EvilSln: Don’t open .sln files
EvilSln：不要打开.sln文件

A New Exploitation Technique for Visual Studio Projects
Visual Studio 项目的新开发技术

Background 背景

Using code projects for phishing attacks is not a new concept. In early 2021, the Lazarus APT group employed a specific attack technique in their campaign targeting security researchers. They embedded malicious event commands within Visual Studio project files, allowing the execution of harmful code during project compilation, as detailed in: Active North Korean campaign targeting security researchers
使用代码项目进行网络钓鱼攻击并不是一个新概念。2021 年初，Lazarus APT 组织在针对安全研究人员的活动中采用了一种特定的攻击技术。他们在Visual Studio项目文件中嵌入了恶意事件命令，允许在项目编译期间执行有害代码，详见： 针对安全研究人员的活跃朝鲜活动

This incident has once again brought the security of Visual Studio into the public eye. However, it is important to note that Visual Studio is not the only product with such risks. JetBrains’ IDEs, VSCode, and other text editors also face similar vulnerabilities when opening unsafe projects. As a response, these products have introduced trust zone mechanisms that disable certain risky functionalities in untrusted environments, aiming to protect their users.
这一事件再次将Visual Studio的安全性带入了公众的视野。但是，重要的是要注意Visual Studio并不是唯一具有此类风险的产品。JetBrains 的 IDE、VSCode 和其他文本编辑器在打开不安全项目时也面临类似的漏洞。作为回应，这些产品引入了信任区域机制，可在不受信任的环境中禁用某些风险功能，旨在保护其用户。

In this repository, we present a new exploitation technique for Visual Studio projects (Microsoft consider it is not a security issue) and provide a proof of concept. Our intention is to raise awareness about the potential risks involved and empower individuals to avoid being hacked.
在此存储库中，我们提出了一种针对Visual Studio项目的新开发技术（Microsoft认为这不是安全问题），并提供概念证明。我们的目的是提高人们对潜在风险的认识，并授权个人避免被黑客入侵。

Detail Analysis 细节分析

Execution 执行

Here are some publicly disclosed methods for exploiting Visual Studio:
以下是一些公开披露的利用Visual Studio的方法：

1. PreBuildEvent: Executes arbitrary commands before project compilation.
   PreBuildEvent ：在项目编译之前执行任意命令。

<PreBuildEvent>
    <Command>
    cmd /c calc
    </Command>
</PreBuildEvent>

2. GetFrameworkPaths Target: Triggered when viewing code.
   GetFrameworkPaths Target ：查看代码时触发。

<Target Name="GetFrameworkPaths">
    <Exec Command="calc.exe"/>
</Target>

3. COMFileReference: Triggered when loading TypeLib during project opening.
   COMFileReference ：在项目打开期间加载 TypeLib 时触发。

<COMFileReference Include="files\helpstringdll.tlb">
     <EmbedInteropTypes>True</EmbedInteropTypes>
</COMFileReference>

(References 2 and 3 are from https://outflank.nl/blog/2023/03/28/attacking-visual-studio-for-initial-access/. We came across this excellent article in the comments after publishing our demo video.)
（参考文献2和3来自 https://outflank.nl/blog/2023/03/28/attacking-visual-studio-for-initial-access/。我们在发布演示视频后的评论中看到了这篇出色的文章。

We wanted to find a way to execute code without the need for compilation, simply by opening the *.sln or *.csproj project file. We discovered that after opening a project, Visual Studio automatically generates a .vs folder in the project’s root directory, which contains a special binary file called .suo.
我们希望找到一种无需编译即可执行代码的方法，只需打开 *.sln or *.csproj 项目文件即可。我们发现，打开项目后，Visual Studio 会在项目的根目录中自动生成一个 .vs 文件夹，其中包含一个名为 .suo 的特殊二进制文件。

According to the Visual Studio documentation: https://learn.microsoft.com/en-us/visualstudio/extensibility/internals/solution-user-options-dot-suo-file?view=vs-2022
根据Visual Studio文档： https://learn.microsoft.com/en-us/visualstudio/extensibility/internals/solution-user-options-dot-suo-file?view=vs-2022

When the environment opens a .suo file, it enumerates all currently loaded VSPackages. If a VSPackage implements the IVsPersistSolutionOpts interface, then the environment calls the LoadUserOptions method on the VSPackage asking it to load all of its data from the .suo file.
当环境打开 .suo 文件时，它会枚举所有当前加载的 VSPackages。如果 VSPackage 实现该 IVsPersistSolutionOpts 接口，则环境将调用 VSPackage 上  LoadUserOptions 的方法，要求它从 .suo 文件加载其所有数据。

It means that the IVsPersistSolutionOpts#LoadUserOptions function will be called when the .suo file is loaded.
这意味着加载 .suo 文件时将调用该 IVsPersistSolutionOpts#LoadUserOptions 函数。

By examining the VSPackage that implements OnLoadOptions, we can find VSCorePackage.
通过检查实现的 OnLoadOptions VSPackage ，我们可以找到 VSCorePackage 。

