00:00:00.000-->00:00:03.583
>>Good morning everyone, thank
you for being here so early to
listen to me talk about

00:00:03.583-->00:00:08.083
Microsoft Office of all things.
Uh, there’s a lot to get through
and I hope that you learn a lot

00:00:08.083-->00:00:12.750
um but even if you don’t at the
very least, I do hope that your
budget application for coming to

00:00:12.750-->00:00:17.000
Def Con was helped by being able
to say you took part in
Microsoft Office training.

00:00:17.000-->00:00:23.167
[laughter] That is a little bit
of a joke but at the same time,
there’s a lot of truth to that

00:00:23.167-->00:00:28.125
because this talk is effectively
about how we as attackers can be
better at using Microsoft

00:00:28.125-->00:00:33.542
Office, how there’s a lot of
legitimate functionality to
extend what Office can do um

00:00:33.542-->00:00:39.458
including execute arbitrary code
um and that’s somethings as
attackers which we can abuse for

00:00:39.458-->00:00:45.500
uh purposes such as maintaining
persistence on compromised work
stations. So, in terms of the

00:00:45.500-->00:00:51.417
motivation for doing this
research, ah the first one was
that Microsoft Office is so

00:00:51.417-->00:00:57.125
ingrained in the workflows of um
a typical business user that if
you compromise a random

00:00:57.125-->00:01:01.167
workstation, you’re almost
certainly going to come across
Micro- across Microsoft Office.

00:01:01.167-->00:01:05.417
That means if you persistence
techniques that use Microsoft
Office, they’re going to have a

00:01:05.417-->00:01:11.000
very wide application. Another
thing was, I wanted to follow on
some research um that was

00:01:11.000-->00:01:17.333
popularized in the past couple
of years in part by a colleague
of mine at MWR Costos um but

00:01:17.333-->00:01:23.833
also um around the same time by
Matt Nelson and that was on the
topic of Office template. So if

00:01:23.833-->00:01:28.750
anyone isn’t familiar with this,
essentially um all documents
that you create with Microsoft

00:01:28.750-->00:01:35.000
Office maintain a reference back
to their original template and
if you put a macro in that

00:01:35.000-->00:01:39.292
original template, when you -op
when you open up a document, uh
that reference will actually get

00:01:39.292-->00:01:45.583
followed and that um halo, that
macro will -will get executed.
Now these templates are stored

00:01:45.583-->00:01:52.125
in trusted locations. Uh what
this means is that trusted to be
exempt from normal macro policy.

00:01:52.125-->00:01:57.000
So even if you disable macros
without notification, um
documents that exist in within

00:01:57.000-->00:02:02.208
these folders such as the
templates ah the VBA, the macros
will still get executed. Uh, now

00:02:02.208-->00:02:07.333
when looking at these, some of
them are very cleared marked as
being for the purposes of

00:02:07.333-->00:02:12.250
templates but others are being
marked as for startup and that
got me wondering “What’s the

00:02:12.250-->00:02:16.667
difference between the two? What
does Microsoft want us storing
here and how can we potentially

00:02:16.667-->00:02:21.667
use that?” So one of the things
I came across was, Word WLL
files um and it turns out these

00:02:23.958-->00:02:29.333
are basically just DLL’s uh
which export particular
functions which can be used to

00:02:29.333-->00:02:35.417
extend what Word can do. Now if
you look online for how to
create a WLL file, what do these

00:02:35.417-->00:02:40.250
functions need to be called, do
they have to be implemented in a
specific way? You won’t actually

00:02:40.250-->00:02:44.833
find a huge amount of
information uh and it turns out
that one po -potential answer

00:02:44.833-->00:02:48.875
for this is that they were
actually developed for Office
’97 um but despite this they

00:02:48.875-->00:02:54.500
still supported in modern office
versions. Um, so in terms of uh
for what we need to do, um what,

00:02:54.500-->00:02:59.042
you know what are these
functions that we need to
export. Ah, it actually doesn’t

