ASLR

All posts tagged ASLR

This is just a short post highlighting how easily ASLR could be bypassed by instantiating ActiveX controls using certain classids in Microsoft Office. I’ve mainly tested with MS Word on an updated Windows 7 32bit with Office 2010 32bit but other applications such as Excel and PowerPoint should work too.

All these classids listed in the below table give security warning prompt but the library will still load before any action is taken.

Library sqlceca35.dll comes with Microsoft SQL Server Compact which is an embedded database that gets installed by Microsoft Office. I’ve seen some systems with version 4.0 installed where sqlceca40.dll has its dynamic bit set and thus gets ASLRed.

C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceca35.dll
{20347534-760B-464D-B572-285E6B618257} SSCE.Error.3.5
{3018609E-CDBC-47E8-A255-809D46BAA319} SSCE.DropTableListner.3.5
{455C3E04-BFE9-4089-8622-F2464EC3FDDB} SSCE Active Sync Engine.3.5
{7C7E6C99-BB8D-4718-AAA9-70C4320010DE} SSCE.Params.3.5
{8CD1B98D-D8D5-4B51-9564-48B12A98698F} SSCE.RemoteDataAccess.3.5
{9E7E2CCE-3F1F-4891-892C-AC8B486D03B2} SSCE.Params.3.5
{9FD542D2-61C4-4E9F-A8E2-E6B8C7F64CBF} SSCE.Errors.3.5
{A9D3060D-3526-4538-B13A-1913568DAA0D} SSCE.Engine.3.5
{EA91E968-EF93-4FF1-86F3-75CC93416DF2} SSCE.Replication.3.5
C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceoledb35.dll
{90A1998A-EB21-4F61-872F-F4DFDE1065D6} Microsoft.SQLSERVER.CE.OLEDB.
ErrorLookup.3.5
C:\Program Files\Common Files\System\Ole DB\XMLRW.dll
C:\Program Files\Common Files\System\Ole DB\XMLRWBIN.dll
{10154F28-4979-4166-B114-3E7A7926C747} MSOLAP.4
{867CD778-80D7-4f93-989E-B3E76A92FB42} MSOLAP100ErrorLookup.1
C:\Windows\system32\msvbvm60.dll
{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}
C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll
C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL
C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL
C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL
{5591379C-B467-4BCA-B647-A438712504B0} LR.LexRefTfFunctionProvider.1.0.1
C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x86\Synchronization.dll
{A7B3B4EE-925C-4D6C-B007-A4A6A0B09143}
C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x86\FeedSync.dll
{BC0CD90A-2C24-41BE-B6EC-87C15D919418}
C:\Program Files\Common Files\Microsoft Shared\VSTA\8.0\x86\VSTARemotingServer.dll
{60A896CA-1649-45BF-B63F-2E7312A968F0}
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\
8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Blueprints.dll
{65C52C10-2286-420A-B35C-15CF7F9B5876} Microsoft.VisualStudio.Tools.Applications.
Blueprints.HostControl
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\
8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.DesignTime.dll
{9DA65B6A-813C-4592-9E8A-412C40BBC4B7} Microsoft.VisualStudio.Tools.Applications.
DesignTime.HostAdapter

Some are shown to get rebased as I loaded all libraries in one go but if loaded individually the address should not change.

Taking a look in Office 2010 64bit we still see some do not get ASLRed.

Disabling ActiveX controls in Microsoft Office
Disabling ActiveX controls can be configured via the Trust Center settings

File — Options — Trust Center — Trust Center Settings — ActiveX Settings

This will disable all controls so probably not a good idea in your environment

Disabling specific embedded ActiveX controls with Office kill bit
To enable the Office COM kill bit for a specific control to block a registry key would need to be added with the CLSID of the ActiveX control then add a DWORD value of 0x00000400 to the Compatibility Flags. The location for setting the Office 2010 COM kill bit in the registry is

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\COM Compatibility

Microsoft EMET
Using EMET we can see all libraries get ASLRed.

Microsoft Office 2013
Finally in Office 2013 the classids that do exist, the libraries that do load have already got there dynamic bit set and get ASLRed

All the documents with these classids can be downloaded from here

A couple of months ago a RTF 0-day was used in attacks and to bypass ASLR (Address Space Layout Randomization) it was using a non-ASLR module MSCOMCTL.OCX.  This got me interested to research into how it was actually loading up and discover if there were any more modules that could be used in the future following the recent Microsoft bulletin MS14-024 that finally implemented ASLR on the module. I started with an exploit taken from MetaSploit which exploits the Microsoft Word RTF Object Confusion vulnerability (CVE-2014-1761) and patched in April updates MS14-017 . This exploit uses module MSCOMCTL.OCX to bypass ASLR and what I needed was that part of the code so removed all other code leaving it just to load the OCX file.

Just to load the OCX file we are looking around 17018 bytes added to the exploit. Far too large so I started looking into ways to reduce the size. Most of the data was used in the control word \objdata which contains the data used by the object represented in hexadecimal. Taking this data and using a vbs script I wrote the data to file so it could be easily viewed in a hex editor to try and make sense of it.

The FormatID value of 0x00000002 tells the ObjectHeader structure that it must be followed by an EmbeddedObject structure. The main value to look at was the bulk size of the data which had a size of 0x00001E00 (7680 bytes), going to the end of this data clunk leads to the next OLEVersion header. Removing this data chunk, some control words and tidying it up we are left with

As you can see I have also changed the data chunk size to 1 and the data chunk only now contains 0x41 and the file size has gone down to 1619 bytes. (Size defined on line 8)

Looking at the remaining data above there is another OLEVersion header and FormatID value. FormatID 0x00000005 tells us that the classname must be present, is this case METAFILEPICT. The classname field identifies the type of the presentation data structure and in this case is a Windows Meta File (WMF). If we change the FormatID to 0x00000000 it tells the parser that that classname field must not be present and we can remove the rest of the data chunk which leaves us with

Lastly the control word \objclass is optional so thats removed

Finally we end up with a size of 180 bytes from the huge 17018 bytes we started in the beginning. It could be the 0-day exploit chose a large chunk of object data to give it a bit of size and confusion for the analyst when reverse engineering the RTF. A good Microsoft document  “Object Linking and Embedding (OLE) Data Structures”  explains the data structures.

Searching for new ActiveX/COM objects
Now that all the irrelevant data had been discarded it was a matter of just changing the ProgID (programmatic identifier) and size of the ProgID. Since ActiveX controls are not being used in Internet Explorer the controls are not required to be marked as “safe for initialization” or “safe for scripting”. The tedious task now was building a couple of vanilla Windows machines and get them all up-to-date, testing with only Windows first and then with Microsoft Office. Actions needed to take were

  • List all non ASLR modules
  • List all COM object modules
  • Test modules can be loaded in Word
  • Check modules does not get rebased

After going through this process I ended up with two libraries that fitted the criteria perfectly.

Library OTKLOADR.DLL
Path C:\Program Files\Microsoft Office\Office14\ADDINS\
C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\ (W64)
ProgIDs otkloadr.WRAssembly.1
otkloadr.WRLoader.1
Versions 7.10.2179.0 (msvcr71.dll) 7.10.5077.0 (olkloadr.dll)
Note OTKLOADR.DLL gets rebased but is linked to another non-ASLR module MSVCR71.DLL in the same path
Library SQLCECA35.DLL
Path C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5 (W64)
ProgIDs SSCE.DropTableListener.3.5
SSCE.Engine.3.5SSCE.Error.3.5
SSCE.Errors.3.5
SSCE.Param.3.5
SSCE.Params.3.5
SSCE.RemoteDataAccess.3.5
SSCE.Replication.3.5
Versions 3.5.5692.0 (sqlceca35.dll and sqlceer35EN.dll)
Note Another module also gets loaded sqlceer35EN.dll but gets rebased

All of the ProgIDs listed above apart from one loads the relevant non ASLR module successfully but upon exiting MS Word it prompts “Do you want to save changes you made to {filename}” and also most of the time gives error “There is not enough memory or disk space to display or print the picture”.

The one that works with no prompts or errors was using ProgID “otkloadr.WRAssembly.1“. This ProgID works with no issues at all, opens and exits the document cleanly, no square box displayed and it happens to be our friendly old “MSVCR71.DLL” library not compiled with the /DYNAMICBASE option. Looks like this library just does not go away and has come back to haunt us again 🙂 Another research area would be to load all ProgIDs available and monitor which ones load non-ASLR modules but that’s for another day. Here is a screenshot of both libraries loaded in WINWORD.EXE process space

This has been tested on a fully patched Windows 7 SP1 Enterprise OS (32bit and 64bit) with Microsoft Office Professional Plus 2010 (32bit) with version of Word being 14.0.7116.5000 (32bit) and here is the code using ProgID otkloadr.WRAssembly.1

{\rtf1{\object\objocx{\*\objdata 
01050000
02000000
16000000
6f746b6c6f6164722e5752417373656d626c792e3100
00000000
00000000
01000000
41
01050000
00000000
}}}

Third Party modules
As I started looking at other apps dozens of ProgIDs were being discovered. ITunes and DivX player contains modules that could be loaded by their ProgIDs but unlikely as they use the preferred base address of 0x10000000 so if some module is already loaded at that address then the next module would get rebased. Yahoo Messenger contains a number of ProgIDs that does not get rebased. I also found some old Microsoft OCX files (non-ASLRed) installed on another PC most likely by other third-party software or old Microsoft software. A quick test on ProgIDs PicClip.PictureClip.1 (PICCLP32.OCX) MSMAPI.MapiMessage.1 (MSMAPI32.OCX) worked fine.

