1
00:00:00,000 --> 00:00:00,900
- So to end it all,

2
00:00:00,900 --> 00:00:04,530
we'll end with a great
talk with two first timers.

3
00:00:04,530 --> 00:00:06,262
And when you guys give
him a big hand. (claps)

4
00:00:06,262 --> 00:00:09,262
(audience applauds)

5
00:00:10,590 --> 00:00:12,150
And the name is Steven and Nick,

6
00:00:12,150 --> 00:00:15,420
and the talk is called "Less
SmartScreen More Caffeine",

7
00:00:15,420 --> 00:00:17,130
which is the best thing ever.

8
00:00:17,130 --> 00:00:18,420
More coffee.

9
00:00:18,420 --> 00:00:20,853
ClickOnce, (Ab)Use for
Trusted Code Execution.

10
00:00:23,040 --> 00:00:26,400
Actually cheers for these
guys and cheers for everybody,

11
00:00:26,400 --> 00:00:27,900
we're having a great Con

12
00:00:27,900 --> 00:00:30,153
and let's kick it off for these guys.

13
00:00:31,607 --> 00:00:34,440
(audience cheers)

14
00:00:38,220 --> 00:00:41,057
Oh wait, I'm sorry. (laughs)

15
00:00:41,057 --> 00:00:42,060
I made a mistake.

16
00:00:42,060 --> 00:00:44,460
So since their first time at the Con,

17
00:00:44,460 --> 00:00:47,610
we were a tradition of doing some shots,

18
00:00:47,610 --> 00:00:49,531
there like to basically cool them down.

19
00:00:49,531 --> 00:00:51,993
(audience members cheer)
So here we are.

20
00:00:53,040 --> 00:00:56,553
Steve, Nick, two shot,

21
00:00:58,530 --> 00:01:00,630
cause everyone's a little nervous.

22
00:01:00,630 --> 00:01:04,187
You know it's only live
streamed and all that fun stuff.

23
00:01:04,187 --> 00:01:05,910
- Yeah. Thank you so much.

24
00:01:05,910 --> 00:01:06,990
- There you go. Cheers.

25
00:01:06,990 --> 00:01:08,253
- Cheers.
- Cheers.

26
00:01:11,274 --> 00:01:12,510
(audience cheers)

27
00:01:12,510 --> 00:01:15,333
- Thank you everybody. Appreciate it.

28
00:01:18,690 --> 00:01:20,100
- Hey, so yeah, we'll be talking

29
00:01:20,100 --> 00:01:21,750
about some ClickOnce techniques.

30
00:01:21,750 --> 00:01:22,830
We'll start off with some intros.

31
00:01:22,830 --> 00:01:23,880
My name's Nick Powers.

32
00:01:23,880 --> 00:01:26,790
I'm currently a Senior
Consultant at SpecterOps.

33
00:01:26,790 --> 00:01:30,810
My interest include Windows
stuff, initial access,

34
00:01:30,810 --> 00:01:33,963
some relay attacks, and my
handle on Twitter is @zyn3rgy.

35
00:01:34,860 --> 00:01:35,693
- My name is Steven.

36
00:01:35,693 --> 00:01:38,067
I'm also a Senior Consultant
on team at SpecterOps.

37
00:01:38,067 --> 00:01:39,600
You can follow me @0xthirteen,

38
00:01:39,600 --> 00:01:42,420
if you wanna follow, see more.

39
00:01:42,420 --> 00:01:44,730
So what we look to accomplish today,

40
00:01:44,730 --> 00:01:48,540
we wanna take a relatively
common initial access technique

41
00:01:48,540 --> 00:01:53,430
and extend its value for
offensive use by abusing the trust

42
00:01:53,430 --> 00:01:55,083
of third party applications.

43
00:01:56,250 --> 00:01:58,380
So a little overview of what
we're gonna cover today.

44
00:01:58,380 --> 00:01:59,670
Give a little background of ClickOnce.

45
00:01:59,670 --> 00:02:02,280
I'm not sure if everyone
knows exactly ClickOnce

46
00:02:02,280 --> 00:02:04,800
or how it works, but we'll cover that.

47
00:02:04,800 --> 00:02:06,240
We'll talk about pressure points

48
00:02:06,240 --> 00:02:09,750
of building ClickOnce
applications for weaponization

49
00:02:09,750 --> 00:02:13,440
of initial or offensive
operations, how we can alleviate

50
00:02:13,440 --> 00:02:16,740
those pressure points,
actually showing weaponization,

51
00:02:16,740 --> 00:02:17,640
and then we'll close it off

52
00:02:17,640 --> 00:02:20,223
with some detection
and response overviews.

53
00:02:21,870 --> 00:02:23,610
So a little bit of background.

54
00:02:23,610 --> 00:02:26,880
Initial access techniques are decreasing.

55
00:02:26,880 --> 00:02:28,260
Recently, Microsoft came out

56
00:02:28,260 --> 00:02:30,720
and said, by default in office macros,

57
00:02:30,720 --> 00:02:33,270
they're gonna start disabling
them when it's downloaded

58
00:02:33,270 --> 00:02:34,410
from the internet.

59
00:02:34,410 --> 00:02:37,590
It's been reversed, then
it got reversed back.

60
00:02:37,590 --> 00:02:39,510
So at this case, or at this point,

61
00:02:39,510 --> 00:02:40,620
we're not quite sure where that is,

62
00:02:40,620 --> 00:02:42,840
but there is a lot of
scrutiny that's applied to

63
00:02:42,840 --> 00:02:45,210
Office macros, whether it be applied

64
00:02:45,210 --> 00:02:48,297
for fishing campaigns or
seeded access, what have you.

65
00:02:48,297 --> 00:02:51,630
And so this is just a
way for more techniques

66
00:02:51,630 --> 00:02:55,110
to be leveraged for
initial access campaigns.

67
00:02:55,110 --> 00:02:57,030
Some of the things that
we have to worry about

68
00:02:57,030 --> 00:02:59,130
for initial access campaigns,

69
00:02:59,130 --> 00:03:01,650
obviously we got SmartScreen,
any sort of application

70
00:03:01,650 --> 00:03:04,860
control, EDR, things like
that that run endpoints,

71
00:03:04,860 --> 00:03:07,590
definitely things that
increased our barriered entry

72
00:03:07,590 --> 00:03:09,930
for initial access.

73
00:03:09,930 --> 00:03:11,370
Some things that we need to overcome.

74
00:03:11,370 --> 00:03:14,250
So we need to make sure that
we can install or execute code

75
00:03:14,250 --> 00:03:16,050
that does not require
any sort of privileges,

76
00:03:16,050 --> 00:03:18,240
or sorry, administrative privileges.

77
00:03:18,240 --> 00:03:19,980
Reputable, known good files

78
00:03:19,980 --> 00:03:21,720
during execution definitely helps us

79
00:03:21,720 --> 00:03:24,060
during this process.

80
00:03:24,060 --> 00:03:26,250
Streamlined minimal user interaction.

81
00:03:26,250 --> 00:03:28,050
The more things that people
have to do during fishing

82
00:03:28,050 --> 00:03:31,950
campaigns or initial access
operations definitely decreased

83
00:03:31,950 --> 00:03:33,540
our chances of being successful.

84
00:03:33,540 --> 00:03:36,630
And then we want ease of
re-rolling our techniques

85
00:03:36,630 --> 00:03:37,463
over and over.

86
00:03:39,810 --> 00:03:43,890
So ClickOnce, again, ClickOnce
is a deployment technology

87
00:03:43,890 --> 00:03:46,230
that enables you to create
self-updating Windows-based

88
00:03:46,230 --> 00:03:47,730
applications that can be installed

89
00:03:47,730 --> 00:03:49,920
and run with minimal user interaction.

90
00:03:49,920 --> 00:03:53,400
So this is a vehicle for
installing or executing .NET

91
00:03:53,400 --> 00:03:54,750
applications on endpoints.

92
00:03:54,750 --> 00:03:57,660
And so there's multiple
different ways that ClickOnce can

93
00:03:57,660 --> 00:04:00,240
be deployed, can be
installed on endpoints.

94
00:04:00,240 --> 00:04:02,730
The main thing that we'll
be focusing on today are web

95
00:04:02,730 --> 00:04:07,530
applications or websites that
we can get these installed.

96
00:04:07,530 --> 00:04:09,420
But the main thing that
we'll need to focus on

97
00:04:09,420 --> 00:04:12,270
and will be important throughout
this talk are manifests.

98
00:04:12,270 --> 00:04:14,520
Now, anyone that's done
any sort of manifests,

99
00:04:14,520 --> 00:04:18,900
or .NET stuff, or .NET work

100
00:04:18,900 --> 00:04:20,250
might be familiar with manifests.

101
00:04:20,250 --> 00:04:21,810
And so we'll be talking about that

102
00:04:21,810 --> 00:04:23,550
throughout this entire slide deck.

103
00:04:23,550 --> 00:04:27,720
But plenty of legitimate
applications use ClickOnce

104
00:04:27,720 --> 00:04:30,210
for their vehicles of
deploying their code.

105
00:04:30,210 --> 00:04:33,210
So Chrome historically
used to use ClickOnce.,

106
00:04:33,210 --> 00:04:34,830
Fidelity, the bank, uses ClickOnce

107
00:04:34,830 --> 00:04:37,110
and tons of other ones you
probably have never heard of,

108
00:04:37,110 --> 00:04:38,523
but they also use ClickOnce.

109
00:04:40,200 --> 00:04:42,387
So again, as I said,
manifests are very important.

110
00:04:42,387 --> 00:04:45,300
And so, we'll talk about the
different types of manifests

111
00:04:45,300 --> 00:04:46,620
that come into play with ClickOnce

112
00:04:46,620 --> 00:04:49,170
and what their roles are with them.

113
00:04:49,170 --> 00:04:50,730
So the first one that
we need to think about

114
00:04:50,730 --> 00:04:52,230
is a Deployment Manifest.

115
00:04:52,230 --> 00:04:55,470
And so this is gonna be
named a .application file.

116
00:04:55,470 --> 00:04:57,060
So when you go to a website,

117
00:04:57,060 --> 00:04:58,710
the first thing that you
interact with ClickOnce

118
00:04:58,710 --> 00:05:01,770
application is gonna be a
.application file, which again,

119
00:05:01,770 --> 00:05:03,480
as the Deployment Manifest.

120
00:05:03,480 --> 00:05:06,630
Now this is gonna reference the
actual application manifest.

121
00:05:06,630 --> 00:05:10,560
And inside of this, we have
some identity information

122
00:05:10,560 --> 00:05:12,870
and things along those lines.

123
00:05:12,870 --> 00:05:16,530
In addition to interacting
with deploy manifest,

124
00:05:16,530 --> 00:05:19,110
we also have .appref-ms files,

125
00:05:19,110 --> 00:05:21,630
which we won't talk about
too much in this talk,

126
00:05:21,630 --> 00:05:24,813
but they are usable for
ClickOnce applications.

