uh we have the final presentation of
day one uh and I'll pass you straight
across to Gregor's thoric
thank you very much
as you already know my name is Gregor or
Greg you prefer I used to dig deeper and
deeper into Windows internals this is
what I do because I simply love it I'm
also doing this for work and that
someday
I was asked about
protecting quite huge environment with
applocker so I started to dig deeper and
this session is actually about things I
have found when digging deeper into the
app Locker
very briefly about the agenda so what I
want to tell you what I want to show you
is not only about the cache however this
is the most important and I believe most
interesting part of the session but also
about some other things including some
quick introduction about the applocker
about the idea and so on so when it
comes to a blocker is one of three
Microsoft approaches to application-wide
listing application white listing is a
change the Paradigm of protecting your
PCS because in most cases when we want
to protect our PCS from
malicious applications we are using kind
of blacklisting for example antivirus or
anti-malware software so if the software
knows some executable file is bad or
simply saying unwanted it will not allow
it to run this is the blacklisting
approach but if someone compiles
modifies changes whatever does and
application is obviously malicious but
not recognized by your antivirus it will
be allowed to run because it's not
recognized a white listing changes the
approach to the opposite one so only
allowed applications are allowed to run
only known applications can run within
the environment making the management
quite harder because we have to
whitelist every single application we
expect within the environment at the
same time
improving the protection greatly because
if some new application which we do not
know appears within the environment it
will simply not run so nothing Mal
issues can
uh be launched by malicious or just
unaware user as I said Microsoft had had
three different approaches to the white
listing topic the first one appeared in
the Windows XP it was a SRP software
restriction policies software
restriction policies was enforced by the
Explorer process and the Explorer
process is owned by the user logging
onto the workstation so it effectively
means a user has a full control over the
process trying to control a user making
the solution not that
successful
um one of the best known solution for
disabling SRP software resection
policies was an application called the
GP disabled and the application GP
disabled was written by Mark russinovich
and magically disappeared from the
internet after microsoma with Droid
Microsoft in Windows Vista it was
slightly changed because in Windows
Vista if you dig deeper to newer version
of Windows you will see something under
registry keys and so on called SRP
version 2. from the marketing
perspective from the official
documentation perspective SRP version 2
is a blocker a blocker consists of
couple of components I will cover them
briefly in a moment
in the meantime I will mention the third
approach Microsoft made it is wdac
Windows Defender application control
relies on the deepest level of the
protection I would say including
hardware-based protection against
malicious applications and
Microsoft is trying to support in
parallel applocker and wdac for some
scenarios applocker is better for
example a blocker is user aware which
means I can allow some stuff to be run
by a special group members and do not
allow the same stuff to run if the user
does not
belong to this group for WDC it is
absolutely impossible if something is
not while listed it will never run on
this particular machine there are some
tables comparing side to side on
Microsoft website those two solutions so
you can easily compare them and find
which one is better for you in my
opinion WDC is way harder to be managed
wdac
provides stricter protection I would use
WDC for some devices not being actively
changed over time or at least not so
often for example like ATM kiosks etc
etc some point of sale sales Windows
devices Etc when it comes to applocker
we have couple of components within the
solution to briefly end with the theory
so we have nice graphical user interface
for the management and we have
Powershell command let's
um the thing being created within the
um
[Music]
a blocker management is translated to a
kind of a database which is in turn
translated by a special Windows Service
app ibsbc to the version being
acceptable by the kernel driver and the
kernel driver is responsible for
enforcing application or existing so as
it is Kernel component it cannot be
easily manipulated by a user not having
administrative permissions of course if
we have administrative permissions for
any of those Solutions we can
simply if not bypass them we can disable
them because it is what is allowed for
administrators so it will not protect
you from
someone being already an administrator
maybe it will protect from a stupid
administrator doing
things which shouldn't be done but at
the same time if an admin wants to
disable protection it has such
possibility for SRP for app ID I mean a
blocker and for wdac
if you do not trust your admin I'm
always saying it means you should look
at different operating system not on the
Windows one because Windows itself
cannot effectively defend from someone
being already an app
okay
how we can write this application how we
can show uh how we can tell to the
solution something is allowed and
something is not allowed in applocker I
will demonstrate it in a moment we have
three ways of doing this the first one
is to specify a path to a file so if
something has a particular path C
program file something something.exe it
means it is allowed if the perfect
different this rule does not match and
other rule must allow us to run this
particular piece of software if you want
it
running another approach path is quite
simple but at the same time if someone
can manipulate the drive replacing the
legitimate executable file with
something something malicious it is
malicious Pizza software will be will be
allowed to run because path matches the
row and the second approach is based on
hashes so the hash of executable file is