00:02:59.042-->00:03:04.125
really matter. What you can just
do is create the DLL, uh stick
your payload in the DLLmain

00:03:04.125-->00:03:09.000
function, a you don’t actually
need to export anything. All you
need to do is rename the file

00:03:09.000-->00:03:15.417
extension from a DLL to a WLL so
one letter change. Drop that in
the startup location for

00:03:15.417-->00:03:21.708
Microsoft Word and uh Word will
actually arbitrarily load that
DLL for you and you can get code

00:03:21.708-->00:03:26.458
execution that way. One
interesting thing about the way
that Microsoft would treat WLL

00:03:26.458-->00:03:31.792
files is that ah it doesn’t
actually list them as active
add-ins which is something that

00:03:31.792-->00:03:36.333
those involved in defense should
be aware of. Um, I think this
potentially could just be

00:03:36.333-->00:03:41.583
because um, the correct
functions aren’t being exported
in order for it to identify it.

00:03:41.583-->00:03:46.583
Um but regardless it –it works
for the defense purposes. Excel
also has a an add-in, XLL, as is

00:03:49.083-->00:03:54.083
considerably more updated. The
software development kits were
released in 2007 so only 10

00:03:54.083-->00:04:00.292
years ago. Um, you do have to
export the right functions in an
XLL add-in. Um, this one

00:04:00.292-->00:04:05.667
specific function that you have
export called Excel Auto Open
and when Excel starts up, it

00:04:05.667-->00:04:10.333
will check the startup location
for any files in there. It will
see if it’s export this function

00:04:10.333-->00:04:16.000
and then it will call that so we
can get arbitrary code execution
through this way as well. A

00:04:16.000-->00:04:22.167
couple of curious things about
the way that Excel treats XLL
add-ins, the first is that um

00:04:22.167-->00:04:26.292
Excel doesn’t seem particularly
concerned about file extensions
for anything in the startup

00:04:26.292-->00:04:31.292
location so you don’t even need
to rename your DLL to an XLL,
you can call it a .txt file or

00:04:33.417-->00:04:37.958
if you want, you can have no
extension at all. Um, Excel
seems to just fingerprint all

00:04:37.958-->00:04:44.083
the files, see if it understands
them, and then will um load them
up, uh load them anyways.

00:04:44.083-->00:04:49.542
Another thing is there is this
particular registry key uh which
you can see there and then it

00:04:49.542-->00:04:54.542
has a particular property which
you can create um called OPEN.
Ah so the value is open and you

00:04:54.542-->00:04:59.333
can have multiple of these open
and then an integer um and then
the value of this. If you

00:04:59.333-->00:05:05.792
specify the /R switch um and
then the absolute path of a XLL
add-in um you can actually load

00:05:05.792-->00:05:12.458
XLL add-ins from outside the
started trusted location. Um and
that doesn’t give any warning

00:05:12.458-->00:05:18.250
prompts to -to users. So just a
quick a demonstration of this.
Um, so if we open up Excel we

00:05:18.250-->00:05:23.250
can see that nothing um gets
executed. And if we go into the
Options going to the Trust

00:05:25.792-->00:05:30.833
Center and look at the trusted
location. So we can see for the
user startup location, so this

00:05:30.833-->00:05:34.125
is for our user, this doesn’t
require any administrative
rights, it’s in the roaming

00:05:34.125-->00:05:38.250
profile which is good for
persistence in transient
environments. Um, Microsoft

00:05:38.250-->00:05:44.250
Excel Excel Start. So we got
this .txt file on the desktop
and if we check that with

00:05:44.250-->00:05:49.625
Dependency Walker we can see
it’s actually a DLL file cause
it’s exporting a -a function

00:05:49.625-->00:05:55.417
called Excel AutoOpen, you see
that there. So what we need to
do is copy this into the startup

00:05:55.417-->00:06:02.333
location. So if we go into
AppData which takes us into the
roaming profile then Microsoft

00:06:02.333-->00:06:07.333
Excel, Excel Start, copy that
in, um it, Excel should load
this DLL which in this case um

00:06:13.042-->00:06:18.042
just spawns a count. Um
[Applause] So if we, if we
delete that file now so it

00:06:21.667-->00:06:26.125
shouldn’t um shouldn’t execute
because it’s not there. Ah, so
just to show the –the registry

00:06:26.125-->00:06:30.500
variant and the there’s no sort
of security warnings for that,
there’s this .rec file which

00:06:30.500-->00:06:34.917
creates the property that we
just saw before, the open
property /R and then the

00:06:34.917-->00:06:40.000
absolute path to an XLL file on
the desktop. One thing that I
forgot to mention, was that if

00:06:40.000-->00:06:45.750
you’re if you’re doing the
registry method file extensions
do matter so it needs to be XLL

00:06:45.750-->00:06:52.000
or DLL um but there we have uh
the registry key being created
and then again when it uh opens

00:06:52.000-->00:06:57.000
it executes. So it’s possible to
create VBA add-ins as well. So
VBA of course is the language of

00:06:59.875-->00:07:03.500
macros. The way that you create
them is pretty much the same as
the way that you create a macro

00:07:03.500-->00:07:09.625
document. Um, you open Excel,
you open the VBA editor, you
stick your macro in. Um, the

00:07:09.625-->00:07:13.958
difference comes when you go to
save it, um if you drop down the
list of supported file types,

00:07:13.958-->00:07:18.000
somewhere near the bottom but
not quite, there’s actually
something’s called Excel um

00:07:18.000-->00:07:23.000
add-in which has an XLA or XLAM
file extension um and if you ah
basically save it as this format

00:07:26.000-->00:07:30.958
which is just a an Excel
document without any associated
spreadsheets, and drop it in the

00:07:30.958-->00:07:35.625
um startup location for Excel,
that will get executed when
Excel opens in the same way that

00:07:35.625-->00:07:41.083
we’ve just seen. PowerPoint has
the same sort of thing, ah
different file extension, same

00:07:41.083-->00:07:45.792
way of creating. Ah, one
difference is that you do need
to indicate PowerPoint for a

00:07:45.792-->00:07:50.083
registry edit that it needs to
load it um so you create a
particular key-in that has a

00:07:50.083-->00:07:54.958
couple of properties such as
AutoLoad, you set that to a
value of 1 which means uh load

00:07:54.958-->00:07:59.833
at startup and then you’d give
it a path which is just a file
name, um but that um and then

00:07:59.833-->00:08:06.292
PowerPoint will know itself to
check in the startup location
for a file of that name. Now a

00:08:06.292-->00:08:12.042
lot of the -or all of the
add-ins I talked about so far
involve basically dropping

00:08:12.042-->00:08:16.833
something into um the startup
location. Another form of add-in
which is sort of slightly

00:08:16.833-->00:08:20.917
different in terms of the way
that you deploy it uh uh those
add-ins which are based on COM.

00:08:20.917-->00:08:24.083
Um so for anyone that isn’t
familiar with COM, Component
Object Model, this was a

00:08:24.083-->00:08:29.250
technology developed in the
early 90’s by Microsoft. Ah, and
basically it’s to create uh a

00:08:29.250-->00:08:34.292
sort binary interface standard
so you can create reusable
software components which can be

00:08:34.292-->00:08:39.500
interactive within a language
independent way. Um I guess the
non-Wikipedia definition is you

00:08:39.500-->00:08:43.708
create something and as long as
you know how to interface with
it, you don’t really need to

00:08:43.708-->00:08:48.750
know how the innards are
implemented. Um so these are
used all over Windows um, you

00:08:48.750-->00:08:53.917
know Windows, modern Windows
operating systems are still very
reliant on COM. Um, these COM

00:08:53.917-->00:08:58.917
objects and you can use these
COM objects as add-ins for um
Office programs. In order to do

00:09:01.333-->00:09:05.500
that you have to implement a
particular software interface
called the IDTExtensibility2

