Ctrl+K

T1055.015 - ListPlanting

T1055.015 - ListPlanting#

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.

List-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application’s list-view settings are stored within the process’ memory in a SysListView32 control.

ListPlanting (a form of message-passing “shatter attack”) may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process’ memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other Process Injection methods.

Some variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function. For example, an adversary can use the PostMessage and/or SendMessage API functions to send LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.(Citation: ESET InvisiMole June 2020)

Finally, the payload is triggered by sending the LVM_SORTITEMS message to the SysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems callback.

Atomic Tests#

Atomic Test #1 - Process injection ListPlanting#

This test injects shellcode into a remote RegEdit process using the ListPlanting technique. ListPlanting exploits Window with ListView control. Code write to memory with NtWriteVirtualMemory. The shellcode is executed via PostMessage. When successful, a message box will appear with the title “Warning” and the content “Atomic Red Team” after a few seconds. Notepad will open following the appearance of the message box. Supported Platforms: windows

Elevation Required (e.g. root or admin)

Dependencies: Run with powershell!#

Description: Injector ListPlanting.exe must exist at specified location (#{exe_binary})#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\T1055.015\bin\ListPlanting.exe") {exit 0} else {exit 1}
Get Prereq Commands:#
New-Item -Type Directory (split-path "PathToAtomicsFolder\T1055.015\bin\ListPlanting.exe") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1055.015/bin/ListPlanting.exe" -OutFile "PathToAtomicsFolder\T1055.015\bin\ListPlanting.exe"

Invoke-AtomicTest T1055.015 -TestNumbers 1 -GetPreReqs

Attack Commands: Run with powershell#

Start-Process "PathToAtomicsFolder\T1055.015\bin\ListPlanting.exe"
Start-Sleep -Seconds 7
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force```

Invoke-AtomicTest T1055.015 -TestNumbers 1

Cleanup:#

Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force```

Invoke-AtomicTest T1055.015 -TestNumbers 1 -Cleanup

Detection#

Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as FindWindow, FindWindowEx, EnumWindows, EnumChildWindows, and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be abused for this technique.

Consider monitoring for excessive use of SendMessage and/or PostMessage API functions with LVM_SETITEMPOSITION and/or LVM_GETITEMPOSITION arguments.

Analyze process behavior to determine if a process is performing unusual actions, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

Contents