C:\Windows\System32\COMCT232.OCX   
C:\Windows\System32\COMCTL32.OCX   
C:\Windows\System32\COMDLG32.OCX   
C:\Windows\System32\MCI32.OCX
C:\Windows\System32\MSCOMCT2.OCX   
C:\Windows\System32\MSCOMM32.OCX
C:\Windows\System32\MSFLXGRD.OCX   
C:\Windows\System32\MSINET.OCX
C:\Windows\System32\MSMAPI32.OCX
C:\Windows\System32\MSMASK32.OCX
C:\Windows\System32\MSWINSCK.OCX
C:\Windows\System32\PICCLP32.OCX
C:\Windows\System32\SYSINFO.OCX
C:\Windows\System32\TABCTL32.OCX

Mitigation
The best mitigation would be to install Microsoft EMET and add MSWord (WINWORD.EXE) to its application list. EMET has a number of mitigations which will stop exploits one way or another and it’s free so there’s no excuse for not getting it deployed. There is also a  FixIT from Microsoft which configures the Microsoft Office File Block policy to prevent the opening of RTF files in supported versions of Microsoft Word. You can also configure the blocking of RTF files manually in the Trust Center settings.

File — Options — Trust Center — Trust Center Settings — File Block Settings

Make sure “Open” is checked for RTF Files. Further below there are three other choices. “Do not open selected file types” selected won’t even open the file which is what you want.

Choosing “Open selected file types in Protected View” which is the default opens another WINWORD.EXE as a child process in low integrity mode.

The registry settings are below if you decide to script it out to your managed assets.

Windows Registry Editor Version 5.00
;
[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\FileBlock]
"RtfFiles"=dword:00000002
"OpenInProtectedView"=dword:00000001
;
; "RtfFiles"=dword:00000001            - Save checked
; "RtfFiles"=dword:00000002            - Open and Save checked
; "OpenInProtectedView"=dword:00000000 - Do not open selected file types
; "OpenInProtectedView"=dword:00000001 - Open selected file types in Protected View
; "OpenInProtectedView"=dword:00000002 - Open selected file types in Protected View and allow editing

By default for most MSWord document formats are not set for Protected View settings so MSWord would be running in medium integrity meaning once compromised would be extremely damaging making malware persistent on the machine. RTF format file extensions .rtf can be renamed to .doc and still would be parsed as RTF so bear that in mind for those who are thinking of blocking just by .rtf extension on your mail relays.

Conclusion
Bypassing ASLR on Microsoft Word RTF formatted documents has now become a lot easier as we can see. There could be potentially hundreds of possible ProgIDs on a system from various applications that could be used increasing the ever threat of being compromised. Until all vendors start compiling there code with the /DYNAMICBASE option which I don’t see it happening anytime soon the only real defense would be to get Microsoft EMET installed on all assets ASAP.

Here is a zip file containing some example RTF files, third-party software ProgIDs, vbs script, etc.

 

 

This is just a short post highlighting a couple of products that if installed could be used to bypass ASLR in Internet Explorer.

  • DivX Player 10.0.2
  • Yahoo Messenger 11.5.0.228
  • AOL Instant Messenger 7.5.14.8

These products contain a number of libraries that does not get ASLRed when loaded in memory due to not being compiled with the dynamicbase flag. These libraries can easily be loaded in Internet Explorer as they get registered on the system to run without permissions therefore no prompts are given. Below are the lists of libraries that can be loaded via ProgID or ClassID.

