excel (and office apps) kills the citrix (or terminal services) star · 2019-09-03 · excel (and...
TRANSCRIPT
![Page 1: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/1.jpg)
Excel (and Office apps) Kills the Citrix (or
Terminal Services) Star Chema Alonso
(@chemaalonso) [email protected]
![Page 2: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/2.jpg)
Español
![Page 3: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/3.jpg)
I’m disappointed
![Page 4: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/4.jpg)
We want in exchange:
![Page 5: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/5.jpg)
Who?
![Page 6: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/6.jpg)
About • Working at
INFORMATICA64.COM • http://www.informatica64.com
![Page 7: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/7.jpg)
SPAM ALERT
h"p://www.informa/ca64.com/forensicfoca/
![Page 8: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/8.jpg)
What?
![Page 9: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/9.jpg)
Terminal Applications
![Page 10: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/10.jpg)
Kung-Fu Panda Talk
![Page 11: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/11.jpg)
Why?
![Page 12: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/12.jpg)
RDP
![Page 13: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/13.jpg)
Citrix
![Page 14: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/14.jpg)
Using Bing
![Page 15: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/15.jpg)
Goverment Sites
![Page 16: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/16.jpg)
Goverment Sites
![Page 17: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/17.jpg)
Secure?
![Page 18: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/18.jpg)
![Page 19: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/19.jpg)
Verbosity • Conf -files are too verbosity – Internal IP Address – Users & encrypted passwords – Internal Software – Perfect for (A)PTs • 0-day exploits • Evilgrade attacks
![Page 20: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/20.jpg)
Verbosity
9th of April: FOCA PRO Online Seminar in english h"p://www.informa/ca64.com/foca.aspx
Book and get one of the most lovely FOCA PRO 3.1
![Page 21: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/21.jpg)
Sorry, No CLI, No Linux version Yet
Pink, fat… Have you seen
it?
![Page 22: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/22.jpg)
Verbosity • Attacker can: – modify conf files – Generate error messages – Fingerprinting all software • Example: C.A.C.A.
![Page 23: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/23.jpg)
Terminal Services • Remoteapplicationmode – 0 -> Desktop – 1 -> Only App
• What app? – Alternate Shell (RDP < v 6.0) – RempoteApplicationProgram
(RDP v 6.0++)
![Page 24: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/24.jpg)
Terminal Services Error Messages
![Page 25: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/25.jpg)
Computer Assited Citrix Apps
InnitalProgram
![Page 26: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/26.jpg)
Playing the Piano
![Page 27: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/27.jpg)
Playing the Piano • Too many links
– Specially running on Windows 2008
• Too many environment variables – %SystemRoot% – %ProgramFiles% – %SystemDrive%
![Page 28: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/28.jpg)
Window Server 2008 wants to help you!!
(anytime!)
![Page 29: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/29.jpg)
Playing the Piano • Too many shortcuts
– Ctrl + h – Web History – Ctrl + n – New Web Browser – Shift + Left Click – New Web Browser – Ctrl + o – Internet Addres – Ctrl + p – Print – Right Click (Shift + F10) – Save Image As – View Source – F1 – Jump to URL…
![Page 30: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/30.jpg)
Playing the Piano
• Too , Too , Too many shorcuts: – ALT GR+SUPR = CTRL + ALT + SUP – CTRL + F1 = CTRL + ALT + SUP – CTRL + F3 = TASK MANAGER
• Sticky Keys
![Page 31: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/31.jpg)
Easy?
![Page 32: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/32.jpg)
Demo Servers
![Page 33: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/33.jpg)
Paths?
![Page 34: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/34.jpg)
Minimun Exposure Paths
• There are as many paths as pulbished apps • Every app is a path that could
drive to elevate privileges • Complex tools are better
candidates • Excel is a complex tool
![Page 35: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/35.jpg)
Bosses love
EXCEL
![Page 36: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/36.jpg)
VBA
![Page 37: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/37.jpg)
Excel 1:
The power of VBA
![Page 38: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/38.jpg)
Software Restriction Policies
• Too many consoles – Cmd.exe – Windows Management
Instrumentation – PowerShell – Jscript – Cscript.. – ….
![Page 39: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/39.jpg)
Software Restriction Policies
• Forbidden apps – Via hash – Via path
• App Locker – Using Digital Certificates
• ACLs
![Page 40: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/40.jpg)
Software Restriction Policies
• Too many consoles, – (Even frOm other OS) – Reactos….
![Page 41: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/41.jpg)
Excel 2
forbidden Consoles
![Page 42: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/42.jpg)
Security Polices for Excel Macros
1) Disable VBA - Secure but it´s not REAL
Excel 2) Security for macros
- No macros - signed macros - Case by case - All macros
![Page 43: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/43.jpg)
Excel 3
No macros!
![Page 44: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/44.jpg)
![Page 45: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/45.jpg)
Excel 4
Only Signed-macros
![Page 46: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/46.jpg)
Risky?
![Page 47: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/47.jpg)
Start the III World War • Find a bug in a DHS Computer • Trust in your Rogue CA • Generate an attacking URL in the
CRL (attacking China, for example) • Sign an excel file with your rogue
CA • Send a digital ly-signed excel file
to someone relevant!
![Page 48: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/48.jpg)
Something like…
![Page 49: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/49.jpg)
Just kidding
![Page 50: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/50.jpg)
Final demo
![Page 51: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/51.jpg)
Solutions • Re-evaluate your Remote App
connections • No alerts at all in Excel (and all
the rest of apps you publish) • No trusted locations in user-
profiles • No shared remote users • Trust in nobodoy… • Sorry, not even in nobody
![Page 52: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/52.jpg)
How may paths do you have?
• TS Web Access – Hidden means not-removed
![Page 53: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/53.jpg)
Contact information
• Chema Alonso – [email protected] – http://www.elladodelmal.com – @chemaalonso
• http://www.informatica64.com
![Page 54: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/54.jpg)
Special Thanks to • Juan Garrido “Silverhack”
– [email protected] – http://windowstips.wordpress.com
• Didier Stevens – http://blog.didierstevens.com/2010/02/04/cmd-dll/
• Shanit Gupta – http://www.blackhat.com/presentations/bh-usa-08/
Gupta/BH_US_08_Gupta_Got_Citrix_Hack_IT.pdf
• PDP – http://www.blackhat.com/presentations/bh-europe-08/
Petkov/Presentation/bh-eu-08-petkov.pdf
![Page 55: Excel (and Office apps) Kills the Citrix (or Terminal Services) Star · 2019-09-03 · Excel (and Office apps) Kills the Citrix (or Terminal Services) Star Chema Alonso (@chemaalonso)](https://reader033.vdocuments.net/reader033/viewer/2022060300/5f080e197e708231d4201b4f/html5/thumbnails/55.jpg)
?