// Microsoft.VisualStudio.dll
// Microsoft.VisualStudio.VSCorePackage
protected override void OnLoadOptions(string name, Stream stream)
{
	if (name.Equals(typeof(VsToolboxService).Name))
	{
		VsToolboxService vsToolboxService = this.GetService(typeof(IToolboxService)) as VsToolboxService; 
		if (vsToolboxService != null)
		{
			vsToolboxService.LoadOptions(stream); // [1]
		}
	}
}

at [1] , VSCorePackage will pass the stream to OptionService and calll vsToolboxService.OnLoadOptions(stream)
at ， [1] VSCorePackage 将传递 stream to OptionService 和 calll vsToolboxService.OnLoadOptions(stream)

// Microsoft.VisualStudio.Toolbox.VsToolboxService
internal void LoadOptions(Stream stream)
{
	BinaryReader binaryReader = new BinaryReader(stream);
	BinaryFormatter binaryFormatter = new BinaryFormatter();
	int num = binaryReader.ReadInt32();
	for (int i = 0; i < num; i++)
	{
		string text = binaryReader.ReadString();
		int num2 = binaryReader.ReadInt32();
		for (int j = 0; j < num2; j++)
		{
			string text2 = this.Links.Read(stream);
			VsToolboxService.ToolboxItemContainer toolboxItemContainer = (VsToolboxService.ToolboxItemContainer)binaryFormatter.Deserialize(stream); // [2]
			if (text2 != null && File.Exists(text2))
			{
				toolboxItemContainer.LinkFile = text2;
				this.Links.TrackLink(text2);
				this.Items.GetFilteredList(text).Add(toolboxItemContainer);
			}
		}
	}
}

And [2] will call BinaryFormatter.Deserialize to get an object from the stream. This is a familiar use of BinaryFormatter deserialization. Due to insufficient type restrictions, we can directly use ysoserial.net to generate a payload and attempt to write it to the .suo file. When opening the project in Visual Studio, the malicious .suo file will be automatically loaded and trigger the execution of calc.exe.
并将 [2] 调用 BinaryFormatter.Deserialize 以从流中获取对象。这是 BinaryFormatter 反序列化的常见用法。由于类型限制不足，我们可以直接用于 ysoserial.net 生成有效负载并尝试将其写入 .suo 文件。在 Visual Studio 中打开项目时，恶意 .suo 文件将自动加载并触发 的 calc.exe 执行。

BTW, there is another class with almost the same vulnerability, and interested readers should be able to find it quickly.
顺便说一句，还有另一个具有几乎相同漏洞的类，感兴趣的读者应该能够快速找到它。

“Bypass” Trust Zones and MOTW?
“绕过”信任区和 MOTW？

The situation with Visual Studio is somewhat different. After conducting a search, we found an article here that provides insights.
Visual Studio的情况有些不同。进行搜索后，我们在这里找到了一篇提供见解的文章。

For Visual Studio 2022 Preview 3, you’ll have to manually enable the “trusted locations” feature. Once enabled, Visual Studio will detect if you are attempting to open untrusted content and will show a new dialog that warns you about the security implications:
对于 Visual Studio 2022 预览版 3，必须手动启用“受信任位置”功能。启用后，Visual Studio 将检测您是否正在尝试打开不受信任的内容，并显示一个新对话框，警告您有关安全隐患的信息：

This setting needs to be manually enabled. However, even two years after the article was published, this setting remains disabled by default. There might be something preventing Visual Studio from enabling it.
此设置需要手动启用。但是，即使在文章发表两年后，此设置仍默认处于禁用状态。可能有一些东西阻止Visual Studio启用它。

But we still need to bypass the protection of MOTW, don’t we?
但我们仍然需要绕过 MOTW 的保护，不是吗？

In our tests, it seems that Visual Studio does not adhere to MOTW. sln files containing MOTW tags downloaded over HTTP can be opened without any warning. It may require specific methods or configurations to trigger the MOTW warning.
在我们的测试中，Visual Studio似乎不遵守MOTW。包含通过HTTP下载的MOTW标签的sln文件可以在没有任何警告的情况下打开。它可能需要特定的方法或配置来触发 MOTW 警告。

All in all, we can bypass the double protection of Trust Zones and MOTW without any effort, which poses a significant risk for unaware users.
总而言之，我们可以毫不费力地绕过信任区域和 MOTW 的双重保护，这对不知情的用户构成了重大风险。

Exploitation 开发

A evil project structure would look like this:
一个邪恶的项目结构看起来像这样：

$ tree -a
.
├── App1
│   └── Form1.cs
├── App1.sln
└── .vs
    └── App1
        └── v17
            └── .suo

In theory, the project could be even smaller, but for now, this should be sufficient. Compared to plaintext .sln or .csproj files, .suo is hidden (folders and files starting with . are not displayed by default in the file explorer) and its content is harder to read. There is also limited documentation describing the structure of this file, making it easier to overlook even with careful inspection.
从理论上讲，该项目可能会更小，但就目前而言，这应该足够了。与纯文本 .sln 或 .csproj 文件相比， .suo 是隐藏的（默认情况下，以 开头的 . 文件夹和文件不会显示在文件资源管理器中），并且其内容更难阅读。描述此文件结构的文档也有限，即使仔细检查也更容易忽略。