127
00:05:25,650 --> 00:05:27,300
The second app manifest
that I just mentioned,

128
00:05:27,300 --> 00:05:30,180
application manifests,
is the second manifest

129
00:05:30,180 --> 00:05:31,013
that we have to deal with

130
00:05:31,013 --> 00:05:33,180
when dealing with ClickOnce applications.

131
00:05:33,180 --> 00:05:35,280
And this is a .manifest file.

132
00:05:35,280 --> 00:05:37,860
And so this will specify
dependencies, again,

133
00:05:37,860 --> 00:05:40,020
as I said, identities inside the files

134
00:05:40,020 --> 00:05:42,480
and everything that needs to be downloaded

135
00:05:42,480 --> 00:05:44,980
and deployed alongside
that ClickOnce application.

136
00:05:45,900 --> 00:05:47,970
The identity information
is gonna come into play

137
00:05:47,970 --> 00:05:50,280
as a very important role,
which we'll cover later on

138
00:05:50,280 --> 00:05:52,110
toward the end of this presentation.

139
00:05:52,110 --> 00:05:53,000
But something just to keep in mind

140
00:05:53,000 --> 00:05:55,200
in the back of your head right now.

141
00:05:55,200 --> 00:05:57,900
Everything that we put inside
of the actual application

142
00:05:57,900 --> 00:06:00,780
manifest will have integrity checks,

143
00:06:00,780 --> 00:06:03,900
but we can have some workarounds
with those that we'll cover

144
00:06:03,900 --> 00:06:05,220
later on as well.

145
00:06:05,220 --> 00:06:09,720
Then inside of the actual
.NET applications themselves,

146
00:06:09,720 --> 00:06:12,570
we also have embedded
application manifests

147
00:06:12,570 --> 00:06:14,580
and embedded assembly manifests.

148
00:06:14,580 --> 00:06:16,170
And so these are different, but they look

149
00:06:16,170 --> 00:06:19,950
somewhat similar to how a
ClickOnce application works.

150
00:06:19,950 --> 00:06:22,020
But this is just something
that's just a component

151
00:06:22,020 --> 00:06:23,280
of .NET itself.

152
00:06:23,280 --> 00:06:27,123
But again, these have various
factors that are important.

153
00:06:28,530 --> 00:06:30,720
So this is what a ClickOnce
application looks like.

154
00:06:30,720 --> 00:06:34,410
We have our deployment manifest,
our application manifest,

155
00:06:34,410 --> 00:06:38,460
and then our actual .NET.exe.deploy.

156
00:06:38,460 --> 00:06:40,650
They can be named .deploy
for the extension,

157
00:06:40,650 --> 00:06:41,483
but they don't have to be,

158
00:06:41,483 --> 00:06:45,060
but typically in like legitimate
ClickOnce applications,

159
00:06:45,060 --> 00:06:47,583
we'll see they are named .deploy.

160
00:06:49,590 --> 00:06:50,423
Oops.

161
00:06:53,880 --> 00:06:54,713
Sorry.

162
00:06:55,740 --> 00:06:57,990
Okay. So ClickOnce applications
are deployed, as I said,

163
00:06:57,990 --> 00:07:00,030
visiting the deployment manifest.

164
00:07:00,030 --> 00:07:03,030
So if you visit some ClickOnce
or deployment manifest

165
00:07:03,030 --> 00:07:05,730
in something like Edge
or Internet Explorer,

166
00:07:05,730 --> 00:07:07,417
you'll see a little popup show up says,

167
00:07:07,417 --> 00:07:08,400
"oh, do you wanna run this

168
00:07:08,400 --> 00:07:10,470
and get the execution that
happens along with that?",

169
00:07:10,470 --> 00:07:12,390
which we'll show in a demo later on.

170
00:07:12,390 --> 00:07:15,600
Alternatively, as I said,
there is an .appref-ms file,

171
00:07:15,600 --> 00:07:17,490
which can be used when you're dealing

172
00:07:17,490 --> 00:07:20,493
with Firefox or Chrome browsers as well.

173
00:07:21,870 --> 00:07:24,840
This serves content based
on whatever the application

174
00:07:24,840 --> 00:07:27,270
manifest specifies and will be downloaded

175
00:07:27,270 --> 00:07:30,780
via HTTP or HTTPs to the host system

176
00:07:30,780 --> 00:07:33,000
and will be saved in the app data,

177
00:07:33,000 --> 00:07:36,780
local directory, and a
randomized directory,

178
00:07:36,780 --> 00:07:38,610
but all in the same naming convention

179
00:07:38,610 --> 00:07:41,070
of apps 2.0 and stuff like that.

180
00:07:41,070 --> 00:07:43,380
The processes that will launch everything,

181
00:07:43,380 --> 00:07:45,750
handle the download, the execution,

182
00:07:45,750 --> 00:07:48,270
and the launching of
everything is called dfsvc,

183
00:07:48,270 --> 00:07:50,580
which is a part of the .NET framework.

184
00:07:50,580 --> 00:07:53,250
And so the main thing that dfsvc is doing,

185
00:07:53,250 --> 00:07:55,890
it's gonna be loading the
System.Deployment.dll,

186
00:07:55,890 --> 00:07:58,770
again, part of the .NET
framework that will be handling

187
00:07:58,770 --> 00:08:00,933
pretty much every component of ClickOnce.

188
00:08:04,230 --> 00:08:06,960
So we have here our HTML,

189
00:08:06,960 --> 00:08:09,990
this is just an example of
what the download looks like.

190
00:08:09,990 --> 00:08:12,540
We have our deployment
manifest and it's gonna hit all

191
00:08:12,540 --> 00:08:16,320
of our dependencies and the
main ClickOnce application

192
00:08:16,320 --> 00:08:18,993
and download everything
and get it onto the host.

193
00:08:20,190 --> 00:08:21,420
This is just a simple example

194
00:08:21,420 --> 00:08:23,880
of what our .appref-ms file looks like.

195
00:08:23,880 --> 00:08:25,560
This just shows the location

196
00:08:25,560 --> 00:08:27,600
of where the ClickOnce application is,

197
00:08:27,600 --> 00:08:29,550
calls the ClickOnce protocol handler,

198
00:08:29,550 --> 00:08:31,920
and then specifies some
additional .NET information

199
00:08:31,920 --> 00:08:32,853
that's necessary.

200
00:08:35,430 --> 00:08:37,440
This is what an example
of a deployment manifest

201
00:08:37,440 --> 00:08:38,850
would looks like.

202
00:08:38,850 --> 00:08:40,830
We're referencing the
application manifest,

203
00:08:40,830 --> 00:08:42,000
as I said, part of here,

204
00:08:42,000 --> 00:08:44,970
and this will determine where to download

205
00:08:44,970 --> 00:08:45,803
all the rest of the dependencies

206
00:08:45,803 --> 00:08:47,850
and the actual ClickOnce
application itself.

207
00:08:47,850 --> 00:08:51,000
And then also, we have the
assemblyIdentity as well,

208
00:08:51,000 --> 00:08:52,400
which is important later on.

209
00:08:53,880 --> 00:08:55,560
Example of what the application manifest

210
00:08:55,560 --> 00:08:57,570
of ClickOnce looks like, we just have

211
00:08:57,570 --> 00:09:00,300
UAC information, identity information.

212
00:09:00,300 --> 00:09:02,370
We have some dependency information,

213
00:09:02,370 --> 00:09:05,100
everything that needs to
be downloaded as well.

214
00:09:05,100 --> 00:09:07,900
And everything that comes
along with the entire package.

215
00:09:09,750 --> 00:09:10,710
This is an example

216
00:09:10,710 --> 00:09:13,560
of what embedded application
manifest looks like.

217
00:09:13,560 --> 00:09:16,230
And so we have, again,
more identity information.

218
00:09:16,230 --> 00:09:18,690
This is actually just .NET
applications themselves.

219
00:09:18,690 --> 00:09:20,487
So this is what they will be built with.

220
00:09:20,487 --> 00:09:23,943
And this is contained in
almost all applications.

221
00:09:25,890 --> 00:09:28,500
Example of what an assembly
manifest looks like.

222
00:09:28,500 --> 00:09:31,500
This will reference mainly
the dependencies that go along

223
00:09:31,500 --> 00:09:33,390
with a ClickOnce application.

224
00:09:33,390 --> 00:09:34,620
This is what it looks like in dnSpy,

225
00:09:34,620 --> 00:09:37,890
a little bit cleaner than the
last screenshot from IL DASM,

226
00:09:37,890 --> 00:09:39,120
but that's just showing the difference

227
00:09:39,120 --> 00:09:40,533
of what is shown there.

228
00:09:41,820 --> 00:09:44,160
So the reason that we'll be
talk covering through this talk

229
00:09:44,160 --> 00:09:46,590
of why these are important is
that they're gonna be parsed

230
00:09:46,590 --> 00:09:49,470
by the System.Deployment.dll
functionality.

231
00:09:49,470 --> 00:09:51,990
And they're gonna make
some comparison checks

232
00:09:51,990 --> 00:09:53,460
for the actual execution.

233
00:09:53,460 --> 00:09:55,950
But this is kind of showing
example of where that is

234
00:09:55,950 --> 00:09:58,923
essentially being applied
and parsed and handled.

235
00:10:00,750 --> 00:10:03,780
So we're gonna show a
demo that's gonna show

236
00:10:03,780 --> 00:10:06,210
what if you were to build
a ClickOnce application

237
00:10:06,210 --> 00:10:09,030
right now and you, it's not signed,

238
00:10:09,030 --> 00:10:10,890
you don't have the codesigning cert,

239
00:10:10,890 --> 00:10:14,223
and what this would look like
from a execution standard.

240
00:10:17,280 --> 00:10:19,113
This is yeah. All right.

241
00:10:20,760 --> 00:10:23,820
So we'll go to our site
index.html for the site.

242
00:10:23,820 --> 00:10:25,830
We have our download, which is gonna be

243
00:10:25,830 --> 00:10:28,893
where our deployment manifest is located.

244
00:10:31,110 --> 00:10:32,490
Click download with the little popup.

245
00:10:32,490 --> 00:10:34,500
It says, "do you wanna run this?"

246
00:10:34,500 --> 00:10:36,060
Say yes.

247
00:10:36,060 --> 00:10:39,030
We have our little run
dialogue, click run downloads,

248
00:10:39,030 --> 00:10:41,670
and we have our SmartScreen popup show up.

249
00:10:41,670 --> 00:10:45,030
So from a fishing campaign
or initial access operation,

250
00:10:45,030 --> 00:10:47,580
this is not what we wanna see.

251
00:10:47,580 --> 00:10:48,960
We have hurdles to come through here

252
00:10:48,960 --> 00:10:51,390
now that we have this
application that is not trusted,

253
00:10:51,390 --> 00:10:53,433
no reputation, nothing behind it.

