IExpress
Screenshot of IExpress in Windows 10 | |
Developer(s) | Microsoft |
---|---|
Operating system | Windows NT |
Type | Self-contained installation packages maker |
IExpress, a component of Windows 2000 and later versions of the operating system, is used to create self-extracting packages from a set of files. Such packages can be used to install software.
Overview
IExpress (IEXPRESS.EXE
) can be used for distributing self-contained installation packages (INF-based setup executables) to multiple local or remote Windows computers. It creates a self-extracting executable (.EXE) or a compressed Cabinet (.CAB) file using either the provided front end interface (IExpress Wizard), or a custom Self Extraction Directive (SED) file.[1] SED files can be modified with any plain text/ASCII editor, like Notepad. All self-extracting files created by IExpress use CAB compression algorithms, are compressed using the Cabinet Maker (MAKECAB.EXE
) tool,[2] and are extracted using the WExtract (WEXTRACT.EXE
) tool.
IEXPRESS.EXE
is located in the SYSTEM32
folder of both 32 and 64-bit installations of Windows. The front end interface (IExpress Wizard) can be started by manually navigating to the respective directory and opening the executable (IExpress.exe), or by typing IExpress into the Run window of the Start Menu. It can also be used from the command line (Windows Command Prompt or batch file) to create custom installation packages, eventually unattended. (automated operation):
IEXPRESS /N drive_letter:\directory_name\file_name.SED
IExpress Wizard interface guides the user through the process of creating a self-extracting package. It asks what the package should do: extract files and then run a program, or just extract files. It then allows the user to specify a title for the package, add a confirmation prompt, add a license agreement that the end-user must accept in order to allow extraction, select files to be archived, set display options for the progress window, and finally, specify a message to display upon completion.
If the option to create an archive and run a program is selected, then there will be an additional step, prompting the user to select the program that will be run upon extraction.
Security
The self-extracting packages created with IExpress have (inherent) vulnerabilities which allow arbitrary code execution because of the way they handle their installation command and their command line processing.[3][4] Additionally, because of the way Windows User Account Control handles installers, these vulnerabilities allow a privilege escalation.[5][6]
More specifically, the vulnerability comes in two versions: the most obvious one is that a /c:
switch tells the package to run an arbitrary command in the extracted directory;[6] the other is that the directory is predictable and writable by any ordinary user, so that the usual msiexec.exe
command can be replaced by an attack payload.[5] The latter has been fixed by Microsoft in MS14-049, but the former is only addressed by a policy to deprecate IExpress.[6] There is also a DLL hijacking exploit possible with IExpress.[7]
See also
References
- ^ MDGx: INF Guide: SED Overview
- ^ MS TechNet: IExpress Technology and the IExpress Wizard
- ^ MS Knowledge Base: Command-line switches for IExpress software update packages
- ^ MS TechNet: IExpress command-line options
- ^ a b FullDisclosure: Defense in depth -- the Microsoft way (part 11): privilege escalation for dummies
- ^ a b c FullDisclosure: Defense in depth -- the Microsoft way (part 33): yet another (trivial) UAC bypass resp. privilege escalation
- ^ "[CVE-2016-0014] Executable installers are vulnerable^WEVIL (case 1): Microsoft's IExpress resp. WExtract, SFXCab, BoxStub, ..." seclists.org.
External links
- MSDN: Using IExpress Wizard to Create a DPInst Installation Package
- MS TechNet: IExpress Technology and the IExpress Wizard
- MDGx: Internet Explorer Administration Kit (IEAK): Guides, Resources & Downloads
- MDGx: Complete INF + IEAK Guide
- MDGx: Setup Information (INF) & Self Extraction Directive (SED) files: Guides, Resources & Downloads
- v
- t
- e
- APIs
- Architecture
- Booting process
- Games
tools
- App Installer
- Command Prompt
- Control Panel
- Device Manager
- Disk Cleanup
- Drive Optimizer
- Driver Verifier
- DirectX Diagnostic Tool
- Event Viewer
- IExpress
- Management Console
- Netsh
- Performance Monitor
- Recovery Console
- Resource Monitor
- Settings
- Sysprep
- System Configuration
- System File Checker
- System Information
- System Policy Editor
- System Restore
- Task Manager
- Windows Error Reporting
- Windows Ink
- Windows Installer
- PowerShell
- Windows Update
- WinRE
- WMI
- 3D Viewer
- Calculator
- Calendar
- Camera
- Character Map
- Clipchamp
- Clock
- Cortana
- Edge
- Fax and Scan
- Feedback Hub
- Get Help
- Magnifier
- Maps
- Messaging
- Media Player
- 2022
- Movies & TV
- Mobility Center
- Money
- Narrator
- Notepad
- OneDrive
- OneNote
- Paint
- Paint 3D
- People
- Phone Link
- Photos
- Quick Assist
- Remote Desktop Connection
- Snipping Tool
- Speech Recognition
- Skype
- Sports
- Start
- Sticky Notes
- Store
- Tips
- Voice Recorder
- Weather
- WordPad
- Xbox
- Active Directory
- Domains
- DNS
- Group Policy
- Roaming user profiles
- Folder redirection
- Distributed Transaction Coordinator
- MSMQ
- Windows Media Services
- Active DRM Services
- IIS
- WSUS
- SharePoint
- Network Access Protection
- PWS
- DFS Replication
- Print Services for UNIX
- Remote Desktop Services
- Remote Differential Compression
- Remote Installation Services
- Windows Deployment Services
- System Resource Manager
- Hyper-V
- Server Core
- Boot Manager
- Console
- CSRSS
- Desktop Window Manager
- Portable Executable
- Enhanced Write Filter
- Graphics Device Interface
- Hardware Abstraction Layer
- I/O request packet
- Imaging Format
- Kernel Transaction Manager
- Library files
- Logical Disk Manager
- LSASS
- MinWin
- NTLDR
- Ntoskrnl.exe
- Object Manager
- Open XML Paper Specification
- Registry
- Resource Protection
- Security Account Manager
- Server Message Block
- Shadow Copy
- SMSS
- System Idle Process
- USER
- WHEA
- Winlogon
- WinUSB
- Solitaire Collection
- Surf
Microsoft Store
- DVD Player
- File Manager
- Hover!
- Mahjong
- Minesweeper
- Category
- List