Cybersecurity Q&A
Browse concise answers derived from our published, source-linked cybersecurity coverage.
How do I integrate a third-party open-source library like SharpWMI into SharpGen?
Copy the library's source code (e.g., SharpWMI) into `SharpGen/Source`, modify the `.csproj` file to add any missing assembly references (e.g., `System.Management`), and adjust the library’s static methods to `public`. Then recompile SharpGen with `dotnet build --configuration Release`. After that, you can call the library’s methods in your SharpGen source files, such as `SharpWMI.Program.LocalWMIQuery(...)`. This technique is similar to how Covenant integrates SharpSploit – see [Covenant Utilization Analysis](/news/covenant-utilization-analysis) for related concepts.
How can I compile a single command or a source file with SharpGen?
To compile a single command, use `dotnet bin/Release/netcoreapp2.1/SharpGen.dll -f example.exe "Console.WriteLine(Mimikatz.LogonPasswords());"`. For a complete source file, use the `--source-file` parameter: `dotnet ... -f example.exe --source-file example.txt`. By default, SharpGen auto-generates a random class name for obfuscation, but you can specify a fixed name with `-c`. Note that Roslyn ensures each compilation produces a different hash. For more details, refer to the [SharpGen Utilization Analysis](/news/sharpgen-utilization-analysis).
What is SharpGen and how does it integrate with other .NET assemblies?
SharpGen is a red team tool that integrates, restructures, and encrypts .NET assemblies using Roslyn dynamic compilation. It pre-packages libraries like SharpSploit and allows calling their functions directly, for example, executing `Mimikatz.LogonPasswords()`. SharpGen also supports integrating other open-source libraries like SharpWMI or custom C# templates by placing source code in the `SharpGen/Source` folder and recompiling the tool. For more details, see the [SharpGen Utilization Analysis](/news/sharpgen-utilization-analysis).
How do I compile the mapi_tool code for different .NET versions?
The `mapi_tool` is written in C# and can be compiled using the .NET `csc.exe` compiler. For .NET 3.5, use: `C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe mapi_tool.cs /r:Microsoft.Office.Interop.Outlook.dll`. For .NET 4.0 or higher, use the path for `v4.0.30319` instead. Ensure the referenced `Microsoft.Office.Interop.Outlook.dll` matches the installed Outlook version; sample DLLs for Office 2010 and 2013 are provided in the repository.
What features are available in the open-source mapi_tool without triggering security prompts?
The `mapi_tool` implements several operations that do not trigger the Outlook security warning: retrieving the count of emails in all folders, obtaining configuration info (CurrentProfileName, ExchangeMailboxServerName, ExchangeMailboxServerVersion), listing emails (subject, receipt time, attachment file names, EntryID) at a specified location, and listing unread emails with the same metadata. For operations that access more sensitive data (like sender, body content, global address list), the tool will show a prompt unless the registry has been modified. Full details are in the [Outlook MAPI Development Guide](/news/outlook-mapi-development-guide).
Why does Outlook show a security warning when my MAPI program runs, and how can I disable it?
The warning "A program is trying to send an e-mail message on your behalf" appears when the antivirus software is inactive or expired. To disable it, modify the registry: set `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\<version>\Outlook\Security\ObjectModelGuard` to `2` (REG_DWORD). For 32-bit Office on 64-bit Windows, use the `Wow6432Node` path. The `<version>` corresponds to the Office version, e.g., 14.0 for Office 2010. This registry change suppresses the prompt for MAPI access.
How can I use Outlook MAPI to read inbox emails in C#?
First, ensure the Outlook client is installed and logged in. Then create a C# console application and reference the `Microsoft.Office.Interop.Outlook.dll` that matches your Outlook version. Use code like `Application app = new Application(); NameSpace ns = app.GetNamespace("MAPI"); MAPIFolder inbox = ns.GetDefaultFolder(OlDefaultFolders.olFolderInbox);` to obtain the inbox and iterate over its `Items` to access `MailItem` properties such as Subject, SenderName, Body, and Attachments. A full example is provided in the [Outlook MAPI Development Guide](/news/outlook-mapi-development-guide).
What is the difference between Outlook MAPI and Exchange Web Services (EWS)?
Outlook MAPI is a set of interfaces used to access resources within the Outlook client, such as reading emails from the local .ost file. In contrast, [Exchange Web Service (EWS) Development Guide](/news/exchange-web-service-ews-development-guide) is designed to access resources directly from the Exchange server. MAPI requires the Outlook client to be installed, while EWS does not depend on a local Outlook installation.
Besides registry enumeration, what other method can list installed programs on a Windows system?
You can enumerate shortcut files using WMI's `Win32_ShortcutFile` class. For example, `wmic PATH Win32_ShortcutFile get name` retrieves all .lnk files. Since most installed programs create shortcuts, this can serve as an alternative or supplementary method to registry enumeration.
What registry keys should I check to get both 32-bit and 64-bit installed programs on a 64-bit system?
On 64-bit systems, 64-bit programs are listed under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall`, while 32-bit programs are under `HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall` due to registry redirection. A complete enumeration must query both locations, as noted in the article's discussion of registry redirection issues.
How can I obtain a complete list of installed programs on a Windows system using PowerShell?
