Active X Exploitation 2023

In this article we will learn about Active X Exploitation.

Introduction to Active X Exploitation:

ActiveX is a framework created by Microsoft to extend the functionality of the Component Object Model (COM) and Object Linking Embedding (OLE) and apply it to content downloaded from networks.

It was first created in 1996 and is mostly used in Windows operating systems; ActiveX clients must run on x86 hardware because ActiveX generally contains compiled code. ActiveX controls are small programs, sometimes called add-ons, that are used to extend the functionality of an application, which in turn improves the overall user experience. ActiveX controls are downloaded from web pages the user accesses and the downloaded files are stored on the user’s hard drive. ActiveX provides better access to the user’s system than other similar technologies such as Java applets.

ActiveX also uses Authenticode technology, which relies on digital certificates. Authenticode is used to prevent the spread of malicious code, creating liability. With Authenticode, you can sign any file extensions like .exe, .ocx, .vbd, .dll, etc.

Similar Technologies

ActiveX is predominantly a Windows technology, ActiveX clients must be running Microsoft Windows or a Windows emulator to function. ActiveX uses native code execution to significantly speed up execution, which is useful for CPU-intensive operations such as graphics rendering.

ActiveX technologies are mostly popular for creating add-ons for web browsers, especially Internet Explorer. ActiveX provides native code execution, which has several advantages. Seeing this, other companies tried to come up with similar technologies. Some of them are:

NPAPI
Native Google client

NPAPI: The Netscape Application Programming Interface is a cross-platform architecture used to create plug-ins for use in web browsers. NPAPI is widely used in Netscape-based browsers such as Mozilla Firefox and also in many others such as Google Chrome, Opera, etc. It is a competing technology to ActiveX. The main difference between the two is that NPAPI is designed to be widely used for web browser plugins, while ActiveX is not limited to just that.

Google Native Client (NaCl): Is a sandboxing technology developed by Google to provide similar functionality to ActiveX. The main difference between the two is that NaCl is intended to be used only to enhance the functionality of a web browser, while ActiveX controls can be used in many Windows-based applications.

Java Applets: A similar technology used to improve the user experience and as you know Java is a platform independent programming language. Whenever a programmer creates a Java applet and runs a compiler, the compiler converts the source code to bytecode. The Java Virtual Machine converts the bytecode into machine code that the processor understands.

ActiveX security flaws

• ActiveX, while useful, has always been plagued by its fair share of security bugs. ActiveX security policies are mostly based on trust. If you trust the author, you can install the control without fear of abuse. Similarly, if you trust Internet Explorer, you can expect it to prevent your computer from being exploited.
• Unfortunately in the real world you can’t trust things, it’s just not viable. Another long-standing problem with ActiveX is that the code it executes is not isolated in any way. It allows 100% native code to run on the client system. Once installed, it can perform literally any action on the system. This is a major security flaw.
• A vulnerability in ActiveX is another security flaw that needs to be highlighted. Buffer overflows and file overwrites are some vulnerabilities that are commonly exploited. Some ActiveX vulnerabilities are available for download on the Internet for a small fee. Proper coding with ActiveX is required to prevent exploitation of vulnerabilities. ActiveX controls can be digitally signed, but this does not guarantee that they will be safe to run.

Detection

ActiveX bugs are not easy to detect, however many tools can be used to audit such controls. Some of them are listed below:

Microsoft OLE/COM Viewer: This is a tool that comes with Microsoft’s Visual Studio C/C++ compilers. They allow you to view OLE/COM objects, their properties, methods, interfaces, etc.

Registry Monitor: Registry Monitor is part of the Sysinternals suite of system tools provided by Microsoft. It allows you to track registry changes, accesses, etc. It allows us to see if some registry value is changing or if a given key is performing some action.

File Monitor: File Monitor is another tool from Sysinternals that allows us to monitor file access on our computer. It allows us to check if the process is trying to modify any directory or file.

TCP View: TCP View is another tool from the Sysinternals suite. It allows you to monitor open TCP/UDP ports and also displays TCP connections made by processes. This can help determine if an ActiveX control is trying to open a port for communication.

WindDbg: Is a kernel-level debugger provided by Microsoft that allows us to debug programs running in kernel mode. It can be used to detect ActiveX-based buffer overflows.

Related article:Ethical Hacking Interview Questions 2023

How ActiveX is used

Attackers use vulnerabilities in ActiveX to compromise systems running Internet Explorer. A sample exploit is explained below.

Note

• RUN>>REGEDIT>>HKCR>>CLSID is used to display the CLSID
• XXXX.XXXXX.1 is the format for program ID Ex ACCClientDocMgr.AccClientDOCMgr.1
• Open com raider is a fuzzing tool. Active fuzzing is a method that provides invalid and random inputs to ActiveX objects in order to record their behavior. Another fuzzing tool used is Dranzer.
• Credit for this exploit goes to Michael Brooks.

Alleviation

There is no surefire method to stop malicious ActiveX controls, but with proper precautions, the damage caused by such controls can be greatly reduced. Some of the following methods can be used to mitigate the effects of malicious ActiveX controls.

Killbits

One popular method of blocking malicious ActiveX controls is to use Killbit. Killbit is a security feature used by ActiveX containers to block specific ActiveX controls. This is done using the class identifier (CLSID). Once an ActiveX container receives a Killbit update, it will never run ActiveX controls that have the Killbit specified.

Killbits are generally distributed to Windows systems through Windows Updates. Killbits are applied by making changes to registry keys. This can be done manually or through Windows Updates.

User awareness

User awareness is the best way to prevent ActiveX abuse. Denying ActiveX controls by default is often a good solution to the problem. However, this may not always be feasible. It’s generally best not to install ActiveX controls from untrusted sources.

Use ActiveX controls only when absolutely necessary.

Login to ActiveX

ActiveX is used by web developers to enhance their web pages with features that may not be possible with plain HTML alone, including animations, multimedia, etc.

But allowing ActiveX code to run in the browser is not safe, which is why IE 7 introduced a system called ActiveX Opt-in. This gives users control over whether or not to run ActiveX controls in the browser, and when the browser encounters an ActiveX control, the following warning is displayed.

The user can then decide whether to run the control or not after verifying the author of the control. Before executing it the user is asked for permission again. The Opt-in feature has been included in all versions of Internet Explorer from 7 onwards.

We can further configure settings for running ActiveX controls from the security panel in Internet Explorer. From here we can disable the execution of ActiveX controls entirely.

SiteLock Template

The Site lock template is a technology devised by Microsoft to design safer ActiveX controls. This allows developers that are using the Windows platform to restrict the domains in which a control can be run. This prevents remote execution of controls.

It can also severely restrict the scripting capabilities of ActiveX controls to prevent them from being repurposed to carry out malicious tasks.

References

• http://www.howtogeek.com/162282/what-activex-controls-are-and-why-theyre-dangerous/
• http://www.wikipedia.org
• http://msdn.microsoft.com/en-us/library/Aa752035.aspx
• http://msdn.microsoft.com/en-us/library/bb250471.aspx
• http://support.microsoft.com/kb/240797
• http://www.microsoft.com/security/pc-security/activex.asp
• https://www.corelan.be/index.php/forum/exploit-writing-win32-browsers-and-activex/activex-vulnerabilities-exploitation/