254
00:10:54,270 --> 00:10:57,360
You go and look at it, look at
the application, open it up.

255
00:10:57,360 --> 00:10:59,370
We'll see, look at the signature.

256
00:10:59,370 --> 00:11:01,950
This is just, self-signed
nothing special here.

257
00:11:01,950 --> 00:11:03,570
But there was something that we had to,

258
00:11:03,570 --> 00:11:05,423
some hoops that we had to jump through.

259
00:11:12,900 --> 00:11:15,510
- Awesome, so Steven just
gave us a really good overview

260
00:11:15,510 --> 00:11:18,480
of what ClickOnce looks
like in its current state,

261
00:11:18,480 --> 00:11:20,400
when we want to weaponize
that for something,

262
00:11:20,400 --> 00:11:23,160
some sort of initial access
fishing or otherwise.

263
00:11:23,160 --> 00:11:26,070
So to start working towards
some of the problems that we

264
00:11:26,070 --> 00:11:28,590
want to address, we got a screenshot here.

265
00:11:28,590 --> 00:11:30,570
This is from the Bloodhound gang Slacks,

266
00:11:30,570 --> 00:11:33,090
specifically the Red Team channel.

267
00:11:33,090 --> 00:11:35,070
And there's a long
message here at the top.

268
00:11:35,070 --> 00:11:37,080
The summary is someone
is, someone is asking

269
00:11:37,080 --> 00:11:39,030
about using ClickOnce for initial access.

270
00:11:39,030 --> 00:11:40,380
And if you look at the response

271
00:11:40,380 --> 00:11:42,727
second from the bottom it reads,

272
00:11:42,727 --> 00:11:43,620
"If you have a cert,

273
00:11:43,620 --> 00:11:45,930
then I would 100% recommend
looking into ClickOnce.

274
00:11:45,930 --> 00:11:47,490
One of the best initial access techniques,

275
00:11:47,490 --> 00:11:50,130
but you really need a cert
for this to be effective."

276
00:11:50,130 --> 00:11:51,600
And it's in its current state,

277
00:11:51,600 --> 00:11:53,910
how people currently use
this for initial access,

278
00:11:53,910 --> 00:11:56,673
for example, we definitely
agreed with that sentiment.

279
00:11:58,350 --> 00:12:00,180
So what are some of these pressure points

280
00:12:00,180 --> 00:12:02,670
with the way ClickOnce's
deployment currently works?

281
00:12:02,670 --> 00:12:04,950
Well, the first one is SmartScreen.

282
00:12:04,950 --> 00:12:07,290
You saw in the demo that
Steven just did for us,

283
00:12:07,290 --> 00:12:09,690
that there was a big, somewhat obnoxious,

284
00:12:09,690 --> 00:12:12,060
blue box that popped up, you
have to click more info to

285
00:12:12,060 --> 00:12:14,340
even be given the option to run anyways,

286
00:12:14,340 --> 00:12:16,440
and then we get our code execution.

287
00:12:16,440 --> 00:12:17,760
To give a little background on

288
00:12:17,760 --> 00:12:19,980
what SmartScreen actually consists of,

289
00:12:19,980 --> 00:12:22,006
it's a reputation based protection.

290
00:12:22,006 --> 00:12:25,590
It first appeared in
Windows 8.1 and above,

291
00:12:25,590 --> 00:12:28,560
that reputation is based
on either the file hash,

292
00:12:28,560 --> 00:12:30,330
so like the file that you're sending

293
00:12:30,330 --> 00:12:32,250
for your initial access
attempt, there'll be a hash,

294
00:12:32,250 --> 00:12:34,890
like the check sum associated with that.

295
00:12:34,890 --> 00:12:36,540
It could be associated with the signature

296
00:12:36,540 --> 00:12:37,890
that signed the assembly.

297
00:12:37,890 --> 00:12:39,780
It could also be associated with the URL

298
00:12:39,780 --> 00:12:43,440
that your potential victim
grabbed the assembly from.

299
00:12:43,440 --> 00:12:44,640
One thing that I like to note,

300
00:12:44,640 --> 00:12:45,870
and I'll say this a couple more times

301
00:12:45,870 --> 00:12:47,850
during the presentation,
just to kind of compare

302
00:12:47,850 --> 00:12:50,970
and contrast what we're
presenting with alternatives,

303
00:12:50,970 --> 00:12:53,910
is an EV codesigning
certificate, for example,

304
00:12:53,910 --> 00:12:56,790
would also get rid of
the SmartScreen prompt,

305
00:12:56,790 --> 00:12:58,950
but there's a lot of
pros and cons associated

306
00:12:58,950 --> 00:13:00,210
with this as well,

307
00:13:00,210 --> 00:13:03,720
but there are two separate
types of code signing certs.

308
00:13:03,720 --> 00:13:05,610
I'll talk about it here in the next slide.

309
00:13:05,610 --> 00:13:08,610
There's Authenticode, but EV
code signing is the only one

310
00:13:08,610 --> 00:13:11,010
that will give that immediate
SmartScreen reputation.

311
00:13:11,010 --> 00:13:13,860
So without code signing certificates,

312
00:13:13,860 --> 00:13:15,150
like Steven just showed us,

313
00:13:15,150 --> 00:13:18,970
ultimately what we'll end up executing is

314
00:13:20,100 --> 00:13:23,430
an unsigned assembly for
this ClickOnce deployment.

315
00:13:23,430 --> 00:13:24,263
What does that mean?

316
00:13:24,263 --> 00:13:26,610
We'll trigger SmartScreen
like we just saw.

317
00:13:26,610 --> 00:13:29,970
It means things like Mark of
the Web will be associated

318
00:13:29,970 --> 00:13:31,320
with the assembly that we've downloaded.

319
00:13:31,320 --> 00:13:33,150
That's what ends up
triggering SmartScreen.

320
00:13:33,150 --> 00:13:36,570
This could also be a reason
for EDR products or AV to pay

321
00:13:36,570 --> 00:13:39,690
closer attention to the
assembly being downloaded,

322
00:13:39,690 --> 00:13:42,390
as well as you could
fall victim to solutions

323
00:13:42,390 --> 00:13:45,540
like app control or
whitelisting prevention,

324
00:13:45,540 --> 00:13:48,360
because the assembly that would
be downloaded is unsigned.

325
00:13:48,360 --> 00:13:50,523
It might not execute for those reasons.

326
00:13:52,620 --> 00:13:55,650
So continuing on with some
of these pressure points.

327
00:13:55,650 --> 00:13:58,230
Generally ClickOnce is less used.

328
00:13:58,230 --> 00:14:01,470
We think than for
example, Office Documents.

329
00:14:01,470 --> 00:14:04,830
Our assumption for that is
that the internals have been

330
00:14:04,830 --> 00:14:06,930
less explored up to this point, generally.

331
00:14:07,890 --> 00:14:11,490
People might assume that
it's harder to put together

332
00:14:11,490 --> 00:14:13,830
one of these deployments
to deliver like an initial

333
00:14:13,830 --> 00:14:15,880
access payload during a fishing campaign.

334
00:14:17,100 --> 00:14:19,230
The manifest information
has to be accurate

335
00:14:19,230 --> 00:14:23,100
for a deployment to work, which
can be another kind of pain.

336
00:14:23,100 --> 00:14:24,570
Steven mentioned a lot of manifests.

337
00:14:24,570 --> 00:14:26,520
We'll dig in a little bit
more here in a second,

338
00:14:26,520 --> 00:14:29,610
but he already mentioned, and
I'll kind of reiterate now,

339
00:14:29,610 --> 00:14:33,090
that all of these manifest
values need to match up

340
00:14:33,090 --> 00:14:34,650
for this deployment to be successful.

341
00:14:34,650 --> 00:14:37,260
And we'll step through
that in a little bit.

342
00:14:37,260 --> 00:14:41,010
The code signature is needed,
potentially needed for

343
00:14:41,010 --> 00:14:44,250
higher success rates during
things like fishing campaigns.

344
00:14:44,250 --> 00:14:46,650
Again, the EV signature
can guarantee that,

345
00:14:46,650 --> 00:14:50,070
but EV code signing certs are
really, really tough to get.

346
00:14:50,070 --> 00:14:52,260
Alternatively, you could sign

347
00:14:52,260 --> 00:14:55,230
with an Authenticode
certificate and that certificate

348
00:14:55,230 --> 00:14:56,820
won't give you the immediate reputation,

349
00:14:56,820 --> 00:14:59,820
but it could itself build
up reputation over time.

350
00:14:59,820 --> 00:15:01,620
And then once that
Authenticode certificate has

351
00:15:01,620 --> 00:15:04,140
built up reputation,
everything you sign with it,

352
00:15:04,140 --> 00:15:06,690
will have reputation with SmartScreen.

353
00:15:06,690 --> 00:15:08,520
Also, if you're going to code sign to get

354
00:15:08,520 --> 00:15:10,410
around things like SmartScreen,

355
00:15:10,410 --> 00:15:13,320
there's considerations such as
attribution for your payload.

356
00:15:13,320 --> 00:15:15,330
So like the assessments that we're doing,

357
00:15:15,330 --> 00:15:17,190
if we start signing our payloads,

358
00:15:17,190 --> 00:15:18,840
we could sign a payload for an assessment

359
00:15:18,840 --> 00:15:20,550
we did two years ago for a customer,

360
00:15:20,550 --> 00:15:22,680
and then somebody could like somebody

361
00:15:22,680 --> 00:15:24,690
in the threat Intel
community could tweet that.

362
00:15:24,690 --> 00:15:27,390
And then virus total would just
show you all of the payloads

363
00:15:27,390 --> 00:15:29,490
that we've been developing
over the last two years.

364
00:15:29,490 --> 00:15:32,280
So that's a concern for
us on the offensive side,

365
00:15:32,280 --> 00:15:34,800
as well as it's just
complicated to obtain.

366
00:15:34,800 --> 00:15:37,890
It can be complicated to obtain
something like an EV cert.

367
00:15:37,890 --> 00:15:41,220
There's a strict vetting process
that costs a lot of money.

368
00:15:41,220 --> 00:15:43,080
So there's a lot of pros
and cons to consider.

369
00:15:43,080 --> 00:15:46,470
So the question that we
pose at this point is,

370
00:15:46,470 --> 00:15:49,200
so what can we do to alleviate
these pressure points

371
00:15:49,200 --> 00:15:52,413
and not have to obtain one
of these code signing certs?

372
00:15:55,140 --> 00:15:57,540
So we're kind of gonna approach this

373
00:15:57,540 --> 00:15:59,910
with two somewhat unique techniques,

374
00:15:59,910 --> 00:16:02,160
but the first one is going to be

375
00:16:02,160 --> 00:16:04,170
there's all these ClickOnce
deployments out there

376
00:16:04,170 --> 00:16:05,910
that are already signed.

