6 ms·
If this is true then it's a huge mess: - They used a static list of file extensions to blacklist - This hasn't been kept up to date, powershell scripts are au
by orf 11y ago
If this is true then it's a huge mess:
- They used a static list of file extensions to blacklist
- This hasn't been kept up to date, powershell scripts are automatically executed
- There is no way to disable it
- Embedded files are executed within a trusted directory
I'm guessing Microsoft has to tread very lightly when messing with OLE, I bet a lot of legacy software from large Microsoft customers uses it.
- EvanAnderson 11y agoI didn't see anything in that post to give me the feeling that code is being executed automatically. While I would concede that requiring the user to click on something inside the "payload" document isn't a high bar to achieve it is different than automatic code execution upon opening the document.
- gossitd 11y agoIt needs user interaction. POC Samples here: http://owned.lab6.com/~gossi/research/public/packager/ http://owned.lab6.com/~gossi/research/public/packager/ (made by me, safe to try).
- UnoriginalGuy 11y ago> This hasn't been kept up to date, powershell scripts are automatically executed Powershell won't execute AT ALL by default. You have to enable execution. And it certainly won't execute automatically, the user has to click to run.
- r00fus 11y agoLegacy software and installations should be no excuse to be bug compatible to this level for recent versions and patches.