33.583-->00:00:00.000
any request or questions! Thank
you! [applause]