Skip to content
BranchesTags

Repository files navigation

Test004

Persistence via Shell Extensions

Into to Windows Shell

The windows shell is the Graphical User Interface for the Windows Operating System, which includes the following:

  • Desktop
  • Start Menu
  • Taskbar
  • Etc.

Shell Development

"The Windows UI provides users with access to a wide variety of objects necessary to run applications and manage the operating system." 

- Some guy at microsoft

Includes but not limited to:

  • implementing custom file formats
  • implementing control panel items
  • implementing in-process extensions
  • Shell Extensibility (creating a data source)

We will be focusing on shell extensibility ... (Shell Extensions)

Shell Extensibility

Shell Extension Handlers

  • Shell capabilities can be extended with registry entries and .ini files

  • Shell Extension handlers impliment actions a shell can perform

    • example: Drop Handler - Called when an object is dragged over or dropped on a file

Shell Extension Handler Examples (file type association)

  • Shortcut Menu Handler
  • Data Handler
  • Drop Handler
  • Icon Handler
  • Property Sheet Hndler
  • Thumbnail Image Handler
  • Infotip Handler
  • Metadata Handler

Shell Extension Handler Examples (non file type association)

  • Column Handler (XP and earlier)
  • Copy hook handler
  • Drag and Drop handler
  • Icon Overlay Handler
  • Search Handler (XP and earlier)

More on Handlers (Handlers++)

"Many Shell extension handlers are in-process Component Object Model (COM) objects. They must be assigned a GUID and registered as described in Registering Shell Extension Handlers."

- Probably the same dude from microsoft
  • SO... all extensions must implement IUknown interface

Basic COM Primer 1

  • What is COM (Component Object Model)?

    • method for sharing binary code across applications

  • COM creates a binary standard (modules compiled in a specific structure) so that modules can be accessed from any programming language

Basic COM Primer 2

  • Interface?

    • Group of functions called methods
    • Interface names start with I as in IUnknown

  • COClass?

    • Component Object Class: contained in DLL / EXE
    • COClass impliments interfaces
    • COM object is na instance of COClass in memory

  • COM Server?

    • Binary containing one or more coclasses.

  • GUID?

    • Globally Unique Identifier: Unique 128 bit number
    • each interface and coclass has a GUID

Basic COM Primer 3

  • Instances created using CoCreateInstance method
  • Instances released using Release method defined in IUnknown

IUnknown:

  • AddRef() : increment reference count
  • Release() : decrement reference count
  • QueryInterface() : requests interface pointer from COM Object (used when coclass implements more than one interface)

Back to Shell Extensions

  • When X action happens our Y dll gets loaded

  • Handlers included in this project:

    • IconOverlay Handler
    • IconHandler (file specific)
    • Drop Handler
    • Property Sheet Handler (file specific)
    • Thumbnail Image Handler (file specific)
    • Infotip Handler (file specific)
    • Copy Hook Handler
    • Data Handler (file specific)

IconOverlay Handler

  • Interfaces:
    • IUnknown
    • IShellIconOverlayIdentifier
      • GetOverlayInfo: Provides the location of the icon overlay's bitmap.
      • GetPriority: Specifies the priority of an icon overlay.
      • IsMemberOf: Specifies whether an icon overlay should be added to a Shell object's icon.

IconHandler

  • Interfaces:

    • IUnknown
    • IPersistFile
      • GetCurFile: Retrieves the current name of the file associated with the object. If there is no current working file, this method retrieves the default save prompt for the object.
      • IsDirty: Determines whether an object has changed since it was last saved to its current file.
      • Load: Opens the specified file and initializes an object from the file contents.
      • Save: Saves a copy of the object to the specified file.
      • SaveCompleted: Notifies the object that it can write to its file.
    • IExtractIcon
      • Extract: Extracts an icon image from the specified location
      • GetIconLocation: Gets the location and index of an icon.

  • Very thorough tutorial on writing Icon Handlers. Shoutout to Pavel!

Drop Handler

  • Interfaces:
    • IUnknown
    • IPersistFile
      • GetCurFile: Retrieves the current name of the file associated with the object. If there is no current working file, this method retrieves the default save prompt for the object.
      • IsDirty: Determines whether an object has changed since it was last saved to its current file.
      • Load: Opens the specified file and initializes an object from the file contents.
      • Save: Saves a copy of the object to the specified file.
      • SaveCompleted: Notifies the object that it can write to its file.
    • IDropTarget
      • DragEnter: Indicates whether a drop can be accepted, and, if so, the effect of the drop.
      • DragLeave: Removes target feedback and releases the data object.
      • DragOver: Provides target feedback to the user and communicates the drop's effect to the DoDragDrop function so it can communicate the effect of the drop back to the source.
      • Drop: Incorporates the source data into the target window, removes target feedback, and releases the data object.

Property Sheet Handler (file specific)

  • Interfaces:
    • IUnknown
    • IShellExtInit
      • Initialize: Initializes a property sheet extension, shortcut menu extension, or drag-and-drop handler.
    • IShellPropSheetExt
      • AddPages: Adds one or more pages to a property sheet that the Shell displays for a file object. The Shell calls this method for each property sheet handler registered to the file type.
      • ReplacePage: Replaces a page in a property sheet for a Control Panel object.

Thumbnail Image Handler (file specific)

  • Interfaces

Infotip Handler (file specific)

  • Interfaces:
    • IUnknown
    • IQueryInfo:
      • GetInfoFlags: Gets the information flags for an item. This method is not currently used.
      • GetInfoTip: Gets the info tip text for an item.

Copy Hook Handler

  • Interfaces:
    • IUnknown
    • ICopyHook:
      • CopyCallback: Called to approve or deny copy operation

Data Handler (file specific)

  • Interfaces:
    • IUnknown
    • IPersistFile
      • GetCurFile: Retrieves the current name of the file associated with the object. If there is no current working file, this method retrieves the default save prompt for the object.
      • IsDirty: Determines whether an object has changed since it was last saved to its current file.
      • Load: Opens the specified file and initializes an object from the file contents.
      • Save: Saves a copy of the object to the specified file.
      • SaveCompleted: Notifies the object that it can write to its file.
    • IDataObject:
      • 9 methods which I will not include here... click interface link for more details

All About Hijacking

  • Installing all these handlers requires Admin privilges

    • Requires writes to:
      • HKEY_LOCAL_MACHINE (IconOverlay)
      • HKEY_CLASSES_ROOT (Other Handlers such as file type specific)
    • Privileged can be noisy

  • COM Objects vulnerable to COM Hijacking!

    • Since all these extensions require COM, they are vulnerable to COM Hijacking
    • COM hijacking doesn't require admin privs
      • Regestry writes needed for HKEY_CURRENT_USER\Software\Classes\CLSID\
        • add key
        • set dll path
        • set ThreadingModel (apartment)

  • More on COM Hijacking

More References

About

Persistence via Shell Extensions

Resources

Readme
Activity

Stars

64 stars

Watchers

3 watching

Forks

8 forks
Report repository

Releases

Packages

Used by

Contributors

Languages