377
00:16:05,910 --> 00:16:09,090
So why wouldn't we just
find a way to sideload

378
00:16:09,090 --> 00:16:12,810
one of those existing and
trusted ClickOnce deployments?

379
00:16:12,810 --> 00:16:16,350
So the way that we'll approach
this in the upcoming slides

380
00:16:16,350 --> 00:16:20,460
is that we'll search around
through Dorks and other methods

381
00:16:20,460 --> 00:16:23,190
for other people's signed, trusted,

382
00:16:23,190 --> 00:16:26,160
and already published on the
internet ClickOnce deployments.

383
00:16:26,160 --> 00:16:30,270
So we can use those as
a method of sideloading

384
00:16:30,270 --> 00:16:33,213
and ultimately end up with
trusted code execution.

385
00:16:34,530 --> 00:16:36,690
So we're gonna, one thing
that we want to note,

386
00:16:36,690 --> 00:16:38,520
before we start talking about backdooring

387
00:16:38,520 --> 00:16:40,650
existing ClickOnce deployments is that

388
00:16:40,650 --> 00:16:43,381
when we backdoor these
existing deployments, we're not

389
00:16:43,381 --> 00:16:46,590
backdooring like the assembly
that's gonna ultimately

390
00:16:46,590 --> 00:16:48,210
run our malicious code.

391
00:16:48,210 --> 00:16:49,650
We're gonna backdoor a dependency.

392
00:16:49,650 --> 00:16:51,870
So like a DLL or there's a bunch

393
00:16:51,870 --> 00:16:53,100
of other techniques that we can use.

394
00:16:53,100 --> 00:16:56,100
But the point that we wanna
stress is that the assembly,

395
00:16:56,100 --> 00:16:58,050
the deployment that we're backdooring,

396
00:16:58,050 --> 00:16:59,400
we're gonna backdoor our dependency.

397
00:16:59,400 --> 00:17:01,860
Therefore, we will not break the signature

398
00:17:01,860 --> 00:17:03,090
of that host assembly.

399
00:17:03,090 --> 00:17:05,880
So we'll still have the reputation

400
00:17:05,880 --> 00:17:08,070
in regards to SmartScreen,
the potential benefit

401
00:17:08,070 --> 00:17:10,230
when it comes to EDR, et cetera.

402
00:17:10,230 --> 00:17:12,390
There's a lot of useful tools
that we can use to do this,

403
00:17:12,390 --> 00:17:15,270
dnSpy, reshacker, mage, sigchecker.

404
00:17:15,270 --> 00:17:16,620
We'll talk about several of these

405
00:17:16,620 --> 00:17:18,020
throughout the presentation.

406
00:17:22,380 --> 00:17:24,810
- [Steven] So the first
step that we want to go

407
00:17:24,810 --> 00:17:27,660
through is identify an existing

408
00:17:27,660 --> 00:17:29,760
and signed ClickOnce deployment.

409
00:17:29,760 --> 00:17:33,480
So this is an example of what
downloading a fully signed

410
00:17:33,480 --> 00:17:36,150
and usable ClickOnce
deployment looks like.

411
00:17:36,150 --> 00:17:37,770
On the right here, we have,

412
00:17:37,770 --> 00:17:38,940
we're actually going
through Google, looking

413
00:17:38,940 --> 00:17:43,233
through a Dork to identify
published ClickOnce applications.

414
00:17:44,910 --> 00:17:46,740
So once we've gone through that process

415
00:17:46,740 --> 00:17:50,040
of doing our Googling, looking
around, we've identified

416
00:17:50,040 --> 00:17:51,750
signed ClickOnce applications.

417
00:17:51,750 --> 00:17:52,800
So what do we do now?

418
00:17:52,800 --> 00:17:55,440
Well, now we're gonna
hijack the execution flow

419
00:17:55,440 --> 00:17:57,360
of that ClickOnce application.

420
00:17:57,360 --> 00:18:00,360
So we're gonna download
that signed application,

421
00:18:00,360 --> 00:18:02,700
decompile it, since it is .NET,

422
00:18:02,700 --> 00:18:05,640
it's very easy to do when
you use something like dnSpy.

423
00:18:05,640 --> 00:18:07,440
Understand the execution flow of

424
00:18:07,440 --> 00:18:09,690
where all the components
are and how it works.

425
00:18:09,690 --> 00:18:12,330
Find a dependency that
is not strongly named,

426
00:18:12,330 --> 00:18:16,140
and then go into that dependency
or that DLL, backdoor it.

427
00:18:16,140 --> 00:18:18,810
So we'll put our code,
whatever malicious code

428
00:18:18,810 --> 00:18:21,450
that we wanna write, put
it inside of that .NET.

429
00:18:21,450 --> 00:18:24,060
We can also do traditional
DLL search order hijacking

430
00:18:24,060 --> 00:18:25,260
here as well.

431
00:18:25,260 --> 00:18:28,500
But once we've put our code
into that DLL, we'll go ahead

432
00:18:28,500 --> 00:18:31,650
and build a manifest
that reflect the changes

433
00:18:31,650 --> 00:18:34,470
that we've made and then
recompile everything and host it,

434
00:18:34,470 --> 00:18:36,690
and have it ready to be deployed.

435
00:18:36,690 --> 00:18:40,710
Alternatively, if we don't
want to backdoor a dependency,

436
00:18:40,710 --> 00:18:44,430
we can do app domain
injection, which will allow us

437
00:18:44,430 --> 00:18:48,367
to load a DLL based on
config file for .NET.

438
00:18:48,367 --> 00:18:49,770
And we also can get
creative with that too,

439
00:18:49,770 --> 00:18:53,010
if you wanna do any sort
of NodeJS weaponization

440
00:18:53,010 --> 00:18:55,920
or .NET digitalization, we can so that

441
00:18:55,920 --> 00:18:57,390
we're not just running
straight up shell code

442
00:18:57,390 --> 00:19:02,390
and calling commonly abused with 32 APIs.

443
00:19:04,470 --> 00:19:05,910
So going through the process,

444
00:19:05,910 --> 00:19:08,850
we identify our ClickOnce
application, we download it,

445
00:19:08,850 --> 00:19:10,980
we look at it has a valid signature,

446
00:19:10,980 --> 00:19:13,920
so this is a prime example
or a prime opportunity

447
00:19:13,920 --> 00:19:15,423
for us to weaponize this.

448
00:19:16,440 --> 00:19:18,900
We look through the actual references,

449
00:19:18,900 --> 00:19:20,370
dependencies that this would use.

450
00:19:20,370 --> 00:19:22,710
Look for anything that has
the public key token of null,

451
00:19:22,710 --> 00:19:24,573
which means it's not strongly named.

452
00:19:26,580 --> 00:19:27,413
Go through the code.

453
00:19:27,413 --> 00:19:28,950
So we wanna find somewhere that we can get

454
00:19:28,950 --> 00:19:31,350
our code typically executed early on,

455
00:19:31,350 --> 00:19:33,840
and then we'll go,
pretty much gonna happen

456
00:19:33,840 --> 00:19:35,100
at the entry point.

457
00:19:35,100 --> 00:19:37,620
Look through kind of the,
where everything happens.

458
00:19:37,620 --> 00:19:38,850
We find something here.

459
00:19:38,850 --> 00:19:41,700
The DPI settings has a method
called set DPI awareness.

460
00:19:41,700 --> 00:19:44,790
So we'll go into that, look
into there not strongly named.

461
00:19:44,790 --> 00:19:47,580
So this is a prime location
for us to put our code

462
00:19:47,580 --> 00:19:51,963
inside of it and get our
execution in a signed process.

463
00:19:52,980 --> 00:19:55,170
So we have our notepad.exe we're calling,

464
00:19:55,170 --> 00:19:58,293
and then a popup box
that we're gonna execute.

465
00:20:02,130 --> 00:20:02,963
- [Nick] Thanks.

466
00:20:04,740 --> 00:20:08,460
Okay. So we covered, Steven
gave us a quick overview

467
00:20:08,460 --> 00:20:11,100
of what ClickOnce currently
looks like to weaponize.

468
00:20:11,100 --> 00:20:13,320
And we've started getting
into backdooring ClickOnce,

469
00:20:13,320 --> 00:20:14,700
existing ClickOnce deployments,

470
00:20:14,700 --> 00:20:18,900
but Steven's made several
references to manifests,

471
00:20:18,900 --> 00:20:22,110
and manipulating these
manifests will be relevant to us

472
00:20:22,110 --> 00:20:25,320
being able to weaponize what
we're talking about in terms

473
00:20:25,320 --> 00:20:28,080
of like backdooring other
people's ClickOnce deployments.

474
00:20:28,080 --> 00:20:32,040
So Steven just walked us through putting

475
00:20:32,040 --> 00:20:35,640
some of our potentially
malicious code inside,

476
00:20:35,640 --> 00:20:38,670
adding that to a DLL, a
dependency of the deployment,

477
00:20:38,670 --> 00:20:41,310
and then executing to
get that code execution.

478
00:20:41,310 --> 00:20:42,630
The last thing we'll have to do to make

479
00:20:42,630 --> 00:20:44,760
this deployment work is like you said,

480
00:20:44,760 --> 00:20:46,440
change some of these
values in the manifest,

481
00:20:46,440 --> 00:20:49,440
so the deployment will
execute successfully.

482
00:20:49,440 --> 00:20:54,440
So the first thing to note
here is that there are several

483
00:20:54,450 --> 00:20:57,270
fields within the ClickOnce
manifests that are optional.

484
00:20:57,270 --> 00:21:00,090
The things that will very
likely prevent successful

485
00:21:00,090 --> 00:21:02,850
execution of a ClickOnce
deployment would be,

486
00:21:02,850 --> 00:21:06,660
for example, the public key
token values, the hash block.

487
00:21:06,660 --> 00:21:07,650
These are all things that

488
00:21:07,650 --> 00:21:09,780
when you're executing
the ClickOnce deployment,

489
00:21:09,780 --> 00:21:11,370
they're like integrity checks.

490
00:21:11,370 --> 00:21:14,580
And you can probably imagine
because we've modified

491
00:21:14,580 --> 00:21:16,110
at least one of the dependencies,

492
00:21:16,110 --> 00:21:18,390
we've changed the ultimate check sum

493
00:21:18,390 --> 00:21:21,240
or the hash associated with
that DLL, it's changed.

494
00:21:21,240 --> 00:21:23,580
So we need to either change
or remove these values

495
00:21:23,580 --> 00:21:24,540
from the manifest.

496
00:21:24,540 --> 00:21:28,530
And thankfully, a lot of
these values that are checking

497
00:21:28,530 --> 00:21:30,870
that integrity of the
deployment are optional.

498
00:21:30,870 --> 00:21:33,300
So we can just remove them
or we can replace them with

499
00:21:33,300 --> 00:21:36,330
all zeros and null them out,
and it won't be checked.