being calculated and if hash matches
then application is allowed to run if
hash does not match application is not
allowed to run
this way is definitely the most secure
one because every single bit changed
within the
executable file will mean this
application is not allowed to run
anymore but at the same time a
management will be a nightmare because
try to imagine what will happen after
patches after patching Tuesday if half
of your executable files change so their
hashes changed as well and you have to
calculate new hashes and update your
white listing solution to to reflect
those changes the third one one relies
on digital signatures okay let's go for
some
real thing so I will launch the
management it is done through local
security policies or through group
policies here you can see the console
within the console I have predefined
rules I have a blocker up and running
here with the service running and so on
so it is ready to go
um
I'm using two default Rules by default
we have three rows I which bigger it is
not by default but if we do not have
rules we can create default rules and
we'll have three rules the third one is
about allow everything uh for
administrators and those two left here
is allow everything it if it is within
the program files and allow everything
if it is the windows folder it is not
perfect but at the same time is quite
good because only administrators are
able to drop a file into those folders
in most cases when it comes to rules we
can have rules for executable files we
can have rules for installer not that
practical for script not practical at
all and for packaged up roles not
practical because I never seen a
malicious software distributed as
packaged up within that blocker if I go
for properties on the advanced you can
additionally enable dlls to be monitored
with dlls there's one thing the
landscape of dlls on every single PC is
way more complex and less guarded than
the landscape of dot exe files when it
comes to them
content the type of the file actually
dot xdn.dll is the same it is portable
executable format the only difference is
how we launch this particular type of
file because 4.exe it is enough to
double click on it and for dll there
must be a process loading this dll and
automatically or intentionally call one
of methods being exported from the dll
automatically I mean the special export
from the dll It is Well documented it is
called dll main dll main export is
automatically
launched a run when dll is loaded into
any process so if we create a malicious
dll having dll main function inside if
any process loads this dll this
malicious function will be executed
and our code will execute wheeler so the
only issue with dlls is to host them
somehow with another process we have
couple of legitimate and couple of
unusual ways to mention the legitimate
way we have run dll 32 one of those we
have Rec svr 32 another one calling
submitters from the dll when it comes to
unofficial one of my findings I really
like it
if there is a format utility
let's go for the format
format and within the format parameters
one of those being presented by The
Format utility is a file system being
specified by
um
fs and the file system and you can see
we can specify slash FS column and then
specify a file system it is fat farted
32 NTFS and so on and so on and is it
format that's smart it knows every
single file system format not at all
there are dlls on the drive there
see Windows stem
32 you
dll you can see over here
a couple of dlls like ufat
ux fat untfs
undfs is happening here and so on and so
on what does the format utility do if
you specify a file system it will load
the dll name U plus the file system you
specified and it does not check if such
fight system make any sense or not if
you specify format slash FS column you
test which is not fair system at all
format utility will load utest.dll and
execute the dll main so please protect
yourself from launching dlls as well
even it is way more complex when it
comes to a blocker another solution for
applocker we have to check the stack box
and new entry appears within them
graphical interface
what a blocker can do actually I have
configured it only for executable files
and for each of categories
a blocker can do two things for us the
first one is enforce rules which is that
obvious one so if something does not
match a rule it is not allowed to run
period and and over and the second one
is audit mode audit mode means it allows
to run absolutely everything but there
is an entry within even log telling us
it would be denied if we play seriously
which is great for polishing your rules
before you start enforcing them because
it's one of the main pains within the
white listing solution how to do not
break how to do not interrupt your
production your system your your line of
business applications with rules being
too strict so you can create rules
switch everything to audit mode and then
observe your logs if something would be
blocked and if yes it is your decision
should I edit my rules or good to know I
would I would block it anyway here I'm
using audit only to do not block
anything at the same time I have
everything everything logged within the
log as I said applocker is using its
logs so here you have it logs for those
particular entries and I have created a
small view providing me a set of last
entries here so some automatic things
happening on my VM all the time
are reflected over here so I can observe
here you can see some warning probably
something would be blocked and this
small horse from this path would be
blocked for a reason it is not it is
running from my profile and not from
program files or Windows uh so it is not
include within my rules containing only
program file and windows right now okay
so I will launch
um I will create a rule
for an executable file I have created I
have it on the desktop
CLS I created a small application
writing 100 a letters you will see in a
moment why
so this is what my application is doing
not a big deal not very complex I launch
it from the desktop so obviously if I
refresh my log I will see what's allowed
to run but it would be blocked if we
play seriously obviously there is no
rule for this particular file as the
path does not match any of those having