Dll     - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
ProgID  - OVSHelper.OVSHelperCOM.1
ClassID - C6E31427-FD7E-4C53-B568-124B191E5DC4
Version - 1.1.0.12
-
Dll     - C:\Program Files\DivX\DivX Web Player\npdivx32.dll
ProgID  - npdivx.DivXBrowserPlugin.1
ClassID - 67DABFBF-D0AB-41FA-9C46-CC0F21721616
Version - 3.0.1.5
-
Dll     - C:\Program Files\DivX\DivX Web Player\npdivx32.dll
ProgID  - nprovi.RoviStreamPlayer.1
ClassID - 7F64C4F7-2D43-42fe-B7E7-CE5873E7D8B6
Version - 3.0.1.5
-
Dll     - C:\Program Files\Yahoo!\Messenger\YPagerChecker.dll
ProgID  - YPagerChecker.MessengerChecker.1
ClassID - DA4F543C-C8A9-4E88-9A79-548CBB46F18F
Version - 1.1.0.3
-
Dll     - C:\Program Files\AIM\isAim.dll
ProgID  - isaim.aimlocator.1
ClassID - BAEB32D0-732D-11D2-8BF4-0060B0A4A9EA
Version - 2.0.0.0

To view which libraries that can be loaded without permission go to “Manage Add-ons” which can be accessed from Internet Explorer – Tools – Manage Add-ons and choose “Run without permission” in the show dropdown list.

The below script you can use to test if any of these libraries get loaded or just click here to run it now. Libraries taking base address 0x10000000 will get rebased if one is already loaded. Note that for the Yahoo Messenger object check does not work so will fail but the library will still get loaded if installed. Also depending where you download AOL Instant Messenger the latest version is 8.0.6.1 which does not contain isAim.dll library.

<HTML>
<SCRIPT language="JavaScript"> 
//
if (DivX1() == "DivX")
{
   document.write("DivX VOD Helper Plug-in npovshelper.dll loaded<br>");
}
if (DivX2() == "DivX")
{
   document.write("DivX Web Player (DivXBrowserPlugin) npdivx32.dll loaded<br>");
}
if (DivX3() == "DivX")
{
   document.write("DivX Web Player (RoviStreamPlayer) npdivx32.dll loaded<br>");
}
if (Aol() == "AIM")
{
   document.write("AOL Messenger isAim.dll loaded<br>");
}
if (Yahoo() == "YahooM")
{
   document.write("Yahoo Messenger YPagerChecker.dll loaded<br>");
}
//
function DivX1() 
{
   var divxver = "";
   var divx = 0;
   var err = 0;
   try {
         divx = new ActiveXObject("OVSHelper.OVSHelperCOM.1") 
   } catch (err) {
      document.write("DivX VOD Helper Plug-in npovshelper.dll failed<br>");
   }
   if ((typeof divx) == "object") {
      divxver = "DivX";
   }
   return divxver;
}
function DivX2() 
{
   var divxver = "";
   var divx = 0;
   var err = 0;
   try {
         divx = new ActiveXObject("npdivx.DivXBrowserPlugin.1")
   } catch (err) {
      document.write("DivX Web Player (DivXBrowserPlugin) npdivx32.dll failed<br>");
   }
   if ((typeof divx) == "object") {
      divxver = "DivX";
   }
   return divxver;
}
function DivX3() 
{
   var divxver = "";
   var divx = 0;
   var err = 0;
   try {
         divx = new ActiveXObject("nprovi.RoviStreamPlayer.1")
   } catch (err) {
      document.write("DivX Web Player (RoviStreamPlayer) npdivx32.dll failed<br>");
   }
   if ((typeof divx) == "object") {
      divxver = "DivX";
   }
   return divxver;
}
function Aol() 
{
   var aolver = "";
   var aol = 0;
   var err = 0;
   try {
         aol = new ActiveXObject("isaim.aimlocator.1")
   } catch (err) {
      document.write("AOL Messenger isAim.dll failed<br>");
   }
   if ((typeof aol) == "object") {
      aolver = "AIM";
   }
   return aolver;
}
function Yahoo() 
{
   var yahoover = "";
   var yahoo = 0;
   var err = 0;
   try {
         yahoo = new ActiveXObject("YPagerChecker.MessengerChecker.1")  
   } catch (err) {
      document.write("Yahoo Messenger YPagerChecker.dll failed<br>");
   }
   if ((typeof yahoo) == "object") {
      yahoover = "YahooM";
   }
   return yahoover;
}
</SCRIPT>
</HTML>

Checking with Process Explorer you’ll see something like this

There are a number of mitigations available so bypassing ASLR using modules not set with the dynamicbase bit should be old news by now.

  • Install Microsoft EMET which supports multiple mitigation technologies, one being Mandatory Address Space Layout Randomization (ASLR) forcing module addresses to be randomized for a target process
  • Upgrade to Internet Explorer 10 or 11 where additional patches will be installed enabling it to use ForceASLR on Windows 7
  • Upgrade to Windows 8 which supports ForceASLR where Internet Explorer tells the OS to randomize all modules loaded by the browser
  • Disable the libraries from “Manage Add-ons”

Running Internet Explorer 10/11 or EMET all addresses will get randomized as you can see below