00:09:05.500-->00:09:11.958
Interface. Ah and basically that
involves implementing a series
of uh 5 methods which basically

00:09:11.958-->00:09:17.708
act as event handlers. So one of
these for example would be um On
Connection which executes code

00:09:17.708-->00:09:24.667
when um the COM object is loaded
as an add-in into the Office
application which is very useful

00:09:24.667-->00:09:30.042
but you could do more
interesting things if you wanted
to. So for example, because COM

00:09:30.042-->00:09:34.250
, COM add-ins you can basically
create them so they’re portable
between all Office products. Um

00:09:34.250-->00:09:39.750
you could have one for Outlook
for example which only executes
code when an email is received,

00:09:39.750-->00:09:44.417
is received with a particular
string in the body. In terms of
the way that we actually go

00:09:44.417-->00:09:50.500
about registering them- using
these add-ons uh add-ins, once
we created them, um it becomes

00:09:50.500-->00:09:55.042
sort of a little bit problematic
and sort of a little bit
mysterious and I felt that it

00:09:55.042-->00:10:01.167
was best to explain through an
example. So for anyone that’s
done COM programming before,

00:10:01.167-->00:10:06.083
you’ll note that you sort of
register them normally using
such tools as Reg ASM ah which

00:10:06.083-->00:10:10.958
requires administrative rights.
Uh, basically the reason for
that is because these tools

00:10:10.958-->00:10:16.875
write directly to the place in
HKey classes root in –in the
registry where COM registration

00:10:16.875-->00:10:23.125
information lives. But this
information is just derived from
other information from part of

00:10:23.125-->00:10:28.375
HKey Current User and HKey Local
Machine ah which actually gets
synchronized when you lock out.

00:10:28.375-->00:10:34.542
Um and one of those hives, HKey
Current Users we, we obviously
have um write access to so if we

00:10:34.542-->00:10:41.375
manually register COM objects,
we don’t need administrative
rights. So, just to show you a

00:10:41.375-->00:10:48.083
very sort of simplistic example
at a very stratospheric level,
if you look up at the top here,

00:10:48.083-->00:10:53.292
this is sort of creating a key
calling InconspicuousComAddIn
dot connect. Um, and that has

00:10:53.292-->00:10:59.625
subkey CLSID with a default
value of a GUID. And that GUID
has its own key ah in the green

00:10:59.625-->00:11:04.167
section with various bits of
information associated with it.
Um, and you know not important

00:11:04.167-->00:11:08.958
really to understand what –what
all of them are for our
understanding but this line here

00:11:08.958-->00:11:13.708
is particularly important
Codebase. Ah so that points to
um the file on disk which is

00:11:13.708-->00:11:18.792
actually implementing this COM
object. So we have a name that’s
associated with a GUID and that

00:11:18.792-->00:11:23.708
GUID is somehow mapped to um the
–the file on disk which
implements it so then we can

00:11:23.708-->00:11:28.625
basically go down to the bottom
bit which is the application
specific registration so telling

00:11:28.625-->00:11:34.625
the application to use that COM
object um where we can basically
just say, “Use this friendly

00:11:34.625-->00:11:40.500
name,” um and then Windows does
the mapping back to the actual
COM object on this. So this way

00:11:40.500-->00:11:45.500
we can uh using COM objects, we
can create cross application
add-ins um which are very

00:11:47.625-->00:11:53.833
portable and don't require
administrative rights. Another
form of add-in ah based on COM

00:11:53.833-->00:11:58.833
is for the VBA editor. So these
are add-ins which don't execute
when you open a document um but

00:12:01.083-->00:12:06.083
they execute when you open the
VBA editor so whenever someone
comes to look um at the VBA code

00:12:08.875-->00:12:15.833
itself at the macros, um or edit
them, that's when it gets
executed. So it gets executed

00:12:15.833-->00:12:22.792
when the VBA editor loads. Um,
does it really have a huge
application but uh perhaps one

00:12:22.792-->00:12:28.458
of my favorites. Um, the way
that you register these is
basically the same as what I

00:12:28.458-->00:12:30.458
just discussed. You register it
with windows like the first 2
boxes and then it's only the

00:12:30.458-->00:12:34.500
application specific bit at the
end which is different. So in
this case, um creating a –a key

00:12:34.500-->00:12:39.625
which has this sort of uh the
name of the COM object and then
it's got various properties

00:12:39.625-->00:12:44.833
associated with it such as load
behavior which means load it
when um when the VBE editor

00:12:44.833-->00:12:49.833
starts up. Another form of
add-in um is sort of specific to
Microsoft Excel is called the

00:12:54.250-->00:12:59.208
Automation add-ins so if you
open up Excel now, and you –you
look at the support list of

00:12:59.208-->00:13:03.458
supported add-ins, you'll see
that it distinguishes between
COM add-ins and automation

00:13:03.458-->00:13:09.375
add-ins ah but really automation
add-ins are also based on COM.
Um, the difference is that they

00:13:09.375-->00:13:15.875
don't implement the
IDTExtensibility2 interface. Um,
I should mention as well that uh

00:13:15.875-->00:13:20.875
VBE add-in also implements the
IDTExtensibility2 interface so
the COM add-ins and the VBE

00:13:20.875-->00:13:25.500
add-ins kind of more or less the
same thing whereas this
automation add-in say for Excel

00:13:25.500-->00:13:28.917
are slightly different ah
because you don't need to
implement that interface. Ah,

00:13:28.917-->00:13:34.250
basically you just define um
public functions in the COM
objects, ah and those public

00:13:34.250-->00:13:40.500
functions become user defined
functions within umm Excel so uh
you can have a formulae for

00:13:40.500-->00:13:46.000
example which is equals calc and
it spawns calc or inject
shellcode into the memory of

00:13:46.000-->00:13:51.042
another process or whatever you
want it to do. Again,
registration is exactly the same

00:13:51.042-->00:13:56.625
in terms of what you do with
Windows. The difference is when
it comes to um the application

00:13:56.625-->00:14:02.417
specific bit and again we see a
reappearance of the open
registry key property only this

00:14:02.417-->00:14:07.792
time we're using the /A switch
and then we're giving the uh,
the name of the COM object and

00:14:07.792-->00:14:13.333
then Windows sorts everything
else out for us. So a lot of the
stuff I've talked about so far

00:14:13.333-->00:14:18.083
is using technologies that have
been around for a while, what is
Off-, what is Microsoft pushing

00:14:18.083-->00:14:23.583
at the moment in terms of
add-ins. One of them is Visual
Studio Tools for Office. This,

00:14:23.583-->00:14:27.875
despite the name is not
something which is specifically
for developers, um it's just I

00:14:27.875-->00:14:33.542
guess you create a template in
Visual Studio. It's a bit of a
strange name. Um, basically this

00:14:33.542-->00:14:38.208
is a crux application add-in
which is supposed to be a –a
replacement for COM add-ins. Uh,

00:14:38.208-->00:14:44.708
there's a few differences but I
guess the main one is that um
the it sort of simplifies the

00:14:44.708-->00:14:49.500
IDTExtensibility2 interface so
instead of having to implement 5
methods, you only have to

00:14:49.500-->00:14:54.125
implement 2 um but there's
problems with using it for
offensive purposes namely that

00:14:54.125-->00:14:59.875
you need a –a specific run time,
a special run time in order to
use these add-ins. Um, and also

00:14:59.875-->00:15:04.500
they're quite noisy when you
install them. Um, the thing
which Microsoft seems to really

00:15:04.500-->00:15:08.708
be pushing at the moment is Web
add-ins. And these are really
quite interesting because

00:15:08.708-->00:15:13.125
they're based on HTML and
Javascript and they can be not
just cross application but they

00:15:13.125-->00:15:19.250
can be cross platform so you can
have add-ins that work not just
on um Windows but you can have

