10 ms·

Embedding an EXE inside a .REG file with automatic execution

205 points by liberia 4y ago

kekebo 4y ago
The (base64-encoded) binary can even be stored directly in the Registry: https://twitter.com/tenrobots/status/1552179803121258496 https://twitter.com/tenrobots/status/1552179803121258496
- jgalentine007 4y ago
  Yes, there is an atomic test / mitre attack technique exactly for this. The lame part is the attack executes successfully on stock windows 10/11. Its one of the top threats of 2021/2022. https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-11---powershell-fileless-script-execution https://github.com/redcanaryco/atomic-red-team/blob/master/a...
rwmj 4y ago
Why doesn't he keep the encoded .exe as an adjacent registry key, and have the powershell script open that key, decode the content and run it? Anyway once you've persuaded the user to import a .reg file as administrator, it's game over. There are so many registry entries with exploitable possibilities. (It's similar to persuading a Linux user to unpack a tarball over /etc) While I'm here... hivex is a Linux library for accessing and modifying the Windows registry (https://github.com/libguestfs/hivex https://github.com/libguestfs/hivex), and virt-win-reg is a Linux tool for modifying the registry of a VM (https://libguestfs.org/virt-win-reg.1.html https://libguestfs.org/virt-win-reg.1.html). After many hours discovering how the registry works to write those, I also wrote this about why the registry sucks: https://rwmj.wordpress.com/2010/02/18/why-the-windows-registry-sucks-technically/ https://rwmj.wordpress.com/2010/02/18/why-the-windows-regist...
- _c3ag 4y ago
  why not executing the .exe and it doing it for you?
- vxNsr 4y ago
  This could be useful in places where you need to deliver something to someone who trusts you, but corp policies get in the way. I’m talking not maliciously. There a cases where you’re admin but still can’t quite run something, or download an exe, but this might get past.
  - banana_giraffe 4y ago
    They can't download an exe, but can download a .reg file, modify RunOnce, run powershell scripts, scripts that write an executable, and run that executable? I mean, maybe that's a use case, sure, but I'm not likely to remember this is in my toolbox, much less assume it'll ever work.
- bryanrasmussen 4y ago
  >Anyway once you've persuaded the user to import a .reg file as administrator, it's game over. relevant Raymond Chen https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91531 https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91...
- jjice 4y ago
  > (It's similar to persuading a Linux user to unpack a tarball over /etc) Would this allow for arbitrary code execution? Curious as a Linux amateur
  - blibble 4y ago
    you could put a cron entry by dumping a file into /etc/cron.d/ run any command as any user once a minute
    - JonathonW 4y ago
      Or put something into /etc/profile.d and run at every shell startup, or put something into /etc/ld.so.conf.d and inject code into every process started on the system, or put something into /etc/init.d and run at every boot... (continue ad infinitum) If you let code overwrite the files that make up your system configuration, you're going to have a Bad Time on any OS; this isn't somehow specific to Windows and the registry.
    - entropie 4y ago
      /etc/inittab You could probably replace the executables for the ttys, potentially having a keylogger for every userinput on the terminal?
  - mananaysiempre 4y ago
    Sure; the list of startup services is maintained there, for one (in one of a number of ways), but a variety of programs allow the administrator to configure hooks to execute when something happens as well. Then there are lists of variables that are in fact shell scripts, names of users’ configured shells, mount options, kernel modules, ... . Arbitrary code execution immediately (as opposed to after next reboot or at least a service’s configuration being reloaded) seems harder, but I expect it to be possible as well. ETA: Took a couple of minutes, huh. A sibling comment mentions the dynamic linker, which apparently maintains a cache of well-known library locations in /etc. This yields execution as soon as a new dynamically linked executable is started, which probably qualifies as immediate. (More care would be required to avoid breaking the system in the process, though.)
- rkagerer 4y ago
  I actually miss the .ini files of early DOS / Windows days, with the defacto convention of storing them in their related program directory. They were easy to examine and edit with text tools, and you could do things like diffs. And when you delete the program directory, they go away as well. I used Total Uninstall on a couple Windows 7 workstations for over a decade and really paid attention to curating my registry against bloat. Almost every software out there leaves waste behind in your registry after you uninstall it. I reported some of the most egregious cases to developers/publishers over the years... a few even got fixed. But the ecosystem is a mess. I'm not sure Microsoft ever realized the importance of hammering on best practices and providing the tooling to make them effortless to follow. Even their internal teams have done some ugly stuff over the years.
  - pjmlp 4y ago
    Same here, there was nothing wrong with them. Microsoft has been pushing for xml configuration files alongside applications, but even their own teams don't listen, so here we are.
  - KronisLV 4y ago
