Sunday, July 14, 2024

Hackers Use Windows XSS Flaw To Execute Arbitrary Command In MMC Console

Attackers are leveraging a new infection technique called GrimResource that exploits MSC files.

By crafting malicious MSC files, they can achieve full code execution within the context of mmc.exe (Microsoft Management Console) upon a user click. 

It offers several advantages for attackers by bypassing the need for macros (disabled by default) and providing low-security warnings, making it ideal for gaining initial access while evading detection.

The first GrimResource sample was uploaded to VirusTotal in early June, highlighting a potentially emerging threat

Reference to apds.dll redirect in StringTable

A novel attack technique, GrimResource, exploits an unpatched XSS vulnerability in apds.dll to achieve initial access and code execution on Windows systems, where attackers craft malicious MMC files containing references to the vulnerable APDS resource in the StringTable. 

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

Obfuscated VBScript
Obfuscated VBScript

This triggers arbitrary JavaScript execution within the context of mmc.xe, and by abusing DotNetToJScript functionality, attackers further escalate privileges to arbitrary code execution. 

The attack chain uses a transformNode obfuscation technique to circumvent ActiveX security warnings, followed by an obfuscated VBScript that sets the target payload in environment variables. 

A custom.NET loader named PASTALOADER leverages these variables to inject the final payload (e.g., Cobalt Strike) into a newly spawned dllhost.exe process using a combination of DirtyCLR, function unhooking, and indirect syscalls for stealth.  

Payload injected into dllhost.exe
Payload injected into dllhost.exe

An existing detection for suspicious execution via Microsoft Common Console (MSC) files was designed to catch a different technique involving the Console Taskpads attribute. 

It looks for a specific pattern in process creation: a child process spawned by a parent mmc.exe process that launched an MSC file with a wildcard argument but didn’t match known legitimate MMC file locations or whitelisted executables. 

GrimResource detected
GrimResource detected

An attacker can exploit the.NET COM object functionality through a non-standard Windows Script Interpreter (WSH) script engine called DotNetToJScript, which utilizes a trusted process to allocate executable memory (RWX) on behalf of a malicious VBScript or JScript script. 

The detection relies on identifying this abnormal memory allocation pattern along with the call stack involving specific DLLs (mscoree.dll, combase.dll, jscript.dll, vbscript.dll, jscript9.dll, and chakra.dll) that link the.NET process to the WSH script engine. 

Monitoring for suspicious file open events (apds.dll) by mmc.exe can expose attempts to execute scripts through the MMC console. 

apds.dll being invoked in the MSC StringTable
apds.dll being invoked in the MSC StringTable

They can leverage MMC console files (MSC files) to execute malicious scripts by exploiting a vulnerability in APDS (Advanced Protocol Detection Service) to redirect the user to a malicious webpage, which creates a temporary HTML file (redirect.html) in the user’s INetCache folder. 

The Elastic security team can spot this attack by connecting events like the MMC process beginning with an MSC file and creating a redirect.html file.

YARA rules can be used to find the specific features of the malicious MMC console file. 

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles