5 ms·
Macro-Less Code Exec in MSWord
- jonathonf 9y agoGiven there are two prompts that the document is trying to do something "different", and the second tells you explicitly it's trying to run an executable and provides a path, is this realistically exploitable?
- Gaelan 9y agohttps://i.imgur.com/H0uVqFer.jpg https://i.imgur.com/H0uVqFer.jpg
- jononor 9y agoFrom observing users, it seems that just clicking OK without even reading dialog prompts seems quite common..
- wlesieutre 9y agoEven if you've specifically asked that next time it happens they stop and read you the error, they'll click OK and text you "There was an error can you fix it?"
- Tijdreiziger 9y agoFurther down in the post, they explain how you can use a different syntax to get a non-suspicious prompt.
- est 9y agoGiven that only 1% chances of people click OK, you just spam it to millions of people. Someone will click OK.
- rightos 9y agoBut then it's really not much better than spamming a .ps1 or .js script (handled by Windows Script Host by default), or even straight up executable as many already do. If they're at that level then there's really not much you can do but avoid having them get the stuff in the first place.
- ec109685 9y agoThose can be filtered by email systems.
- deleted 9y ago[deleted]
- rightos 9y agoSo can this, it'd be fairly trivial to detect and block anything using DDE at the file level - however a common strategy is to send an encrypted archive file and give the password in the email to bypass that detection. Trashing all encrypted archives automatically.... ehh, maybe viable?
- zxcmx 9y agoThe other scenario where this kind of thing can be useful is poorly secured "kiosks", aka, you want to run arbitrary code but the administrator of that machine doesn't want you to. Macros can be disabled by group policy.
- tinus_hn 9y agoIt doesn’t even come with red text and warning signs. Users don’t read this stuff and even if they do, it’s easy to explain the warnings away in the document or the email that contains it. It is just stupid design and there is no excuse this is still in a supported application in 2017. But then again, what would you expect from Microsoft Office.
- cyphar 9y ago> The second prompt asks the user whether or not they want to execute the specified application, now this can be considered as a security warning since it asks the user to execute “cmd.exe”, however with proper syntax modification it can be hidden. The warning is a security feature, but they didn't elaborate on how you can bypass it with "proper syntax modification". If that's true, then it should be considered at least somewhat exploitable.
- Tijdreiziger 9y agoThey did, further down in the post.
- e19293001 9y agoSomewhat related thread: https://news.ycombinator.com/item?id=15438894 https://news.ycombinator.com/item?id=15438894
- upofadown 9y agoMicrosoft loves to execute code from unlikely places. What possible legitimate use would this particular "feature" be good for?
- kyberias 9y agoYeah, what possibly use could there be to launch other programs from other programs? Come on now.
- ksk 9y agoI believe this unfortnuate idea was introduced in 1993 with windows 3.1. This was sold as a way for an application like powerpoint to script access to data for say, a chart, from a spreadsheet file. This way when the spreadsheet was updated, the powerpoint was as well.
- makmanalp 9y agoOh, to be a fly on the wall of those naive folks that spread DDE, then OLE, then ActiveX all over MS Office, and the poor folks who are now struggling to find and gate every nook and cranny that gunk ended up in.
- yuhong 9y agoAFAIK they spent a lot of effort on that kind of stuff in Office 2003.
- ksk 9y agoIf you download such a file, the default setting of the protected mode should cover this. https://i.imgur.com/49x2IZN.png https://i.imgur.com/49x2IZN.png
- The6P4C 9y agoWho doesn't immediately click out of protected view though?
- sleepychu 9y agoWhy would you? (If you're just reading it)
- technion 9y agoThe primary issue for me is that in protected mode, you can't copy to clipboard. So I can't take a note and send it to someone, I can't paste something into a ticket system, etc etc. I have to admit I'm pretty used to just clicking out of protected mode.
- Walf 9y agoWord exits protected mode just to print. Apparently you can create screen pixels from that mode, but not if they're going to end up in a PDF or on paper.
- ksk 9y agoYeah, I wonder if we need two paradigms here. Clicking things should only be for non-executable read-only stuff. And we need another UI verb for when we want to execute code, read/write, etc. Hard to get people onboard though, when they're just used to doing it one way.
- Chiba-City 9y agoI'm 51. We PC nerds played with IPC via DDE and even Net DDE in the early 90's Netware days before TCP/IP and HTTP took over with XML or JSON in tow. A script connected "Emacs Lisp" for office automation is still a good idea for professionals. The programmable spreadsheet changed the world in the 1980's like few today could ever imagine. They gave out Office to everyone en masse after that. But Hack attacks via email are not always front and center considerations. IPC interoperability is important for folks actually customizing workstation workflows.
- sxldier 9y agoPretty cool and informative! Just thought I'd say that it's possible to the see the IP you are connecting to. Not sure if you'd like to update the video or not.
- darklajid 9y agoI know that's not the point of the article. Why are they connected as root via ssh? Any good reason for that? Just to troll people like me?