500
00:21:36,330 --> 00:21:37,500
And also, additionally,

501
00:21:37,500 --> 00:21:41,010
if we wanted to do things like
app domain manager injection,

502
00:21:41,010 --> 00:21:43,890
we could use the file XML block to add

503
00:21:43,890 --> 00:21:46,890
more dependencies to this
ClickOnce deployment.

504
00:21:46,890 --> 00:21:47,970
One thing that we wanted to note,

505
00:21:47,970 --> 00:21:50,880
because we're talking a lot
about integrity checking

506
00:21:50,880 --> 00:21:53,700
and signatures here is
that you can imagine

507
00:21:53,700 --> 00:21:56,610
if we're modifying someone
else's existing ClickOnce

508
00:21:56,610 --> 00:22:00,870
deployment to get the benefit
of their signed executable,

509
00:22:00,870 --> 00:22:04,500
then when we modify the manifest,
the manifestor also signs.

510
00:22:04,500 --> 00:22:06,510
So when we have to change these values,

511
00:22:06,510 --> 00:22:08,370
we will break the
signature of the manifest.

512
00:22:08,370 --> 00:22:10,590
That's something that we wanted to note.

513
00:22:10,590 --> 00:22:15,000
But ultimately we think
this is okay in our opinion,

514
00:22:15,000 --> 00:22:17,850
because we'll show on the
next slide here in a second,

515
00:22:17,850 --> 00:22:21,060
what the difference in
the popup boxes are,

516
00:22:21,060 --> 00:22:24,720
and it's, in our opinion,
significantly less intrusive

517
00:22:24,720 --> 00:22:27,750
than the SmartScreen, big
obnoxious, click the more info,

518
00:22:27,750 --> 00:22:29,100
click to run anyways thing.

519
00:22:31,980 --> 00:22:32,910
So this is the difference

520
00:22:32,910 --> 00:22:36,780
if we break the signature
associated with a manifest.

521
00:22:36,780 --> 00:22:41,610
Just to kind of reiterate, a
lot of very popular ClickOnce

522
00:22:41,610 --> 00:22:43,710
deployments out there don't
even have signed manifests.

523
00:22:43,710 --> 00:22:47,130
So it's gonna be the
box on the left anyways,

524
00:22:47,130 --> 00:22:48,630
the little red X in the right.

525
00:22:48,630 --> 00:22:49,650
Even if it is signed

526
00:22:49,650 --> 00:22:52,920
with a trusted code signing certificate,

527
00:22:52,920 --> 00:22:54,930
the only difference is that kind of

528
00:22:54,930 --> 00:22:56,430
like yellow explanation point

529
00:22:56,430 --> 00:23:00,870
and not a huge difference
when we break the manifest

530
00:23:00,870 --> 00:23:03,170
associated with the
ClickOnce deployment here.

531
00:23:05,820 --> 00:23:08,850
So some of the code signing implications

532
00:23:08,850 --> 00:23:11,640
associated with ClickOnce
deployment abuse.

533
00:23:11,640 --> 00:23:12,870
The question we're posing here is

534
00:23:12,870 --> 00:23:14,580
do we really need a code signing cert to

535
00:23:14,580 --> 00:23:16,503
effectively weaponize ClickOnce?

536
00:23:17,340 --> 00:23:18,540
Like we just showed, the difference

537
00:23:18,540 --> 00:23:21,000
in the prompt here is relatively minimal,

538
00:23:21,000 --> 00:23:23,910
especially when we compare that to how

539
00:23:23,910 --> 00:23:26,410
kind of intrusive the
SmartScreen prompt could be.

540
00:23:27,570 --> 00:23:30,540
Again, we have the option of going out

541
00:23:30,540 --> 00:23:31,500
and paying a lot of money,

542
00:23:31,500 --> 00:23:34,020
and going through a relatively
strict vetting process,

543
00:23:34,020 --> 00:23:36,720
if we wanted to pursue an EV
code signing cert for example,

544
00:23:36,720 --> 00:23:38,700
or maybe even Authenticode,

545
00:23:38,700 --> 00:23:41,040
but there's pros and cons
associated with that as well.

546
00:23:41,040 --> 00:23:43,240
The vetting process is
strict, like we said,

547
00:23:44,160 --> 00:23:49,110
but there's no need when
sideloading a signed reputable

548
00:23:49,110 --> 00:23:51,963
assembly with the code
signing certificates.

549
00:23:54,060 --> 00:23:55,920
So yeah, kind of like we said,

550
00:23:55,920 --> 00:23:58,680
we see a lot more benefit
in just abusing some sort

551
00:23:58,680 --> 00:24:02,266
of sideloading technique
than going through that long,

552
00:24:02,266 --> 00:24:04,500
somewhat intrusive vetting process

553
00:24:04,500 --> 00:24:07,200
for an EV code signing cert
and paying a lot of money.

554
00:24:09,270 --> 00:24:11,970
So we'll have another quick demo here too.

555
00:24:11,970 --> 00:24:13,200
The first demo was Steven showing

556
00:24:13,200 --> 00:24:15,120
what ClickOnce looked like initially,

557
00:24:15,120 --> 00:24:17,760
and this will show what
the process looks like

558
00:24:17,760 --> 00:24:19,620
when we execute a ClickOnce deployment,

559
00:24:19,620 --> 00:24:22,323
but we've sideloaded
somebody else's signed code.

560
00:24:27,120 --> 00:24:30,000
We go back to the same website here.

561
00:24:30,000 --> 00:24:33,003
You'll see again, a very
similar deployment manifest.

562
00:24:34,440 --> 00:24:35,280
The same prompt here.

563
00:24:35,280 --> 00:24:36,580
We're just gonna say open.

564
00:24:39,480 --> 00:24:42,630
And then that prompt, but you'll notice

565
00:24:42,630 --> 00:24:44,880
when all of our
dependencies download here,

566
00:24:44,880 --> 00:24:46,770
now there's no SmartScreen prompt.

567
00:24:46,770 --> 00:24:48,320
We just get our code execution.

568
00:24:54,554 --> 00:24:57,000
And just to kind of prove
why that's the case.

569
00:24:57,000 --> 00:24:59,190
We'll go over to the assembly that we,

570
00:24:59,190 --> 00:25:01,696
or the deployment that
we decided to sideload,

571
00:25:01,696 --> 00:25:04,470
and we'll show that it is in fact signed

572
00:25:04,470 --> 00:25:08,493
by legitimate code signing certificate.

573
00:25:16,200 --> 00:25:18,360
Okay, so just to kind of recap.

574
00:25:18,360 --> 00:25:20,520
We've covered what ClickOnce
deployments look like

575
00:25:20,520 --> 00:25:21,750
in their current state.

576
00:25:21,750 --> 00:25:23,550
Then we kind of pose the question of

577
00:25:23,550 --> 00:25:27,060
why not just side load
other people's existing

578
00:25:27,060 --> 00:25:29,820
and potentially trusted
ClickOnce deployments.

579
00:25:29,820 --> 00:25:31,800
But the other technique that
we kind of wanted to go over

580
00:25:31,800 --> 00:25:34,560
was if we could take that a step further.

581
00:25:34,560 --> 00:25:36,966
And the reason we wanted to
do this in the first place is

582
00:25:36,966 --> 00:25:40,260
if you go out looking on
like using Google dorks

583
00:25:40,260 --> 00:25:42,900
or other resources,
there's a finite number

584
00:25:42,900 --> 00:25:45,750
of existing ClickOnce deployments
published on the internet.

585
00:25:45,750 --> 00:25:48,240
It's not necessarily
the most popular vehicle

586
00:25:48,240 --> 00:25:49,500
for installing .NET.

587
00:25:49,500 --> 00:25:52,173
So there's only a specific
number of those available.

588
00:25:53,250 --> 00:25:55,770
And so we wanted to take it a step further

589
00:25:55,770 --> 00:25:58,290
and be able to take
arbitrary .NET assemblies

590
00:25:58,290 --> 00:26:00,870
that are signed and trusted

591
00:26:00,870 --> 00:26:04,020
and be able to create our
own ClickOnce deployments

592
00:26:04,020 --> 00:26:08,400
around those trusted or around
those signed .NET assemblies

593
00:26:08,400 --> 00:26:11,580
mostly because that would
vastly increase the amount

594
00:26:11,580 --> 00:26:13,860
of assemblies that we could sideload

595
00:26:13,860 --> 00:26:16,560
and use for initial access
or whatever we wanted.

596
00:26:16,560 --> 00:26:20,103
So we'll take the regular .NET assembly,

597
00:26:21,180 --> 00:26:25,290
but we can't just take
any .NET assembly to abuse

598
00:26:25,290 --> 00:26:26,123
for this use case.

599
00:26:26,123 --> 00:26:28,140
There's a couple prerequisites
that we found that you

600
00:26:28,140 --> 00:26:31,050
have to meet, that the
assembly itself has to meet.

601
00:26:31,050 --> 00:26:32,850
One of which is that the default

602
00:26:32,850 --> 00:26:36,600
embedded application manifest
identity needs to not exist.

603
00:26:36,600 --> 00:26:38,340
We'll show exactly what
that looks like in a second.

604
00:26:38,340 --> 00:26:39,960
But Steven mentioned earlier,

605
00:26:39,960 --> 00:26:42,357
there's the concept of embedded manifests.

606
00:26:42,357 --> 00:26:45,450
The manifest that is embedded
within the assembly itself.

607
00:26:45,450 --> 00:26:48,330
There's a line in all the
XML that you saw earlier.

608
00:26:48,330 --> 00:26:50,790
One of them says assemblyIdentity.

609
00:26:50,790 --> 00:26:53,193
That line needs to not
exist for this to work.

610
00:26:54,103 --> 00:26:58,890
The requestedPrivileges line
needs to be set to asinvoker

611
00:26:58,890 --> 00:27:00,330
or it needs to not exist.

612
00:27:00,330 --> 00:27:03,030
So basically, the requestedPrivileges line

613
00:27:03,030 --> 00:27:05,497
in that embedded manifests,
it's gonna say like,

614
00:27:05,497 --> 00:27:06,787
"Do you need to run as admin?"

615
00:27:06,787 --> 00:27:08,610
"Can you run as a regular user?"

616
00:27:08,610 --> 00:27:11,490
If it's set to require administrator

617
00:27:11,490 --> 00:27:13,410
or there's one more
that's higher than that,

618
00:27:13,410 --> 00:27:15,000
that we'll show in a second.

619
00:27:15,000 --> 00:27:16,320
It won't work with this technique.

620
00:27:16,320 --> 00:27:19,320
If it's set to asinvoker
or it doesn't exist,

621
00:27:19,320 --> 00:27:20,920
it will work for this technique.

622
00:27:23,160 --> 00:27:26,670
So other than those prerequisite checks,

623
00:27:26,670 --> 00:27:28,020
everything else is gonna be the same to

624
00:27:28,020 --> 00:27:28,853
what we just went through.