    > Almost every software out there leaves waste behind in your registry after you uninstall it. I think this is just a design flaw of the implementation itself. Why couldn't every entry have a few more fields under the hood: programsDependingOnThisEntry: [PROGRAM_FOO, PROGRAM_BAR] I know that this might bloat the overall size of it, but in my experience most data structures that aren't a graph of some sort but need to be used by multiple consumers will eventually become full of orphaned data. In this example, references to actual installed programs would make sure that when you have orphaned data it can be removed automatically (or the choice given to you), much like apt might suggest that you have some packages that aren't used by any other piece of software anymore. For informative purposes, maybe also add: entryFirstAdded: 2005.05.15 14:00 entryLastChanged: 2006.11.04 17:35 entryLastRead: 2008.10.13 13:00 The timestamps could optionally assist in figuring out when the values were changed/added/actually used, so you know how important something is. If an entry hasn't been accessed in 5 years of your daily usage or something, quite possibly it isn't awfully important.
bilekas 4y ago
This has been known for a long while. I'm not sure the purpose - probably just for fun, but as an attack vector without 0day in pdf for example, to me at least it wouldn't be too effective. I've always been fascinated thought and been playing around with images with executable inside that could be triggered through the browser that you're on, I have played with a personal chromium build that it 'kind of' happens, but i digress. Interesting article - I just don't see a patch coming for it anytime soon.
marcodiego 4y ago
In my (admittedly biased) view, microsoft sacrificed security in the name of "usability". The problem is with what they considered "usability". It looks like in their view, "easy of use" simply meant "keep it working the way users are used to do". This created many bad habits in windows users: always clicking next, installing software from untrusted sources, hiding extensions of files, need for the user to install drivers after pluging a device, use of administrator rights even for simple tasks, rebooting the computer to make something work, periodic reinstalling the OS to make it faster.... and many other behaviors that are very very strange for people who don't use windows. The other problem it created is that windows users expect things to be like that. Even if something is better they will have difficulty using it if it is different from how windows users are used to. Certainly this helps to keep windows market while making everybody pay a hefty price. I'd bet if it wasn't because of android, ios and smart tv's; because they are different enough from what users think a "computer" is; windows users would expect a port to connect some form of media for software installation on these devices. These habits afflict even power users, developers and administrators. Just consider how long windows lived without a reasonable powerful command line. I was more than once looked down from "windows experts" because for them, using a command line like is commonly done on linux is a "thing of the past". People should learn some windows behaviors are not normal. Your computer shouldn't get slower over time, installing software from untrusted sources is not normal, an extension is part of the name of a file and it should not be hidden, using the computer as administrator should be reserved for administrator tasks only, your desktop area is not /tmp/, drivers belong to the kernel and devices should work as soon as they are plugged in, the command line is not a thing of the past... We are all paying the price for not killing these myths.
- inetknght 4y ago
  > We are all paying the price for not killing these myths. I can't tell you how many times I've taken on teaching a novice or junior developer and then had to un-teach them all the shit that Windows teaches users.
  - marcodiego 4y ago
    There is a funny symptom among windows users when they have a notebook/laptop: they need a mouse. Even when the notebook has a good trackpad, they still need a mouse. I tried to investigate why this happens. What I suspect: windows overuse/abuse clicks. The user must click so many points, they don't care about using the keyboard or shortcuts. Also, AFAIK, only recently windows has support for things like two-finger scroll and right click by tapping with two fingers; most users don't even know this is possible and look surprised when I show them that. They have a need for a mouse. They scroll the text using the scrollbar, they use it even for moving the caret to the above line when writing code! It makes me sad just looking at that.
t00 4y ago
There surely is a better way to launch an exe having access to the registry, even if it is just HKEY_CURRENT_USER. Some directory handler or file handler, GUID for launching an exe when desktop is shown etc. Anyone knows more about alternatives to Run/RunOnce to start an exe? Or maybe, let's leave it for the reader to investigate...
HEI-Points 4y ago
• administrator privileges are required • the main payload doesn't execute until the next reboot still an impressive demo
Mandatum 4y ago
Any company that allows .reg files executed by non-admin users have bigger fish to fry. This method has been used for literally decades.
redbell 4y ago
I admire this type of content where the creator take some concepts we [all] use and understand then combine them in a specific, but a new way, add some tweaks to get some never-seen results. Here is another experience that, as a Windows developer, blows my mind for a while. https://www.youtube.com/watch?v=ExwqNreocpg https://www.youtube.com/watch?v=ExwqNreocpg
Dwedit 4y ago
"RunOnce" isn't even the preferred way to run EXEs with RegEdit. See "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options". That stuff there is very powerful and scary. You can even use this feature to stop the Windows Telemetry from running.

