I’ll have to test this and try to bypass it

http://hype-free.blogspot.com/2008/04/windows-xp-high-security-configuration.html

Towards the middle of the page I describe how you change the default setting for SRP so that it applies to executables AND dlls, rather than just executables.

Details can be found here: http://blog.didierstevens.com/2008/06/09/quickpost-embedding-an-executable-in-a-vbscript/

I really think whitelisting DLLs are too difficult to manage.
The problem with AV signatures, is that they are easy to bypass. This script is likely to be used in a targeted attack.

If I get it right, you produce your executable (maybe a HelloWorld.exe) but compile it as a DLL. I see that Sub DumpFile1(f) has a whole load of hex values and I presume that’s where the hex values of the DLL are entered?

I’ve managed to get the Macro Code into Excel 2003 but am not sure where the LoadLibrary and FreeLibrary declarations go. I don’t have a DLL but wherever I put these declarations on the Macro code, an error is generated when I run it from the button.

Can you post the code for your “MyDLL” (in the hope that I can compile it as I have done previously!) and give an indication about the Function Declarations?

Thanks for your efforts.

The only thing that I can see would be to go with the white list option. It certainly would be a large undertaking but at least in an enterprise environment with a standard computer template it should not need to be done very often. It would need to be created once and only updated every time new software was added. First installing any new software on a computer that had a fresh install and was never connected to a network should allow you to relatively easily identify any new Dll’s that would need to be added to the white list. Should should be able to push the updated whitelist out over group policy and limit the impact on users. But this would only really work in an enterprise environment, and no one ever said security was going to be easy.

The only other possible thing I can imagine would be to get updated AV signatures that would catch files with numerous strings of bytes in the scripting. It looks like that would be necessary to pull off the exploit and I can’t think of a legitimate reason for something like that to be included in a file, but I don’t really do any scripting so maybe there is some utility there.