Furthermore, due to Visual Studio’s behavior of saving new content into the .suo file upon closing, the payload content is cleared, providing a natural concealment to this exploit technique. Additionally, this characteristic ensures that the exploit won’t be triggered multiple times.
此外，由于Visual Studio在关闭时将新内容保存到.suo文件中的行为，有效负载内容被清除，从而为这种利用技术提供了自然的隐藏。此外，此特征可确保漏洞利用不会多次触发。

Lazarus has shown us how to poison projects:
拉撒路向我们展示了如何毒害项目：

• Make the project publicly available on GitHub, for example, Active North Korean campaign targeting security researchers
  在GitHub上公开该项目，例如针对安全研究人员的活跃朝鲜运动
• Send the project through a social platform, for example, New campaign targeting security researchers
  通过社交平台发送项目，例如，针对安全研究人员的新活动

Then, guide the victim to open the project. Unlike in 2021, code will be executed when the project is opened, without any additional clicks or missing MOTW / untrusted warning dialog.
然后，引导受害者打开项目。与 2021 年不同，代码将在项目打开时执行，无需任何额外的点击或缺少 MOTW/不受信任的警告对话框。

With the power of deserialization, an attacker can execute arbitrary code in memory.
借助反序列化的强大功能，攻击者可以在内存中执行任意代码。

Proof of Concept 概念验证

1. Clone or download this project
   克隆或下载此项目

git clone https://github.com/cjm00n/EvilSln

2. Double-click the App1.sln file to open it with Visual Studio. (*.csproj works too)
   双击 App1.sln 该文件以使用 Visual Studio 将其打开。（*.csproj也有效）

3. The calculator will pop up.
   计算器将弹出。

Tested version: 17.7.5 (VS2022 update at 2023.10).
测试版本：17.7.5（VS2022 更新于 2023.10）。

No Smartscreen warning, No trust need, No futher interaction need. But it will not be fixed, because Microsoft consider it’s not a vulnerability.
没有智能屏幕警告，不需要信任，不需要进一步的交互。但它不会被修复，因为Microsoft认为它不是一个漏洞。

Mitigation 缓解

1. Follow the steps outlined in Microsoft’s article to manually open relevant settings: Improving developer security with Visual Studio 2022
   按照Microsoft文章中概述的步骤手动打开相关设置： 使用 Visual Studio 2022 提高开发人员安全性
2. Avoid opening any unknown projects in Visual Studio. As Microsoft states, “Opening a Visual Studio project is an insecure operation.”
   避免在 Visual Studio 中打开任何未知项目。正如Microsoft所说，“打开Visual Studio项目是一项不安全的操作。

Discussion 讨论

After discovering this exploit, we promptly reached out to Microsoft for clarification and received a clear response stating that it is not a security issue.
发现此漏洞后，我们立即联系Microsoft进行澄清，并收到明确的回复，指出这不是安全问题。

After investigation, our team decided the issue is not a vulnerability. Opening a Visual Studio project is an insecure operation, as documented here: https://devblogs.microsoft.com/visualstudio/improving-developer-security-with-visual-studio-2022/
经过调查，我们的团队确定该问题不是漏洞。打开 Visual Studio 项目是一种不安全的操作，如下所述：https://devblogs.microsoft.com/visualstudio/improving-developer-security-with-visual-studio-2022/

This aligns with the response provided in outflank’s blog. Therefore, this is an exploit that will not be fixed, or rather, a series of exploits that will not be fixed. However, it is evident that there is a vulnerability here. We believe that there are more undisclosed files that automatically load when you open a project. Simply opening such a project is enough to compromise your machine.
这与 outflank 博客中提供的回复一致。因此，这是一个不会被修复的漏洞，或者更确切地说，是一系列不会被修复的漏洞。但是，很明显，这里存在漏洞。我们相信，当您打开项目时，还有更多未公开的文件会自动加载。简单地打开这样的项目就足以危及您的机器。

Are there any known evil projects in the wild?
野外是否有任何已知的邪恶项目？

We quickly do an investigation using sourcegraph and found that there are at least 10,570 repositories on GitHub that contain .suo files. Unfortunately, we didn’t have the time to inspect whether any of them contain malicious content.
我们使用源代码图快速进行了调查，发现GitHub上至少有10,570个存储库包含.suo文件。不幸的是，我们没有时间检查其中是否有任何包含恶意内容。

Regardless, please be careful when using your IDE, especially Visual Studio. it does many things that you are unaware of under its roaring hood.
无论如何，在使用 IDE 时请小心，尤其是 Visual Studio。它在咆哮的引擎盖下做了很多你不知道的事情。

Credit 信用

cjm00nw & edwardzpeng

原文始发于GitHub：A New Exploitation Technique for Visual Studio Projects