configured here
what I will do right now I will
configure new rule for this particular
executable file and this rule something
is hidden over my taskbarg so I will do
maybe like this next it is for you to
make characters bigger hello everyone
file hash
next I will browse for files I will
specify on the desktop there is right
AAA open
create and new rule appears over here
right now if I go for the same
executable file if I launch it again
um
I will see in my event log F5 there is
an information this particular executive
Tableau file was allowed to run which is
perfectly well
following our ideas and how it should
work in at least in my opinion opinion
okay what I will do right now I will go
for a drive management
I will go with this again I will go for
the drive management I will attach a
vhdx file
dear
temp you can see there is xvhdx file and
I will attach this file this will
simulate the thing I could do having two
laptops like plugging USB drive removing
it plug it to other laptop manipulate it
somehow and plug in it back it is what I
will do with the HDX file so
attach vhdx C temp X
vhdx
okay new Drive appeared here it is the
drive of X and I will copy
the file
copyright IAA into the X drive if I run
it from the X Drive
will be will it be allowed to run it
should be F5
X right IAA was allowed to run because
it hash matches our rule so
what I will do right now I will unplug
my drive
offline or detach vhd even better okay
and I will manipulate it on the lower
level
from the different machine in real world
scenario here I will edit it with a
Binary Editor so I will open my file
Ctrl f
this is the string it is why my
application writes these things to make
it easy to find on the image so this is
the string being written and I will
replace
bunch of my a letters with the X letter
so right now I will save the vhd x file
manipulating the content of the binary
file it is probably what all of the of
us did in the primary school trying to
hack some application to display my main
name is instead of the legitimate name
of the author uh I did exactly the same
with the application I have created so
again Atta ghd
um sorry C temp
X vhdx
and I will run exactly the same X right
IAA
drive and not a big surprise
I can observe a couple of letters within
the executable file were changed but the
question is what a blocker thinks about
this and you can see it is right now 449
it was allowed to run and the question
is why
how it could happen that we created hash
based rule so if anyone changes anything
a bit within this executable file it
will be not allowed to run I have
changed couple of letters so it is
definitely different and it is allowed
to run because of speed and because a
blocker
wants to have it running faster because
some data is being hashed instead of
calculated every single time from
scratch so
um
how I can change verify this I will go
for this console
um when it comes to hashes powerful is
the best one power shell
um get file hash
um write AAA from desktop this is the
hash uh get file hash X right AAA this
is the ones from the
X drive it is significantly different
this is the role of the hash to
visualize this difference particularly
and of course the file is different but
the cache remain the same and the
question is where is the cache and how
it looks like within the app Locker so
if we are within the Powershell get
um
uh blocker
a blocker policy minus local
and I will send it to XML
and to XML
and then policy for a blocker is
allowing me to file hash SWAT 256 and
you can see the hash starting from 6e38
AF which is none of those
what happens here
actually a blocker lies because even if
it says schwa256
this hash is not sure 256 at all
it is a blocker hash and Microsoft
nowhere documents how it is calculated
uh there is one thing here because it
Microsoft does not document how the hash
is calculated but in the totally
different areas of Microsoft
documentation Microsoft explained as
so-called authentic code hash
used for digitally signed executable
files there is a special algorithm
hashing only special part of the
executable files to make it faster
and those hashes match
so we can guess it is authentic code
hash even if Microsoft does not really
say so
um so
we have a pretty amazing by the way I
discovered it when I tried to
pre-calculate hashes of like 100 of
files and then drop into them to this
those pre-calculated hashes into their
blocker and none of those hashes worked
why I freshly calculated them verified
and it works and then I try to do this
by importing a file through a blocker
Wizard and I realized that this hash is
totally different anyway
this is how the cache is being
calculated in practice it is using a
blocker out in the code hash if you
really want to use schwa256 it is yet
another totally undocumented thing I do
not recommend rely on it instead of
schwa256 you can specify an algorithm
schwa256 flat
documented nowhere but if you use it
then real SWAT 256 can be used and it
will work okay by the way if I have this
command handy I will out file I will
save it to a file
um
xml.com
okay so I have this I'll handle just for
the future okay
let's move two steps back I have changed
the content of the file and it still
runs because applocker believes it is
the original one so at the first run
before I detach the drive hash was
somehow
cached and after the manipulation no one
realized the content changed and the
hash remained the original and the
applocker relies on the half on the
cache I will mess them talking to you
too
quickly okay anyway how we can display
um
or play with those hashes
CLS we can
after some digging I have realized that
the cache of hashes is being stored
within NTFS extended attributes if you
know the idea of alternate data stream
this one will be very similar
extended attribute is like alternate
data stream on steroids
FSU till file there is a query a command
within built-in FS util utility FS util
file query
query a a query extended attribute let's
say for the right IA from the desktop
and you can see some data
here you have the information and we
have to Extended attributes this is a
name of the first one and its content
this is the name of the second one and
the content is slightly bigger and those
are identified by aid1 and Aid 3.
