Add support for Microsoft Edge

[adevelopcr]

Can you add support for microsoft edge or tell the functions to hook to sniff before sending ssl requests and after reading ssl requests
Hooking the raw sockets won't give readable text but encrypted

[NytroRST]

Yes, Edge is on my list. However, they use process mitigations so there are problems with the injections/ When I will have some time, I will look into how to bypass it.

[adevelopcr]

could you explain what is process mitigations ?

[NytroRST]

Here are some details: https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-setprocessmitigationpolicy

[adevelopcr]

So edge uses SetProcessMitigationPolicy with ProcessDynamicCodePolicy flag to prevent overwriting the executable code (hooking function by placing jump) is this the problem ?
If it's then there are multiple ways to bypass this

[NytroRST]

It has some mitigations, but I did not check which of them. I know an article about a bypass and I will look into this as soon as possible. If you have any details about bypasses, can you post here the links?

…

________________________________ From: adevelopcr <notifications@github.com> Sent: Sunday, July 8, 2018 8:00:21 PM To: NytroRST/NetRipper Cc: Ionut Popescu; Comment Subject: Re: [NytroRST/NetRipper] Add support for Microsoft Edge (#22) So edge uses SetProcessMitigationPolicy with ProcessDynamicCodePolicy flag to prevent overwriting the executable code (hooking function by placing jump) is this the problem ? If it' then there are multiple ways to bypass this — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FNytroRST%2FNetRipper%2Fissues%2F22%23issuecomment-403301242&data=02%7C01%7C%7Cea7971492db8400a6cb108d5e4f44b44%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666660238304854&sdata=7jASNf1TPOT%2FWW%2F6LbI3Z9s%2BM2gtwXpJOKqcIEubt3U%3D&reserved=0>, or mute the thread<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAMoRQbacrLoucmE0FiTNc3f5jzYmXgjZks5uEjqlgaJpZM4VGjHN&data=02%7C01%7C%7Cea7971492db8400a6cb108d5e4f44b44%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666660238461100&sdata=o3eSttUPHWopxOf%2FbV6ZEk2bxyn%2FwtVvyJvlhBRW2Do%3D&reserved=0>.

[adevelopcr]

After some search (I still don't understand what this mitigation actually prevents) here what I came with :
1 - firstly I think you aren't using manual mapping but hooking via LoadLibrary which will load the dll and edge uses another mitigation which disables loading non signed dlls and edge doesn't prevent dynamic code generation as from here
http://www.sekoia.fr/blog/microsoft-edge-binary-injection-mitigation-overview/
They said that they injected a shellcode successfully into edge . If this is true then my injector should be already suitable for injecting dlls inside edge

If this is false and edge really disables dynamic executable code generation :
2 - from here : https://www.unknowncheats.me/forum/playerunknown-s-battlegrounds/245691-allocating-executable-memory-remote-process-ntallocatevirtualmemory.html
The function sets the flag of the protection inside EPROCESS structure and it can be overwritten with WriteProcessMemory to disable the dynamic code mitigation

3 - you can perform aggressive hooking by hooking CreateProcess in explorer.exe and other running processes to suspend and hook edge on its early launch and before setting the protection flag

4 - you can use the new injection techniques which doesn't require to write executable code in the target

I have no access to a computer now and probably for more than week so I couldn't try my injector to inject into edge

[NytroRST]

Very nice, thanks a lot! I also read some time ago the sekoia article, but I did not know about the other one. I will check what it is possible to do on this topic. It should be possible, as we are already executing code on the target machine. Hopefully, it should be possible from user-mode only...

