# GrimResource - Microsoft Management Console for initial access and evasion

Crafted MSC files abuse an old XSS in apds.dll to run JScript in mmc.exe, chained with DotNetToJScript to execute Cobalt Strike.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Management Console
- Credited: Joe Desimone,Samir Bousseaden
- Disclosed: 2024-06-22
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/grimresource
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource
- Tags: domain:desktop impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:reverse-engineering vuln:command-injection vuln:rce vuln:xss

**Target:** Windows MSC console files / apds.dll resource handler
**Root cause:** apds.dll contains a legacy XSS flaw reachable via a res:// reference placed in the MSC StringTable, letting attacker-controlled JScript execute in mmc.exe context.
**Steps:**
1. Craft an MSC file with `<?xml` header and `MMC_ConsoleFile` root
2. Insert a StringTable entry referencing the vulnerable APDS resource via `res://` with `javascript:eval(...)` payload
3. Open the .msc file; mmc.exe loads apds.dll and executes the JScript
4. Use transformNode obfuscation to suppress ActiveX warnings
5. Chain DotNetToJScript to load an embedded .NET loader (PASTALOADER)
6. PASTALOADER reads payload from env vars, spawns dllhost.exe, injects via DirtyCLR/unhooking/indirect syscalls
**How found:** Researchers observed a novel in-the-wild MSC sample (first seen on VirusTotal June 6) and reverse-engineered the infection chain, identifying the apds.dll res:// StringTable reference as the execution primitive.
**Exploitation:** Victim opens a malicious .msc (e.g. sccm-updater.msc); mmc.exe executes JScript via apds.dll XSS, which runs VBScript setting env vars, then DotNetToJScript loads PASTALOADER, which injects Cobalt Strike into a sacrificial dllhost.exe for stealth.
**Escalation:** Chained XSS primitive to full .NET loader and process injection to evade static and behavioral detection.
**Insight:** Legacy XSS sinks inside signed Windows DLLs (res:// + javascript: handlers) can be reached from unexpected file formats like MSC StringTables; hunt for `res://` and `javascript:` strings in console/document files.