here we have a thing this one is
documented because the name starts with
dollar kernel dot Purge what does it
mean in practice
if an extended attribute name starts
with the dollar kernel it is allowed to
be created only by the windows kernel
this is kind of the protection as I said
this one is documented
so I cannot create such attribute there
is no easy way of manipulating the
attribute but I can read the attribute
delete the old one and recreate a new
one if I want to play with them anyway I
cannot manipulate the dollar kernel
attributes because I can delete them I
can manipulate them I can read them but
I cannot recreate a new one so it will
simply not work the second part of the
name dot Purge is even more interesting
and it is again documented
um if dollar perch is present within
extended attribute name the ntfs.driver
within the kernel must remove this
attribute totally if any change within
the file content happens so if I open my
executable file
directly from the file system with
Binary Editor if I change it those
extended attributes disappear because
the content is changed and they
disappear if I reach under the NTFS
driver which I did by detaching the
drive and the manipulating content no
one was informed please invalidate the
cache so here you can see
um
6e38 AF and so on as a
content of the cache by the way it is
exactly the hash being uh
present within the applocker role even
if you do not remember it I have it in
the text file you can rewind the
recording if you want if I do the same
for the X Drive
um
X backslash the content is exactly the
same here 6838 and so on the cached
value is the same and a blocker relies
on this cached value
um
by the way
there is one interesting thing because
it would be good to know if a file is
allowed to run or not really within the
Powershell
Powershell we have a test
applocker policy commandlet
one of the parameters is XML policy
another one is a path for the file here
I do not have to use path directly XML
policy
um I save the police on the drive so it
was
xml.txt and the path
I have to specify the
file to be tested if it is allowed to
run if I specify right IAA I will see an
information there is a rule named Rye
AAA which makes the file allowed to be
run if I do the same
within the Powershell testing how
a blocker will evaluate the X Drive
you'll see it will be denied
yet another applocker Beauty
because a blocker itself the engine of
that blocker relies on the cache
and the test applocker policy tool
relies on the real content of the file
why do not make it this way it is well
you know Microsoft very well I built
um okay so Tesla blocker and policy
doesn't have to tell you truth because
cache may tell something different and
the test commandlet does not rely on the
cache and the kernel driver relies on
the cache
and
um another thing because what did uh we
did over here we manipulated the content
of the binary file under the NTFS driver
which has some potential obviously when
it comes to malicious action but it's
not that great thing because you cannot
plant your malicious file on the
um
removable drive and then create the
cache so I will go this path I will copy
copy
um
maybe not from Powershell exit I will
return to my irregular unprivileged
console see less I will hide this one
because now it starts to be quite messy
copy I have a special application which
is obviously not quite listed
um for owning the system into the X
drive and I will detach the X Drive
let's detach it
I will display
my rules by opening the XML txt file
this is the file I have created a moment
ago format War wrap here you can see
that
hash and within the file
I have
again
Ctrl c i detach the drive it was too
fast because now I cannot plant the hash
attach vhd AC temp x v h d x
um okay it is attached so right now dear
X I have this file obviously this file
has absolutely no extended attributes
which I could we prove FSU till file a
query a a x pwn and it has no extended
attributes because it was not launched
so far so cached cached hashes were not
calculated stored and so on it will
happen at the first use and right now I
will plunk a cache
over it
um so there is a tool I'm sharing with
my GitHub
um
and it is on my desktop so it is setup
Locker hash cache you have to specify
file name and the hash so it is X um
pwn and a hash within my clipboard all
the time again can I create dollar
caramel not at all it is not allowed for
me but I can create an extended
attribute called hash kernel which is
allowed because why not
so right now I will do the same magic
but on different level and I will open a
Binary Editor
my Binary Editor is still here
reopen X the HDX control error like for
replace dollar kernel
Port
let's use uppercase
again not dollar but hash dollar kernel
like this replace all
it happened
so right now it is named according to
applocker expectation if I attach my
