Bruce Dang
Secure Windows Initiative (SWI)
Microsoft

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft1

 Introduction
 Oﬃce binary ﬁle format (<= 2003)
 Bugs Defensive mechanisms
 Exploit structures Analysis techniques Detection mechanisms
 The surprise…
 Patch process (end‐to‐end)
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft2

 Targeted attacks
 Very popular in the last couple years
 Bypasses perimeter security devices/software Diﬃcult to detect No technical information in the public There are things you can do to mitigate andstop most of the attacks.

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft3

 Structured Storage / OLE SS
 File system inside a binary ﬁle Divide data into storage and streams (storage =directory, stream = ﬁle)
 12‐page speciﬁcation

 Application‐speciﬁc data stored insidestorage/streams.
 Can be frustrating to parse manually
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft4

 StgOpenStorage() on the ﬁle. You get backan IStorage object.
 IStorage‐>EnumElements() enumerates all ofthe storages and streams.
 IStorage‐>OpenStream() opens up whateverstream you want. Returns an IStream object.
 IStream‐>Stat() tells you the stream size.
 IStream‐>Read() reads n bytes from thestream.
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft5

HRESULT hr;
IStorage *is;IStream *stream;
IEnumSTATSTG *penum;
STATSTG statstg;
StgOpenStorage(L“foo.ppt", NULL, STGM_DIRECT |STGM_READ | STGM_SHARE_EXCLUSIVE, NULL, 0, &is);is->EnumElements(NULL, NULL, NULL, &penum);
hr = penum->Next(1, &statstg, 0);
while( hr == S_OK) {wprintf(L"name = %s\tsize = 0x%08x\n”,statstg.pwcsName, statstg.cbSize);...
is->OpenStream(statstg.pwcsName, NULL, STGM_READ |STGM_SHARE_EXCLUSIVE, 0, &stream);
stream->Read(data, statstg.cbSize, NULL);... parse data ...
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft6

 A bit simpler. Good for experiments.
from pythoncom import *ostore = StgOpenStorage(sys.argv[1], None, 0x10, None, 0)
estat = ostore.EnumElements()
str = estat.Next()
while str != ():if str[0][0] == "PowerPoint Document":
len = str[0][2]str = estat.Next()
ostream = ostore.OpenStream("PowerPoint Document", None,0x10, 0)
data = ostream.Read(len)...parse data...

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft7

 Stores data in the “PowerPoint Document”

stream. OpenStream(L“PowerPoint Document”, ...)
 Two types of PowerPoint data structures Container – a “directory”▪ Contains other container or atoms.
 Atom – a “ﬁle”

 Records follow TLV style MSO objects follow the same format
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft8

 1 struct to rule them all
typedef struct{uint2 recVer:4;
uint2 recInstance:12;
uint2 recType;uint4 recLen;} PPTRHDR_t; If recVer = 0xF, then the record is a container;

else, it is an atom
 recType refers to the record type. There are ~ 100of these in PowerPoint. You can look them up theﬁle format speciﬁcation.
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft9typedef struct{uint2 recVer:4;
uint2 recInstance:12;
uint2 recType;uint4 recLen;} PPTRHDR_t;

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft10

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft11

*Data from the stream*
Document container

Document atom
Environment container
1 slide container per slide
Slide container
Slide container
UserEditAtom atom (usually last)
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft12 Data is stored inside the “Workbook” stream
 No containers/atoms. Just plain BIFF records.
 BIFF records also follow TLV format
 Record data has an upper bound of ~ 2000‐

8000 bytes (BIFF version dependent). Iflonger, use a CONTINUE record
 Data inside the “Workbook” stream isorganized like: BOF <data> EOF BOF <data>
EOF BOF <data> EOF …
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft13

 Nothing out of the ordinary: integer

over/underﬂow, oﬀ‐by‐one, double free,uninitialized variables, bad pointer reuse,stack/heap overﬂow, …

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft14

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft15

 Use MOICE
 Free It requires Oﬃce 2003
 It only works on OLE structured storage ﬁles
 It uses the Oﬃce 2007 compatibility pack
 It converts your binary ﬁle format to the new XML

format and opens it up

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft16

 Oﬃce 2003 SP3
 Free Result of a major security / SDL push
 If you had Oﬃce 2003 SP3, then you would not be

aﬀected by any of the Oﬃce zero‐days
acknowledged in the public since.

 If you have Oﬃce 2003, install SP3

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft17

 Oﬃce 2003 SP3 and MOICE actuallyeliminates / mitigates most of the Oﬃcevulns.
 Always have the latest patches.

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft18

 Use Oﬃce 2007

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft19

 Not out of the ordinary Basic structure Shellcode Malware Clean document

 Techniques

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft20

 Everything is included inthe document
 There can be variations

 Multiple shellcode stages
 Multiple trojans
 Obfuscation of trojans/doc

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft21

 Techniques Standard GetEIP / PIC
 Custom encoders
 PEB retrieval
 File handle bruteforce
 Application relaunch

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft22

 Why ﬁle handle bruteforce?
 Exploit must ﬁnd itself in memory (this is not thesame as GetEIP)
 Exploit cannot simply scan the entire processaddress space looking for itself (speed) Very easy/short implementation in assembly. It’s
literally:
int fh;for (fh=0; fh < 65536; fh += 4){if (GetFileSize(fh, NULL) == mysize) return fh;}

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft23

 What it does (there can be variations) Shellcode decodes itself and runs
 Builds up a list of function pointers Finds itself in memory (ﬁle handle)
 Read data from speciﬁc locations in the ﬁle Extract the trojan and the clean document
 Run the trojan and relaunch the app to open the newﬁle Exit the current process SetFilePointer, ReadFile, WriteFile, CloseFile,WinExec, ExitProcess.

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft24

 Tools
 Hexeditor
 Disassembler
 Optional: Debugger (WinDBG is suﬃcient) Objectives
 Identify the shellcode
 Understand it Extract the malicious components
 [Identify the exact vuln]
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft25

 How many do you recognize?
 EB 10 5B 4B 33 C9 66 B9 96 03 80

34 0B FD E2 FA EB 05 E8 EB FF FFFF
 64 A1 30 00 00 00
 64 8B 1D 30 00 00 00
 D9 74 24 F4

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft26

 Debug DOC/XLS/PPT?
 Static method Decode the shellcode and read it Dynamic method A bit more interesting

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft27

 Method 1
 Identify the shellcode, patch the ﬁrst few bytes to0xCC
 Start up Oﬃce, attach WinDBG to it and ‘g’ Open up the document
 If you did it right, you should hit the int 3 andthen single step as needed. If not then you
probably got infected.
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft28

 Method 2
 Pick an any executable Copy the shellcode and put it in the binary and set

eip there.
 Single step just like any an executable.

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft29

 Method 3
 Save the ﬁle, i.e., “c:\temp\sc.bin”
 Open up notepad.exe, calc.exe, whatever.
 Attach WinDBG to it.
 .dvalloc <size of sc.bin> .readmem c:\temp\sc.bin addr <size of sc.bin> Real shellcode address = <addr + sc oﬀset>
 r eip=<addr + sc oﬀset>;t (not ‘g’)
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft30

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft31

 Method 4 (best one)
 Save the ﬁle as “c:\temp\sc.bin”
 Open the ﬁle in an editor (notepad, vim, …);

anything that opens the ﬁle.
 Attach WinDBG to it.
 .dvalloc <size of sc.bin> .readmem c:\temp\sc.bin addr <size of sc.bin> Real shellcode address = <addr + sc oﬀset>
 r eip=<addr + sc oﬀset>;t (not ‘g’)

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft32

 You need to be able to ﬁngerprint an OLE

structure storage ﬁle D0 CF 11 E0 A1 B1 1A E1

 Get the stream name to determine the ﬁletype (DOC, PPT, XLS) Read the stream content and parse it as we
showed earlier Determine what records are aﬀected anddetect them
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft33

 We released the ﬁle format speciﬁcations forDOC, XLS, PPT, and MSO

 http://www.microsoft.com/interop/docs/OﬃceBinaryFormats.mspx

 Given the information here and thosespeciﬁcations, you can actually write code toparse and check the validity of the records.

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft34

 To write good IDS/AV signatures, you usually

have to understand the vulnerabilities.
 Reverse engineer the patches We will give you the vulnerability details

 MAPP (Microsoft Active Protection Program)

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft35

 Information available at 5pm PST Monday What is included?
 A technical description of the vulnerability A repro ﬁle / packet trace Crash dump / stack trace / disassembly Detection logic

 How to get the data?

9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft36

 My team’s blog (SWI blog):

http://blogs.technet.com/swi
 We talk about vulnerability details there It is written by people who triage the vulnerability Got a bug to report? secure@microsoft.com
 Got interesting Oﬃce samples and wantsome help in triaging them? Send them to us.
 My email: bda@microsoft.com
 0x3f…
9/23/08

Bruce Dang | BDA@microsoft.com | Secure Windows Initiative | Microsoft37