You can enumerate the registry keys under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` (and its 32-bit counterpart `Wow6432Node` on 64-bit systems) using `Get-ItemProperty`. The article provides a PowerShell script that loops through subkeys and retrieves the `DisplayName`. This method covers all programs shown in Programs and Features, regardless of their installer type.
Why can't I get a complete list of installed programs on Windows using WMI's Win32_Product class?
The Win32_Product class only returns programs installed via Microsoft Windows Installer (MSI). Programs like Google Chrome that use other installation methods (e.g., custom installers) are not listed. For a complete list, you need to enumerate the registry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall`, as explained in the article [Penetration Basics - Obtaining the List of Installed Programs on the Current System](/news/penetration-basics-obtaining-the-list-of-installed-programs-on-the-current-system).
How can I use log debugging to analyze the exploitation process for CVE-2022-1040?
You can enable CSC log debugging by running `csc custom debug` and then monitoring the output with `tail -f /log/csc.log`. To disable debugging, run `csc custom debug` again. This helps trace the authentication bypass flow in real time, such as checking why the CAPTCHA validation fails or which OpCodes are being invoked. The technique is described in the [Sophos XG Firewall Authentication Bypass Vulnerability (CVE-2022-1040) Exploitation Analysis](/news/sophos-xg-firewall-authentication-bypass-vulnerability-cve-2022-1040-exploitation-analysis).
What additional security measure was added for WAN and VPN zone logins, and how does it affect exploitation?
Sophos added CAPTCHA verification for administrators logging into the Sophos XG Firewall management page from WAN and VPN zones. The CAPTCHA logic is implemented in `CSRFCheckFilter.class` (the `validateCaptcha()` and `doFilter()` functions) and `CaptchaHelper.class`. This measure can break exploitation chains that try to bypass authentication from untrusted zones, as the original POC returned a redirection to `/webpages/login.jsp` when CAPTCHA was required.
How do I find OpCodes with a response type of 2 in the Sophos XG Firewall database?
The original analysis incorrectly stated the field name; the correct query uses `requesttype = 2` instead of `responsetype`. Run the PostgreSQL command `psql -U pgrouser -d corporate -c "select opcode, mode, requesttype from tblcrevent where requesttype=2;"` to retrieve approximately 160 modes, including OpCodes for sensitive operations like `login`, `download_backup`, and `ccc_login`. This method is outlined in the [Sophos XG Firewall Authentication Bypass Vulnerability (CVE-2022-1040) Exploitation Analysis](/news/sophos-xg-firewall-authentication-bypass-vulnerability-cve-2022-1040-exploitation-analysis).
What is CVE-2022-1040 and how can I restore a vulnerable debugging environment for Sophos XG Firewall?
CVE-2022-1040 is an authentication bypass vulnerability in Sophos XG Firewall. To restore a vulnerable debugging environment locally after automatic updates have patched it, you must remount the filesystem as read-write with `mount -o remount,rw /`, then edit `/usr/share/webconsole/WEB-INF/web.xml` to remove the `RequestCheckFilter` filter that checks for invisible characters in JSON parameters. This is detailed in the [Sophos XG Firewall Authentication Bypass Vulnerability (CVE-2022-1040) Exploitation Analysis](/news/sophos-xg-firewall-authentication-bypass-vulnerability-cve-2022-1040-exploitation-analysis).
How can security researchers systematically find exploitable DLLs for rundll32?
Researchers can use PowerShell scripts like `Get-Exports.ps1` to enumerate all DLLs in `%windir%\system32`, filter for export functions such as `OpenURL`, and check if they invoke `ShellExecute`. The article provides a modified script with error handling, successfully identifying `ieframe.dll` and `shdocvw.dll`. This method helps discover new execution vectors, complementing other techniques like [Loading .Net Programs Using JS](/news/loading-net-programs-using-js).
What types of files can be executed via rundll32's ShellExecute call?
Beyond `.exe` files, `ShellExecute` supports scripts such as `.js`, `.hta`, and `.url` files. For instance, `rundll32.exe url.dll,OpenURL C:\4\calc.hta` launches an HTA that runs `calc.exe`. This expands the attack surface for fileless or script-based attacks, as noted in the [analysis](/news/analysis-of-executing-programs-using-rundll32).
Which other DLLs contain exploitable exported functions similar to OpenURL?
The article identifies `ieframe.dll` and `shdocvw.dll` as having the `OpenURL` export, which executes `.url` files. Additionally, `zipfldr.dll` with `RouteTheCall` can be abused. These were discovered using PowerShell scripts that enumerate DLL exports, as discussed in the original [Analysis of Executing Programs Using rundll32](/news/analysis-of-executing-programs-using-rundll32).
How can rundll32.exe be abused to execute arbitrary programs?
The `rundll32.exe` utility can load DLLs and call their exported functions. The function `OpenURL` in `url.dll` calls `ShellExecute`, allowing the user to control the file parameter. For example, `rundll32.exe url.dll,OpenURL calc.exe` executes Calculator. This technique, detailed in [Analysis of Executing Programs Using rundll32](/news/analysis-of-executing-programs-using-rundll32), is often used for lateral movement and code execution.