OpenRCE: Blog

New Shell Extension CLSID Black List

Fri, 14 Apr 2006 01:57:24 -0500

There's a new reg key to black list CLSIDs for Shell Extensions from the latest MS patch set(MS06-015).

Here's a bit of detail on the keys for Shell Extensions (http://support.microsoft.com/kb/216384/EN-US/):
HKLM:Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved is the CLSID list of Shell Extensions that are approved to run.

This is compared against when 'EnforceShellExtensionSecurity' is set to 1 in HKLM:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer.  Nothing new there, that's existing functionality.

However, with MS06-015, there's a new key: HKLM:Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked that also gets referenced from ShouldLoadShellExt.

The *blocked list* is checked before the *allowed list*, so anything that is blocked will not run, whether or not it's in the *allowed list*.

So, following MS06-015, you can make sure hosts will not run Shell Extensions by adding their CLSID to the *blocked list*.

Obviously this couldn't be put in the workaround for this patch, but for future Shell Extension vulnerabilities, this is definatley a workaround.

This new key was found while reversing MS06-015 for XP.

~Andre Protas

script contribution

Mon, 27 Mar 2006 02:45:53 -0600

just a simple timesaver, but pysym.py will auto-load (once re-supported by idapython) symbols/debug from ms's symbol servers.
https://www.openrce.org/repositories/browse/randori82

blackhat europe slides

Wed, 22 Mar 2006 17:40:17 -0600

Thanks for coming (those of you that did) to the presentation. The little feedback that we have heard was quite positive.

For those of you interested, here are the slides:
http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Manzuik.pdf

The free diffing tool should be available soon, as it's undergoing some batch mode analysis for qa testing.