625
00:27:28,853 --> 00:27:31,830
We're just gonna sideload,
assign .NET assembly

626
00:27:31,830 --> 00:27:34,833
and end up with more
trusted code execution.

627
00:27:38,190 --> 00:27:40,380
So this is something
that we wanted to note,

628
00:27:40,380 --> 00:27:43,560
just like with a lot of other things,

629
00:27:43,560 --> 00:27:47,340
there are potentially
potentially some inaccuracies

630
00:27:47,340 --> 00:27:49,500
associated with like MSDN documentation.

631
00:27:49,500 --> 00:27:52,020
This is one that we found
while we were reversing

632
00:27:52,020 --> 00:27:54,000
one of the DLLs associated with ClickOnce

633
00:27:54,000 --> 00:27:55,890
that Steven will talk about in a second,

634
00:27:55,890 --> 00:27:59,550
but this particularly says basically,

635
00:27:59,550 --> 00:28:03,150
if a .NET assembly has
an embedded manifest,

636
00:28:03,150 --> 00:28:05,970
you need to recompile it to not
include an embedded manifest

637
00:28:05,970 --> 00:28:07,110
for it to work with ClickOnce.

638
00:28:07,110 --> 00:28:08,850
We actually found that
that wasn't the case,

639
00:28:08,850 --> 00:28:10,950
it can include UAC information,

640
00:28:10,950 --> 00:28:13,290
as long as it's set to asinvoker.

641
00:28:13,290 --> 00:28:14,823
It just can't require admin.

642
00:28:17,550 --> 00:28:19,320
So this is when we were digging

643
00:28:19,320 --> 00:28:20,880
through the system deployment DLL,

644
00:28:20,880 --> 00:28:23,550
which is where again, most
of the ClickOnce deployment

645
00:28:23,550 --> 00:28:24,990
functionality exists.

646
00:28:24,990 --> 00:28:28,380
You can see here, this is just
us dropping that DLL in dnSpy

647
00:28:28,380 --> 00:28:32,100
and you'll see maybe like
five or six lines down.

648
00:28:32,100 --> 00:28:34,080
It might be hard to see, but you can see,

649
00:28:34,080 --> 00:28:36,210
I'm sorry, actually,
the if statement here,

650
00:28:36,210 --> 00:28:38,730
you'll see the keyword
requiredAdministrator.

651
00:28:38,730 --> 00:28:40,770
The DLL's just doing some checks against

652
00:28:40,770 --> 00:28:42,570
that manifest that we
just talk talked about.

653
00:28:42,570 --> 00:28:45,480
And if it is required, if
it requires administrator,

654
00:28:45,480 --> 00:28:47,850
it says for this deployment to fail.

655
00:28:47,850 --> 00:28:51,630
So a couple inaccuracies
in the MSDN documentation

656
00:28:51,630 --> 00:28:52,463
that we found.

657
00:28:55,170 --> 00:29:00,170
So this is a comparison of
a default .NET assembly.

658
00:29:00,540 --> 00:29:02,160
You'll see at the top.

659
00:29:02,160 --> 00:29:07,050
And a second ago, I mentioned
the assemblyIdentity line.

660
00:29:07,050 --> 00:29:08,400
That's also very important

661
00:29:08,400 --> 00:29:09,450
for what we're talking about here.

662
00:29:09,450 --> 00:29:10,620
That needs to not exist.

663
00:29:10,620 --> 00:29:13,680
So just as reference, that top box,

664
00:29:13,680 --> 00:29:17,100
that is an embedded
manifest that will not work

665
00:29:17,100 --> 00:29:18,570
for what we're talking about.

666
00:29:18,570 --> 00:29:21,600
The bottom one, you'll notice,
is a nonstandard embedded

667
00:29:21,600 --> 00:29:23,250
manifest that we found,

668
00:29:23,250 --> 00:29:26,250
and this is actually a
signed Microsoft assembly,

669
00:29:26,250 --> 00:29:28,530
signed by Microsoft trusted assembly.

670
00:29:28,530 --> 00:29:31,830
And it does not include
that assemblyIdentity line.

671
00:29:31,830 --> 00:29:33,903
So it will work with this technique.

672
00:29:37,290 --> 00:29:39,180
So we spent a lot of time going

673
00:29:39,180 --> 00:29:42,870
through the system
deployment DLL to figure out

674
00:29:42,870 --> 00:29:45,720
why deployments would fail
or why they would work.

675
00:29:45,720 --> 00:29:48,300
And Steven actually did a lot
of the heavy lifting on that.

676
00:29:48,300 --> 00:29:51,390
So I'll let him talk about
some of this reversing.

677
00:29:51,390 --> 00:29:54,510
- Yeah. So in this top screenshot here,

678
00:29:54,510 --> 00:29:56,580
we have the assemblyIdentity that is part

679
00:29:56,580 --> 00:29:58,410
of the application deployment,

680
00:29:58,410 --> 00:30:00,510
or like the ClickOnce
application manifest.

681
00:30:00,510 --> 00:30:02,700
And so one of the fields
in there is gonna be

682
00:30:02,700 --> 00:30:03,930
the processorArchitecture,

683
00:30:03,930 --> 00:30:06,150
which is something that
is required for us to have

684
00:30:06,150 --> 00:30:10,440
inside of the assemblyIdentity
for the deployment.

685
00:30:10,440 --> 00:30:12,570
In the bottom screenshot,
we have the comparison.

686
00:30:12,570 --> 00:30:14,610
If that assemblyIdentity is

687
00:30:14,610 --> 00:30:18,300
in the embedded application manifest,

688
00:30:18,300 --> 00:30:21,750
then typically, by default,
it was not built with,

689
00:30:21,750 --> 00:30:23,940
or is not compiled with that information.

690
00:30:23,940 --> 00:30:26,460
So it does a check
between these two values.

691
00:30:26,460 --> 00:30:28,050
And the ultimate reason is that

692
00:30:28,050 --> 00:30:31,440
there is no processorArchitecture

693
00:30:31,440 --> 00:30:32,860
that it has to be specified

694
00:30:34,380 --> 00:30:36,990
inside of the embedded
application manifest.

695
00:30:36,990 --> 00:30:40,110
So while we can try to get it
to match, it will never match.

696
00:30:40,110 --> 00:30:43,710
So it essentially prevents us
from being able to load just

697
00:30:43,710 --> 00:30:47,370
any .NET assembly that we want
in a ClickOnce application.

698
00:30:47,370 --> 00:30:50,310
It's only limited to any that
meet this particular reason.

699
00:30:50,310 --> 00:30:52,980
But at the bottom you'll
see, the bottom line

700
00:30:52,980 --> 00:30:54,533
is gonna be the ClickOnce
application manifest

701
00:30:54,533 --> 00:30:55,980
and the top line is gonna be

702
00:30:55,980 --> 00:30:57,680
the embedded application manifest.

703
00:30:59,850 --> 00:31:01,410
- And here's just some documentation to

704
00:31:01,410 --> 00:31:02,520
back up what Steven just said.

705
00:31:02,520 --> 00:31:05,700
It shows that in the manifest
that we're talking about,

706
00:31:05,700 --> 00:31:07,350
the processorArchitecture field

707
00:31:07,350 --> 00:31:10,260
of that particular block will be required.

708
00:31:10,260 --> 00:31:13,260
And that's why this
particular prereq exists

709
00:31:13,260 --> 00:31:15,260
for the technique that we're discussing.

710
00:31:17,310 --> 00:31:20,280
So just to kind of recap
about the difference

711
00:31:20,280 --> 00:31:23,190
between the techniques
that we're talking about.

712
00:31:23,190 --> 00:31:25,470
First, we talked about
sideloading somebody else's

713
00:31:25,470 --> 00:31:26,340
ClickOnce deployment.

714
00:31:26,340 --> 00:31:29,310
Find it online, download
it, sideloaded dependency.

715
00:31:29,310 --> 00:31:32,160
Now we've just gone over the fact that

716
00:31:32,160 --> 00:31:35,280
there's a way to actually use
an arbitrary .NET assembly

717
00:31:35,280 --> 00:31:38,340
that's signed and wrap a
ClickOnce deployment around it

718
00:31:38,340 --> 00:31:41,310
and use that for what we're talking about.

719
00:31:41,310 --> 00:31:43,860
But if we decide to do that,

720
00:31:43,860 --> 00:31:46,410
we'll need to create our
manifests from scratch,

721
00:31:46,410 --> 00:31:48,540
cause we don't have somebody
else's to just go off

722
00:31:48,540 --> 00:31:50,760
and tweak and then redeploy.

723
00:31:50,760 --> 00:31:53,160
So this is actually super easy because

724
00:31:53,160 --> 00:31:58,080
in the Windows 10 SDK, there's
an assembly called mage.exe,

725
00:31:58,080 --> 00:32:00,660
and what mage.exe is, it's defined as

726
00:32:00,660 --> 00:32:04,200
the manifest generation and editing tool,

727
00:32:04,200 --> 00:32:06,720
command line tool that supports
the creation and editing

728
00:32:06,720 --> 00:32:09,450
of application and deployment manifests.

729
00:32:09,450 --> 00:32:12,150
So I included some one-liners here,

730
00:32:12,150 --> 00:32:13,470
like Steven mentioned a couple times,

731
00:32:13,470 --> 00:32:17,190
we'll need our application
and our deployment manifests

732
00:32:17,190 --> 00:32:18,150
and that's essentially it.

733
00:32:18,150 --> 00:32:20,610
We run two one-liners with mage.exe.

734
00:32:20,610 --> 00:32:23,190
We've created our two
manifests that we need

735
00:32:23,190 --> 00:32:25,500
for this ClickOnce deployment,

736
00:32:25,500 --> 00:32:28,560
and then we should have
what we need to create

737
00:32:28,560 --> 00:32:30,120
a weaponized ClickOnce deployment.

738
00:32:30,120 --> 00:32:31,500
And again, we noted earlier,

739
00:32:31,500 --> 00:32:34,110
but it's probably worth noting again,

740
00:32:34,110 --> 00:32:37,140
when you create these
manifests with mage.exe,

741
00:32:37,140 --> 00:32:39,240
it will automatically
calculate some of those

742
00:32:39,240 --> 00:32:42,840
like integrity check like hash values.

743
00:32:42,840 --> 00:32:45,360
Several of those are optional.

744
00:32:45,360 --> 00:32:48,960
The public key token value can
be nulled out with 16 zeros.

745
00:32:48,960 --> 00:32:51,450
The hash blocks associated
with all of the files

746
00:32:51,450 --> 00:32:53,400
in their dependencies can just be removed.

747
00:32:53,400 --> 00:32:54,250
They're optional.

748
00:32:55,440 --> 00:32:59,010
So if you don't remove
those or recalculate them,

749
00:32:59,010 --> 00:33:00,300
it can cause a deployment to fail.

750
00:33:00,300 --> 00:33:02,133
So that's why we like to reiterate.

