One Day SecOne Day Sec

Penetration Techniques - Backdoor Exploitation of Junction Folders and Library Files

Onedaysec
4 min read
1 views
docx image 1770019761917 0 5b572722a2

0x00 Preface

---

The CIA Vault 7 documents released by WikiLeaks involve the exploitation of Junction Folders and Library Files in Windows systems

Links are as follows:

https://wikileaks.org/ciav7p1/cms/page_13763381.html

https://wikileaks.org/ciav7p1/cms/page_13763373.html

Jayden Zheng analyzed this, sharing a backdoor exploitation method for Library Files, and detailed how to detect malicious use of Junction Folders and Library Files

Links are as follows:

https://www.countercept.com/blog/hunting-for-junction-folder-persistence/

https://www.countercept.com/blog/abusing-windows-library-files-for-persistence/

Based on the above references, this article will compare Junction Folders and Library Files, further exploit the backdoor method of Library Files (more covert), open-source a POC, and share insights on detection

0x01 Introduction

---

This article will cover the following:

  • Methods of Utilizing Junction Folders
  • Methods of Utilizing Library Files
  • Further Exploitation of Library Files Backdoors
  • Detection and Identification

0x02 Methods of Utilizing Junction Folders

---

Junction Folders can be simply understood as folders that can jump to another location

Three common methods of creation:

  • Modifying registry entries
  • Modifying desktop.ini within the folder
  • Using special filenames, such as test.{ED7BA470-8E54-465E-825C-99712043E01C}

For the third method, specific CLSIDs correspond to specific file paths

If we create a CLSID via the registry and specify a DLL path, that DLL will be loaded when opening the folder

1、Practical Testing

Test DLL executes calculator, reference download link:

An open-source project

(1) Modify the registry and add a registry entry

The bat command is as follows:

SET KEY=HKEY_CURRENT_USER\Software\Classes\CLSID\{11111111-1111-1111-1111-111111111111}\InProcServer32
REG.EXE ADD %KEY% /VE /T REG_SZ /D "c:\test\calc.dll" /F
REG.EXE ADD %KEY% /V ThreadingModel /T REG_SZ /D Apartment /F

(2) Create a new folder test.{11111111-1111-1111-1111-111111111111}

(3) Select this folder to load calc.dll

Note:

It will only load once; restarting the explorer.exe process can trigger it again

2. Implementation method for automatic system startup loading (user permissions)

(1) Rename system folders

Rename %appdata%\Microsoft\Windows\Start Menu\Programs\Accessories to Accessories.{11111111-1111-1111-1111-111111111111}

(2) Create a new folder

Save the folder test.{11111111-1111-1111-1111-111111111111} in any of the following locations:

  • %appdata%\Microsoft\Windows\Start Menu\Programs\
  • Subdirectories of %appdata%\Microsoft\Windows\Start Menu\Programs\

0x03 Exploitation Methods for Library Files

---

File extension is library-ms, located at %appdata%\Microsoft\Windows\Libraries

Official documentation:

https://docs.microsoft.com/en-us/windows/client-management/windows-libraries

Simple understanding of Library Files:

Can display contents from multiple folders simultaneously

1. Practical testing:

(1) Modify the registry, add registry entries

Batch command as follows:

SET KEY=HKEY_CURRENT_USER\Software\Classes\CLSID\{11111111-1111-1111-1111-111111111111}\
REG.EXE ADD %KEY%InProcServer32 /VE /T REG_SZ /D "c:\test\calc.dll" /F
REG.EXE ADD %KEY%InProcServer32 /V ThreadingModel /T REG_SZ /D Apartment /F
REG.EXE ADD %KEY%ShellFolder /V Attributes /T REG_DWORD /D 4035969341 /F

Note:

Compared to Junction Folders, Library Files require an additional registry entry to be added.

(2) Modify %appdata%\Microsoft\Windows\Libraries\Documents.library-ms

Add the following content in XML format:


@shell32.dll,-34577
true

shell:::{11111111-1111-1111-1111-111111111111}

(3) Access %appdata%\Microsoft\Windows\Libraries\Documents.library-ms

When opening the file, DLLs will be loaded multiple times; a mutex can be added here to prevent multiple launches. Download link (for demonstration purposes only):

An open-source project

Noteworthy points:

Includes changed from 2 locations to 3 locations

As shown in the figure below

(3) Access %appdata%\Microsoft\Windows\Libraries\Documents.library-ms — technical illustration 1

By examining this location, the loaded CLSID can be discovered, as shown below

(3) Access %appdata%\Microsoft\Windows\Libraries\Documents.library-ms — technical illustration 2

2. Implementation method for system auto-loading at startup (user permissions)

Place the modified Documents.library-ms in any of the following locations:

  • %appdata%\Microsoft\Windows\Start Menu\Programs\
  • Subdirectories of %appdata%\Microsoft\Windows\Start Menu\Programs\

Note:

Music.library-ms and Pictures.library-ms can also be modified, or even custom-created (with specified display icons)

0x04 Further exploitation of Library Files backdoor

---

Regarding the exploitation method of Library Files backdoor, the most obvious characteristic is that the loaded CLSID can be discovered directly from Includes

Here is a solution:

Clear the path and set it to not display

Successfully hide the loaded CLSID, the final effect is as shown in the figure below

0x04 Further exploitation of Library Files backdoor — technical illustration 3

1. Implementation method

According to the XML format, clear the original and add the following code:


@shell32.dll,-34577
false
true

shell:::{11111111-1111-1111-1111-111111111111}

2. POC implemented via PowerShell

After testing, it is not necessary to specify ; a fixed template can be used.

