Grinder for Edge on Win10

[pyoor]

Has anyone got a working stub for Edge on Win10?

[hacksysteam]

@pyoor I will be starting to write one now. Let me see how it works out.

[mtowalski]

@hacksysteam I hope that You will succeed :)

[ca0nguyen]

Latest Edge come with new mitigation that prevent inject unsigned DLL. Grinder logger works only with successful dll injection. This is a problem :(.
https://blogs.windows.com/msedgedev/2015/11/17/microsoft-edge-module-code-integrity/

[v-p-b]

Can't you workaround this problem with some leaked code signing certs? (e.g. https://www.duosecurity.com/static/files/DellCertificates.zip)

[hacksysteam]

@v-p-b Nice. But how about self signed certificate and trusting the root CA?

[v-p-b]

@hacksysteam Sounds good! Self-signed might be problematic but registering an internal CA seems like a universal solution.

[ca0nguyen]

I've already tried to add a Root CA and signed the DLL. Windows 10 tells "This digital signature is OK", but still cannot inject to MicrosoftEdgeCP.exe. According to msedgedev blog, Edge uses enforcement in the kernel. Maybe have to look the kernel to see what happening.

[hacksysteam]

@ca0nguyen Quoting from MS Edge blog *"DLLs that are either Microsoft-signed, or WHQL-signed, will be allowed to load, and all others will be blocked." *. I guess we need to dig kernel then.

[ca0nguyen]

@hacksysteam Thanks to point out. I missed that part and took hours to make signtool work. The more challenge now since I don't know much about kernel stuff.

[hacksysteam]

@ca0nguyen Now, that's a good thing. We can now inject grinder_logger in Edge

http://www.sekoia.fr/blog/microsoft-edge-binary-injection-mitigation-overview/

[v-p-b]

@hacksysteam Did you manage to create a PoC for this? If I understand correctly this would require patching LoadLibrary() (with a kernel debugger perhaps?), no configuration option is available, right?

[hacksysteam]

@v-p-b unfortunately no. Currently I'm not fuzzing browsers. But with new mitigations in Edge, it would be hard to run this logger. However, I can not guarantee as I have not tested it.

[jessefmoore]

Can't you workaround this problem with some leaked code signing certs? (e.g. https://www.duosecurity.com/static/files/DellCertificates.zip)

Hi v-p-b, do you have that zip file still? I would like to use them. :-)

[jessefmoore]

DellCertificates.zip

Got it, never mind. https://duo.com/assets/files/DellCertificates.zip