…

________________________________ From: adevelopcr <notifications@github.com> Sent: 08 July 2018 21:37 To: NytroRST/NetRipper Cc: Ionut Popescu; Comment Subject: Re: [NytroRST/NetRipper] Add support for Microsoft Edge (#22) After some search (I still don't understand what this mitigation actually prevents) here what I came with : 1 - firstly I think you aren't using manual mapping but hooking via LoadLibrary which will load the dll and edge uses another mitigation which disables loading non signed dlls and edge doesn't prevent dynamic code generation as from here http://www.sekoia.fr/blog/microsoft-edge-binary-injection-mitigation-overview/<https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.sekoia.fr%2Fblog%2Fmicrosoft-edge-binary-injection-mitigation-overview%2F&data=02%7C01%7C%7C464f01d41b2a4a90564208d5e501cb19%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666718212614867&sdata=6wGQ69Ltr6dJVCf0KR07C%2Bp5eFR8esCcyoCmXhyzlgI%3D&reserved=0> They said that they injected a shellcode successfully into edge . If this is true then my injector should be already suitable for injecting dlls inside edge If this is false and edge really disables dynamic executable code generation : 2 - from here : https://www.unknowncheats.me/forum/playerunknown-s-battlegrounds/245691-allocating-executable-memory-remote-process-ntallocatevirtualmemory.html<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.unknowncheats.me%2Fforum%2Fplayerunknown-s-battlegrounds%2F245691-allocating-executable-memory-remote-process-ntallocatevirtualmemory.html&data=02%7C01%7C%7C464f01d41b2a4a90564208d5e501cb19%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666718212771120&sdata=xVjm5%2Bhhj5K2SAzppO0DnEecaglz7r1auuLVsCwzu0o%3D&reserved=0> The function sets the flag of the protection inside EPROCESS structure and it can be overwritten with WriteProcessMemory to disable the dynamic code mitigation 3 - you can perform aggressive hooking by hooking CreateProcess in explorer.exe and other running processes to suspend and hook edge on its early launch and before setting the protection flag 5 - you can use the new injection techniques which doesn't require to write executable code in the target I have no access to a computer now and probably for more than week so I couldn't try my injector to inject into edge — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FNytroRST%2FNetRipper%2Fissues%2F22%23issuecomment-403307048&data=02%7C01%7C%7C464f01d41b2a4a90564208d5e501cb19%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666718212771120&sdata=Mo2xIsSVCydYxlDDYaaD9TtCcy%2FgO3%2BlrWkTqCenTUE%3D&reserved=0>, or mute the thread<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAMoRQRhrYhoPij-65NHtKtct3pm3arQdks5uElFMgaJpZM4VGjHN&data=02%7C01%7C%7C464f01d41b2a4a90564208d5e501cb19%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666718212771120&sdata=LyFGUQQ6y5vGF6mr9xITkVHGolyhf3s0wXfaupwmddY%3D&reserved=0>.

[adevelopcr]

Then which function need to be hooked ?
And were you using usual dll injection and not manual mapping ? as I saw that netripper has reflective dll injection

[adevelopcr]

I'm sure now manual mapping will work
See here on rohitab :
http://www.rohitab.com/discuss/topic/42220-injecting-microsoft-edge/

and from this article on microsoft blog :
https://blogs.windows.com/msedgedev/2015/11/17/microsoft-edge-module-code-integrity/
they said that edge is protected from the windows kernel .
If this is true it won't be possible to load unsigned dll into edge without a driver which requires to be signed on 64 systems so signing the dll is easier

[NytroRST]

Usefuk links, thanks a lot! I will look into this and I will let you know.

