One Day SecOne Day Sec

Analysis of Windows Backdoor Exploitation Methods in CIA Vault7 RDB

Onedaysec
3 min read
0 views
Analysis of Windows Backdoor Exploitation Methods in CIA Vault7 RDB — One Day Sec default thumbnail

0x00 Preface

---

In the previous article 'CIA Hive Testing Guide – Source Code Acquisition and Brief Analysis', we studied the documents codenamed Vault 8 released by WikiLeaks, providing a brief analysis of the server remote control tool Hive.

This article will continue analyzing the CIA-related materials released by WikiLeaks, introducing the Windows backdoor exploitation methods mentioned in the Remote Development Branch (RDB) of Vault 7.

Material address:

https://wikileaks.org/ciav7p1/cms/page_2621760.html

0x01 Introduction

---

This article will analyze the following backdoor exploitation methods:

  • VBR Persistence
  • Image File Execution Options
  • OCI.DLL Service Persistence
  • Shell Extension Persistence
  • Windows FAX DLL Injection

0x02 VBR Persistence

---

Used to execute backdoors during the Windows system startup process, capable of hooking kernel code

VBR stands for Volume Boot Record (also known as the Partition Boot Record)

The corresponding tool is Stolen Goods 2.0 (not publicly released)

Documentation address for Stolen Goods:

https://wikileaks.org/vault7/document/StolenGoods-2_0-UserGuide/

Features:

  • Can load drivers during the Windows startup process (drivers do not require signatures)
  • Compatible with WinXP (x86), Win7 (x86/x64)

This method is sourced from https://github.com/hzeroo/Carberp

Note:

The source code included in https://github.com/hzeroo/Carberp is worth in-depth study

0x03 Image File Execution Options

---

Redirecting executable programs through registry configuration

Modification method (hijacking notepad.exe):

Registry path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

Create new key notepad.exe

Create new string value, name: notepad.exe, path "C:\windows\system32\calc.exe"

Corresponding cmd command:

reg add "hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\calc.exe" /f

When starting notepad.exe, the actual executed program is "C:\windows\system32\calc.exe"

Note:

Typically, modifying registry at this location will be intercepted by antivirus software

0x04 OCI.DLL Service Persistence

---

Utilizing MSDTC service to load dll for achieving auto-start

A backdoor used by Shadow Force in domain environments, documentation suggests CIA also discovered this method can be used in non-domain environments

I introduced this exploitation method in a previous article, the address is:

https://some-open-source-project/Use-msdtc-to-maintain-persistence/

The method used in my article is to save the dll in C:\Windows\System32\

The method used by the CIA is to save the dll in C:\Windows\System32\wbem\

Both locations are viable; the MSDTC service will search these two locations in sequence upon startup

0x05 Shell Extension Persistence

---

Hijacking the startup process of explorer.exe via COM dll

I have also introduced this approach in a previous article, the address is as follows:

https://some-open-source-project/Use-COM-Object-hijacking-to-maintain-persistence-Hijack-explorer.exe/

Note:

This method has been used by several well-known malware, such as COMRAT, ZeroAccess rootkit, and BBSRAT

0x06 Windows FAX DLL Injection

---

Hijacking Explorer.exe's loading of fxsst.dll through DLL hijacking

Explorer.exe loads c:\Windows\System32\fxsst.dll at startup (service enabled by default for fax services)

Saving payload.dll as c:\Windows\fxsst.dll enables DLL hijacking, hijacking Explorer.exe's loading of fxsst.dll

An earlier publicly disclosed exploitation method, reference link as follows:

https://room362.com/post/2011/2011-06-27-fxsstdll-persistence-the-evil-fax-machine/

0x07 Summary

---

This article analyzes the Windows backdoor exploitation methods mentioned in the Remote Development Branch (RDB) of Vault7, showing that this content draws on publicly disclosed exploitation methods

I have systematically collected publicly disclosed Windows backdoor exploitation methods (including my own disclosed methods), address as follows:

An open-source project

Related Questions & Answers

What is the Windows FAX DLL injection technique and how does it exploit fxsst.dll?

Windows FAX DLL injection exploits the fact that explorer.exe loads `fxsst.dll` from `C:\Windows\System32\` at startup if the fax service is enabled (default). By placing a malicious DLL named `fxsst.dll` in `C:\Windows\`, the system loads the attacker's DLL instead due to DLL search order hijacking. This publicly disclosed technique, referenced in the [Analysis of Windows Backdoor Exploitation Methods in CIA Vault7 RDB](/news/analysis-of-windows-backdoor-exploitation-methods-in-cia-vault7-rdb), provides a simple yet effective persistence method.

How does the Shell Extension persistence method hijack explorer.exe startup via COM DLL?

Shell Extension persistence works by registering a malicious COM DLL as a shell extension, which explorer.exe loads automatically during startup. This technique has been used by malware like COMRAT and ZeroAccess rootkit. The [Analysis of Windows Backdoor Exploitation Methods in CIA Vault7 RDB](/news/analysis-of-windows-backdoor-exploitation-methods-in-cia-vault7-rdb) notes that it hijacks the normal startup process of explorer.exe, providing a stealthy persistence mechanism.

What is OCI.DLL service persistence and how does it achieve auto-start via MSDTC?

OCI.DLL service persistence exploits the Microsoft Distributed Transaction Coordinator (MSDTC) service, which automatically searches specific directories for DLLs upon startup. By placing a malicious DLL in `C:\Windows\System32\` or `C:\Windows\System32\wbem\`, the backdoor loads every time the service starts. This method, used by Shadow Force and documented in the CIA Vault7 RDB analysis, is effective in both domain and non-domain environments. For a related persistence technique using Waitfor.exe, see [Use Waitfor.exe to maintain persistence](/news/use-waitfor-exe-to-maintain-persistence).

How does the Image File Execution Options technique redirect executable programs in Windows?

The Image File Execution Options technique modifies a registry key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` to redirect a target executable (e.g., notepad.exe) to a different program (e.g., calc.exe) by adding a Debugger string value. For example, starting notepad.exe would then execute calc.exe. As noted in the [Analysis of Windows Backdoor Exploitation Methods in CIA Vault7 RDB](/news/analysis-of-windows-backdoor-exploitation-methods-in-cia-vault7-rdb), antivirus software typically intercepts such registry modifications.

What is VBR persistence and how is it used to execute backdoors during Windows startup?

VBR (Volume Boot Record) persistence, as detailed in the [Analysis of Windows Backdoor Exploitation Methods in CIA Vault7 RDB](/news/analysis-of-windows-backdoor-exploitation-methods-in-cia-vault7-rdb), involves hooking kernel code during the Windows startup process to load unsigned drivers. This technique, implemented by the tool Stolen Goods 2.0, is compatible with WinXP (x86) and Win7 (x86/x64) and was derived from the Carberp source code. It allows backdoors to execute before system defenses are fully active.

Continue Reading