205 points by liberia 4y ago

The (base64-encoded) binary can even be stored directly in the Registry: https://twitter.com/tenrobots/status/1552179803121258496 https://twitter.com/tenrobots/status/1552179803121258496

jgalentine007 4y ago
Yes, there is an atomic test / mitre attack technique exactly for this. The lame part is the attack executes successfully on stock windows 10/11. Its one of the top threats of 2021/2022. https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-11---powershell-fileless-script-execution https://github.com/redcanaryco/atomic-red-team/blob/master/a...

rwmj 4y ago

Why doesn't he keep the encoded .exe as an adjacent registry key, and have the powershell script open that key, decode the content and run it? Anyway once you've persuaded the user to import a .reg file as administrator, it's game over. There are so many registry entries with exploitable possibilities. (It's similar to persuading a Linux user to unpack a tarball over /etc) While I'm here... hivex is a Linux library for accessing and modifying the Windows registry (https://github.com/libguestfs/hivex https://github.com/libguestfs/hivex), and virt-win-reg is a Linux tool for modifying the registry of a VM (https://libguestfs.org/virt-win-reg.1.html https://libguestfs.org/virt-win-reg.1.html). After many hours discovering how the registry works to write those, I also wrote this about why the registry sucks: https://rwmj.wordpress.com/2010/02/18/why-the-windows-registry-sucks-technically/ https://rwmj.wordpress.com/2010/02/18/why-the-windows-regist...

_c3ag 4y ago
why not executing the .exe and it doing it for you?
vxNsr 4y ago
This could be useful in places where you need to deliver something to someone who trusts you, but corp policies get in the way. I’m talking not maliciously. There a cases where you’re admin but still can’t quite run something, or download an exe, but this might get past.
- banana_giraffe 4y ago
  They can't download an exe, but can download a .reg file, modify RunOnce, run powershell scripts, scripts that write an executable, and run that executable? I mean, maybe that's a use case, sure, but I'm not likely to remember this is in my toolbox, much less assume it'll ever work.
bryanrasmussen 4y ago
>Anyway once you've persuaded the user to import a .reg file as administrator, it's game over. relevant Raymond Chen https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91531 https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91...
jjice 4y ago
> (It's similar to persuading a Linux user to unpack a tarball over /etc) Would this allow for arbitrary code execution? Curious as a Linux amateur
- blibble 4y ago
  you could put a cron entry by dumping a file into /etc/cron.d/ run any command as any user once a minute
  - JonathonW 4y ago
    Or put something into /etc/profile.d and run at every shell startup, or put something into /etc/ld.so.conf.d and inject code into every process started on the system, or put something into /etc/init.d and run at every boot... (continue ad infinitum) If you let code overwrite the files that make up your system configuration, you're going to have a Bad Time on any OS; this isn't somehow specific to Windows and the registry.
  - entropie 4y ago
    /etc/inittab You could probably replace the executables for the ttys, potentially having a keylogger for every userinput on the terminal?
- mananaysiempre 4y ago
  Sure; the list of startup services is maintained there, for one (in one of a number of ways), but a variety of programs allow the administrator to configure hooks to execute when something happens as well. Then there are lists of variables that are in fact shell scripts, names of users’ configured shells, mount options, kernel modules, ... . Arbitrary code execution immediately (as opposed to after next reboot or at least a service’s configuration being reloaded) seems harder, but I expect it to be possible as well. ETA: Took a couple of minutes, huh. A sibling comment mentions the dynamic linker, which apparently maintains a cache of well-known library locations in /etc. This yields execution as soon as a new dynamically linked executable is started, which probably qualifies as immediate. (More care would be required to avoid breaking the system in the process, though.)
rkagerer 4y ago
I actually miss the .ini files of early DOS / Windows days, with the defacto convention of storing them in their related program directory. They were easy to examine and edit with text tools, and you could do things like diffs. And when you delete the program directory, they go away as well. I used Total Uninstall on a couple Windows 7 workstations for over a decade and really paid attention to curating my registry against bloat. Almost every software out there leaves waste behind in your registry after you uninstall it. I reported some of the most egregious cases to developers/publishers over the years... a few even got fixed. But the ecosystem is a mess. I'm not sure Microsoft ever realized the importance of hammering on best practices and providing the tooling to make them effortless to follow. Even their internal teams have done some ugly stuff over the years.
- pjmlp 4y ago
  Same here, there was nothing wrong with them. Microsoft has been pushing for xml configuration files alongside applications, but even their own teams don't listen, so here we are.
- KronisLV 4y ago
  > Almost every software out there leaves waste behind in your registry after you uninstall it. I think this is just a design flaw of the implementation itself. Why couldn't every entry have a few more fields under the hood: programsDependingOnThisEntry: [PROGRAM_FOO, PROGRAM_BAR] I know that this might bloat the overall size of it, but in my experience most data structures that aren't a graph of some sort but need to be used by multiple consumers will eventually become full of orphaned data. In this example, references to actual installed programs would make sure that when you have orphaned data it can be removed automatically (or the choice given to you), much like apt might suggest that you have some packages that aren't used by any other piece of software anymore. For informative purposes, maybe also add: entryFirstAdded: 2005.05.15 14:00 entryLastChanged: 2006.11.04 17:35 entryLastRead: 2008.10.13 13:00 The timestamps could optionally assist in figuring out when the values were changed/added/actually used, so you know how important something is. If an entry hasn't been accessed in 5 years of your daily usage or something, quite possibly it isn't awfully important.

bilekas 4y ago

This has been known for a long while. I'm not sure the purpose - probably just for fun, but as an attack vector without 0day in pdf for example, to me at least it wouldn't be too effective. I've always been fascinated thought and been playing around with images with executable inside that could be triggered through the browser that you're on, I have played with a personal chromium build that it 'kind of' happens, but i digress. Interesting article - I just don't see a patch coming for it anytime soon.

marcodiego 4y ago

In my (admittedly biased) view, microsoft sacrificed security in the name of "usability". The problem is with what they considered "usability". It looks like in their view, "easy of use" simply meant "keep it working the way users are used to do". This created many bad habits in windows users: always clicking next, installing software from untrusted sources, hiding extensions of files, need for the user to install drivers after pluging a device, use of administrator rights even for simple tasks, rebooting the computer to make something work, periodic reinstalling the OS to make it faster.... and many other behaviors that are very very strange for people who don't use windows. The other problem it created is that windows users expect things to be like that. Even if something is better they will have difficulty using it if it is different from how windows users are used to. Certainly this helps to keep windows market while making everybody pay a hefty price. I'd bet if it wasn't because of android, ios and smart tv's; because they are different enough from what users think a "computer" is; windows users would expect a port to connect some form of media for software installation on these devices. These habits afflict even power users, developers and administrators. Just consider how long windows lived without a reasonable powerful command line. I was more than once looked down from "windows experts" because for them, using a command line like is commonly done on linux is a "thing of the past". People should learn some windows behaviors are not normal. Your computer shouldn't get slower over time, installing software from untrusted sources is not normal, an extension is part of the name of a file and it should not be hidden, using the computer as administrator should be reserved for administrator tasks only, your desktop area is not /tmp/, drivers belong to the kernel and devices should work as soon as they are plugged in, the command line is not a thing of the past... We are all paying the price for not killing these myths.

inetknght 4y ago
> We are all paying the price for not killing these myths. I can't tell you how many times I've taken on teaching a novice or junior developer and then had to un-teach them all the shit that Windows teaches users.
- marcodiego 4y ago
  There is a funny symptom among windows users when they have a notebook/laptop: they need a mouse. Even when the notebook has a good trackpad, they still need a mouse. I tried to investigate why this happens. What I suspect: windows overuse/abuse clicks. The user must click so many points, they don't care about using the keyboard or shortcuts. Also, AFAIK, only recently windows has support for things like two-finger scroll and right click by tapping with two fingers; most users don't even know this is possible and look surprised when I show them that. They have a need for a mouse. They scroll the text using the scrollbar, they use it even for moving the caret to the above line when writing code! It makes me sad just looking at that.

t00 4y ago

There surely is a better way to launch an exe having access to the registry, even if it is just HKEY_CURRENT_USER. Some directory handler or file handler, GUID for launching an exe when desktop is shown etc. Anyone knows more about alternatives to Run/RunOnce to start an exe? Or maybe, let's leave it for the reader to investigate...

HEI-Points 4y ago

• administrator privileges are required • the main payload doesn't execute until the next reboot still an impressive demo

Mandatum 4y ago

Any company that allows .reg files executed by non-admin users have bigger fish to fry. This method has been used for literally decades.

redbell 4y ago

I admire this type of content where the creator take some concepts we [all] use and understand then combine them in a specific, but a new way, add some tweaks to get some never-seen results. Here is another experience that, as a Windows developer, blows my mind for a while. https://www.youtube.com/watch?v=ExwqNreocpg https://www.youtube.com/watch?v=ExwqNreocpg

Dwedit 4y ago

"RunOnce" isn't even the preferred way to run EXEs with RegEdit. See "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options". That stuff there is very powerful and scary. You can even use this feature to stop the Windows Telemetry from running.