The process is as follows:

  • Modify the registry
  • Release Documents.library-ms in the specified directory

Points to note in script writing:

  1. The output encoding format must be specified as UTF-8; the default UTF-16 (unicode) will cause the library-ms file format to be incorrect.
  2. To pass the variable $clsid into the string, double quotes " must be used for string definition instead of single quotes '

Complete code can be referenced from:

An open-source project

The code implements adding registry entries and creating the file %appdata%\Microsoft\Windows\Libraries\Documents.library-ms, which loads c:\test\calc.dll when the user logs in.

0x05 Detection and Identification

---

Regarding the exploitation methods for Junction Folders and Library Files, the special aspects are:

  • Ordinary user permissions are sufficient
  • The file format is uncommon and highly deceptive

By combining exploitation methods, each step can be inspected:

  1. Check for suspicious DLLs

Payload must be in DLL format

  1. Check for suspicious DLLs under the registry CLSID

Monitor sensitive registry locations HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID and HKEY_CURRENT_USER\Software\Classes\CLSID

  1. For Junction Folders, traverse folders to check if file extensions are associated with suspicious CLSIDs

For Library Files, traverse library-ms files to check if they are associated with suspicious CLSIDs

This can be directly referenced from Jayden Zheng's script:

https://gist.github.com/countercept/6890be67e09ba3daed38fa7aa6298fdf

0x06 Summary

---

This article tested exploitation methods for Junction Folders and Library Files, further explored backdoor exploitation methods for Library Files to enhance stealth, open-sourced a POC, discussed considerations for script writing, and finally shared insights on detection

Related Questions & Answers

What methods can defenders use to detect backdoor exploitation of Junction Folders and Library Files?

Defenders should monitor registry keys `HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID` and `HKEY_CURRENT_USER\Software\Classes\CLSID` for suspicious DLL paths. For Junction Folders, check file extensions for unexpected CLSID associations (e.g., folder names ending with `.{CLSID}`). For Library Files, scan `.library-ms` files for XML elements referencing unfamiliar or suspicious CLSIDs. Automated scripts from researchers like Jayden Zheng (linked in the article) can help. Additionally, pay attention to user‑space persistence mechanisms since both techniques work with standard user privileges. For more on auditing access controls, refer to [Penetration Techniques - Access Control List in Windows](/news/penetration-techniques-access-control-list-in-windows).

How can the Library Files backdoor be made more stealthy to avoid detection?

By default, the `Includes` section in the library-ms XML reveals the malicious CLSID. Attackers can clear the display path and set `isDefaultSaveLocation` to `false`, hiding the CLSID entirely. The manipulated library then appears normal while still loading the DLL when opened. This advanced technique is covered in the article under "Further Exploitation of Library Files Backdoor" and makes detection harder because the CLSID is not visibly listed in the library's properties or Explorer view.

What are Library Files (.library-ms) and how are they abused for backdoor persistence?

Library Files (`.library-ms`) are XML-based Windows files that aggregate content from multiple folders into a single view. Attackers modify them, e.g., `Documents.library-ms` at `%appdata%\Microsoft\Windows\Libraries`, by adding an XML element referencing a CLSID that points to a malicious DLL in the registry. When a user accesses the library (e.g., from the Start Menu or Explorer), the DLL loads. This method is similar to Junction Folders but requires an extra registry key (`ShellFolder\Attributes`). The article at [Penetration Techniques - Backdoor Exploitation of Junction Folders and Library Files](/news/penetration-techniques-backdoor-exploitation-of-junction-folders-and-library-files) explains the setup and how it can be triggered at startup.

How can an attacker use Windows Junction Folders to establish persistence on a system?

An attacker can create a Junction Folder with a special CLSID name (e.g., `test.{1111...}`) and add a registry entry under `HKEY_CURRENT_USER\Software\Classes\CLSID\{CLSID}\InProcServer32` pointing to a malicious DLL. When the folder is opened (e.g., via Explorer), the DLL is loaded. For automatic startup at user logon, the folder can be placed in the Start Menu or its subdirectories. This technique, detailed in the [Penetration Techniques - Backdoor Exploitation of Junction Folders and Library Files](/news/penetration-techniques-backdoor-exploitation-of-junction-folders-and-library-files) article, requires only user privileges and leverages registry and folder manipulation.

Continue Reading