751
00:33:04,200 --> 00:33:09,180
And so now we'll do a demo
of us, instead of sideloading

752
00:33:09,180 --> 00:33:11,280
somebody else's existing deployment,

753
00:33:11,280 --> 00:33:15,150
we took an arbitrary Microsoft
signed .NET assembly.

754
00:33:15,150 --> 00:33:17,880
We wrapped wrapped it with
some manifests that we created

755
00:33:17,880 --> 00:33:22,110
and because it meets, because
it checks off these boxes,

756
00:33:22,110 --> 00:33:24,570
it meets these
prerequisites that we found,

757
00:33:24,570 --> 00:33:26,853
we can weaponize it using ClickOnce.

758
00:33:28,530 --> 00:33:30,720
So you see, we start off
here, the same way we started

759
00:33:30,720 --> 00:33:31,553
in the other demos.

760
00:33:31,553 --> 00:33:34,650
We go to our website, we
reference our deployment manifest,

761
00:33:34,650 --> 00:33:36,570
we start the download process.

762
00:33:36,570 --> 00:33:37,710
We click run.

763
00:33:37,710 --> 00:33:39,810
Again, you'll notice
here, we were not prompted

764
00:33:39,810 --> 00:33:40,643
with SmartScreen.

765
00:33:40,643 --> 00:33:43,470
That's because we're using
a signed .NET assembly

766
00:33:43,470 --> 00:33:44,463
in this context.

767
00:33:45,360 --> 00:33:47,160
You can see that the notepad prompt

768
00:33:47,160 --> 00:33:48,870
in the code that Steven
referenced earlier.

769
00:33:48,870 --> 00:33:51,393
So this shows that our
code successfully executed.

770
00:33:55,170 --> 00:33:57,300
But the interesting part here is that

771
00:33:57,300 --> 00:33:59,100
before you saw we were just running

772
00:33:59,100 --> 00:34:02,580
in the context of some
person signed assembly.

773
00:34:02,580 --> 00:34:06,120
This time, you'll notice that
this is signed by Microsoft,

774
00:34:06,120 --> 00:34:08,910
an assembly that we found of theirs.

775
00:34:08,910 --> 00:34:12,150
It's a part of the Azure SDK
to be a little more specific,

776
00:34:12,150 --> 00:34:15,060
but now we were able
to, like we just said,

777
00:34:15,060 --> 00:34:19,260
create our own ClickOnce
manifests using mage.exe, wrap it

778
00:34:19,260 --> 00:34:22,800
around this assembly that we
found that meets these prereqs,

779
00:34:22,800 --> 00:34:25,500
and ultimately sideload it
and execute our malicious code

780
00:34:25,500 --> 00:34:28,113
in the context of this
Microsoft signed assembly.

781
00:34:40,590 --> 00:34:42,360
And then lastly, just like before,

782
00:34:42,360 --> 00:34:45,030
we'll go to the folder to show
what was actually downloaded.

783
00:34:45,030 --> 00:34:46,230
Click properties.

784
00:34:46,230 --> 00:34:49,530
We'll check the signatures
and it shows that it's signed

785
00:34:49,530 --> 00:34:53,073
with a valid Microsoft
code signing certificate.

786
00:34:59,160 --> 00:35:02,550
Okay, so we we've gone over two techniques

787
00:35:02,550 --> 00:35:04,680
that we can use to ultimately achieve

788
00:35:04,680 --> 00:35:08,190
more trusted code
execution using ClickOnce.

789
00:35:08,190 --> 00:35:10,950
But we wanted to help
expedite this process.

790
00:35:10,950 --> 00:35:14,370
So we will be releasing two tools.

791
00:35:14,370 --> 00:35:16,410
One is AssemblyHunter that
Steven will talk about

792
00:35:16,410 --> 00:35:17,430
in a second.

793
00:35:17,430 --> 00:35:19,530
The other is ClickOnceHunter.

794
00:35:19,530 --> 00:35:21,390
So ClickOnceHunter,
essentially what it does is

795
00:35:21,390 --> 00:35:22,860
it's just gonna help expedite

796
00:35:22,860 --> 00:35:25,230
some of the dorking process
that I mentioned earlier.

797
00:35:25,230 --> 00:35:28,140
So you can use your
favorite search engine.

798
00:35:28,140 --> 00:35:30,480
You can use GitHub, we'll
reference a few in a second,

799
00:35:30,480 --> 00:35:34,050
but ClickOnceHunter
specifically will use like

800
00:35:34,050 --> 00:35:35,730
Chrome Headless, Chrome DevTools,

801
00:35:35,730 --> 00:35:39,480
and also incorporate some
API gateway functionality

802
00:35:39,480 --> 00:35:41,640
to rotate your source IP address,

803
00:35:41,640 --> 00:35:43,320
get around some of that rate limiting,

804
00:35:43,320 --> 00:35:45,450
and speed up the dorking process,

805
00:35:45,450 --> 00:35:48,330
so you can find some of
these existing ClickOnce

806
00:35:48,330 --> 00:35:50,193
deployments to side load yourself.

807
00:35:51,330 --> 00:35:54,330
Steven will also be releasing
ClickHunter very soon.

808
00:35:54,330 --> 00:35:55,620
That's gonna do a lot of
- [Steven] AssemblyHunter

809
00:35:55,620 --> 00:35:57,990
- I'm sorry, AssemblyHunter very soon.

810
00:35:57,990 --> 00:36:01,680
And it will do a lot
of really cool things.

811
00:36:01,680 --> 00:36:04,080
Some it'll triage the local file system

812
00:36:04,080 --> 00:36:06,000
and do a lot of these
prereq checks for you.

813
00:36:06,000 --> 00:36:09,300
So you can search a local
file system and find

814
00:36:09,300 --> 00:36:12,780
if any assemblies that are
there locally would work

815
00:36:12,780 --> 00:36:15,330
for some of the techniques
that we've talked about.

816
00:36:16,320 --> 00:36:19,007
So this is just a quick
example of using Shodan.

817
00:36:20,610 --> 00:36:22,650
You can use this particular keyword.

818
00:36:22,650 --> 00:36:25,200
There's a huge list of other dorks

819
00:36:25,200 --> 00:36:26,100
that you could use as well,

820
00:36:26,100 --> 00:36:28,920
but this shows some
existing potentially signed

821
00:36:28,920 --> 00:36:31,920
and trusted ClickOnce
deployments that exist.

822
00:36:31,920 --> 00:36:34,650
Here's another example of
using some Bing specific dorks

823
00:36:34,650 --> 00:36:37,110
that you can see like 11,000 results.

824
00:36:37,110 --> 00:36:39,030
So there's a lot out
there for people to find

825
00:36:39,030 --> 00:36:40,893
and potentially weaponize.

826
00:36:42,300 --> 00:36:46,980
Here's using GitHub with
some specific keywords again,

827
00:36:46,980 --> 00:36:49,830
and this time we were searching the values

828
00:36:49,830 --> 00:36:53,040
in the embedded manifest to
see if it would meet some

829
00:36:53,040 --> 00:36:55,390
of these prerequisites
that we've talked about.

830
00:36:56,790 --> 00:37:01,110
And here's another project on
GitHub that shows a manifest

831
00:37:01,110 --> 00:37:02,700
that will be embedded
that will very likely

832
00:37:02,700 --> 00:37:05,310
meet our prerequisites to sideload this

833
00:37:05,310 --> 00:37:07,160
as a weaponized ClickOnce deployment.

834
00:37:09,030 --> 00:37:11,340
And this is what the output
of the tool will look like.

835
00:37:11,340 --> 00:37:15,030
It's just gonna give a list
to the deployments online

836
00:37:15,030 --> 00:37:18,780
that you can go download
deployment and start to sideload

837
00:37:18,780 --> 00:37:20,733
with whatever you wanna side load with.

838
00:37:22,920 --> 00:37:24,240
- [Steven] So this is an example

839
00:37:24,240 --> 00:37:26,460
of what AssemblyHunter looks like.

840
00:37:26,460 --> 00:37:28,980
You can see, we can triage
entire paths, single files,

841
00:37:28,980 --> 00:37:31,320
collections, services, tasks.

842
00:37:31,320 --> 00:37:33,630
Clearly, I think anyone, you look at this

843
00:37:33,630 --> 00:37:35,625
and it can do a lot more than just look at

844
00:37:35,625 --> 00:37:37,530
ClickOnce abusable techniques.

845
00:37:37,530 --> 00:37:39,390
I'll let you figure that
out if you so please,

846
00:37:39,390 --> 00:37:41,130
or if you wanna ask me
about it, I'll tell you,

847
00:37:41,130 --> 00:37:43,620
but we can get a lot of
information based on everything

848
00:37:43,620 --> 00:37:47,850
that we triage across the
entire host OS if we so please.

849
00:37:47,850 --> 00:37:50,700
So this is an example of that
one that Nick just showed

850
00:37:50,700 --> 00:37:53,340
from GitHub, share X, which
is a pretty big project.

851
00:37:53,340 --> 00:37:55,890
Does not have the assemblyIdentity
line inside of it.

852
00:37:55,890 --> 00:37:58,440
So this is an abusable
project, can be deployed

853
00:37:58,440 --> 00:37:59,850
via ClickOnce application.

854
00:37:59,850 --> 00:38:02,160
So this was us showing
that we can find it also

855
00:38:02,160 --> 00:38:04,823
with AssemblyHunter, if it's
installed on an endpoint.

856
00:38:06,672 --> 00:38:10,260
Other ones that we found,
the one that we demoed,

857
00:38:10,260 --> 00:38:12,450
our third demo, DF monitor,

858
00:38:12,450 --> 00:38:14,310
this is essentially how we discovered it.

859
00:38:14,310 --> 00:38:15,780
We ran this across a host.

860
00:38:15,780 --> 00:38:20,160
We came across this one that
has no application manifests

861
00:38:20,160 --> 00:38:20,993
in it.

862
00:38:20,993 --> 00:38:21,990
So that means that it is abusable

863
00:38:21,990 --> 00:38:23,700
for us to take advantage of.

864
00:38:23,700 --> 00:38:25,290
Here we have Chocolatey, it's a free one

865
00:38:25,290 --> 00:38:27,180
if you want to go and
use it, if you so please.

866
00:38:27,180 --> 00:38:31,830
Typically, people download
projects or packages, repos

867
00:38:31,830 --> 00:38:33,033
for Windows.

868
00:38:35,370 --> 00:38:37,680
So more AssemblyHunter usage.

869
00:38:37,680 --> 00:38:38,700
So this is just looking

870
00:38:38,700 --> 00:38:41,580
through the .NET framework directory.

871
00:38:41,580 --> 00:38:44,220
And so this highlights
things that are important

872
00:38:44,220 --> 00:38:48,270
for us to take note of when
looking into .NET assemblies.