…

________________________________ From: adevelopcr <notifications@github.com> Sent: Monday, July 9, 2018 12:22:48 AM To: NytroRST/NetRipper Cc: Ionut Popescu; Comment Subject: Re: [NytroRST/NetRipper] Add support for Microsoft Edge (#22) I'm sure now manual mapping will work See here on rohitab : http://www.rohitab.com/discuss/topic/42220-injecting-microsoft-edge/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rohitab.com%2Fdiscuss%2Ftopic%2F42220-injecting-microsoft-edge%2F&data=02%7C01%7C%7Ce9cd8224911a461edd7608d5e518f4b9%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666817694911409&sdata=ZUCID5xpiE3R4yGts7jUHKmy4WMExga7MW9HKCoX3%2FA%3D&reserved=0> and from this article on microsoft blog : https://blogs.windows.com/msedgedev/2015/11/17/microsoft-edge-module-code-integrity/<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fblogs.windows.com%2Fmsedgedev%2F2015%2F11%2F17%2Fmicrosoft-edge-module-code-integrity%2F&data=02%7C01%7C%7Ce9cd8224911a461edd7608d5e518f4b9%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666817694921414&sdata=0kYmXa4xD%2Bx%2B8EvcULtwImN7hAhq3sJnBD54lDkZldM%3D&reserved=0> they said that edge is protected from the windows kernel . If this is true it won't be possible to load unsigned dll into edge without a driver which requires to be signed on 64 systems so signing the dll is easier — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FNytroRST%2FNetRipper%2Fissues%2F22%23issuecomment-403318228&data=02%7C01%7C%7Ce9cd8224911a461edd7608d5e518f4b9%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666817694931425&sdata=NQ%2FHrDMRQzIQreTe9WKqpijlGXIuXCH7WSGVgixqZyw%3D&reserved=0>, or mute the thread<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAMoRQTGltCEvnyBIoEttNC8wTV_8s99oks5uEngogaJpZM4VGjHN&data=02%7C01%7C%7Ce9cd8224911a461edd7608d5e518f4b9%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636666817694941430&sdata=%2BMRdzWYOaj2EaDeaOa0KTTOSsek35aGh5%2FjJZ74T5yw%3D&reserved=0>.

[adevelopcr]

I think you also can make what I called "aggressive hooking" by hooking CreateProcess in explorer.exe and other running apps for one time and the hook will copy itself to every program started by these hooked programs
usually users start most programs including edge with double click so it will be started from explorer.exe

In case of hooking edge only you will compare the name of the process parameter in CreateProcess with edge executable name and once you get it you can use NtSuspendProcess , hook and finally NtResumeProcess or simply start the process with CREATE_SUSPENDED (you hooked CreateProcess) and hook your target functions

what I understood for now is that edge may be using a protection from the kernel against loading unsigned dlls but the protection starts only after setting the mitigation policy with the function mentioned above

I had to search for the techniques used by malwares to bypass this protection and most of them manual mapped the dll but I found one malware which used this method

https://www.proofpoint.com/us/threat-insight/post/Death-Comes-Calling-Thanatos-Alphabot-Trojan-Hits-Market

I think I'll soon create a protector against these attacks even if the attack was applied

The strange thing I noticed is that these attacks exist since long time probably more than 10 years but the browsers companies are only responsible for finding ways to collect more money for them

[NytroRST]

I would not like to invest too much time on this. I will just take a look and if I manage to do something, I will update NetRipper.

Thank you very much for your support, useful info!

[adevelopcr]

I'm looking forward to seeing your update
And I think edge will be using some winapi functions like internet explorer maybe wininet or winhttp or something similar
But also it may be using some c++\cx or c++ winrt interfaces (it's uwp)

[NytroRST]

It might use SslEncryptPacket and SslDecryptPacket, I will check as well.

…

________________________________ From: adevelopcr <notifications@github.com> Sent: Monday, July 9, 2018 7:22:48 PM To: NytroRST/NetRipper Cc: Ionut Popescu; Comment Subject: Re: [NytroRST/NetRipper] Add support for Microsoft Edge (#22) I'm looking forward to seeing your update And I think edge will be using some winapi functions like internet explorer maybe wininet or winhttp or something similar But also it may be using some c++\cx or c++ winrt interfaces (it's uwp) — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FNytroRST%2FNetRipper%2Fissues%2F22%23issuecomment-403537040&data=02%7C01%7C%7C10c52d9bdfe5402d02ee08d5e5b83637%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636667501695134364&sdata=4obvs2EMwYoU6lob%2FZ5SP7ImsFqmWaEbq%2FZBAeECmjA%3D&reserved=0>, or mute the thread<https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAMoRQRa7__PljiE1vB-qiPbYPQ939c53ks5uE4NYgaJpZM4VGjHN&data=02%7C01%7C%7C10c52d9bdfe5402d02ee08d5e5b83637%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636667501695134364&sdata=HQ%2FC6Lglx%2FIeSCHeIe1QSYn0kPv%2BZvaAdu29Wjg9%2F4s%3D&reserved=0>.