4 ms·

For those of you worried about this, I tested it at work and it was blocked by our Software Restriction Policy that I put in place just a few weeks ago. The ex

For those of you worried about this, I tested it at work and it was blocked by our Software Restriction Policy that I put in place just a few weeks ago. The execution of %TEMP%\PAYLOAD.EXE was blocked. I highly urge everyone to deploy a strong Software Restriction Policy in whitelist mode. It catches everything we've thrown at it so far.

stephengillie 11y ago
I didn't know this was available until now. Another tool for the toolbox!
huhtenberg 11y ago
There's also AppLocker in W7+ : https://msdn.microsoft.com/en-us/library/dd548340%28v=ws.10%29.aspx https://msdn.microsoft.com/en-us/library/dd548340%28v=ws.10%... and I would guess it's very closely related to SRP - https://technet.microsoft.com/en-us/library/ee424371%28v=ws.10%29.aspx https://technet.microsoft.com/en-us/library/ee424371%28v=ws....
gossitd 11y ago
hi, I wrote the advisory. Here's some POC I just published here: http://owned.lab6.com/~gossi/research/public/packager/ http://owned.lab6.com/~gossi/research/public/packager/ The SalesOrder.rtf file is safe to try at work. All it does is lock your workstation. It should work behind Software Restriction Policy and Microsoft AppLocker (and Citrix Application thingy).
- RKearney 11y ago
  The RTF opened a zip folder with a .js file in it. Attempting to open it with the default Windows Based Script Host results in a dialog box from Software Restriction Policy stating that execution was blocked.
reiichiroh 11y ago
Would someone renaming the payload to a filename of something that's whitelisted defeat the whitelist?
- RKearney 11y ago
  It depends how the whitelisting is done. We just have C:\Windows, C:\Program Files, and C:\Program Files (x86) whitelisted. This means that any exe (or scr, bat, vbs, etc), ran from any other location, will not run at all. This of course caused problems with GoToMeeting and Google Chrome (and other programs that install to AppData), but the fix was to track down the msi installer for corporate deployments to have it install to Program Files.

stephengillie 11y ago

I didn't know this was available until now. Another tool for the toolbox!

huhtenberg 11y ago

There's also AppLocker in W7+ : https://msdn.microsoft.com/en-us/library/dd548340%28v=ws.10%29.aspx https://msdn.microsoft.com/en-us/library/dd548340%28v=ws.10%... and I would guess it's very closely related to SRP - https://technet.microsoft.com/en-us/library/ee424371%28v=ws.10%29.aspx https://technet.microsoft.com/en-us/library/ee424371%28v=ws....

gossitd 11y ago

hi, I wrote the advisory. Here's some POC I just published here: http://owned.lab6.com/~gossi/research/public/packager/ http://owned.lab6.com/~gossi/research/public/packager/ The SalesOrder.rtf file is safe to try at work. All it does is lock your workstation. It should work behind Software Restriction Policy and Microsoft AppLocker (and Citrix Application thingy).

RKearney 11y ago
The RTF opened a zip folder with a .js file in it. Attempting to open it with the default Windows Based Script Host results in a dialog box from Software Restriction Policy stating that execution was blocked.

reiichiroh 11y ago

Would someone renaming the payload to a filename of something that's whitelisted defeat the whitelist?

RKearney 11y ago
It depends how the whitelisting is done. We just have C:\Windows, C:\Program Files, and C:\Program Files (x86) whitelisted. This means that any exe (or scr, bat, vbs, etc), ran from any other location, will not run at all. This of course caused problems with GoToMeeting and Google Chrome (and other programs that install to AppData), but the fix was to track down the msi installer for corporate deployments to have it install to Program Files.