00:15:19.250-->00:15:24.375
it for Macs or mobile devices.
Um, I haven't really looked at
this and it's certainly an

00:15:24.375-->00:15:28.958
interesting research pro-
project if anybody wants to look
at it. Um, but very briefly

00:15:28.958-->00:15:32.583
looking at the API
documentation, there doesn't
seem to be any immediately

00:15:32.583-->00:15:38.083
obvious way of um executing
operating system commands or any
indeed anything sort of more

00:15:38.083-->00:15:44.083
interesting than that such as
interacting with um operating
system API's. In terms of

00:15:44.083-->00:15:50.958
defending against these add-ins,
it's very easy for COM
automation VSTO you can disable

00:15:50.958-->00:15:55.042
add-ins and that will stop
attackers from using them but of
course, in many cases that will

00:15:55.042-->00:15:59.042
also stop legitimate
organizations that need to use
them from using them. Um, so in

00:15:59.042-->00:16:05.125
this case you can actually
require that add-ins be um
signed by a trusted publisher.

00:16:05.125-->00:16:09.417
However if you do this, I highly
recommend that you also click
the box which says disable

00:16:09.417-->00:16:15.167
notifications for um unsigned
add-ins because if you just
require um the add-ins be

00:16:15.167-->00:16:19.667
signed, users can actually still
click through that and load the
add-ins. Um, so it’s -it's

00:16:19.667-->00:16:25.292
basically you need to click
these two sort of um options at
the top. Despite the -the name

00:16:25.292-->00:16:30.292
of WLL, XLL, and VBA add-ins, uh
disabling add-ins doesn't
actually work for these um so

00:16:33.542-->00:16:38.083
you they still execute for some
reason so you have to take a
different approach in terms of

00:16:38.083-->00:16:43.958
protect- uh, prevention and uh
-uh detection. So the first
would recommendation that I

00:16:43.958-->00:16:49.000
would make is to remove the
trusted locations if you're not
using them or at least relocate

00:16:49.000-->00:16:53.958
the trusted locations to an area
where um administrators um only
have access so you're

00:16:53.958-->00:16:59.292
maintaining administrative
control of that area and low
privilege users can't write into

00:16:59.292-->00:17:04.250
it. Um, but also improving
detective capabilities so um
monitoring those trusted

00:17:04.250-->00:17:09.292
locations for changes so that is
looking at what existing files
are in there, have these files

00:17:09.292-->00:17:13.917
been modified, what new files
are being put in there. Remember
with the case of Excel, it

00:17:13.917-->00:17:18.167
doesn't matter um what
extensions that you're using so
don't just simply look for

00:17:18.167-->00:17:23.125
particular extensions. Really
it's -it's any file that uh–that
are in those folders. Um, I

00:17:23.125-->00:17:28.750
mentioned various registry keys
during the course of this talk.
Um, monitoring these locations

00:17:28.750-->00:17:33.625
in particular the sort of the
registry key property open,
that's a big one, and it's used

00:17:33.625-->00:17:38.042
quite widely. Uh and then basic
EDR stuff, you know looking at
process relationships and stuff

00:17:38.042-->00:17:44.833
and so on. Uh, in conclusion, ah
so this talk was about looking
at the attack surface of

00:17:44.833-->00:17:49.333
Microsoft Office, how there's
many legitimate um means of
extending its functionality and

00:17:49.333-->00:17:54.792
executing arbitrary code which
we can abuse uh for the purposes
of persistence. Um, and pretty

00:17:54.792-->00:18:01.292
much all of- in fact all of the
–the techniques that I've –I've
talked about today don't require

00:18:01.292-->00:18:07.083
administrative rights um, which
is um of course sort of uh the
key situation for persistence

00:18:07.083-->00:18:11.875
techniques. My Twitter Account
is at William Knowles. Uh, if
you want to follow me, please

00:18:11.875-->00:18:18.333
do. Uh, I will look at posting
the uh the slides online in the
coming days and weeks. Thank you

00:18:18.333-->00:18:23.333
very much. [Applause]