-
Notifications
You must be signed in to change notification settings - Fork 131
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Grinder for Edge on Win10 #62
Comments
@pyoor I will be starting to write one now. Let me see how it works out. |
@hacksysteam I hope that You will succeed :) |
Latest Edge come with new mitigation that prevent inject unsigned DLL. Grinder logger works only with successful dll injection. This is a problem :(. |
Can't you workaround this problem with some leaked code signing certs? (e.g. https://www.duosecurity.com/static/files/DellCertificates.zip) |
@v-p-b Nice. But how about self signed certificate and trusting the root CA? |
@hacksysteam Sounds good! Self-signed might be problematic but registering an internal CA seems like a universal solution. |
I've already tried to add a Root CA and signed the DLL. Windows 10 tells "This digital signature is OK", but still cannot inject to MicrosoftEdgeCP.exe. According to msedgedev blog, Edge uses enforcement in the kernel. Maybe have to look the kernel to see what happening. |
@ca0nguyen Quoting from MS Edge blog *"DLLs that are either Microsoft-signed, or WHQL-signed, will be allowed to load, and all others will be blocked." *. I guess we need to dig kernel then. |
@hacksysteam Thanks to point out. I missed that part and took hours to make signtool work. The more challenge now since I don't know much about kernel stuff. |
@ca0nguyen Now, that's a good thing. We can now inject grinder_logger in Edge http://www.sekoia.fr/blog/microsoft-edge-binary-injection-mitigation-overview/ |
@hacksysteam Did you manage to create a PoC for this? If I understand correctly this would require patching LoadLibrary() (with a kernel debugger perhaps?), no configuration option is available, right? |
@v-p-b unfortunately no. Currently I'm not fuzzing browsers. But with new mitigations in Edge, it would be hard to run this logger. However, I can not guarantee as I have not tested it. |
Hi v-p-b, do you have that zip file still? I would like to use them. :-) |
Got it, never mind. https://duo.com/assets/files/DellCertificates.zip |
Has anyone got a working stub for Edge on Win10?
The text was updated successfully, but these errors were encountered: