sR6uWE

More documents

Recommendations

Info

IPC: MESSAGE 0X0C1000• Effect of issue 2– Steal arbitrary file if WER server is compromised (“Watson.microsoft.com” bydefault, or enterprise WER server)– Delete arbitrary file (by DWWIN.EXE)• Response from MSRC– “…We’ve completed our investigation on this issue but this doesn't meet ourcurrent bug bar for servicing. We are looking at incorporating this fix as part ofour future security plans …”– Well, see “Microsoft Office 2016” section…Labs.mwrinfosecurity.com | © MWR Labs 40
IPC: MESSAGE 0X0F1000• “Microsoft Help” request– CreateProcessW (""CLVIEW.EXE" "WINWORD" "Word""), or– HlinkNavigateToStringReference (MS Office Developer Help website)• Depends on request fieldsMessage Body for 0x0F1000 RequestSize Field CommentUINT32 ui32ViewID -UINT32 ui32MessageID 0x465 or 0x469LPWSTR lpwData Pointer to wzData, or NullLPWSTR lpwHelpID Pointer to wzHelpID, or NullUINT16 ui16DataSize -WCHAR[0x104] wzData “DEV”, “SHAPESHEET”, or othersUINT16 ui16HelpIDSize -WCHAR[0x104] wzHelpID “NoHelp”, or othersLabs.mwrinfosecurity.com | © MWR Labs 41
Page 1 and 2: UNDERSTANDING THE MICROSOFT OFFICE
Page 3 and 4: Outline• Introduction• Sandbox
Page 5 and 6: INTRODUCTION• Sandboxing 101- Wik
Page 7 and 8: MS OFFICE 2013 PROTECTED-VIEW SANDB
Page 9 and 10: OperatingINTERNALS: ARCHITECTUREBro
Page 11 and 12: INTERNALS: ARCHITECTURE• Elevatio
Page 13 and 14: OperatingINTERNALS: ARCHITECTUREBro
Page 15 and 16: INTERNALS: INITIALIZATIONMSO.sub_00
Page 17 and 18: INTERNALS: INITIALIZATIONLowIntegri
Page 19 and 20: INTERNALS: RESTRICTIONSFile Locatio
Page 21 and 22: INTERNALS: RESTRICTIONS• Capabili
Page 25 and 26: IPC: INTERNAL OBJECTSThreadMgr Obje
Page 27 and 28: IPC: MESSAGE FORMATMessage HeaderMe
Page 29 and 30: IPC: MESSAGE 0X001000• No message
Page 31 and 32: IPC: MESSAGE 0X091000Message Body f
Page 33 and 34: IPC: MESSAGE 0X0C1000• Windows Er
Page 35 and 36: WER ServerIPC: MESSAGE 0X0C1000Wind
Page 37 and 38: IPC: MESSAGE 0X0C1000• Issue 2: D
Page 39: IPC: MESSAGE 0X0C1000• DemoLabs.m
Page 45 and 46: MS OFFICE 2016: SANDBOX INTERNALS
Page 47 and 48: MS OFFICE 2016: IPC 0X161000• New
Page 51 and 52: REFERENCES• Yason, Mark Vincent.

sR6uWE

Create successful ePaper yourself

Delete template?

Save as template?