873
00:38:48,270 --> 00:38:52,200
So the UAC setting make sure
it's asinvoker or non-existent,

874
00:38:52,200 --> 00:38:54,600
the assembly manifest doesn't
really make a difference,

875
00:38:54,600 --> 00:38:56,940
Cause we tell all this information there

876
00:38:56,940 --> 00:38:59,250
and then the no application
manifest identity

877
00:38:59,250 --> 00:39:01,650
needs to be either null
or have no identity.

878
00:39:01,650 --> 00:39:04,350
And so these are all just,
again, abusable things

879
00:39:04,350 --> 00:39:08,280
from .NET framework that
we can also deploy as well.

880
00:39:08,280 --> 00:39:10,170
At the bottom, we have caspol,

881
00:39:10,170 --> 00:39:11,800
which is also part of
.NET and not abusable,

882
00:39:11,800 --> 00:39:15,330
cause you can see the
application identity is existent

883
00:39:15,330 --> 00:39:18,537
there so we cannot use that
as a deployment for ClickOnce.

884
00:39:20,700 --> 00:39:23,220
So we'll talk about some
detection opportunities.

885
00:39:23,220 --> 00:39:26,760
So ClickOnce applications,
luckily, are not super common

886
00:39:26,760 --> 00:39:29,340
and this is gonna be
dependent on an environment.

887
00:39:29,340 --> 00:39:30,780
We've seen enterprise environments

888
00:39:30,780 --> 00:39:34,830
where they have 20,000
executions of ClickOnce a day,

889
00:39:34,830 --> 00:39:36,150
based on dfsvc.

890
00:39:36,150 --> 00:39:37,860
And we've also seen other
environments that have

891
00:39:37,860 --> 00:39:39,330
zero executions a day.

892
00:39:39,330 --> 00:39:41,760
So it's important to baseline here

893
00:39:41,760 --> 00:39:44,010
of ClickOnce deployment
inside of an environment

894
00:39:44,010 --> 00:39:46,020
to determine if it's
actually something that's

895
00:39:46,020 --> 00:39:48,330
pretty commonly executed or not.

896
00:39:48,330 --> 00:39:49,163
As we said before,

897
00:39:49,163 --> 00:39:52,860
dfsvc is gonna be the process
that spawns the entire

898
00:39:52,860 --> 00:39:54,840
or the handling of the entire deployment.

899
00:39:54,840 --> 00:39:56,940
So from everything from
downloading, checking manifest,

900
00:39:56,940 --> 00:39:59,730
parsing, and all that, and execution,

901
00:39:59,730 --> 00:40:01,290
whatever we are running, our application

902
00:40:01,290 --> 00:40:04,650
will be a child process of dfsvc.

903
00:40:04,650 --> 00:40:08,610
So any sort of noncommon or
nonexpected child processes

904
00:40:08,610 --> 00:40:10,500
of that, something that can be keyed on,

905
00:40:10,500 --> 00:40:13,350
we can potentially whitelist
certain applications,

906
00:40:13,350 --> 00:40:15,420
if we use them in the environment,

907
00:40:15,420 --> 00:40:18,060
that's an opportunity for us.

908
00:40:18,060 --> 00:40:21,060
If we see dfsvc having a child process

909
00:40:21,060 --> 00:40:22,980
with an unsigned module load,

910
00:40:22,980 --> 00:40:24,480
that is a pretty high indicator.

911
00:40:24,480 --> 00:40:26,220
Now we know understand
that this is not gonna be

912
00:40:26,220 --> 00:40:27,900
inside of every environment,
that this can be,

913
00:40:27,900 --> 00:40:29,760
this type of telemetry
is gonna be leveraged

914
00:40:29,760 --> 00:40:31,560
or can be looked into.

915
00:40:31,560 --> 00:40:33,660
But that, for this technique at least,

916
00:40:33,660 --> 00:40:36,330
is a pretty good way to catch this.

917
00:40:36,330 --> 00:40:38,910
In addition to that, dfshim.dll

918
00:40:38,910 --> 00:40:41,730
can also be used to launch deployments

919
00:40:41,730 --> 00:40:44,550
or downloads of ClickOnce deployment.

920
00:40:44,550 --> 00:40:46,140
Something we wanna look into too,

921
00:40:46,140 --> 00:40:49,050
ETW monitoring become increasingly used

922
00:40:49,050 --> 00:40:52,320
by endpoint products and EDRs and such.

923
00:40:52,320 --> 00:40:55,500
So if we look at any
sort of ETW information,

924
00:40:55,500 --> 00:40:57,810
potentially find malicious code execution.

925
00:40:57,810 --> 00:40:59,110
Something to keep in mind.

926
00:41:00,360 --> 00:41:04,290
Part of .NET configs, we
can put an ETW enable flag

927
00:41:04,290 --> 00:41:06,960
in there and just call it, make it false,

928
00:41:06,960 --> 00:41:08,790
meaning that ETW will not be used

929
00:41:08,790 --> 00:41:12,660
in that particular .NET
applications process.

930
00:41:12,660 --> 00:41:13,590
So there is that,

931
00:41:13,590 --> 00:41:16,890
and is also public bypasses
that exist for ETW as well.

932
00:41:16,890 --> 00:41:19,410
So something to keep in mind
that just because we're looking

933
00:41:19,410 --> 00:41:23,013
for ETW doesn't mean that
there's not blind spots in that.

934
00:41:25,080 --> 00:41:26,850
As I said before,
there's gonna be download

935
00:41:26,850 --> 00:41:28,650
or every ClickOnce
deployment is downloaded

936
00:41:28,650 --> 00:41:30,600
to the local updated directory.

937
00:41:30,600 --> 00:41:32,310
So if we baseline that directory,

938
00:41:32,310 --> 00:41:34,920
look for anything that is
an outlier or an uncommon,

939
00:41:34,920 --> 00:41:36,300
and that's something that we could find

940
00:41:36,300 --> 00:41:39,390
that was potentially
executed that we don't want.

941
00:41:39,390 --> 00:41:41,160
And then uncommon application signatures,

942
00:41:41,160 --> 00:41:42,420
making internet connections.

943
00:41:42,420 --> 00:41:45,750
So if our first technique
that we showed of backdooring

944
00:41:45,750 --> 00:41:49,839
existing .NET applications
or ClickOnce deployments,

945
00:41:49,839 --> 00:41:51,300
a lot of them are not
companies that you've probably

946
00:41:51,300 --> 00:41:52,140
ever heard of.

947
00:41:52,140 --> 00:41:56,430
And so executing this, executing
this in an environment,

948
00:41:56,430 --> 00:42:00,390
you probably have an uncommon
signature of an application

949
00:42:00,390 --> 00:42:05,253
that is now establishing C2
or doing something nefarious.

950
00:42:06,690 --> 00:42:07,980
Some prevention opportunities.

951
00:42:07,980 --> 00:42:10,020
So we can deploy registry settings

952
00:42:10,020 --> 00:42:11,673
across enterprise, via GPO.

953
00:42:12,801 --> 00:42:17,730
We have this one that's
for prompting trust levels

954
00:42:17,730 --> 00:42:18,840
with ClickOnce.

955
00:42:18,840 --> 00:42:21,030
A few options that we can set it to

956
00:42:21,030 --> 00:42:22,380
and zones that we can enable.

957
00:42:22,380 --> 00:42:26,160
So we have my computer, local
internet, trusted sites,

958
00:42:26,160 --> 00:42:28,170
internet, and untrusted sites.

959
00:42:28,170 --> 00:42:31,680
And so we can decide to,
if you want to enable them,

960
00:42:31,680 --> 00:42:33,600
make sure the Authenticode is required

961
00:42:33,600 --> 00:42:35,733
or completely just outright disable it.

962
00:42:37,080 --> 00:42:39,360
If we do have any sort of
application control deployed

963
00:42:39,360 --> 00:42:40,860
throughout the enterprise,
then we also could look

964
00:42:40,860 --> 00:42:43,893
for unsigned applications
attempting to be loaded too.

965
00:42:46,860 --> 00:42:48,900
So this is just an example
of what it would look like

966
00:42:48,900 --> 00:42:51,480
if we disabled or had the registry key

967
00:42:51,480 --> 00:42:53,850
that says disable internet.

968
00:42:53,850 --> 00:42:55,680
So anything that comes from the internet,

969
00:42:55,680 --> 00:42:57,990
the users won't even have
an opportunity to run it.

970
00:42:57,990 --> 00:42:59,490
It's just close and that's it.

971
00:43:04,140 --> 00:43:04,973
- All right.

972
00:43:04,973 --> 00:43:07,860
So yeah, in closing,
there's a lot of folks

973
00:43:07,860 --> 00:43:11,820
that helped us work
towards kind of working

974
00:43:11,820 --> 00:43:14,010
through some of the
technical details of finding

975
00:43:14,010 --> 00:43:14,843
these techniques.

976
00:43:14,843 --> 00:43:16,980
So the first one that we
wanted to give a shout-out

977
00:43:16,980 --> 00:43:19,560
was our coworker, Lee Christensen.

978
00:43:19,560 --> 00:43:23,850
He's done a lot of incredible
offensive .NET work in general

979
00:43:23,850 --> 00:43:25,950
and what we did would
not have been possible

980
00:43:25,950 --> 00:43:27,510
without his prior work.

981
00:43:27,510 --> 00:43:29,910
Another shout-out we wanted
to give was Casey Smith.

982
00:43:29,910 --> 00:43:34,860
He's done also, probably too
much incredible work to name.

983
00:43:34,860 --> 00:43:37,890
One specifically that's
relevant to a couple

984
00:43:37,890 --> 00:43:40,830
of the techniques we named,
app domain manager injection.

985
00:43:40,830 --> 00:43:43,140
He gave a phenomenal DerbyCon talk

986
00:43:43,140 --> 00:43:45,900
that helped us a lot working
towards these techniques.

987
00:43:45,900 --> 00:43:49,410
Another one would be William
Burke gave a presentation

988
00:43:49,410 --> 00:43:52,140
on specifically the
appref-ms stuff that we

989
00:43:52,140 --> 00:43:55,140
very briefly referenced
during this presentation.

990
00:43:55,140 --> 00:43:56,610
He gave that presentation at Black Hat,

991
00:43:56,610 --> 00:43:59,970
maybe two or three years
ago, and it really helped us.

992
00:43:59,970 --> 00:44:02,190
And lastly, kind of in closing,

993
00:44:02,190 --> 00:44:04,770
there's still a gigantic
attack surface associated

994
00:44:04,770 --> 00:44:08,400
with .NET in general, but even
more specifically ClickOnce.

995
00:44:08,400 --> 00:44:11,490
There's plenty of areas
to continue looking into

996
00:44:11,490 --> 00:44:14,613
and a lot of potential for
more capability development.

997
00:44:17,340 --> 00:44:19,096
So thank you guys so much for coming.

998
00:44:19,096 --> 00:44:22,096
(audience applauds)

999
00:44:23,220 --> 00:44:24,053
- Good time.