vhdx drive again attach vhd C temp X
vhdx it reappeared right now if I
display extended attributes here you can
see there is a perfectly legit extended
attribute so xpwn
will launch and when I look into the log
not a big surprise it was allowed to run
as the engine of the apocal relied on
the cache I have planted Within
the previous steps
is it dangerous in practice
when it comes to manipulating attaching
the touching files not that much there
is one trick attaching and detaching
files virtual drives requires privileges
allowing to you to be an admin anyway
but when it comes to the physical Drive
being plugged and unplugged yes it may
be dangerous in practice we are not
meeting
um
typical hash based rules so often but it
may happen and we can just read the rule
set and then plan the hash information
and then manipulate the content but it
works exactly the same way for digital
signatures because if you remember the
previous output here for the pwn this is
the entry I have planted for the right
IAA we have slightly more like this this
is with aib tree identifier also for app
ID
aid3 and the signer info signering for
this as a hint if the file is digitally
signed the information about the signer
is cached exactly the same way so very
common rule we have in our applocker
deployments let's allow everything if
it's from Microsoft
again if you are able to plant such ntf
NTFS extended attribute on a
non-microsoft file it will be allowed to
run because applockers allows us to run
everything being signed by Microsoft and
reading it from the extended attributes
couple of bytes a couple of hundreds of
bytes is way faster than reading the
full content of the file hashing it
comparing it to the well verifying its
certificate that the signing if sign
matches verifying if the certificate is
not expired and so on and so on every
single launching of application would be
I'm consuming right now is about reading
its own cache and relying in on own
cache not really believing it is
possible to manipulate it
uh by the way I will not show you you
can try it on your own if you are using
WDC wdac has such cache
hashes cached a quite similar way there
is one big difference when it's come to
WDC the first one within the wdac policy
we can specify one Very Special Value
please invalidate all extended
attributes at reboot
so all caches will be wiped when your
computer restarts another
Improvement within the WDC is
cached hashes
are
used only from the system Drive
and not from the removable drive so we
cannot attack removable drive for WDC
using this way but at the same time we
can use it for a blocker yet again a
thing to consider when you try to Pick
Your
solution to be to be used within your
environment because sometimes it may be
a risk worth considering
so
to make it faster Microsoft decided to
Cache some valuable data and every
single time we have a cache involved
somewhere into the process there is a
possibility of doing two things to
changes things without updating cash or
to plan the cash entry to falsify a
cached entry for some thing and we can
try to manipulate a blocker this way I
will return to my slide desk it is very
complex slide desk as you can see like
literally two slides shift F5
like this here you can see couple of
links the first two are guiding you to
the
um to my GitHub where I publish
executable files and
um source code I write in C mainly for
tools I have presented
um I'm providing a short write-up this
is the third link and I also trying to
demonstrate the full path at this
partiality it is less complex than
today's session but still you can follow
the idea reaching the quick video I I'm
referring this QR code is actually
guiding you to
four lines HTML page containing those
links if if you prefer this way that's
so that's basically it thank you very
much and hopefully see you soon again
do we have any questions for
Greg after his presentation
okay you see the information if you need
more is there so
so just a moment I'll bring you the mic
I will try to repeat the question but
first I have to hear it
probably someone from upstairs and going
downstairs right now sorry anyway I'm
not running away so if you're upstairs
just please it would be great to hear
the question anyway and answer if I know
the answer
over there
anyway I'm not running if you go to my
GitHub you will find kind of a way of
contacting me feel free to ask me to
reach me I can see one hands up on the
on the left side of the room
a real person not just a voice
um you mentioned that uh
mounting vhd X Files requires elevated
privileges what about the iso fires
because ISO fires can be opened by users
yep but ISO files cannot have NTFS file
system those are cdfs and cdfs does not
have extended attributes so it does not
affect ISO files okay thank you
foreign
from upstairs no uh anybody else with a
with a question
no in which case thank you again thank
you uh very much